Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter 'onmouseover' security flaw widely exploited

sophos.com

Post reply on HN
Print view View original

71–77 of 77 posts

Re: Twitter 'onmouseover' security flaw widely exploited

#71

Post by js2 »

Tichy wrote: post #56
bl4k wrote: post #9

I just wrote a proof-of-concept worm that steals session cookies. It spreads by retweeting. If something like this was released it would spread like wildfire. Reminds me of the MySpace worm that took the site down Time to change your passwords! (Edit: I will post the vuln code once this is patched. Atm I am playing with having the payload make Ajax queries back to Twitter :). Having shortcut functions in the page (ie…

What is the significance of the "@"? Is it because once they encounter the @, they split into a different parsing routine (for example to link @replies)?

If you look at the regex they were using, once it sees an @, it then scans forward until it encounters a /, which is what let's you sneak in anything after the @ other than a /.

Re: Twitter 'onmouseover' security flaw widely exploited

#72

Post by js2 »

Tichy wrote: post #62
jerf wrote: post #58

Earlier quoted context omitted.

That's still the wrong approach (if it's the only part of the solution) and I wouldn't be surprised that there's still a problem in there somewhere. That's the entirely wrong place to deal with this. The correct solution is the moral equivalent of " ", where "html_escape" converts the URL into a properly encoded HTML string regardless of contents, and for simplicitly I'm assuming some other cleansing process has run…

I don't understand what they are doing? I don't recall @ having special significance in a URL? I can only guess that they have two separate steps for transforming URLs into links and transforming @replies into links. Then they first run the URL transformer and then the @replies transformer, which would of course mess up the URL. I have solved that problem in one of my Twitter apps (transforming both in one go), maybe…

They are trying to match URLs so that they can turn them into links. The @ character is valid in a URL. What I don't understand is why they don't URL encode the matching text.

Re: Twitter 'onmouseover' security flaw widely exploited

#73

Post by jrockway »

jasonkester wrote: post #65
pornel wrote: post #57

Earlier quoted context omitted.

Clearly relying on developers to remember to escape didn't work (it's not first XSS and not last). I don't think it's anything like magic quotes. It's more like prepared statements. Magic quotes was enormous failure because it worked on input rather than output. In HTML-specific output code having HTML-escaping is just fine. Lack of escaping enables worms and error isn't immediately visible. Double escaping is quickl…

As soon as you start auto-escaping everything, you need to introduce a dontEscapeThis() method that you can use to actually render the HTML you intended. Having to do that would be enough to make me ditch any framework in favor of one that treats me like a grownup.

Not true.

What you need is a type system. All data that comes from the user is of type UnescapedUserString. When the templating system sees this, it escapes it when written as HTML. Strings that you type into your program that you don't want to be escaped are of type EscapedString. Add some concatenation rules, and you're done.

If you were using Haskell, you wouldn't even need to change much code to do this, thanks to overloaded strings.

Re: Twitter 'onmouseover' security flaw widely exploited

#74

Post by jrockway »

jdub wrote: post #15

I wouldn't be terribly surprised, based on the timeline of exploits I've seen, if the wider abuse of this is due to the incredibly stupid exploit demonstration at the launch of @RainbowTwtr. My related tweets from earlier tonight... ah, about the RainbowTwtr angle, not exploited tweets! :-) http://twitter.com/jdub/status/25106766206 http://twitter.com/jdub/status/25112834543

Why is it stupid to tell people how insecure their favorite messaging platform is? So when they get hacked, they will have to wonder why? Sounds like a great plan...

Re: Twitter 'onmouseover' security flaw widely exploited

#75

Post by semanticist »

thenduks wrote: post #66
vanschelven wrote: post #24

Earlier quoted context omitted.

How is JavaScript injection not a huge security flaw? JavaScript injection -> acquire session -> basically anything (within the context of twitter)

It's clearly a huge security flaw, but as you say -- only within the context of twitter. Looking at the big picture of my life something like this doesn't even register. What's the worst thing that could happen, really? A popup? Maybe my account gets stolen somehow? Some garbage tweets in my timeline that I delete later with a non-web client? All of the sudden I'm following some spammers... I'd get over it.

You could send a DM to everyone you know with an shortened URL that links to a page full of malware and evil that pwns their computer, steals all their data and account log ins, and uses their machine as part of a botnet.

Because the DM would come from you, a person they know, the person is more likely to trust the page or file that's linked to and less likely to catch it brutalising their computer.

The actual data on your Twitter account might not be valuable in itself, but it has significant value as a vector for other attacks.

Re: Twitter 'onmouseover' security flaw widely exploited

#76

Post by jdub »

jrockway wrote: post #74
jdub wrote: post #15

I wouldn't be terribly surprised, based on the timeline of exploits I've seen, if the wider abuse of this is due to the incredibly stupid exploit demonstration at the launch of @RainbowTwtr. My related tweets from earlier tonight... ah, about the RainbowTwtr angle, not exploited tweets! :-) http://twitter.com/jdub/status/25106766206 http://twitter.com/jdub/status/25112834543

Why is it stupid to tell people how insecure their favorite messaging platform is? So when they get hacked, they will have to wonder why? Sounds like a great plan...

If by "tell" you do not mean a cynical public reveal for the sake of product promotion and by "people" you mean the organisation running the platform (Twitter), I'd agree with you. :-)

Re: Twitter 'onmouseover' security flaw widely exploited

#77

Post by jdub »

jdub wrote: post #15

I wouldn't be terribly surprised, based on the timeline of exploits I've seen, if the wider abuse of this is due to the incredibly stupid exploit demonstration at the launch of @RainbowTwtr. My related tweets from earlier tonight... ah, about the RainbowTwtr angle, not exploited tweets! :-) http://twitter.com/jdub/status/25106766206 http://twitter.com/jdub/status/25112834543

Netcraft concurs: http://news.netcraft.com/archives/2010/09/21/twitter-users-f...
Post reply on HN