CSRF Vulnerability in Twitter Allows Forced Following

Use Netsparker


I did mention this earlier in the week when I was talking about Twitter being used as a malware distribution platform, there also seems to be an auto follow vulnerability that spammers would love.

Do you remember Myspace and samy with 900,000 friends? Now we have johng77536 on Twitter!

Last week, TechCrunch’s Jason Kincaid wrote about an obvious Twitter vulnerability that allowed a user called “johng77536? to game the popular micro-blogging service to add thousands of followers (subscribers) in a short period of time.

The “johng77536? account has since been disabled but a security researcher tracking Twitter security flaws and weaknesses has discovered a new vulnerability that lets users easily game the “follow” system.

Whoever used this account was pretty stupid though hooking 7000 followers in a day, that raised some alarms for sure and now the account has been deleted.

I would guess however hundreds of other spammers are using the same technique in a much slower fashion to avoid detection. So watch out if you use Twitter you aren’t following some odd accounts that you didn’t manually subscribe to.

Raff showed me a proof-of-concept exploit that took advantage of a CSRF (cross site request forgery) bug to trick me into following his Twitter account by simply clicking on a rigged Web site. A spammer or phisher could abuse this vulnerability to gain thousands of “followers” and attempt social engineering attacks.

Twitter’s security team has promised a fix within 24 hours.

Raff’s discovery isn’t the first. He has assisted Twitter with fixing another bug that could be abused to send spam mails with malicious links. Several Twitter cross-site scripting bugs have also been found and fixed.

Twitter is actually a fairly simple service so I’m surprised they have so many issues.

I guess it’s the nature of any site that has POST/GET requests and especially those that use AJAX and aren’t aware of the security implications.

Tokens are important people, use them!

Source: Zdnet

Posted in: Hacking News

, , , , , , , ,


Latest Posts:


Intercepter-NG - Android App For Hacking Intercepter-NG – Android App For Hacking
Intercepter-NG is a multi functional network toolkit including an Android app for hacking, the main purpose is to recover interesting data from the network stream and perform different kinds of MiTM attacks.
dcipher - Online Hash Cracking Using Rainbow & Lookup Tables dcipher – Online Hash Cracking Using Rainbow & Lookup Tables
dcipher is a JavaScript-based online hash cracking tool to decipher hashes using online rainbow & lookup table attack services.
HTTP Security Considerations - An Introduction To HTTP Basics HTTP Security Considerations – An Introduction To HTTP Basics
HTTP is ubiquitous now with pretty much everything being powered by an API, a web application or some kind of cloud-based HTTP driven infrastructure. With that HTTP Security becomes paramount and to secure HTTP you have to understand it.
Cangibrina - Admin Dashboard Finder Tool Cangibrina – Admin Dashboard Finder Tool
Cangibrina is a Python-based multi platform admin dashboard finder tool which aims to obtain the location of website dashboards by using brute-force, wordlists etc.
Enumall - Subdomain Discovery Using Recon-ng & AltDNS Enumall – Subdomain Discovery Using Recon-ng & AltDNS
Enumall is a Python-based tool that helps you do subdomain discovery using only one command by combining the abilities of Recon-ng and AltDNS.
RidRelay - SMB Relay Attack For Username Enumeration RidRelay – SMB Relay Attack For Username Enumeration
RidRelay is a Python-based tool to enumerate usernames on a domain where you have no credentials by using a SMB Relay Attack with low privileges.


4 Responses to CSRF Vulnerability in Twitter Allows Forced Following

  1. Flux September 11, 2008 at 5:28 pm #

    I hope twitter can get this problem fixed, it seems to cause some issues.

  2. Goodpeople September 22, 2008 at 7:57 am #

    Three Golden rules regarding Social Networks.

    1. Don’t use them
    2. Don’t subscribe to them
    3. Never log on to them

    (free after Robert Morris)

  3. Navin September 23, 2008 at 12:35 pm #

    I guess Rule 1 is the golden rule for social networking fanatics!!

  4. Pantagruel September 24, 2008 at 6:48 am #

    Free after Goodpeople ;)

    1. Scout out a pub/bar
    2. entice the intended target
    3. Buy him/her a beer/whine/cider
    4. enjoy the real world face to face