Yesterday, James Slater with SEO specialist firm Dave Naylor uncovered a security hole on popular micro-blogging service Twitter that could allow accounts and user details to be stolen and even allow for the installation of malware. Twitter claims to have closed it, but Slater says in an update today that a vulnerability still exists.
Slater explains why users should care:
With a few minutes work, someone with a bit of technical expertise could make a Twitter 'application' and start sending tweets with it. Using the simple instructions below, it can be arranged so that if another Twitter user so much as sees one of these tweets - and they are logged in to Twitter - their account could be taken over.
The vulnerability uses a cross-site scripting vulnerability, which means that malicious code is inserted into a hyperlink. The attacker encodes the URL in such a way that it looks less suspicious to web users.
Twitter claims to have fixed the problem, and they have suspended the account Slater created to demonstrate the exploit. However, their fix hasn't completely closed the security hole.
In the meantime, Slater gives users a few easy tips on how to protect themselves until Twitter fully fixes the security bug. One easy safety step is to use a third-party Twitter application or a posting plug-in like Twitterfox if you can't install applications on your work computer.
Twitter is coming in for criticism for not completely fixing the problem. Robin Wauters at TechCrunch says:
In my opinion, it's completely unacceptable that Twitter engineers never got in touch with Slater to learn more about the exploit and adequately fix the problem, which the SEO consultant correctly marks a shame. Instead, the startup's tech team apparently tried fixing it without really looking at the potential security issues.
In another Twitter annoyance, I commented on Apple's online store updating a few days ago and wondered out loud what new product was coming. It was, of course, an update to the Mac OS, code named Snow Leopard. Soon, I was getting lots of messages saying the same thing: "Snow Leopard maybe?". All of the accounts had saucy pictures of women. When I asked about this on Twitter, one of my followers, Louise Udall-Waring, said:
I nicknamed them Twitter Trollops because they are advertising porn or X rated sites!
I've received 50 or so of these messages. Spam is constant battle on the web, and in the past, I've seen spambots posting on trending topics. I only saw these messages when I was following a popular search term, but now I'm getting the messages sent to me. Hopefully, Twitter will fix this security hole and banish the Twitter Trollops to some corner of internet hell where they can frolic harmlessly with the Viagra spambots.
Burgess Powers makes web sites highly visible so people can easily find them