Despite wreaking havoc on Twitter, the worms that exploited a JavaScript bug were mainly harmless and the work of curious hobbyists or opportunistic spammers.
One day after the Great Twitter Meltdown, details of how pranksters
gleefully redirected users and spewed out retweets full of gibberish continue
to emerge. What's surprising is that instead of criminals and attackers intent
on taking over computers or stealing information, most of the perpetrators were
just curious users trying to see what they could do with the security hole.
According to various reports, the programming XSS flaw on Twitter's home
page was initially discovered by
Masato
Kinugawa, a Japanese developer, who used the code to create rainbow-colored
tweets. Another was a Norwegian Ruby programmer named
Magnus
Holm, who has the dubious distinction of having The New York Times claim he
created the first worm to use the XSS exploit. Holm reportedly saw Kinugawa's
code and played with the idea. Holm extended the code to retweet itself by
tweeting, "meh, this worm doesn't really scale. the users can just delete
the tweet," and including a link with an "onmouseover" command.
The XSS bug caused the tweet to be retweeted the instant someone's mouse
cursor touched the link.
Holm said he just wanted to "experiment" with the flaw and was
surprised his worm spread to at least 200,000 users.
Another curious user was
Pearce
Delphin, a 17-year-old boy from Australia,
who modified Kinugawa's code and created his own tweet "uh oh" with
the onMouseOver JavaScript command embedded.
"I did it merely to see if it could be done ... that JavaScript really
could be executed within a tweet," Delphin told AFP.
Others quickly picked up and modified the code to create their own versions,
performing auto-retweets and redirecting to pornographic sites. Some were
funny. Most were not.
Despite the havoc and huge amounts of spam, most of the created worms turned
out to be harmless pranks intended to sow confusion. Kaspersky Lab estimated up
to 500,000 people may have been affected.
"We are not aware of any issues related to it that would cause
harm to computers or their accounts," Twitter said.
Visitors on the Twitter page belonging to Sarah Brown, the wife of the U.K.
prime minister, were redirected to a Japanese porn site. Another worm sent
gibberish spam messages to White House Press Secretary Robert Gibb's 100,000
followers. One worm even "rickrolled" users, a widespread Web prank
in which unwitting users are instantly sent to a Website playing 1980s singer
Rick Astley's "Never Gonna Give You Up" music video.
Despite the company's claims that no harm was done, The New York Times
claimed one instance of a worm downloading malicious code from a Russian server
onto the user's computer.
Kinugawa discovered the bug and notified Twitter on Aug. 14. Twitter said in
the blog post that developers had fixed the security hole last month, but a
site update, unrelated to the new site redesign unveiled earlier this month,
reintroduced the bug on the old design. Users who already switched to the new
design or are using third-party apps to read their tweets were unaffected. Users
with JavaScript blockers such as the NoScript add-on for Mozilla Firefox
browsers were also spared.
Twitter acted quickly to close the hole. Reports indicate the company first
became aware of the problem at 5:24 a.m. EDT
and had the flaw
patched
by 10:23 a.m. EDT.
According to the company, there was no need to change passwords because user
account information was not compromised through this exploit.
The XSS bug that brought Twitter down to its knees is a fairly elementary
mistake. In fact, cross-site scripting flaws exist in seven out of 10 of all
Websites, according to WhiteHat Security. Considered relatively benign by Website
operators and developers, what happened to Twitter indicates that it can be a
real problem. The bug was easy to exploit and spread amazingly fast, and it was
done by a handful of hobbyists, not malicious hackers.
Email
Print
