Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter 'onmouseover' security flaw widely exploited

sophos.com

Post reply on HN
Print view View original

31–40 of 77 posts

Re: Twitter 'onmouseover' security flaw widely exploited

#31

Post by chrisbroadfoot »

niekmaas wrote: post #29
chrisbroadfoot wrote: post #25

I wrote one that spreads unicorns. It's awesome! I couldn't figure out how to style it up, and I'm not so cruel as to force retweets. Screenshot: http://www.flickr.com/photos/broadyau/5011139993/ Live: http://twitter.com/broady

Maybe I'm doing something wrong but it doesn't work for me. All I see is the code you pasted including the jQuery code. At least for me the flaw seems to be fixed.

Hm - still works for me. The script takes a bit to load.

1. bit.ly redirect 2. run javascript hosted on github: http://github.com/broady/twitter-xss/blob/master/x.js 3. load cornify.js

Re: Twitter 'onmouseover' security flaw widely exploited

#32

Post by [deleted] »

nakkiel wrote: post #21
paraschopra wrote: post #17

Earlier quoted context omitted.

So, you are publicly saying that you are currently trying to hack Twitter by making a worm? :)

Who here didn't, at least for fun, try to make his own version of the Javascript bit? I'd like to have a variant of the full black Quine that randomizes the color used. It would be so shiny and Twitter wouldn't prevent it from reposting. Here be Rainbows!

[deleted]

Re: Twitter 'onmouseover' security flaw widely exploited

#33

Post by theycallmemorty »

bl4k wrote: post #9

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…

Is this a twitter-only problem with the way the URLs are formed? Or is this a common way of injecting JS into links on other sites as well?

Re: Twitter 'onmouseover' security flaw widely exploited

#34

Post by robryan »

bl4k wrote: post #14
rsbrown wrote: post #11

Relatively harmless as viruses go, so I have to admit to being a bit excited at watching a little bit of internet history unfold. EDIT: mea culpa, you're quite right -- the potential for this is disastrous in terms of CSRF attacks and so on. I was thinking about this particular implementation that appeared to simply be propagating itself.

not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads: * login as that user by sending yourself their session token * scrape email addresses * follow a spam account * popup an affiliate site * trigger a download or one of the new flash exploits to gain access to the local system your code has to fit within 140 chars, but you can use…

Will the session token work just like that? Each session might be tied to a specific IP address or something.

Re: Twitter 'onmouseover' security flaw widely exploited

#36

Post by rbanffy »

eli wrote: post #8

Right now you might be safer using a third-party Twitter client rather than the Twitter.com website. Hmm, I wonder how many web-based twitter clients and widgets have similar vulnerabilities. I bet quite a few.

The emacs client seems safe. ;-)

Re: Twitter 'onmouseover' security flaw widely exploited

#38

Post by rakkhi »

nakkiel wrote: post #21
paraschopra wrote: post #17

Earlier quoted context omitted.

So, you are publicly saying that you are currently trying to hack Twitter by making a worm? :)

Who here didn't, at least for fun, try to make his own version of the Javascript bit? I'd like to have a variant of the full black Quine that randomizes the color used. It would be so shiny and Twitter wouldn't prevent it from reposting. Here be Rainbows!

Man I just got exploited by this, shutting down use of twitter.com till it is fixed.

Re: Twitter 'onmouseover' security flaw widely exploited

#39

Post by moeffju »

bl4k wrote: post #9

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…

It is made a little harder since you cannot use # or @ in the tweet, and your exploit code is limited to ~130 characters, but if you use $.getScript(), oh boy...

Re: Twitter 'onmouseover' security flaw widely exploited

#40

Post by konad »

andreyf wrote: post #27
bl4k wrote: post #14

Earlier quoted context omitted.

not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads: * login as that user by sending yourself their session token * scrape email addresses * follow a spam account * popup an affiliate site * trigger a download or one of the new flash exploits to gain access to the local system your code has to fit within 140 chars, but you can use…

Who got harmed?

With the right payload, you won't know you've been affected via Twitter.
Post reply on HN