IDG News Service >
 

Twitter Mouse-over Flaw Spawns Potentially Dangerous Links

o Jared Newman
21.09.2010 kl 14:40 | PC World (US)

A security flaw has made Twitter's Website a chaotic and potentially unsafe place, filled with annoying pop-up windows that activate just by rolling the mouse over another user's tweets.

 

A security flaw has made Twitter's Website a chaotic and potentially unsafe place, filled with annoying pop-up windows that activate just by rolling the mouse over another user's tweets.

The flaw is activated by inserting a line of JavaScript into the tweet, containing the command "onmouseover." It seems that most people are using this exploit for playful trickery, generating bothersome but benign pop-up messages when the user's mouse rolls over the text.

But according to Sophos, the Twitter hack could be used to send people to malicious third-party Websites. Sarah Brown, wife of former U.K. Prime Minister Gordon Brown, for example, has inadvertently sent users to a Japan-based hardcore porn Website.

To make matters worse, the exploit is also being used to fill and submit status updates when rolled over, leading to fast propagation. My twitter feed is overrun with messages containing the "onmouseover" JavaScript.

Twitter says it is working on the problem. Georg Wicherski of Kaspersky Labs notes that "Twitter now properly escapes links, that specific vulnerability seems closed."

For now, Twitter users should either access the site from a third-party client, such as TweetDeck or Seesmic, or use mobile.twitter.com, to which the exploit does not apply.

Users who were already granted access to the new, redesigned Twitter.com should not run into this exploit.

Keywords: Security  
Latest news from IDG News Service

Copyright 2009 IDG Magazines Norge AS. All rights reserved

Postboks 9090 Grønland - 0133 OSLO / Telefon 22053000

Ansvarlig redaktør Henning Meese / Utviklingsansvarlig Ulf Helland / Salgsdirektør Tore Harald Pettersen