The short story: This morning at 2:54 am PDT Twitter was notified of a security exploit that surfaced about a half hour before that, and we immediately went to work on fixing it. By 7:00 am PDT, the primary issue was solved. And, by 9:15 am PDT, a more minor but related issue tied to hovercards was also fixed.
The longer story: The security exploit that caused problems this morning Pacific time was caused by cross-site scripting (XSS). Cross-site scripting is the practice of placing code from an untrusted website into another one. In this case, users submitted javascript code as plain text into a Tweet that could be executed in the browser of another user.
We discovered and patched this issue last month. However, a recent site update (unrelated to new Twitter) unknowingly resurfaced it.
Early this morning, a user noticed the security hole and took advantage of it on Twitter.com. First, someone created an account that exploited the issue by turning tweets different colors and causing a pop-up box with text to appear when someone hovered over the link in the Tweet. This is why folks are referring to this an “onMouseOver” flaw -- the exploit occurred when someone moused over a link.
Other users took this one step further and added code that caused people to retweet the original Tweet without their knowledge.
This exploit affected Twitter.com and did not impact our mobile web site or our mobile applications. The vast majority of exploits related to this incident fell under the prank or promotional categories. Users may still see strange retweets in their timelines caused by the exploit. However, we are not aware of any issues related to it that would cause harm to computers or their accounts. And, there is no need to change passwords because user account information was not compromised through this exploit.
We’re not only focused on quickly resolving exploits when they surface but also on identifying possible vulnerabilities beforehand. This issue is now resolved. We apologize to those who may have encountered it.
Computer, Technology, Databases, Google, Internet, Mobile, Linux, Microsoft, Open Source, Security, Social Media, Web Development, Business, Finance
Wednesday, September 22, 2010
All about Twitter's "onMouseOver" security exploit incident
Microblogging site, Twitter, has published a note on its recent "onMouseOver" security exploit incident.
Subscribe to:
Post Comments (Atom)
Popular Posts
-
I would like to apologize that sigining of my guestbook is not possible at the moment due to an unexpected bug. There is already 74 entries ...
-
Google url shortener service, goo.gl , is now much improved with newly included features like easier copy and paste, and ability to delete e...
-
Terms Of Use By downloading or using the app, these terms will automatically apply to you – please read them carefully before using the app....
-
As of today, Google will start using a new shortened url - g.co , to promote Google websites. g.co works differently as compared to a long-t...
No comments:
Post a Comment
Do provide your constructive comment. I appreciate that.