Twitter XSS flaw could allow hackers to take over
A bug found in Twitter’s API still hasn’t been fixed yet.
UK-based search engine optimisation (SEO) expert David Naylor found a bug that could allow anybody to change nofollow links produced by its Application Programming Interface (API).
Naylor said it could allow somebody with technical expertise to create a Twitter application and send malicious tweets with it.
He said that if another Twitter user as much as just saw one of these tweets and they were logged in, their account could be taken over.
Naylor outlined a number of worst-case scenarios, such as the running of code inside a user's browser, redirection to malicious websites, deletion of tweets, mass spam messaging, or the sending of login details to others who might want them.
Twitter was said to have fixed the problem, but in a later blog post Naylor claimed that Twitter "missed the point", and that the vulnerability was still open.
In May, security researcher Aviv Raff warned that even if Twitter's API hired the best security engineer to fix flaws, its API would always be the weakest link.
Twitter has not replied to an IT PRO request to reveal whether or not it has fixed the problem.
The case for a marketing content hub
Transform your digital marketing to deliver customer expectationsDownload now
Fast, flexible and compliant e-signatures for global businesses
Be at the forefront of digital transformation with electronic signaturesDownload now
Why CEOS should care about the move to SAP S/4HANA
And how they can accelerate business valueDownload now
IT faces new security challenges in the wake of COVID-19
Beat the crisis by learning how to secure your networkDownload now