Easy-to-exploit, one-click attack caught more than 100,000 users; additional variations may still be at large.
| |
Twitter users faced a virulent new JavaScript-based account hijacking attack on Monday. Simply clicking on one of the malicious links involved, disguised as innocuous-looking links in Tweets, enabled attackers to hijack a user's account and post numerous Tweets.
According to Stefan Tanase at antivirus vendor Kaspersky Lab, which discovered the attack, it "uses a cross-site scripting vulnerability to steal the cookie of the Twitter user, which is transferred to two specific servers. Essentially, any account which clicked on the malicious links is compromised."
So found numerous Twitter users on Monday. According to bit.ly, just one of the malicious links involved in the attack saw more than 116,000 clicks.
All signs point to this attack's origin -- or at least primary target -- as being Brazil, especially since one of the malicious Tweets, written in Portuguese, claimed that a leading Brazilian pop act had suffered a "tragic accident." Furthermore, the stolen cookies were copied to two domains registered under Brazilian names, and one of the sites is hosted in Brazil, said Tanase. "We are currently working on taking down the malicious URLs and minimizing the damage as much as possible."
On Tuesday, Twitter said it had patched the related vulnerability, apparently after taking the dev.twitter.com development server offline. But according to security researchers, additional variations on the vulnerability may still be at large.
This bug has legs. It was first disclosed in late July by a security researcher known as "cbr."
But the Web application vulnerability gained a fresh look on Monday after security researcher Mike Bailey crafted and released proof-of-exploit code. "These things are ridiculously easy to attack," he said, noting that his exploit had required less than 10 minutes of coding.
To help combat such attacks in the future, Twitter is beginning to implement a new link-wrapping service known as t.co, which will compare shortened links with a blacklist of known malware attacks before forwarding users on.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024