|
|
|

Twitter XSS Vulnerability Still Wide Open, Developer Says
By: Brian Prince
2009-08-26
Article Rating:    / 4
There are 0 user comments on this Network Security & Hardware story.
A cross-site scripting vulnerability affecting Twitter security is still open despite the microblogging service's attempt at a fix, a software developer says. If exploited, the bug could enable an attacker to take over a victim's Twitter account.A software developer is claiming Twitter's fix for a critical cross-site
scripting bug is no good, meaning users are still vulnerable to an attack that
could allow an attacker to take over their accounts.
The bug was first reported by techie James Slater. According
to Slater, the vulnerability allows malicious JavaScript to be inserted
into tweets by adding the code to a field of the API
used by Twitter developers. By embedding links in tweets, developers can direct
Twitter users to their Websites.
More information on the Twitter
vulnerability can be found here. At the heart of the issue seems
to be that Twitter's API does not filter
malicious URLs.
"Twitter made one of the most basic mistakes in developing Web
applicationsnever blindly trust data that is provided from the outside world!
Their form did noor some very, very basicchecking on what you enter in the
box," Slater wrote.
He said although Twitter claimed to have fixed the problem after he pointed it in
a blog post Aug. 25, the fix did not address the issue.
"With a few minutes' work, someone with a bit of technical expertise
could make a Twitter 'application' and start sending tweets with it it can be
arranged so that if another Twitter user so much as sees one of these tweetsand
they are logged in to Twittertheir account could be taken over," Slater
wrote.
A Twitter spokesperson did not respond to a request for comment. Slater
advised Twitter users to "unfollow" anyone they don't know or trust.
|
|
x}ks8q8c=mGm9Ʋon"!c䒔˩'o ҃l'9g-`n4wAȥ3!]ל۔\sPç}$5]2i*_
d&@jہ )}mk4
uB ;{#|6S%߽w *s=NN5KԚLÆ|g&$ƾl
dkdp,FcwO5dzZC'AjZ$m(P8"X.wD~TheMQR`F
Cw&tb9Q)+X^DP~DM:ǎ-4rFwN̚0/PcwҴv;P;U{Q5h/E@^cBȡ[w4ɿT݉[՛L=iLVG;%0Ãtf?Dk>NZ] Z3ˆ辥$)5= \o4QL1H6}~8MZ QK8Q+)Kk0~b[4Ip\.* }=-:ҍ}4.j.9a6ԃ)P2zhNt(`_dY7;Ͱ-P6cMTjR>5M0\ܱ¬:֪ǷV1?!MXCE C0ʡ~Ffw:|&xr9%IoK|68#t/ !_wnr@
i/]"n/KŗG)LY4C ! ,#2ɌSHut:e9AcE'C6kiJuV!`FCܺoN 49(蟩$ m4@r5YSl ROFo4| ~ަ,-|y"brݢHPsnSEI7#DLvxr!DKI88g^R]E1\aU<Hwnooǫ$шf",$긦ժ
,r*ǿFX@8ʍ85m!SGñA
S&s;,y8`;}FwgԴHwH<:M/}@˥ya1@
L^a
pw>>-Fv1s{Q {>0i CkFQD47
l"&qsк``2fàF{t$ ,/{@`\@48`$8ʼE]uCbB=Ś떭,L<ħܠ~(~9-WRO^`32)%%E2G 4.gH)AH =[h ]99y$avGBj+6ODs@PGҥ;qjRF;7 +=*%nqR%e 932YIf=?j1!UG,D`v9J,L.i)lc
ը[6؛ri:|:ioB{<0uy=[IZ-z'$g:4$a.*dyFg0sO|sy?&4ğ;nX$}VV̚s=R.Ƈ5#tݴyF3ˁ2$vTD>L˄Fr6:{mQH08u s3tNm~|[FhIO3hy>g~=厬m[_4@~T&](\uΩIJ&k*HY3j-tlrDr
VOr1r@@SjSVTV3Q2}=C+NEۋ)i
3X-8G/4- 'ٲJb-Yֽk%fcPKúJ jt ~d7Bɶ/^¢xmP2D֑Rkϥò=6PcD62Cô
7=}0\ReZȔm%s8+ՒI,Yv()z?rsXSuINMg!r
.>OH)zS7HpFa)e-6BSjj33-F o+_`׆ K LȁUzuڏ3ҝrie?o//{UK\JXq>om V!2ED30`-F}ݛZA_ay
7aT5clq,Y6Uصm!2uD(-CZ!]˙@'@:*[#çV"IJ8vYPzP*WGz1FAn?%hPfJf,`\.xJrE}))J5` L` T< t&{;=
:7G\d]`А( BrIa TWk\P¹й٩ 7]@ &Tt a"'1хڧ>nssa*/W+)Z;Oz^*k 9ЪZZs3;Aq̻8
k 9tc~y89Moř1FtY9[J?Ct>rɵ|`䣇*,p |/"yjėCPӕ~>V6ʼnGG փxuESUG݀Ν. Ϣ=t@h#xZ
`Q`:ڴ{F;$ho EZDuU崠lЀY(/M3$J1N*,7ؔAԙ~o׆gyϤͬn[>Nmwn9Ak jMsU-$x5r?_gq&&Fо,騫VIۂa2&(ڇFsuuu}|Ƭ.n>a=O u:@ |DV;IUsԷбtNk|?գsg8X$]3a0Qnaj0eQ
ʋzhBFr
3!eE#uya39aؠGsHoR10 ZH{QOIŇVӿ}
PkSRQX\u VI^Aұg.@C׳@.l̼ITCGTUeH4ỵV3#e
46-.wEZЋֶi&%lbbϦ\#2OR8KY,aZp9ЃNIc#,\,Bn|&nR X'7:^iۃM$ 節e:Tg-FRV%f萫YI#'.ɢ6A)M`ɒ8khs%sp:'S6PFz%R!i#yF(#wgo@PlB=2tbiw:.[Wky6a2I4DҮi:b/T)wU 4.izIRϢCsw@&l_z¢ te2q{4(}}ŵa[^H&yX|uCaEH5]Uj{_ se#kF!)W_1| r UN7._VZq* s>PV9[BlpD75SXr|MΠkPHe, ,"zJ3)=2
杨V*UYŵ .~xqLLw?ChueqjdE16kK~Zg'7>hZt@(+}w9\b{W\~>s,&L\z;At.:# {L.ڝ0^x_Ը6`>"u8"cozΤNEø@o9P K cE1>bt߫](co[gg
a=l(F[o^9
mݼ\/~.{71\txx\McvuyuyU4"$eu{hq\3MFd1SW5!g42l&ik-,һ9kpf`Z^k=Wئ17U8^Fh6e1w}uYL/1tLVc (ʱ =`=`V鈳N9>v\b/{Ȗ VB0F_Th)4zuSxv>ݴ8S9jɟ}A_(/(kѷo5E߈>O1Of?i<&]{pXJqk'һ< $uSPӇ/ۜr;1dy!B(Í76w jEާ
pZIS"9oթ-ݱi'>(]ax!wm(q%ӝr*n(SAٺCO[,4mfSsSGAGJ脚fye5-eH5NRMLC]OC/ $;kB6\x{ gaM.m2jtwn_"9G,X-Y+ʦ#/i\A1:h",GDd^Y #}DK,`; ;_彠PFs+ɭGXw=uSa*'q)y |