Archive for April, 2009

Sick BirdEverybody heard the tweets: after several other security issues, including "exotic" ones like Clickjacking or JSON hijacking, Twitter is in serious troubles again, this time with an old-school XSS worm which quickly managed to infect many users profiles and is still spreading in multiple variants.

This plague is the brainchild of a 17 years old named Mikeyy, who created it as a publicity stunt to promote his own Twitter clone, A good technical description of its rather simple inner workings has been kindly provided by Damon Cortesi. As you can see, unless the doman is allowed to run JavaScript (very unlikely for NoScript users) you're immune from infection.

This worm having been active so long is quite a surprise to me, since the exploited vulnerability (missing output encoding on users' profile web page URL) requires less than one minute to be fixed, if you know what you're doing. The existence of a mildly obfuscated version authorizes a scary suspect: have Twitter guys just been trying to block the original strain by signature, rather than fixing their website error? This is would be ridiculous*, since any script kiddie can create his own slightly modified version for fun or profit (and is probably doing that). And while the initial code just logs your session cookie on a remote server (which is already bad enough) and replicates itself as spam, nothing restrains a more malicious attacker from taking over your account with all its profile data right away.

The morale of this story? Never tweet without NoScript.

* Update

Ridicolous, but apparently true: in Twitter's first hand account of the countermeasures taken over the weekend, there's a lot of "cleaning up and locking down profiles", but nothing about fixing the website's bugs which allow infections like this to be spread.

Bad Behavior has blocked 924 access attempts in the last 7 days.