Slashdot Log In
Twitter Gets Slammed By the StalkDaily XSS Worm
Posted by
Soulskill
on Sun Apr 12, 2009 10:13 AM
from the tweety-bird-gets-the-worm dept.
from the tweety-bird-gets-the-worm dept.
CurtMonash writes "Twitter was hit Saturday by a worm that caused victims' accounts to tweet favorably about the StalkDaily website. Infection occurred when one went to the profile page of a compromised account, and was largely spread by the kind of follower spam more commonly used by multi-level marketers. Apparently the worm was an XSS attack, exploiting a vulnerability created in a recent Twitter update that introduced support for OAuth, and it was created by the 17-year-old owner of the StalkDaily website. More information can be found in the comment thread to a Network World post I put up detailing the attack, or in the post itself. By evening, Twitter claimed to have closed the security hole."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
author found. Now what? (Score:2)
So the StalkDaily fellow admitted to creating the worm. Now what?
Re:author found. Now what? (Score:5, Funny)
Parent
Re:author found. Now what? (Score:5, Insightful)
Parent
Re:author found. Now what? (Score:5, Funny)
I tried, but they closed down the Microsoft Pub.
Parent
Re: (Score:3, Funny)
Don't worry, the Linux pub is better. The beer is free, and you can get a copy of the beer's recipe anytime you like!
Re:author found. Now what? (Score:5, Funny)
Yeah, but if you ask for a beer the bartender calls you a N00B and if you ask what beers are available he tells you to RTFMenu.
Parent
Re: (Score:3, Funny)
Ob. Penny Arcade (Score:2, Funny)
Re: (Score:3, Insightful)
âoeI am the person who coded the XSS which then acted as a worm when it auto updated a users profile and status, which then infected other users who viewed their profile. I did this out of boredom, to be honest. I usually like to find vulnerabilities within websites and try not to cause too much damage, but start a worm or something to give the developers an insight on the problem and while doing so, promoting myself or my website.â
Every inch of this quotation just makes you want to
To hire or to jail, that is the question (Score:5, Funny)
A 17 year old is old enough to understand the ramifications of his actions to a reasonable extent. He no doubt understood that releasing a worm like that would be met with an unfavorable reaction. But he did it anyway. In this sense, he is a potential menace to the Internet.
However, he is still in his formative years. His abilities could be nurtured in productive directions and we could have the next Edward Dijkstra in the making.
So do we punish him and turn him to the Dark Side? Or do we show him love and respect and turn him? There is still good in him. I can feel it.
Clearly he should be made to (Score:3, Funny)
Go and manually run anti virus software on every infected PC.
Re:Clearly he should be made to (Score:5, Informative)
Go and manually run anti virus software on every infected PC.
Not that kind of worm. It was purely a scripting attack involving javascript. No one's computers were harmed, only a bunch of twitter accounts. (Which can no doubt be fixed by patching the whole and some good SQL query to fix all the accounts in one go.)
Parent
Re: (Score:2, Insightful)
There are no infected PC's. The only thing 'infected' was people's twitter statuses, and now that the exploit was patched, there is no virus, since the code was executed by the server, not by the individual computer.
This sounds pretty harmless.
Re: (Score:3, Interesting)
It was XSS; the idea is that an attacker puts his JavaScript code on a page belonging to someone else. When a victim views the page, their client executes the JavaScript.
Now, in this case, we got lucky: this guy didn't try to exploit browser vulns or anything of the sort. What if, though, this thing had come to the attention of, say, a botnet operator? Combined with a browser vulnerability (the sort found at CanSecWest, for example), the botnet operator could easily have gotten several thousand more systems
Re:To hire or to jail, that is the question (Score:5, Insightful)
Parent
Re:To hire or to jail, that is the question (Score:5, Insightful)
I say anything that slows down the spread of those fucking annoying twitter people is a good thing and he should be awarded a medal.
Tweet this, bitch.
Parent
Re: (Score:3, Funny)
Tweet this, bitch."
Bit obvious (Score:5, Interesting)
Re:Bit obvious (Score:5, Informative)
Especially when you read the Terms of Service on Mr. Mooney's own StalkDaily website, e.g.:
7. You must not modify, adapt or hack StalkDaily.com or modify another website so as to falsely imply that it is associated with StalkDaily.com.
8 You must not create or submit unwanted email to any StalkDaily members ("Spam").
9. You must not transmit any worms or viruses or any code of a destructive nature.
Talk about having a "Do as I say, not as I do" morality. At least it's refreshing to see that hypocrisy is not restricted to people over 30.
Parent
Re: (Score:2, Insightful)
Actually, we had a meeting where we agreed that ToS's are by nature BS. We didn't invite anyone over 30, so I don't know if you missed the memo or just weren't invited.
Re: (Score:2)
Hopefully after he gets a very PAINFUL slap on the wrist for computer trespass.
I really would like the feds/cops to nail him, even if he just gets a stern warning of some sort.
He needs arrested and charged. What he did was a crime, and he needs to be taught to back off of people's computers, preferably before he turns into a legal adult and opens himself up to BIG trouble.
Re: (Score:2)
That's still hacking.
Exploiters who take advantage of loopholes for their own gain should be punished.
Had this student simply reported the incident to twitter, I'd think differently.
Using it to promote his own site proves bad faith.
Ummmm (Score:2, Interesting)
Isn't that called "criminal damage"? Now if I'm not mistaken, the police and courts tend to frown on that sort of thing.
Re: (Score:2)
Re: (Score:2, Insightful)
Why should he be held responsible? The XSS is just plaintext code. It has no meaning unless someone executes it.
Could the same not be argued about malicious/annoying scripting language code, or any interpreted code for that matter?
If TPB can't be held responsible for simply providing links to illegal downloads, surely this kid shouldn't be held responsible for writing up some XML style sheets.
Maybe its just me, but I think that depending on what country you are in the laws for what you are responsible for change quite a bit.
Re: (Score:2, Informative)
Fuckwits... XSS = Cross Site Scripting, not XML Style Sheets.
Would you trust StalkDaily? (Score:5, Insightful)
Seriously, would you? The developer admits to infecting people's computers and accounts in order to advertise his services, and doesn't think he did anything wrong. How can anyone trust his services then?
For starters he should be forced to take down StalkDaily. I'm sure Tweeter lawyers are looking into this right now. And for once, I agree with such a move. /not a tweeter user
Re:Would you trust StalkDaily? (Score:4, Insightful)
Two issues with your post:
One, the dev did not infect anyone's computers. He wrote a small program, on the site, that would update the profile of anybody who saw one of the spam comments. For example, you visit a friend's page who has one of these comments (and therefore the code) and your profile is updated with a comment (and the code). The only "infection" was on the site, not the end users. Also, no accounts were hacked. Simply a case of instructing the visitor's browser to slyly update the visitor's status while looking at a different page. TFA states that there were no passwords, usernames, or anything else in the code.
Two, it's twitter.
Parent
Re: (Score:2)
Wait, exploiting software loopholes to circumvent authentication requirements and make changes to privileged (albeit pointless tatt) information is not "hacking" anymore? I must have missed that memo.
Two, it's "twatter". :D
Re: (Score:2, Interesting)
A Malwarebytes scan comes up with three instances of malware. One is the Seneka rootkit (ouch!).
Also according to the code and analysis posted on TFA showed that the script was ran on the client side, i.e. the user's computer, that exploited an XSS exploit on Twitter's website.
I think that satisfies the definition of a Black-Hat Hack & Infecting users' PCs.
Re: (Score:2)
Seriously, would you? The developer admits to infecting people's computers and accounts in order to advertise his services, and doesn't think he did anything wrong. How can anyone trust his services then?
For starters he should be forced to take down StalkDaily. I'm sure Tweeter lawyers are looking into this right now. And for once, I agree with such a move. /not a tweeter user
Not only that, but by admitting to what he did he makes criminal prosecution easier. Not a very smart thing to do; plus now he will be forever linked to his act for any future employer to see.
Re: (Score:2)
Twitter is similar to Myspace in about the same way as a frog is similar to World of Warcraft.
Yes.
I saw this. (Score:3, Interesting)
One of the Japanese people I followed suddenly tweeted a couple lines in English about StalkDaily and I was like 'wtf?' At least now I know it wasn't them.
Re: (Score:2)
One of the Japanese people I followed suddenly tweeted a couple lines in English about StalkDaily and I was like 'wtf?' At least now I know it wasn't them.
Heh - and now you also know that you were one of the victims. Kind of like that movie where everyone who watched a video type died. Except without the death. And the water.
Re:I saw this. (Score:5, Funny)
You have used the verb "tweeted".
Ninjas have been dispatched to your location, to make sure you don't do it again.
Parent
Re: (Score:2)
Admitting to a felony (Score:2)
Sounds Like A Publicity Stunt (Score:4, Insightful)
FTA:
StalkDaily.com is similar in design and features to Twitter. In addition to the features of Twitter, it also allows users to upload videos and photos. Through looking at the code behind Twitter, Mikeyy was able to produce a similar site to Twitter with some additional features. "I used my past knowledge to gain an insight on how Twitter worked and outputted to a user. Although both of the sites are coded in different languages I was able to give my site the same features as Twitter, while coding some of my own."
It sounds to me like the kid was trying to promote his Twitter knockoff site, but for some reason felt the need to do so by poking a stick in Twitter's eye. Makes me think the whole thing was a juvenile cry for attention. I knew a kid like that in high school. He was smart as could be but would do anything, no matter how socially unacceptable, to get attention.
I think the kid needs counseling and guidance and not a jail sentence.
Re: (Score:2)
Right. Let's send him to jail and complete his criminal education on the taxpayer's dime. He's obviously not hardcore yet, but we'll get him there. Jail is definitely the best option for a 17 yr. old who wrote a spam script.
Samy is my hero (Score:3, Insightful)
Re: (Score:2)
From Wikipedia:
Samy Kamkar entered a plea agreement, on January 31, 2007, to a felony charge. The action resulted in Kamkar being sentenced to three years probation, 90 days community service and an undisclosed amount of restitution.
It sounds like Mikeyy will get at least that much, and possibly much more; IIRC Samy had claimed that his virus was just supposed to be for his friends, while Mikeyy has already gone on record saying that he did it for commercial gain. That was a daft move, which he will realize as those words are trotted out over and over in his trial.
The XSS FAQ (Score:3, Informative)
The guy is an amoral scumbag; however... (Score:2)
I must admit that part of me smiled when I thought about how this might turn a few people off regarding Twitter. What an absurd waste of time and resources Tweeting is...
<aside>If I ever have to have surgery, and I find out that the surgical team was tweeting during the procedure - I'm going to sue them for negligence. PAY ATTENTION TO YOUR JOB DAMMIT!!</aside>
No, okay, he did something awful. Really. Yeah, he did. Any beneficial side effect wasn't by design.
Maybe I'll buy him a beer after he ge
Spell Twitter (Score:4, Funny)
Remember, you can't spell "Twitter" without using the word "twit".
Re:throw the scumbag in jail (Score:5, Informative)
Idiots like him are the reason viruses exist.
Stop right there! You are infringing on a Microsoft technology.
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
You're not ignorant. You're right. In addition, recent Firefox browsers have built-in XSS blocking.
Re: (Score:3, Insightful)
Yeah right! Every time some vi comes up, people start holding NoScript as a panacea. I use NoScript so I am aware of its advantages. But it's not a cure-all. There are so many sites (twitter in this case) which simply do not work without Javascript being enabled. So most of the NoScript users who use twitter through a browser will have Javascript enabled - by white listing it in NoScript. So, no sorry, NoScript is not a protection against this one.
Yes, NoScript (Score:3, Informative)
You're wrong, NoScript DOES give protection against this attack. The malicious code comes from the mikeyylolz.uuuq.com, which is not in your NoScript whitelist even if you're using twitter.com with scripts allowed.
Please check http://hackademix.net/2009/04/13/mikeyys-stalkdaily-twitter-worm-vs-noscript/ [hackademix.net]
Re: (Score:2)
Any publicity is good publicity. While I don't really care about either site, I hadn't even heard of StalkDaily before this.