Forest Global Training Partners

Cyber Risks · Krebs on Security

Nasty Twitter Worm Outbreak

Summary: Several Internet worms spread rapidly through a cross-site scripting vulnerability on Twitter.com that used "onmouseover" techniques, so merely moving a mouse over a malicious Tweet resent the message to all of a user's followers. F-Secure said the trouble started earlier that day, with initial worms apparently beginning as a proof-of-concept while newer versions silently redirected victim PCs to fetch more malicious payloads; Twitter later reported the vulnerability fixed, and its security chief Bob Lord said the exploit affected Twitter.com but not the mobile site or mobile applications.

What's compelling: The worm needed no click, only a mouse passing over a Tweet, and it reached every follower of each victim before Twitter closed the hole within hours; Lord said the vast majority of exploits fell under the prank or promotional categories and that no account information was compromised, but the same delivery path is available to whoever wants to carry a real payload next.

Read the original at Krebs on Security ↗

Topics
Vulnerabilities & Patching
Related