Tweetdeck seems to be down now.
It is: https://twitter.com/TweetDeck/statuses/476770732987252736 == "We've temporarily taken TweetDeck services down to assess today's earlier security issue. We'll update when services are back up."
XSS in Tweetdeck (don't view in Tweetdeck...)
21–26 of 26 posts
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#22"The most powerful Twitter tool for real-time tracking, organizing and engagement."
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#23"The most powerful Twitter tool for real-time tracking, organizing and engagement."
So powerful, it even supports scripted tweets
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#24What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention. javascript is the first payload you try when looking for the stupidest XSS you can find....
Some services will ignore security entirely at first, because it doesn't directly contribute to getting a viable product to market quickly (obviously, users will use an insecure site or app so long as they don't know how insecure it is). Then when the app becomes viable, they will continue to ignore security because it doesn't directly contribute to growth. Security becomes part of the nebulous "optimization" stage which is pushed somewhere down the road - and at some point the application becomes so complex that security isn't deemed worth the effort or the money.
I'm not saying that's what happened here, and depending on the language and platform you're using, xss can be a difficult problem to solve. But it does seem to be a common trait to disregard security until you have to apologize for it.
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#25I wonder if the poster of this "twitter worm" could get in legal trouble for this; it's quite similar to the Samy MySpace worm[1] of a decade ago, where the creator was charged with a felony (they plea bargained out). [1] https://en.wikipedia.org/wiki/Samy_(computer_worm)
Fortunately, the author appears to be German.
Re: XSS in Tweetdeck (don't view in Tweetdeck...)
#26Someone's gonna get in trouble for using an eval in tweetdeck...