This article is from the source 'bbc' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.bbc.co.uk/go/rss/int/news/-/news/technology-11382469

The article has changed 5 times. There is an RSS feed of changes available.

Version 0 Version 1
Twitter flaw pumps out spam links Twitter scrambles to block worms
(about 1 hour later)
A flaw in the website of micro-blogging service Twitter is being used to pump out pop-up messages and links to porn sites. By Jonathan Fildes Technology reporter, BBC News
Users only have to move their mouse over the link - not click it - to open it in the browser. Twitter has patched a flaw in its website that was being exploited to pump out pop-up messages and links to porn sites.
Thousands of Twitter accounts have so far posted messages exploiting the flaw including Sarah Brown, the wife of former Prime Minister Gordon Brown. Initially, users only had to move their mouse over a message containing a link - not click it - to open it in the browser.
The malicious links look like a random URL and contain the code "onmouseover". The code was spread by worms, self-replicating, malicious pieces of code.
This command - written in a programming language called Javascript - automatically directs users to another website, some of which contain pornography. Thousands of users were caught out by the flaw, including Sarah Brown, the wife of the UK's former Prime Minister.
"The exploit is fully patched," Twitter said on its status blog.
People using third-party Twitter software - such as Tweetdeck - were unaffected by the problem.
'No regrets'
The code exploited what is known as a cross-site scripting (XSS) vulnerability, a flaw in a website that can be exploited by relatively simple code.
In the case of the most recent flaw, the command - written in a programming language called Javascript - automatically directed users to another website, some of which contained pornography.
The malicious links looked like a random URL and contained the code "onmouseover", which triggered when the cursor hovered over the link.
"There is no legitimate reason to tweet Javascript," Graham Cluley, a researcher at security firm Sophos, told BBC News."There is no legitimate reason to tweet Javascript," Graham Cluley, a researcher at security firm Sophos, told BBC News.
He said that it looked like the initial vulnerability was exploited as a prank by users, but was now being spread by a worm, a self-replicating and malicious piece of code. The first message to contain the code seemed to have been sent by a developer called Magnus Holm.
"Simply being logged into Twitter and viewing these pages could mean that your own Twitter account could be hacked," said Mr Cluley. "I wrote the first worm that has been spreading," he told BBC News.
Until the flaw is fixed, users should use a third-party Twitter client - such as TweetDeck - rather than the Twitter.com website, he advised. "I simply wanted to exploit the hole without doing any 'real' harm," he said. "It started off as 'ha, no way this is going to work'."
"Don't use the website," he said. He said the flaw had been identified by others and had already been used for other means.
"There were several other tiny hacks using the exploit - I only created the worm," he said.
So far, said Mr Holm, he had seen his worm passed around in at least 200,000 messages.
But he warned there were now several other variants spreading that used "other nasty or smart tricks".
"It was only a matter of time before more serious worms started."
However, he said he had no regrets and was "not sure" whether he would receive a call from Twitter.
It is not the first time the service has suffered an attack.It is not the first time the service has suffered an attack.
In April 2009, another worm spread links to a rival site, again showing unwanted messages on infected user accounts.In April 2009, another worm spread links to a rival site, again showing unwanted messages on infected user accounts.
Mr Cluley said that Twitter needs "much tighter control" over what users can contain in a tweet to prevent similar problems in the future.Mr Cluley said that Twitter needs "much tighter control" over what users can contain in a tweet to prevent similar problems in the future.
Twitter was not immediately available for comment.