Twitter XSS flaw could allow hackers to take over
A bug found in Twitter’s API still hasn’t been fixed yet.
Twitter is vulnerable to a cross-site scripting flaw that could allow hackers to take control of accounts and steal information.
UK-based search engine optimisation (SEO) expert David Naylor found a bug that could allow anybody to change nofollow links produced by its Application Programming Interface (API).
Naylor said it could allow somebody with technical expertise to create a Twitter application and send malicious tweets with it.
He said that if another Twitter user as much as just saw one of these tweets and they were logged in, their account could be taken over.
Naylor outlined a number of worst-case scenarios, such as the running of code inside a user's browser, redirection to malicious websites, deletion of tweets, mass spam messaging, or the sending of login details to others who might want them.
Twitter was said to have fixed the problem, but in a later blog post Naylor claimed that Twitter "missed the point", and that the vulnerability was still open.
In May, security researcher Aviv Raff warned that even if Twitter's API hired the best security engineer to fix flaws, its API would always be the weakest link.
Get the ITPro. daily newsletter
Receive our latest news, industry updates, featured resources and more. Sign up today to receive our FREE report on AI cyber crime & security - newly updated for 2024.
Twitter has not replied to an IT PRO request to reveal whether or not it has fixed the problem.
Nearly half of all digital initiatives still fail – here’s how you can learn from the ‘digital vanguard’ and deliver success
Want developers to build secure software? You need to ditch these two programming languages
Sundar Pichai says more than 25% of Google's code is now generated by AI – and it's a big glimpse into the future of software development