Month Of Twitter Bugs - TwitSnaps XSS

Sunday, July 5, 2009 MoTB 05: Reflected XSS in TwitSnaps What is TwitSnaps "We tweet your photos, that's what we do! You want to share your photographs on Twitter? TwitSnaps is at your service." TwitSnaps about page Twitter affect TwitSnaps can be used to send tweets by uploading new photos, or...

Month Of Twitter Bugs - Twitterfall XSS

Wednesday, July 8, 2009 MoTB 08: DOM Based XSS in Twitterfall What is Twitterfall "Twitterfall is a way of viewing the latest 'tweets' of upcoming trends and custom searches on the micro-blogging site Twitter. Updates fall from the top of the page in near-realtime.." Twitterfall home page Twitter...

Month Of Twitter Bugs - yfrog XSS

Tuesday, July 7, 2009 MoTB 07: Reflected XSS vulns in yfrog What is yfrog "yfrog is a service run by ImageShack that lets you share your photos on and videos on Twitter." yfrog FAQ page Twitter affect yfrog can be used to send tweets by uploading new photos, or posting comments on existing photos...

High-Profile Twitter Hack Spreads Mac, Windows Trojan

From IDG News Service Robert McMillan Former Apple Macintosh evangelist Guy Kawasaki posts Twitter messages about a lot of different thing, but the message he put up Tuesday was really out of character: “Leighton Meester sex tape video free download!” His message included a link that, after some...

Fake Twitter Invites Spread Worm

From MediaPost Laurie Sullivan A wave of fake Twitter email invitations sent in hopes of luring people to unzip a file to find out who invited them has been hitting unsuspecting victims. The message carries a mass-mailing worm. It looks around on infected computers and sends emails to addresses i...

Month of Twitter Bugs Coming in July

A security researcher who specializes in browser and Web 2.0 vulnerabilities plans to use the month of July to expose serious vulnerabilities in the Twitter ecosystem. The Month of Twitter Bugs, a project which launches on July 1, is the handiwork of Aviv Raff. It will disclose a combination of...

Cybercriminals hijack Twitter trending topics to serve malware

From ZDNet Dancho Danchev A currently ongoing malware attack across Twitter is abusing the momentum offered by Twitter’s trending topics in order to trick users into visiting bogus exclusive video sites and infect them with malware. The campaign, spreading since last week, is relying on a growing...

Threatpost News Wrap #2: Drive-by malware, Twitter attacks

Threatpost editors Ryan Naraine and Dennis Fisher look at the latest security news headlines and dig deeper into the latest wave of drive-by download infections and scareware attacks on Twitter. Download SHOW NOTES Cybercriminals hijack Twitter trending topics to serve malware Subscribe to the Ne...

The Twitter worm that isn't

By Roel Schouwenberg On Saturday an alert went out about a new Twitter worm. Could this have been another XSS-Worm? Upon clicking the link users would see the following: However that’s not all that happens. Covertly a connection is made to another server that will result in a malicious PDF being...

Twitter API ripe for malware, worm abuse

A security researcher is warning that the Twitter API can be trivially abused by hackers to launch worm attacks. The red-hot social networking/microblogging service has been scrambling to plug cross-site scripting and other Web site vulnerabilities to thwart worm attacks but, as researcher Aviv...

Security alert: Twitter porn names scam

From PC World Aurora Dizon The “Twitter porn names” game, currently Twitter’s top trending topic, may be a fun distraction that gives you and your friends something to tweet about. But it also has a security hole–one that is no technical snafu. It could be simple human error, but it’s also possib...

MiniTwitter 0.2b Remote User Options Changer Exploit

No description provided by source. !-- || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ¡PROUD TO BE SPANISH! ---------...

MiniTwitter 0.2b - Remote User Options Changer

|| || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ¡PROUD TO BE SPANISH! ---------------------------------------------------------------------------------------------- | USER OPTIONS...

French hacker gains access to Twitter's admin panel

From ZDNet Dancho Danchev Yesterday, a French hacker claimed to have gained access to Twitter’s administration panel, and based on the screen shots that he included featuring internal data zataz.com for accounts belonging to U.S President Barack Obama, Britney Spears, Ashton Kutcher, and Lily...

Twitter searching for software security personnel

From ZDNet Zero Day Now that Oprah’s all a twitter, it looks like everyone’s favorite micro-blogging tool is finally taking a hard look at security. According to a job listing posted online, Twitter is searching for software engineers to focus specifically on application and infrastructure...

Unrestricted file upload

Unrestricted file upload vulnerability in index.php in the Twitter Clone TClone plugin for ReVou Micro Blogging allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in settings/myphoto...

CVE-2008-6752

adminlogin/password.php in the Twitter Clone TClone plugin for ReVou Micro Blogging does not verify the original password before changing passwords, which allows remote attackers to change the administrator's password and gain privileges via a direct request with modified newpass1 and newpass2...

CVE-2008-6751

CVE-2008-6751 documents an unrestricted file upload in index.php of the Twitter Clone (TClone) plugin for ReVou Micro Blogging. A remote attacker can upload a file with an executable extension and access it via settings/my_photo, enabling arbitrary code execution. NVD assigns a base score of 6.8 ...

What's on the cover of that Verizon breach report?

Psst! Psst! Ryan here. Did you notice that all the text on the cover of Verizon’s 2009 data breach report pdf is selectable? A little birdie tells me that’s no coincidence. Encrypted message, etc. Even better, the report contains some obvious clues to decrypt. And something about cash prizes for...

Economy, SMB security to dominate at RSA Conference

As a security show, the RSA Conference leaves a lot to be desired. Its technical sessions carry an uncomfortable load of marketing baggage and don’t have either the cachet or entertaining edge of those at Black Hat or CanSecWest. Anyone will tell you that the real business of RSA is happening off...