Twitter accounts were open to highjack via CSRF flaw

By

Attackers could read direct messages, post tweets.

Twitter has fixed a bug that allowed users to tweet from any account and read direct messages.

Twitter accounts were open to highjack via CSRF flaw

Attackers could add their phone numbers onto a victim's Twitter account and gain control of accounts because the social networking site failed to validate a security token.

Researcher Henry Hoggard (@henryhoggard) said it was possible because of a Cross-Site Request Forgery (CSRF) flaw which existed in Twitter's add a mobile device feature.

"Using this I could use all of the Twitter SMS features, including sending Tweets, sending messages and reading direct messages," Hoggard said in a blog post.

"To exploit this we create a CSRF page that will add the attackers mobile number and network to the victims account.

"Although the page does provide an authenticity token aimed at preventing CSRF, it does not seem to validate that the token is correct, and therefore, we can enter any value."

Hoggard posted proof of concept exploit code used to send the attacking request which he said could be disguised as a webpage which sent the request in the background.

The flaw was discovered, reported and fixed on Monday.

The researcher said users should run the Noscript or Notscript extensions to protect against CSRF.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Qantas contacted by "potential cyber criminal"

Qantas contacted by "potential cyber criminal"

SA Power Networks tackles IAM, cloud security under five-year strategy

SA Power Networks tackles IAM, cloud security under five-year strategy

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Log In

  |  Forgot your password?