Twitter accounts were open to highjack via CSRF flaw

Twitter has fixed a bug that allowed users to tweet from any account and read direct messages.

Attackers could add their phone numbers onto a victim's Twitter account and gain control of accounts because the social networking site failed to validate a security token.

Researcher Henry Hoggard (@henryhoggard) said it was possible because of a Cross-Site Request Forgery (CSRF) flaw which existed in Twitter's add a mobile device feature.

"Using this I could use all of the Twitter SMS features, including sending Tweets, sending messages and reading direct messages," Hoggard said in a blog post.

"To exploit this we create a CSRF page that will add the attackers mobile number and network to the victims account.

"Although the page does provide an authenticity token aimed at preventing CSRF, it does not seem to validate that the token is correct, and therefore, we can enter any value."

Hoggard posted proof of concept exploit code used to send the attacking request which he said could be disguised as a webpage which sent the request in the background.

The flaw was discovered, reported and fixed on Monday.

The researcher said users should run the Noscript or Notscript extensions to protect against CSRF.

Copyright © SC Magazine, Australia