A potentially critical cross-site scripting vulnerability in Twitter has still not been fixed, according to the researcher who discovered the problem.
Search marketing professional James Slater claimed that the vulnerability in the popular micro-blogging site could allow hackers to insert malicious JavaScript into tweets.
"With a few minutes' work, someone with a bit of technical expertise could make a Twitter 'application' and start sending tweets with it," he wrote in a blog post.
"Using the simple instructions below, it can be arranged so that if another Twitter user so much as sees one of these tweets - and they are logged in to Twitter - their account could be taken over."
Despite Twitter promising to fix the problem after being notified by Naylor on Tuesday, the firm's IT team has "completely missed the point", he wrote.
"This isn't the first time we've found vulnerabilities in Twitter. I wonder how many more there are out there?" he added.
"We got no response from them yesterday either, which is a shame. We don't want to stop using their service because we're worried about security, and I'm sure we're not the only ones."
Twitter has yet to officially respond to the news, although many of the comments left on Naylor's blog posting point to the flaw being a "rookie error".
Twitter cross-site scripting flaw 'still not fixed'
By
Phil Muncaster
on
Aug 28, 2009 6:01AM

Completely misses the point.
Got a news tip for our journalists? Share it with us anonymously here.
Sponsored Whitepapers
Planning before the breach: You can’t protect what you can’t see
Beyond FTP: Securing and Managing File Transfers
NextGen Security Operations: A Roadmap for the Future

Video: Watch Juniper talk about its Aston Martin partnership
Don’t pay the ransom: A three-step guide to ransomware protection