Twitter fixes cross-site scripting vulnerability

By

Exploit stole a user's cookie to distribute compromised links.

Twitter has fixed a cross-site scripting (XSS) vulnerability that stole a user's cookie to distribute compromised links.

It was detected by Stefan Tanase, senior security researcher at Kaspersky Lab. He said that the exploit steals the cookie of the Twitter user, which is transferred to two specific servers, and essentially any account that clicked on the malicious links is compromised.

He said that the bit.ly statistics for one of the malicious links show that more than 100,000 users clicked on the link.

“All clues point to Brazil as the originating country for this attack. First, the two domain names used to get the stolen cookies are registered under Brazilian names. More than that, one of them is actually also hosted in Brazil,” he said.

One of the links was a short tweet in Portuguese about the Brazilian pop band Restart, reportedly suffering a 'tragic accident'. Tanase said there is not much doubt about the origins of this attack.

The malicious scripts were detected by Kaspersky Lab as Exploit.JS.Twetti.a, and it has blacklisted the URLs used in this attack.

Tanase said: “We are currently working on taking down the malicious URLs and minimising the damage as much as possible. Twitter along with other significant industry peers has of course been notified.”

Twitter commented that the vulnerability is now fixed.

See original article on scmagazineus.com


Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

Log In

  |  Forgot your password?