Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter 'onmouseover' security flaw widely exploited

sophos.com

Post reply on HN
Print view View original

21–30 of 77 posts

Re: Twitter 'onmouseover' security flaw widely exploited

#21

Post by nakkiel »

paraschopra wrote: post #17
bl4k wrote: post #9

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…

So, you are publicly saying that you are currently trying to hack Twitter by making a worm? :)

Who here didn't, at least for fun, try to make his own version of the Javascript bit? I'd like to have a variant of the full black Quine that randomizes the color used. It would be so shiny and Twitter wouldn't prevent it from reposting.

Here be Rainbows!

Re: Twitter 'onmouseover' security flaw widely exploited

#24

Post by vanschelven »

Swizec wrote: post #5

This is what it posts " http://a.no/@onmouseover=;$(textarea:first).val(this.innerHT... style="color:#000;background:#000;/" class="tweet-url web" rel="nofollow" target="_blank"> http://a.no/@onmouseover=;$(textarea:first).val(this.innerHT... style="color:#000;background:#000;/ " It's not a huge security flaw, just some (this time) harmless javascript injection. What it does is it fires a mouseover event, then fills…

How is JavaScript injection not a huge security flaw? JavaScript injection -> acquire session -> basically anything (within the context of twitter)

Re: Twitter 'onmouseover' security flaw widely exploited

#27

Post by andreyf »

bl4k wrote: post #14
rsbrown wrote: post #11

Relatively harmless as viruses go, so I have to admit to being a bit excited at watching a little bit of internet history unfold. EDIT: mea culpa, you're quite right -- the potential for this is disastrous in terms of CSRF attacks and so on. I was thinking about this particular implementation that appeared to simply be propagating itself.

not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads: * login as that user by sending yourself their session token * scrape email addresses * follow a spam account * popup an affiliate site * trigger a download or one of the new flash exploits to gain access to the local system your code has to fit within 140 chars, but you can use…

Who got harmed?

Re: Twitter 'onmouseover' security flaw widely exploited

#28

Post by niekmaas »

vanschelven wrote: post #24
Swizec wrote: post #5

This is what it posts " http://a.no/@onmouseover=;$(textarea:first).val(this.innerHT... style="color:#000;background:#000;/" class="tweet-url web" rel="nofollow" target="_blank"> http://a.no/@onmouseover=;$(textarea:first).val(this.innerHT... style="color:#000;background:#000;/ " It's not a huge security flaw, just some (this time) harmless javascript injection. What it does is it fires a mouseover event, then fills…

How is JavaScript injection not a huge security flaw? JavaScript injection -> acquire session -> basically anything (within the context of twitter)

He means that his example is pretty harmless, not the flaw itself. As you state the potential of the flaw is huge!

Re: Twitter 'onmouseover' security flaw widely exploited

#29

Post by niekmaas »

chrisbroadfoot wrote: post #25

I wrote one that spreads unicorns. It's awesome! I couldn't figure out how to style it up, and I'm not so cruel as to force retweets. Screenshot: http://www.flickr.com/photos/broadyau/5011139993/ Live: http://twitter.com/broady

Maybe I'm doing something wrong but it doesn't work for me. All I see is the code you pasted including the jQuery code. At least for me the flaw seems to be fixed.

Re: Twitter 'onmouseover' security flaw widely exploited

#30

Post by mikecane »

andreyf wrote: post #27
bl4k wrote: post #14

Earlier quoted context omitted.

not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads: * login as that user by sending yourself their session token * scrape email addresses * follow a spam account * popup an affiliate site * trigger a download or one of the new flash exploits to gain access to the local system your code has to fit within 140 chars, but you can use…

Who got harmed?

My Twitter page has a frikkin overlay on it now, preventing its use. I define harm as not being able to use Twitter due to a malicious act. Sure, I haven't lost a leg, but it's a PITA. I'll probably have to change my password yet again too.
Post reply on HN