This article is from the source 'bbc' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.
You can find the current article at its original source at http://www.bbc.co.uk/go/rss/int/news/-/news/technology-11382469
The article has changed 5 times. There is an RSS feed of changes available.
Version 0 | Version 1 |
---|---|
Twitter scrambles to block worms | |
(about 1 hour later) | |
By Jonathan Fildes Technology reporter, BBC News | |
Twitter has patched a flaw in its website that was being exploited to pump out pop-up messages and links to porn sites. | |
Initially, users only had to move their mouse over a message containing a link - not click it - to open it in the browser. | |
The code was spread by worms, self-replicating, malicious pieces of code. | |
Thousands of users were caught out by the flaw, including Sarah Brown, the wife of the UK's former Prime Minister. | |
"The exploit is fully patched," Twitter said on its status blog. | |
People using third-party Twitter software - such as Tweetdeck - were unaffected by the problem. | |
'No regrets' | |
The code exploited what is known as a cross-site scripting (XSS) vulnerability, a flaw in a website that can be exploited by relatively simple code. | |
In the case of the most recent flaw, the command - written in a programming language called Javascript - automatically directed users to another website, some of which contained pornography. | |
The malicious links looked like a random URL and contained the code "onmouseover", which triggered when the cursor hovered over the link. | |
"There is no legitimate reason to tweet Javascript," Graham Cluley, a researcher at security firm Sophos, told BBC News. | "There is no legitimate reason to tweet Javascript," Graham Cluley, a researcher at security firm Sophos, told BBC News. |
The first message to contain the code seemed to have been sent by a developer called Magnus Holm. | |
"I wrote the first worm that has been spreading," he told BBC News. | |
"I simply wanted to exploit the hole without doing any 'real' harm," he said. "It started off as 'ha, no way this is going to work'." | |
He said the flaw had been identified by others and had already been used for other means. | |
"There were several other tiny hacks using the exploit - I only created the worm," he said. | |
So far, said Mr Holm, he had seen his worm passed around in at least 200,000 messages. | |
But he warned there were now several other variants spreading that used "other nasty or smart tricks". | |
"It was only a matter of time before more serious worms started." | |
However, he said he had no regrets and was "not sure" whether he would receive a call from Twitter. | |
It is not the first time the service has suffered an attack. | It is not the first time the service has suffered an attack. |
In April 2009, another worm spread links to a rival site, again showing unwanted messages on infected user accounts. | In April 2009, another worm spread links to a rival site, again showing unwanted messages on infected user accounts. |
Mr Cluley said that Twitter needs "much tighter control" over what users can contain in a tweet to prevent similar problems in the future. | Mr Cluley said that Twitter needs "much tighter control" over what users can contain in a tweet to prevent similar problems in the future. |