Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
Cloud Computing
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
Wormlike TweetDeck Hijack Speaks Volumes

Wormlike TweetDeck Hijack Speaks Volumes
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

Security researcher Chester Wisniewski said the TweetDeck incident shows how HTML was not intended to be an application programming language. Ajax and other code that has been layered onto it to make it capable of executing programs is a hack, and it is insanely easy to make a mistake that can be exploited, as happened with TweetDeck.
 


Twitter has managed to stay out of the hacking news this year -- until now. The micro-blogging platform plugged a security flaw in its TweetDeck application this week, but revelations about the fallout continue.

"We've temporarily taken TweetDeck services down to assess today's earlier security issue. We'll update when services are back up," was the message people read when they logged into the service during the breach. But that's nothing compared with this: TweetDeck's systems randomly re-tweeted messages that contained could-be malicious code.

It all started with a tweet of a heart symbol loaded with a string of code. A 19-year-old computer geek in Austria named Florian coded the heart symbol using "&hearts." Little did he know it would behave like a worm, spreading far and wide. Florian told CNN he was just experimenting when he realized the heart symbol opened a back door to TweetDeck's software.

Wasn't a Hack

"It wasn't a hack. It was some sort of accident," he told CNN. The problem was he shared that information with the world and it drove a mass TweetDeck hijacking. According to CNN, one message from Twitter user @derGeruhn was shared more than 37,000 times.

"A security issue that affected TweetDeck this morning has been fixed. Please log out of TweetDeck and log back in to fully apply the fix," Twitter tweeted after solving the problem.

Although Twitter fixed the code issue quickly, CNN said it was affected and The Telegraph is reporting that the hack also compromised the Twitter accounts of the BBC and the White House.

Florian, who declined to give his name to the media due to privacy concerns, refuses to take the blame: "It's a pity that many people believe that in some way I 'hacked' TweetDeck and shut it down. I was getting lots of hate messages. Why? Because I reported a serious security bug?"

Some Answers

We caught up with Chester Wisniewski, senior security adviser at Sophos, to get his take on whether or not Florian was irresponsible to disclose the code publicly and what this really says about online security. He told us Florian may have been somewhat irresponsible, and it says plenty about online security.

"It seems Florian's intent was entirely innocent and he didn't himself craft a worm. He claims to have notified Twitter as well," Wisniewski said. "The unknown variable is who shared the trick with the people who meant to cause harm. He could have been quieter about it, but he seems honest enough."

As far as online security, Wisniewski said this incident shows that HTML was not intended to be an application programming language. Ajax and other code that has been layered onto it to make it capable of executing programs is a massive hack, and it is insanely easy to make a mistake that can be exploited.

"Writing Web programs is incredibly complicated because it was never meant to be done," Wisniewski said. "As specifications move forward and mature, hopefully we will have a more solid and appropriate base to build upon now that we see the importance of 'cloud computing' to the future."
 

Tell Us What You Think
Comment:

Name:



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Cloud Computing
1.   VMware Buys CloudVolumes' V-Apps
2.   Concerto 2200: Dedupe, Compression
3.   Office 365 Tailored for Attorneys
4.   Apple Opens China iCloud Data Center
5.   Samsung Buys SmartThings


advertisement
Concerto 2200: Dedupe, Compression
Firms save money by saving space.
Average Rating:
Samsung Buys SmartThings
To allow people, appliances to interact.
Average Rating:
Cisco Axes 6,000 Employees
Company is facing declining profits.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
UPS Stores in 24 States Hit by Data Breach
Big Brown has been breached. UPS said that about 105,000 customer transactions at 51 of its UPS Store locations in 24 states could have been compromised between January and August.
 
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Enterprise Hardware Spotlight
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 
Three New Lenovo PCs Aimed at Business Users
Businesses everywhere want computing solutions that do more for less money, and Lenovo has unveiled three new desktop PCs that offer solid computing at a budget-minded price.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Mobile Technology Spotlight
Google Glass Adds Voice Access to Phone Contacts
The latest update to Google Glass will let users access their top 20 phone contacts with voice commands alone. A user can then choose a phone call, Google hangouts, e-mail or text messaging.
 
Samsung, B&N Target Amazon with Nook Tablet
They've seen the enemy and it is Amazon. So Samsung and Barnes & Noble are teaming up to combat their common foe with a 7-inch tablet that blends Samsung’s tech, Nook’s content and e-reader platform.
 
Acer's New Desktop Box Rides the Chrome OS Wave
Filling out its Chrome OS line, Acer is following the introduction of a larger Chromebook line earlier this month with a new tiny $180 desktop Chromebox and also a smaller Chromebook.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.