Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter 'onmouseover' security flaw widely exploited

sophos.com

Post reply on HN
Print view View original

11–20 of 77 posts

Re: Twitter 'onmouseover' security flaw widely exploited

#11

Post by rsbrown »

Relatively harmless as viruses go, so I have to admit to being a bit excited at watching a little bit of internet history unfold.

EDIT: mea culpa, you're quite right -- the potential for this is disastrous in terms of CSRF attacks and so on. I was thinking about this particular implementation that appeared to simply be propagating itself.

Re: Twitter 'onmouseover' security flaw widely exploited

#12

Post by ifesdjeen »

malte wrote: post #4

Ok, sorry if this question seems amateurish, but I don't quite understand this exploit. I went to my twitter page and it automatically posted a tweet, tried to send DMs etc. A lot of weird stuff was going on so I closed the tab immediately and looked for information on this. Does it mean my account is somehow affected or is it just someone in my timeline who posted this exploit? Edit: Maybe 'affected' is the wrong te…

download any non-web client (i suppose even mobile one will work, but non-javascript one), and remove all the messages that were posted by that script. use non-web clients for reading and posting tweets for next day or two. to be on a safe side, avoid using web version of client for several days, at least until it all gets figured out by twitter guys.

Re: Twitter 'onmouseover' security flaw widely exploited

#14

Post by bl4k »

rsbrown wrote: post #11

Relatively harmless as viruses go, so I have to admit to being a bit excited at watching a little bit of internet history unfold. EDIT: mea culpa, you're quite right -- the potential for this is disastrous in terms of CSRF attacks and so on. I was thinking about this particular implementation that appeared to simply be propagating itself.

not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads:

* login as that user by sending yourself their session token

* scrape email addresses

* follow a spam account

* popup an affiliate site

* trigger a download or one of the new flash exploits to gain access to the local system

your code has to fit within 140 chars, but you can use the libraries that Twitter has included in the page (like $()) to grab elements and make Ajax calls to their backend.

This is a shocker.

Re: Twitter 'onmouseover' security flaw widely exploited

#15

Post by jdub »

I wouldn't be terribly surprised, based on the timeline of exploits I've seen, if the wider abuse of this is due to the incredibly stupid exploit demonstration at the launch of @RainbowTwtr.

My related tweets from earlier tonight... ah, about the RainbowTwtr angle, not exploited tweets! :-)

http://twitter.com/jdub/status/25106766206 http://twitter.com/jdub/status/25112834543

Re: Twitter 'onmouseover' security flaw widely exploited

#17

Post by paraschopra »

bl4k wrote: post #9

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…

So, you are publicly saying that you are currently trying to hack Twitter by making a worm? :)

Re: Twitter 'onmouseover' security flaw widely exploited

#18

Post by nakkiel »

I got the Quine which changes the color and background color of the post to black. I initially though it was some sort of art. I admit I'm totally disappointed.

    http://a.no/@onmouseover=;$(textarea:first).val(this.innerHTML);$(.status-update-form).submit() style="color:#000;background:#000;/
Post reply on HN