Twitter Battered By Powerful Worm Attacks

[ad]

We’ve written about Twitter quite a few times now, with it’s click-jacking vulnerability, twitter phishing attacks and various other issues.

It’s no surprise it’s being targeted though as it’s now the 3rd biggest social network after Facebook and Myspace.

Within a relatively short time period it’s overtaken almost everyone else. This weekend it suffered a fairly serious worm infection that spread itself through injecting JavaScript into people’s profile pages. After visiting an ‘infected’ profile you would then be infected and spread the worm from your profile page.

Twitter was hit over the weekend by powerful, self-replicating attacks that caused people to flood the micro-blogging site with tens of thousands of messages simply by viewing booby trapped user profiles.

The worm attacks began early Saturday morning and were the result of XSS, or cross-site scripting, bugs in the Twitter service. They caused those who viewed the profiles of infected users to post tweets promoting a site called StalkDaily.com. Victim profiles were then altered to include malicious javascript that infected new marks. Over the next 36 hours, at least three similar worms made the rounds, causing Twitter administrators to delete more than 10,000 tweets.

Twitter’s inability to quickly contain the mess prompted some security watchers to criticize Twitter for not being more on top of it. According to this postmortem from the Dcortesi blog, the attacks exploited gaping holes that allowed users to insert tags in the URLs of Twitter users’ profile pages that called malicious javascript from third-party web servers.

It’s not the first time Twitter has been hit and it’s not the first time they have been criticized for not being fast enough or for dealing with the problem properly.

The issue itself is quite a serious one and shouldn’t have existed in the first place, who knows how long this flaw has been known about and what nefarious purposes other people have been using it for.

The fella that exploited it basically did it to promote his own Twitter knock off called StalkDaily which is currently down.

As is frequently the case with XSS-based attacks, the worm was unable to prey on those using the NoScript add-on for the Firefox browser.

Twitter’s security team was able to block the attack for a while, but a new assault that made use of “mildly obfuscated” code soon defeated the countermeasure, raising the possibility that it was based on the detection of attack signatures rather than fixing the underlying bug that allowed the XSS vulnerability in the first place.

“The existence of a mildly obfuscated version authorizes a scary suspect: have Twitter guys just been trying to block the original strain by signature, rather than fixing their website error?” Italian researcher and NoScript creator Giorgio Maone wrote here. “This would be ridiculous, since any script kiddie can create his own slightly modified version for fun or profit (and is probably doing that).”

It’s not the first time Twitter has been slow to react to vulnerabilities on its site that allow self-replicating attacks against its users. The San Francisco-based company took more than 24 hours to close a separate hole discovered by white-hat hackers last month, while many of the company’s employees attended the South by South West conference in Austin, Texas.

The scary part is, Twitter didn’t fix the root cause of the problem – it appears they just filtered out the malicious code. So by altering it slightly the author quickly unleashed another version of the worm.

I hope Twitter get’s their act together and starts fixing things properly.

Source: The Register