Twitter XSS flaw could allow hackers to take over

A bug found in Twitter’s API still hasn’t been fixed yet.

Twitter is vulnerable to a cross-site scripting flaw that could allow hackers to take control of accounts and steal information.

UK-based search engine optimisation (SEO) expert David Naylor found a bug that could allow anybody to change nofollow links produced by its Application Programming Interface (API).

Naylor said it could allow somebody with technical expertise to create a Twitter application and send malicious tweets with it.

Advertisement - Article continues below

He said that if another Twitter user as much as just saw one of these tweets and they were logged in, their account could be taken over.

Naylor outlined a number of worst-case scenarios, such as the running of code inside a user's browser, redirection to malicious websites, deletion of tweets, mass spam messaging, or the sending of login details to others who might want them.

Twitter was said to have fixed the problem, but in a later blog post Naylor claimed that Twitter "missed the point", and that the vulnerability was still open.

In May, security researcher Aviv Raff warned that even if Twitter's API hired the best security engineer to fix flaws, its API would always be the weakest link.

Twitter has not replied to an IT PRO request to reveal whether or not it has fixed the problem.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now
Advertisement

Recommended

Visit/business/policy-legislation/355954/tech-group-challenges-president-trumps-social-media-executive
Policy & legislation

Tech group challenges President Trump's social media executive

5 Jun 2020
Visit/marketing-comms/social-media/355950/twitter-disables-trump-tweet-due-to-copyright-issues
social media

Twitter disables Trump tweet due to copyright issues

5 Jun 2020
Visit/marketing-comms/social-media/355907/twitter-taps-ex-google-cfo-pichette-as-board-chairman
social media

Twitter taps ex-Google CFO Pichette as board chairman

3 Jun 2020
Visit/mobile/mobile-security/355889/parachute-introduces-superlock-feature
mobile security

Parachute's Superlock feature keeps your phone recording in an emergency

2 Jun 2020

Most Popular

Visit/operating-systems/ios/355935/apple-confirms-serious-bugs-in-ios-135
iOS

Apple confirms serious bugs in iOS 13.5

4 Jun 2020
Visit/mobile/5g/355911/the-uk-pivots-to-japan-for-5g-equipment
5G

The UK looks to Japan and South Korea for 5G equipment

4 Jun 2020
Visit/security/ransomware/355945/new-ransomware-uses-java-to-target-software-organisations
ransomware

Tycoon ransomware discovered using Java image files to target software firms

5 Jun 2020