As far as XSS vulnerabilities goes, this one is the size of the Gulf of Mexico. How exactly did they manage to let this one through? (Even more puzzling, it looks like this is special link-parsing functionality that someone had to actually write explicitly to make it work)
Twitter 'onmouseover' security flaw widely exploited
41–50 of 77 posts
Re: Twitter 'onmouseover' security flaw widely exploited
#42Relatively harmless as viruses go, so I have to admit to being a bit excited at watching a little bit of internet history unfold. EDIT: mea culpa, you're quite right -- the potential for this is disastrous in terms of CSRF attacks and so on. I was thinking about this particular implementation that appeared to simply be propagating itself.
not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads: * login as that user by sending yourself their session token * scrape email addresses * follow a spam account * popup an affiliate site * trigger a download or one of the new flash exploits to gain access to the local system your code has to fit within 140 chars, but you can use…
I'm pretty sure I could load an external JS file in 140 chars, so there's effectively no limit.
Re: Twitter 'onmouseover' security flaw widely exploited
#43It's patched now.
Re: Twitter 'onmouseover' security flaw widely exploited
#44Earlier quoted context omitted.
not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads: * login as that user by sending yourself their session token * scrape email addresses * follow a spam account * popup an affiliate site * trigger a download or one of the new flash exploits to gain access to the local system your code has to fit within 140 chars, but you can use…
Will the session token work just like that? Each session might be tied to a specific IP address or something.
When I last checked about 2 years ago, Twitter had woeful session management.
Re: Twitter 'onmouseover' security flaw widely exploited
#45[deleted]
Re: Twitter 'onmouseover' security flaw widely exploited
#46I called this 3 hours ago - do I get a cookie? :)
Oh yes, I forgot HN doesn't like humour. I knew I shouldn't have taken maternity leave.
Re: Twitter 'onmouseover' security flaw widely exploited
#47I wrote one that spreads unicorns. It's awesome! I couldn't figure out how to style it up, and I'm not so cruel as to force retweets. Screenshot: http://www.flickr.com/photos/broadyau/5011139993/ Live: http://twitter.com/broady
Looks like they've fixed it. The URL in your tweet is now escaped.
From the photo it looks hilarious though. Nice job.
Re: Twitter 'onmouseover' security flaw widely exploited
#48I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…
Is it really necessary to change one's password? I've logged out and logged in again to make sure I invalidated my old session cookie. Hopefully that's sufficient.
Re: Twitter 'onmouseover' security flaw widely exploited
#49[deleted]
Re: Twitter 'onmouseover' security flaw widely exploited
#50Earlier quoted context omitted.
not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads: * login as that user by sending yourself their session token * scrape email addresses * follow a spam account * popup an affiliate site * trigger a download or one of the new flash exploits to gain access to the local system your code has to fit within 140 chars, but you can use…
I'm pretty sure I could load an external JS file in 140 chars, so there's effectively no limit.
http://api.jquery.com/jQuery.getScript/
That's pretty much all you need. About 15 chars + length of the script url.
So yeah, there's effectively no limit.