XSS flaw in Twitter

Two security researchers have discovered a serious XSS weakness affecting the Twitter, a popular micro-blogging platform. The attack, posted by researchers at Secure Science is an innocuous proof of concept that forces users to send out a predetermined twitter message, but it could be repurposed into a very nasty worm, said Lance James, chief scientist with Secure Science.

Lance James and Eric Wastl, security researchers for Secure Sciences Corporation, have announced that Twitter users are exposed to potentially dangerous attacks, because of a cross-site scripting vulnerability. XSS flaws are the result of poor input validation and generally allow attackers to force unwanted behavior through simple URL manipulation. The hack is similar to a clickjacking attack that was making the rounds on Twitter last month. There, hackers used a sneaky technique to trick users into clicking on a link without realising it. That link would post the Twitter message saying "don't click" along with a URL.

The shortened version of the PoC link has since been disabled by TinyURL, yet the full URL is still available. Clicking on it will first warn users of what they are about to do and ask them if they want to proceed. Hitting "Ok" will automatically post a message that reads "@XSSExploits I just got owned!," on their Twitter page.

"With a technology such as twitter, I could use it to infect massive amounts of twitter readers/users, say with malware or steal their accounts, etc.," Lance James explains for The Register. This is even more dangerous, as most Twitter users have gotten accustomed to simply clicking on TinyURL links without using the service's preview feature to see where they actually lead.

Twitter could disable the attack by fixing the cross site scripting flaw that the Secure Science researchers are exploiting, but if another similar bug were to pop up on the site, users would be faced with the same problem all over again. The issue is made worse by the fact that because of Twitter's 140 character limit, Twitterers use shortened Web links such as Tinyurl.com and often have no idea whether or not they are clicking on a trustworthy web link, James said.