{"id":997,"date":"2008-09-11T05:39:37","date_gmt":"2008-09-11T05:39:37","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=997"},"modified":"2015-09-09T19:39:17","modified_gmt":"2015-09-09T11:39:17","slug":"csrf-vulnerability-in-twitter-allows-forced-following","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2008\/09\/csrf-vulnerability-in-twitter-allows-forced-following\/","title":{"rendered":"CSRF Vulnerability in Twitter Allows Forced Following"},"content":{"rendered":"

[ad]<\/p>\n

I did mention this earlier in the week when I was talking about Twitter being used as a malware distribution platform<\/a>, there also seems to be an auto follow vulnerability that spammers would love.<\/p>\n

Do you remember Myspace and samy with 900,000 friends<\/a>? Now we have johng77536<\/a> on Twitter!<\/p>\n

Last week, TechCrunch\u2019s Jason Kincaid wrote about an obvious Twitter vulnerability that allowed a user called \u201cjohng77536? to game the popular micro-blogging service to add thousands of followers (subscribers) in a short period of time.<\/p>\n

The \u201cjohng77536? account has since been disabled but a security researcher tracking Twitter security flaws and weaknesses has discovered a new vulnerability that lets users easily game the \u201cfollow\u201d system.<\/p><\/blockquote>\n

Whoever used this account was pretty stupid though hooking 7000 followers in a day, that raised some alarms for sure and now the account has been deleted.<\/p>\n

I would guess however hundreds of other spammers are using the same technique in a much slower fashion to avoid detection. So watch out if you use Twitter you aren’t following some odd accounts that you didn’t manually subscribe to.<\/p>\n

Raff<\/a> showed me a proof-of-concept exploit that took advantage of a CSRF (cross site request forgery) bug to trick me into following his Twitter account by simply clicking on a rigged Web site. A spammer or phisher could abuse this vulnerability to gain thousands of \u201cfollowers\u201d and attempt social engineering attacks.<\/p>\n

Twitter\u2019s security team has promised a fix within 24 hours.<\/p>\n

Raff\u2019s discovery isn\u2019t the first. He has assisted Twitter with fixing another bug that could be abused to send spam mails with malicious links. Several Twitter cross-site scripting bugs have also been found and fixed.<\/p><\/blockquote>\n

Twitter is actually a fairly simple service so I’m surprised they have so many issues.<\/p>\n

I guess it’s the nature of any site that has POST\/GET requests and especially those that use AJAX and aren’t aware of the security implications.<\/p>\n

Tokens are important people, use them!<\/p>\n

<\/p>\n

Source: Zdnet<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

[ad] I did mention this earlier in the week when I was talking about Twitter being used as a malware distribution platform, there also seems to be an auto follow vulnerability that spammers would love. Do you remember Myspace and samy with 900,000 friends? Now we have johng77536 on Twitter! Last week, TechCrunch\u2019s Jason Kincaid […]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[3261,907,3259,3234,3231,3257,396,376,770],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/997"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=997"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/997\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=997"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}