Aussie Student Responsible For Twitter Exploit 122
bennyboy64 writes "An Australian teen has caused havoc on Twitter by discovering an exploit that hit thousands of users, including Barack Obama's press secretary, and resulted in the tweets of a former British PM's wife linking to hardcore porn, The Sydney Morning Herald reports. Pearce Delphin, who is studying his last year at high school, said that he was surprised that 'so many famous people got infected.'"
Got a great career ahead of him (Score:3, Insightful)
Got a great career ahead of him, if he wants...
I'd say Twitter is responsible. (Score:3, Insightful)
Re:who's responsible? (Score:2, Insightful)
From TFA... (Score:4, Insightful)
After a "little bit of coding", he said he "managed to generate a dialog box containing the data from within the Twitter cookie file". He said "theoretically this could be used to maliciously steal users' account details".
They make it sound difficult to alert(document.cookie)...
But "the problem was being able to write code that can steal usernames and passwords while still remaining under Twitter's 140 character tweet limit", he said.
Ah, so the 140-character limit is actually beneficial in some sense!
Re:who's responsible? (Score:4, Insightful)
Dude, that's almost always an AND, not an XOR.
Re:who's responsible? (Score:4, Insightful)
He didn’t really fathom the extent of the exploit, though. He thought it was just a novel toy to pop up alert boxes when you moved the mouse over the tweet. (Well, he actually got the idea of trying to steal users’ session cookies, but didn’t find a way to do it within the 140-character limit.) The idea that really allowed it to go viral – posting a new tweet – was conceived by someone else.
Hell, I’ve done similar... “oh look, the layout of the page broke after I put a special char in that form element... I wonder if I can make it alert(document.cookie) using that? (sure enough) yup...” The main difference in this case is that (a) it was a massive social networking site and (b) other people could see his experiments and come up with their own little variations on the exploit, some of which were less benign than his experiments had been...
Re:What I liked (Score:3, Insightful)
This would be akin to running blind sql injection on websites, and using that as a defense when you got caught.
Little Bobby Tables strikes again. ;)
http://xkcd.com/327/ [xkcd.com]
Re:Who caused it? (Score:5, Insightful)
Since the fall of Adam.
Well, you did ask.
Re:who's responsible? (Score:2, Insightful)
Re:Six Degrees (Score:4, Insightful)
See! You can't!
Re:who's responsible? (Score:5, Insightful)
...Suppose you post a mentally-handicapped guard at your castle gate. When you are gone, your enemy hands him a scroll with instructions and says "These are from your boss. He wants you to do them right away." The instructions tell him to ransack your bed-chamber and run your underwear up the flag-pole. The guard obeys. Who is to blame?
Twitter.
Oh wait, Microsoft.
No... Google.
Ooooh, Terrorists. Almost had me there.
He never exploited.. (Score:2, Insightful)
Re:This is exactly the kind of scenario (Score:4, Insightful)
think of what a blackhat could do with the HTML5 ping attribute, directing many thousands of twitter users all hammering a single site (and url shortening sites go down as collateral damage) to death. It could originate from any social networking site.
And that’s any worse than, say, sending them all to a pastebin page that will repeatedly download all the images from the target website?
Re:Who caused it? (Score:3, Insightful)
OH I know this one!!!
What is... the guy that discovered the exploit!
Because see, even though you discovered that the front door was left open it doesn't give you permission to go in. See how that works? Yeah I know it's very confusing, best just to not check if doors are open unless they're doors you own.
Re:"Responsible" (Score:4, Insightful)
Twitter is a simple message board, but it's accessed with virtual machines that were never designed but just kinda happened - in other words, modern browsers. Combine that with the attitude some people still have that you need to filter - enumerate all bad things and check for them - rather than simply escape the user-input string, and it shouldn't be a surprise that these things keep on happening.
Not that it really matters. An exploited website is like graffiti in real life: much ado about nothing.
Re:This kid did what exploit hunters do (Score:2, Insightful)
"This kid did what exploit hunters do, release code to the internet knowing it can be used for criminal purposes."
According to that logic, if i stab you in the face, the guy who sold me the knife is responsible.
This kid did not do anything wrong. All he did was let people know about the bug.
car analogy:
All he did was put a flyer in your window saying that if you switch on the headlights and the radio at the same time, your car will explode. He is now responsible if somebody else uses that knowledge to blow up a lot of cars.