[AI] Twitter internet worm attack hits thousands
Adhimoolam Vetrivel Murugan
vadhimoolam at gmail.com
Wed Sep 22 16:55:07 EDT 2010
Lord Sugar was relieved not to have caused the Twitter 'hack bug'.
Sarah Brown and Lord Sugar were among thousands of Twitter users who
yesterday found themselves directing people to third-party sites,
including hardcore pornography, as the messaging website fell prey to
an "embarrassing" hacking attack discovered by a Japanese programmer
and then exploited by a number of others.
At one point more than 100,000 people on the service were estimated to
have been affected, while the owners – who are based on the US west
coast – were asleep.
Graham Cluley, a consultant with the online security company Sophos,
said a rogue code or worm spread throughout the service "like someone
had just thrown petrol on a fire".
The problem brought a renewed focus on the importance of Twitter,
which restricts users to 140-character tweets, and has more than 100
million users around the world.
With more and more organisations relying on the service to deliver
information and keep people in touch, the potential for a worm to
render it useless – or, worse, dangerous to use – echoed the problems
suffered by users of Microsoft's Windows operating system when the
ILOVEYOU worm spread through email and infected millions of computers
a decade ago.
The worm began spreading at 10.30am, but abruptly peaked at around
1.30pm, just as Sarah Brown, wife of the former prime minister Gordon
Brown, who has 1.1 million followers on the service, was hit by a
version which redirected anyone who hovered their mouse over the
infected tweet to a Japanese hardcore pornography site.
Because the worm worked on the web browser, any sort of computer could
be affected. Only users of Twitter's mobile site, and those who read
it through third-party applications such as Tweetdeck, Twhirl or
Twitter's own iPhone and Android apps, were unaffected because those
rendered the code ineffective.
The original discoverer of the weakness appears to have been a
Japanese developer called Masato Kinugawa, who says on his Twitter
feed that he reported it to Twitter on 14 August – and thenfound that
the new version of Twitter, launched on Tuesday last week, was also
vulnerable. Others soon picked the idea up and realised they could use
it to send messages, andremove people from Twitter entirely.
As developers and malicious hackers played with the weakness they also
discovered that they could make it activate as soon as someone logged
in to Twitter received an infected tweet on their page.
Richard Gaywood, a programmer and developer, watched the variants
spread: "Other versions were hacked around by users to have all sorts
of other effects, such as porn site redirects, rainbow text in their
tweets, and so forth. Some of them popped up dialogue boxes designed
to alarm the users, talking about accounts being disabled or passwords
stolen (they weren't, in either case)." He added: "It's not that
complex an attack at all either – rather embarrassing for Twitter that
they were caught out by this."
Once alerted to the problem, Twitter fixed it within 25 minutes – but
the reputational damage may take some time to repair.
That came as some relief to Lord Sugar. "Seems loads of people
effected [sic] by hack bug thought it was me who caused it phew !" he
wrote as the attack spread.
More information about the AccessIndia