Newsletters
News & Information for Technology Purchasers NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Enterprise I.T. Cloud Computing Applications Hardware More Topics...
Eliminate costly downtime!
Find out how with Free White Paper
& enter to win a Samsung Galaxy Note

www.apc.com
Cloud Computing
Tame your scariest paperwork. Find Out How
Average Rating:
Rate this article:  
Wormlike TweetDeck Hijack Speaks Volumes
Wormlike TweetDeck Hijack Speaks Volumes

By Jennifer LeClaire
June 12, 2014 1:00PM

    Bookmark and Share
Security researcher Chester Wisniewski said the TweetDeck incident shows how HTML was not intended to be an application programming language. Ajax and other code that has been layered onto it to make it capable of executing programs is a hack, and it is insanely easy to make a mistake that can be exploited, as happened with TweetDeck.
 



Twitter has managed to stay out of the hacking news this year -- until now. The micro-blogging platform plugged a security flaw in its TweetDeck application this week, but revelations about the fallout continue.

"We've temporarily taken TweetDeck services down to assess today's earlier security issue. We'll update when services are back up," was the message people read when they logged into the service during the breach. But that's nothing compared with this: TweetDeck's systems randomly re-tweeted messages that contained could-be malicious code.

It all started with a tweet of a heart symbol loaded with a string of code. A 19-year-old computer geek in Austria named Florian coded the heart symbol using "&hearts." Little did he know it would behave like a worm, spreading far and wide. Florian told CNN he was just experimenting when he realized the heart symbol opened a back door to TweetDeck's software.

Wasn't a Hack

"It wasn't a hack. It was some sort of accident," he told CNN. The problem was he shared that information with the world and it drove a mass TweetDeck hijacking. According to CNN, one message from Twitter user @derGeruhn was shared more than 37,000 times.

"A security issue that affected TweetDeck this morning has been fixed. Please log out of TweetDeck and log back in to fully apply the fix," Twitter tweeted after solving the problem.

Although Twitter fixed the code issue quickly, CNN said it was affected and The Telegraph is reporting that the hack also compromised the Twitter accounts of the BBC and the White House.

Florian, who declined to give his name to the media due to privacy concerns, refuses to take the blame: "It's a pity that many people believe that in some way I 'hacked' TweetDeck and shut it down. I was getting lots of hate messages. Why? Because I reported a serious security bug?"

Some Answers

We caught up with Chester Wisniewski, senior security adviser at Sophos, to get his take on whether or not Florian was irresponsible to disclose the code publicly and what this really says about online security. He told us Florian may have been somewhat irresponsible, and it says plenty about online security.

"It seems Florian's intent was entirely innocent and he didn't himself craft a worm. He claims to have notified Twitter as well," Wisniewski said. "The unknown variable is who shared the trick with the people who meant to cause harm. He could have been quieter about it, but he seems honest enough."

As far as online security, Wisniewski said this incident shows that HTML was not intended to be an application programming language. Ajax and other code that has been layered onto it to make it capable of executing programs is a massive hack, and it is insanely easy to make a mistake that can be exploited.

"Writing Web programs is incredibly complicated because it was never meant to be done," Wisniewski said. "As specifications move forward and mature, hopefully we will have a more solid and appropriate base to build upon now that we see the importance of 'cloud computing' to the future."
 

Tell Us What You Think
Comment:

Name:



APC has an established a reputation for solid products that virtually pay for themselves upon installation. Who has time to spend worrying about system downtime? APC makes it easy for you to focus on business growth instead of business downtime with reliable data center systems and IT solutions. Learn more here.


 Cloud Computing
1.   Oracle Updates Database, Linux Products
2.   Cloud Wars: AWS vs. Microsoft, IBM
3.   Yammer Moved to Office 365
4.   IBM, California Partner in the Cloud
5.   Dropbox for Business Boosts Security


advertisement
Amazon Intros Zocalo Storage Service
Online storage and sharing for business.
Average Rating:
Avaya Pressing Hard on Cloud-Based UC
Provides easier, faster provisioning.
Average Rating:
Cisco Woos More Devs with DevNet
To create new network-aware apps.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Tor Internet Privacy Service Warns Users It Was Breached
You may never have heard of the Tor Project, but the Internet privacy service is making headlines. Tor’s devs say users might be victims of an attack launched against the project earlier this year.
 
Canadian Government Charges China With Cyberattack
The government of Canada is not happy with China. Canadian officials have accused "a highly sophisticated Chinese state-sponsored actor" of launching a cyberattack on its National Research Council.
 
Researchers Working To Fix Tor Security Exploit
Developers for the Tor privacy browser are scrambling to fix a bug revealed Monday that researchers say could allow hackers, or government surveillance agencies, to track users online.
 

Enterprise Hardware Spotlight
Apple Updates MacBook Pros, Cuts Prices Up to $100
The popular MacBook Pro laptop line just got an update and a price cut of as much as $100. The MacBook Pro with Retina display now includes faster processors and double the memory.
 
Dell, BlackBerry Not Sweating Apple-IBM Alliance
IBM's recent move to partner with Apple to sell iPhones and iPads loaded with corporate applications has excited investors in both companies, but two rivals say they are unperturbed for now.
 
Watson Gets His First Customer Service Gig
Since appearing on Jeopardy, IBM's Watson supercomputer has been making a living using his super-intelligent knowledge base for business verticals. Now, Watson's been hired for his first customer service job.
 

Mobile Technology Spotlight
Virgin Mobile Offers Custom Smartphone Plans
As the wireless carrier wars continue heating up, Virgin Mobile just threw the customization coal onto the fire. The firm has debuted a no-annual-contract plan with rates based on individual use.
 
Collaboration Provider Asana Revamps Mobile App
Asana, a collaboration software provider started by a Facebook founder, is now out with a rebuilt native iOS mobile app. It replaces one that even the company admits was not up to par.
 
Facebook: You Will Use Messenger, and You Will Like It
Starting this week, Facebook users with Android and iOS phones will be forced to use the separate Messenger app to send Facebook messages. Pending messages will still be visible in the main app.
 

Navigation
NewsFactor Network
Home/Top News | Enterprise I.T. | Cloud Computing | Applications | Hardware | Mobile Tech | Big Data | Communications
World Wide Web | Network Security | Data Storage | CRM Systems | Microsoft/Windows | Apple/Mac | Linux/Open Source | Personal Tech
Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.