On the Twitter DDoS Attacks, Apple and Microsoft Patches

Threatpost editors Ryan Naraine and Dennis Fisher discuss the DDoS attacks against Twitter, Facebook and LiveJournal and delve into Apple’s Mac OS X patch and Microsoft’s Patch Tuesday plans. SHOW NOTES: UPDATE: Twitter Suffers DoS Attack Apple Warns of Mac Attack Risk via Image Files Microsoft...

UPDATE: Twitter Suffers DoS Attack

Twitter was the target of a sustained denial-of-service attack Thursday morning, an attack that took the site offline for several hours. Twitter’s service went down around 9 a.m. EDT and was back up around noon, while Facebook’s site also experienced problems that may have been the result of a Do...

Confidential Twitter Data Exposed in Attack

From Bits Claire Cain Miller and Brad Stone Twitter, which is generally quite private about its business plans, has fallen prey to an attack by a hacker who has apparently exposed confidential corporate information. The hacker claims to have private documents including confidential contracts with...

Month Of Twitter Bugs - TweetGrid XSS

Sunday, July 12, 2009 MoTB 12: Reflected XSS in TweetGrid What is TweetGrid "TweetGrid is a powerful Twitter Search Dashboard that allows you to search for up to 9 different topics, events, converstations, hashtags, phrases, people, groups, etc in real-time. As new tweets are created, they are...

Month Of Twitter Bugs - Twitiq XSRF/XSS

Friday, July 10, 2009 MoTB 10: CSRF+XSS vulnerabilities in Twitiq What is Twitiq "TwitIQ is an enhanced Twitter interface that provides insight into your Twitter stream and Twitter followers." Twitiq home page Twitter effect Twitiq can be used to send tweets, direct messages and follow/unfollow...

Month Of Twitter Bugs - TweetMeme XSS

Tuesday, July 14, 2009 MoTB 14: Reflected XSS in TweetMeme What is TweetMeme "TweetMeme is a service which aggregates all the popular links on twitter to determine which links are popular. TweetMeme is able to categorize these links into categories and subcategories, making it easy to filter out...

Month Of Twitter Bugs - Brightkite XSS

Monday, July 13, 2009 MoTB 13: Reflected XSS in Brightkite What is Brightkite "Brightkite is a location-based social network. In real time you can see where your friends are and what they're up to. Depending on your privacy settings you can also meet others nearby." Brightkite home page Twitter...

Twitter Suspends Accounts of Users With Infected Computers

From IDG News Service Jeremy Kirk Twitter is suspending the accounts of some users whose computers have fallen victim to a well-known piece of malicious software that has targeted other sites such as Facebook and MySpace. The malware, Koobface, is designed to spread itself by checking to see if...

Month Of Twitter Bugs - yfrog XSS

Tuesday, July 7, 2009 MoTB 07: Reflected XSS vulns in yfrog What is yfrog "yfrog is a service run by ImageShack that lets you share your photos on and videos on Twitter." yfrog FAQ page Twitter affect yfrog can be used to send tweets by uploading new photos, or posting comments on existing photos...

Month Of Twitter Bugs - HootSuite XSS

Thursday, July 2, 2009 MoTB 02: Reflected XSS in HootSuite What is HootSuite "HootSuite is the ultimate Twitter toolbox. With HootSuite, you can manage multiple Twitter profiles, add multiple editors, pre-schedule tweets, and measure your success. HootSuite lets you manage your entire Twitter...

Month Of Twitter Bugs - Twitterfall XSS

Wednesday, July 8, 2009 MoTB 08: DOM Based XSS in Twitterfall What is Twitterfall "Twitterfall is a way of viewing the latest 'tweets' of upcoming trends and custom searches on the micro-blogging site Twitter. Updates fall from the top of the page in near-realtime.." Twitterfall home page Twitter...

Month Of Twitter Bugs - bit.ly XSS

Wednesday, July 1, 2009 MoTB 01: Multiple vulnerabilities in bit.ly service What is bit.ly "bit.ly allows users to shorten, share, and track links URLs. Reducing the URL length makes sharing easier. bit.ly can be accessed through our website, bookmarklets and a robust and open API. bit.ly is also...

Month Of Twitter Bugs - TwitSnaps XSS

Sunday, July 5, 2009 MoTB 05: Reflected XSS in TwitSnaps What is TwitSnaps "We tweet your photos, that's what we do! You want to share your photographs on Twitter? TwitSnaps is at your service." TwitSnaps about page Twitter affect TwitSnaps can be used to send tweets by uploading new photos, or...

High-Profile Twitter Hack Spreads Mac, Windows Trojan

From IDG News Service Robert McMillan Former Apple Macintosh evangelist Guy Kawasaki posts Twitter messages about a lot of different thing, but the message he put up Tuesday was really out of character: “Leighton Meester sex tape video free download!” His message included a link that, after some...

Fake Twitter Invites Spread Worm

From MediaPost Laurie Sullivan A wave of fake Twitter email invitations sent in hopes of luring people to unzip a file to find out who invited them has been hitting unsuspecting victims. The message carries a mass-mailing worm. It looks around on infected computers and sends emails to addresses i...

Month of Twitter Bugs Coming in July

A security researcher who specializes in browser and Web 2.0 vulnerabilities plans to use the month of July to expose serious vulnerabilities in the Twitter ecosystem. The Month of Twitter Bugs, a project which launches on July 1, is the handiwork of Aviv Raff. It will disclose a combination of...

Cybercriminals hijack Twitter trending topics to serve malware

From ZDNet Dancho Danchev A currently ongoing malware attack across Twitter is abusing the momentum offered by Twitter’s trending topics in order to trick users into visiting bogus exclusive video sites and infect them with malware. The campaign, spreading since last week, is relying on a growing...

Threatpost News Wrap #2: Drive-by malware, Twitter attacks

Threatpost editors Ryan Naraine and Dennis Fisher look at the latest security news headlines and dig deeper into the latest wave of drive-by download infections and scareware attacks on Twitter. Download SHOW NOTES Cybercriminals hijack Twitter trending topics to serve malware Subscribe to the Ne...

The Twitter worm that isn't

By Roel Schouwenberg On Saturday an alert went out about a new Twitter worm. Could this have been another XSS-Worm? Upon clicking the link users would see the following: However that’s not all that happens. Covertly a connection is made to another server that will result in a malicious PDF being...

Twitter API ripe for malware, worm abuse

A security researcher is warning that the Twitter API can be trivially abused by hackers to launch worm attacks. The red-hot social networking/microblogging service has been scrambling to plug cross-site scripting and other Web site vulnerabilities to thwart worm attacks but, as researcher Aviv...