What MouseOver exploit of Twitter?

1 ANSWERS

1. Guest952
   

   A "MouseOver" exploit occurred on 21 September 2010, when an XSS Worm became active on Twitter. When an account user held the mouse cursor over blacked out parts of a tweet, the worm within the script would automatically open links and re-post itself on the reader's account. The exploit was then re-used to post pop-up ads and links to pornographic sites. The origin is unclear but Pearce H. Delphin (known on Twitter as @zzap) and a Scandinavian developer, Magnus Holm, both claim to have modified the exploit of a user, possibly Masato Kinugawa, who was using it to create coloured Tweets. Kinugawa, a Japanese developer, reported the XSS vulnerability to Twitter on August 14. Later, when he found it was exploitable again, he created the account 'RainbowTwtr' and used it to post coloured messages.[105] Delphin says he exposed the security flaw by tweeting a JavaScript function for "onMouseOver", and Holm later created and posted the XSS Worm that automatically re-tweeted itself. Security firm Sophos reported the virus was spread by people doing it for "fun and games", but noted it could be exploited by cybercriminals. Twitter issued a statement on their status blog at 13:50 UTC that "The exploit is fully patched". Twitter representative Carolyn Penner said no charges would be pressed.

   Report (0) (0)  |   12 years, 9 month(s) ago