Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Worms Security News

Twitter Gets Slammed By the StalkDaily XSS Worm 145

Posted by Soulskill from the tweety-bird-gets-the-worm dept.
CurtMonash writes "Twitter was hit Saturday by a worm that caused victims' accounts to tweet favorably about the StalkDaily website. Infection occurred when one went to the profile page of a compromised account, and was largely spread by the kind of follower spam more commonly used by multi-level marketers. Apparently the worm was an XSS attack, exploiting a vulnerability created in a recent Twitter update that introduced support for OAuth, and it was created by the 17-year-old owner of the StalkDaily website. More information can be found in the comment thread to a Network World post I put up detailing the attack, or in the post itself. By evening, Twitter claimed to have closed the security hole."
This discussion has been archived. No new comments can be posted.

Twitter Gets Slammed By the StalkDaily XSS Worm More

Twitter Gets Slammed By the StalkDaily XSS Worm

Comments Filter:

  • So the StalkDaily fellow admitted to creating the worm. Now what?

  • A 17 year old is old enough to understand the ramifications of his actions to a reasonable extent. He no doubt understood that releasing a worm like that would be met with an unfavorable reaction. But he did it anyway. In this sense, he is a potential menace to the Internet.

    However, he is still in his formative years. His abilities could be nurtured in productive directions and we could have the next Edward Dijkstra in the making.

    So do we punish him and turn him to the Dark Side? Or do we show him love and respect and turn him? There is still good in him. I can feel it.

    • Go and manually run anti virus software on every infected PC.

       

      • Re:Clearly he should be made to (Score:5, Informative)

        by Anpheus ( 908711 ) on Sunday April 12, 2009 @11:42AM (#27548893)

        Go and manually run anti virus software on every infected PC.

        Not that kind of worm. It was purely a scripting attack involving javascript. No one's computers were harmed, only a bunch of twitter accounts. (Which can no doubt be fixed by patching the whole and some good SQL query to fix all the accounts in one go.)

      • Re: (Score:2, Insightful)

        by FlyingBishop ( 1293238 )

        There are no infected PC's. The only thing 'infected' was people's twitter statuses, and now that the exploit was patched, there is no virus, since the code was executed by the server, not by the individual computer.

        This sounds pretty harmless.

        • Re: (Score:3, Interesting)

          by nneonneo ( 911150 )

          It was XSS; the idea is that an attacker puts his JavaScript code on a page belonging to someone else. When a victim views the page, their client executes the JavaScript.

          Now, in this case, we got lucky: this guy didn't try to exploit browser vulns or anything of the sort. What if, though, this thing had come to the attention of, say, a botnet operator? Combined with a browser vulnerability (the sort found at CanSecWest, for example), the botnet operator could easily have gotten several thousand more systems

    • Re: (Score:1, Interesting)

      by Anonymous Coward

      Those aren't mutually exclusive. Convict him in juve or even adult court, the damage was minimal so give him a suspended sentence plus probation. As part of his probation require him to continue his education &/or participate in legal work activities. As part of his sentence have him forfeit his domain name as the fruits of a criminal enterprise.

      However, remember one thing. This is the age where there are almost unlimited legal, productive outlets for young programmers and computer enthusiasts. Thi

    • Re:To hire or to jail, that is the question (Score:5, Insightful)

      by SuperNothing307 ( 1399851 ) on Sunday April 12, 2009 @12:08PM (#27549063) Homepage
      No offense, but having a good understanding of XSS attacks at 17 doesn't exactly equate to the mathematical and analytical abilities of Edward Dijkstra. I know I don't put myself anywhere near that level. In fact, I'd argue that the chances are well in favor of him doing something like this again, except worse, rather than his becoming someone who does something beneficial for the world. I mean, look at all the attention he has gotten for this. Imagine what would happen if he does something worse! Punish him now, make him understand the gravity of his actions.

    • Re:To hire or to jail, that is the question (Score:5, Insightful)

      by rs79 ( 71822 ) <hostmaster@open-rsc.org> on Sunday April 12, 2009 @01:19PM (#27549447) Homepage

      I say anything that slows down the spread of those fucking annoying twitter people is a good thing and he should be awarded a medal.

      Tweet this, bitch.

      • Re: (Score:1, Informative)

        by Anonymous Coward

        If you don't like the fucking annoying tweets, nobody is forcing you to read them. Just like slashdot.

        • Re: (Score:1)

          by Mozk ( 844858 )

          No, but essentially every television news station, talk show host, and even fucking sports sideline announcer is forcing me to hear about their new Twitter page and listen to them go on to ask "What is Twitter anyway?" while their colleagues joke that they don't know either.

      • Re: (Score:3, Funny)

        by moderatorrater ( 1095745 )
        RT: @rs79 "I say anything that slows down the spread of those fucking annoying twitter people is a good thing and he should be awarded a medal.

        Tweet this, bitch."
      • i can't, its over the character limit.

      • Re: (Score:1)

        by JSG ( 82708 )

        In English we have the verb "to twat" which may help you in your efforts to assist someone to "Tweet this, bitch".

        Why does FF insist on putting a red line under "twat" - its been in the language for at least 10 years ...

        • Re: (Score:1)

          by JSG ( 82708 )

          Sorry, I should probably point out that "twat" is not a past tense of "twit".

    • It takes a certain level of stupidity to "start a worm or something to give the developers an insight on the problem and while doing so, promoting myself or my website." His probation should require an ethics tutor.
    • It's "Edsger", isn't it?
    • There is still good in him. I can feel it. Correct, but we need to wait until after he blows up a planet with his giant laser before we'll be able to bring him back to the light side...

    • Re: (Score:2)

      by Quothz ( 683368 )

      So do we punish him and turn him to the Dark Side? Or do we show him love and respect and turn him?

      Ideally, a little from column A and a little from column B. Naturally he should be punished; as a society we cannot dare tolerate allowing this sort of thing. He didn't do too much damage; Twitter'll have t'spend a few bucks to undo his work, tho'.

      If I had my druthers, I'd leave prison time out of his sentence, but make him pay reparations to Twitter and a small fine, shut down his site, put him on probation, and give him a large pile of community service related to programming and/or web design.

  • Bit obvious (Score:5, Interesting)

    by Toe, The ( 545098 ) on Sunday April 12, 2009 @11:18AM (#27548751)
    Cool exploit, but worm-spamming your own public site is a bit, um, not well thought out. Or maybe it's a great way of getting a job. Depends on the legality of the worm, I suppose. :)

    • Re:Bit obvious (Score:5, Informative)

      by timholman ( 71886 ) on Sunday April 12, 2009 @11:46AM (#27548915)

      Cool exploit, but worm-spamming your own public site is a bit, um, not well thought out.

      Especially when you read the Terms of Service on Mr. Mooney's own StalkDaily website, e.g.:

      7. You must not modify, adapt or hack StalkDaily.com or modify another website so as to falsely imply that it is associated with StalkDaily.com.

      8 You must not create or submit unwanted email to any StalkDaily members ("Spam").

      9. You must not transmit any worms or viruses or any code of a destructive nature.

      Talk about having a "Do as I say, not as I do" morality. At least it's refreshing to see that hypocrisy is not restricted to people over 30.

      • Re: (Score:2, Insightful)

        by FlyingBishop ( 1293238 )

        Actually, we had a meeting where we agreed that ToS's are by nature BS. We didn't invite anyone over 30, so I don't know if you missed the memo or just weren't invited.

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        Don't worry. Twitter has millions in the bank, and lawyers to hand. This little shit will be sued into oblivion and be flipping your burgers.

        • Hopefully after he gets a very PAINFUL slap on the wrist for computer trespass.

          I really would like the feds/cops to nail him, even if he just gets a stern warning of some sort.

          He needs arrested and charged. What he did was a crime, and he needs to be taught to back off of people's computers, preferably before he turns into a legal adult and opens himself up to BIG trouble.

          • Please do RTFA.

            All he did was to exploit a Twitter XSS vulnerability - he didn't touch anything but their servers.

            • That's still hacking.

              Exploiters who take advantage of loopholes for their own gain should be punished.

              Had this student simply reported the incident to twitter, I'd think differently.

              Using it to promote his own site proves bad faith.

      • But he didn't hack StalkDaily.com, as his terms of service forbid! He hacked twitter.com. So he's doing just as he says. :)

      • ...worms or viruses or any code of a destructive nature.

        Is it a good worm, or a bad worm [youtube.com]? Only bad worms are destructive

    • It's great publicity for his site which is similar in functionality to Twitter. I guess his idea was that users of Twitter would try it out and eventually switch.

      Unfortunately the publicity also says 'I'm an unethical douchebag, (who knows what other shit I might pull)' so I imagine the take-up will be in negative numbers, if anything.

      Seems like a great way to shoot himself in the foot.

      Twitter's @oblique says "Honour thy error as a hidden intention". Good luck to Mr. Mooney in making that one work for him.

  • Re: (Score:2, Interesting)

    by account_deleted ( 4530225 )
    Comment removed based on user account deletion

    • Re: (Score:1, Interesting)

      by BadAnalogyGuy ( 945258 )

      Why should he be held responsible? The XSS is just plaintext code. It has no meaning unless someone executes it.

      If TPB can't be held responsible for simply providing links to illegal downloads, surely this kid shouldn't be held responsible for writing up some XML style sheets.

      • Re: (Score:2)

        by Teun ( 17872 )
        Ah yes TPB, but I feel you are now comparing a place with a civil justice system to a place with what often appears as a commercial justice system.

      • Re: (Score:2, Insightful)

        by disbroc ( 1260740 )

        Why should he be held responsible? The XSS is just plaintext code. It has no meaning unless someone executes it.

        Could the same not be argued about malicious/annoying scripting language code, or any interpreted code for that matter?

        If TPB can't be held responsible for simply providing links to illegal downloads, surely this kid shouldn't be held responsible for writing up some XML style sheets.

        Maybe its just me, but I think that depending on what country you are in the laws for what you are responsible for change quite a bit.

        • Could the same not be argued about malicious/annoying scripting language code, or any interpreted code for that matter?

          And binary code is just plain byte sequence.

      • Re: (Score:2, Informative)

        by Anonymous Coward

        Fuckwits... XSS = Cross Site Scripting, not XML Style Sheets.

      • Why should he be held responsible? The XSS is just plaintext code. It has no meaning unless someone executes it.

        Why should a person be held responsible for stabbing another person? A knife is just a piece of metal. It has no meaning unless someone uses it.

      • If TPB can't be held responsible for simply providing links to illegal downloads, surely this kid shouldn't be held responsible for writing up some XML style sheets.

        Yet again living up to your nick! ;)

        In this case surely the guy would also be those who upload illegal torrents to TPB, so I don't see how your defense applies.

  • Would you trust StalkDaily? (Score:5, Insightful)

    by Joao ( 155665 ) on Sunday April 12, 2009 @11:41AM (#27548885) Homepage

    Seriously, would you? The developer admits to infecting people's computers and accounts in order to advertise his services, and doesn't think he did anything wrong. How can anyone trust his services then?

    For starters he should be forced to take down StalkDaily. I'm sure Tweeter lawyers are looking into this right now. And for once, I agree with such a move. /not a tweeter user

    • Re:Would you trust StalkDaily? (Score:4, Insightful)

      by Anonymous Coward on Sunday April 12, 2009 @11:51AM (#27548955)

      Two issues with your post:
      One, the dev did not infect anyone's computers. He wrote a small program, on the site, that would update the profile of anybody who saw one of the spam comments. For example, you visit a friend's page who has one of these comments (and therefore the code) and your profile is updated with a comment (and the code). The only "infection" was on the site, not the end users. Also, no accounts were hacked. Simply a case of instructing the visitor's browser to slyly update the visitor's status while looking at a different page. TFA states that there were no passwords, usernames, or anything else in the code.
      Two, it's twitter.

      • Wait, exploiting software loopholes to circumvent authentication requirements and make changes to privileged (albeit pointless tatt) information is not "hacking" anymore? I must have missed that memo.

        Two, it's "twatter". :D

      • Re: (Score:2, Interesting)

        by memojuez ( 910304 )
        According to TFA, Two instances of Malware and one instance of the Seneka Root Kit

        A Malwarebytes scan comes up with three instances of malware. One is the Seneka rootkit (ouch!).

        Also according to the code and analysis posted on TFA showed that the script was ran on the client side, i.e. the user's computer, that exploited an XSS exploit on Twitter's website.

        I think that satisfies the definition of a Black-Hat Hack & Infecting users' PCs.

      • I tend to agree that Twitter is a waste of bandwidth. But that doesn't mean the offense should be taken any less seriously.

        To paraphrase:
        Then they came for the Twitters.
        I did not speak out;
        I was not a Twitter.
        ... and we all know how that ends.

        What if this had been inflicted against Slashdot? Everybody would be up in arms about it. You should defend Twitter as you would want others to defend any website which is meaningful to you.

    • not a tweeter user

      Obviously.

    • Seriously, would you? The developer admits to infecting people's computers and accounts in order to advertise his services, and doesn't think he did anything wrong. How can anyone trust his services then?

      For starters he should be forced to take down StalkDaily. I'm sure Tweeter lawyers are looking into this right now. And for once, I agree with such a move. /not a tweeter user

      Not only that, but by admitting to what he did he makes criminal prosecution easier. Not a very smart thing to do; plus now he will be forever linked to his act for any future employer to see.

  • I saw this. (Score:3, Interesting)

    by Aladrin ( 926209 ) on Sunday April 12, 2009 @11:49AM (#27548937)

    One of the Japanese people I followed suddenly tweeted a couple lines in English about StalkDaily and I was like 'wtf?' At least now I know it wasn't them.

  • way to go boy genius enjoy jail

  • Sounds Like A Publicity Stunt (Score:4, Insightful)

    by Dreadneck ( 982170 ) on Sunday April 12, 2009 @12:23PM (#27549137)

    FTA:

    StalkDaily.com is similar in design and features to Twitter. In addition to the features of Twitter, it also allows users to upload videos and photos. Through looking at the code behind Twitter, Mikeyy was able to produce a similar site to Twitter with some additional features. "I used my past knowledge to gain an insight on how Twitter worked and outputted to a user. Although both of the sites are coded in different languages I was able to give my site the same features as Twitter, while coding some of my own."

    It sounds to me like the kid was trying to promote his Twitter knockoff site, but for some reason felt the need to do so by poking a stick in Twitter's eye. Makes me think the whole thing was a juvenile cry for attention. I knew a kid like that in high school. He was smart as could be but would do anything, no matter how socially unacceptable, to get attention.

    I think the kid needs counseling and guidance and not a jail sentence.

    • FTA:

      I think the kid needs counseling and guidance and not a jail sentence.

      No, he needs counseling, guidance AND a jail sentence. The kid is 17, and you want to just TALK to him about how he FEELS about what he did...what bull$41t! And to all the "putting him jail will make him a hardcore criminal". PLEASE! Lets see some stats on that. Give him 180 days in JAIL (I.E. Not prison), and 5 years with no access to a computer/phone/etc.

  • Samy is my hero (Score:3, Insightful)

    by The Real Toad King ( 981874 ) <toadking@toadking.com> on Sunday April 12, 2009 @12:41PM (#27549235) Homepage
    This sounds almost exactly like the Samy worm [wikipedia.org] to me.

    • Re: (Score:2)

      by SnowZero ( 92219 )

      From Wikipedia:

      Samy Kamkar entered a plea agreement, on January 31, 2007, to a felony charge. The action resulted in Kamkar being sentenced to three years probation, 90 days community service and an undisclosed amount of restitution.

      It sounds like Mikeyy will get at least that much, and possibly much more; IIRC Samy had claimed that his virus was just supposed to be for his friends, while Mikeyy has already gone on record saying that he did it for commercial gain. That was a daft move, which he will realize as those words are trotted out over and over in his trial.

  • The XSS FAQ (Score:3, Informative)

    by mrkitty ( 584915 ) on Sunday April 12, 2009 @12:45PM (#27549249) Homepage
    The Cross-site Scripting FAQ http://www.cgisecurity.com/xss-faq.html [cgisecurity.com]
  • From the looks of TFS, this only caused people to tweet about StalkDaily, but didn't cause any substantial issues with Twitter itself. You can blame the kid for writing the script, but should you blame him for the dozens of idiots who clicked on an unknown link in hopes of gaining more followers (and a larger e-peen)?

  • I must admit that part of me smiled when I thought about how this might turn a few people off regarding Twitter. What an absurd waste of time and resources Tweeting is...

    <aside>If I ever have to have surgery, and I find out that the surgical team was tweeting during the procedure - I'm going to sue them for negligence. PAY ATTENTION TO YOUR JOB DAMMIT!!</aside>

    No, okay, he did something awful. Really. Yeah, he did. Any beneficial side effect wasn't by design.

    Maybe I'll buy him a beer after he ge

  • Spell Twitter (Score:4, Funny)

    by wfstanle ( 1188751 ) on Sunday April 12, 2009 @02:59PM (#27549941)

    Remember, you can't spell "Twitter" without using the word "twit".

  • I'm no virus expert but isn't this mis-use of the term "worm"? I thought worms (as a computer virus) was any virus that would back-door your system without any action on your part other than being on an unprotected machine that is on a network that features the worm. If you have to view an infected profile to get your twitter account infected that doesn't seem like a worm to me.
  • For many employers, a virus like StalkDaily is an additional reason to block Twitter [wordpress.com]. -Ben

    • For many employers, a virus like StalkDaily is an additional reason to block Twitter [wordpress.com]. -Ben

      For many IT professionals, a company that blocks Twitter, Facebook, MySpace or any other social media site is not who they would want to work for in the first place.

      Such a company does not want their employees to have a balanced life in and out of the work environment. (Sad when a typical usage might be a quick text message to verify after work plans, which is definitely faster and more efficient than multiple phone calls.) With companies attempting to race pay to the bottom in this economy, proficient I

Slashdot Top Deals

I tell them to turn to the study of mathematics, for it is only there that they might escape the lusts of the flesh. -- Thomas Mann, "The Magic Mountain"

Close