Second Twitter XSS Attack in 24 Hours

Almost 24 hours after the first XSS attack on Twitter, that resulted in thousands of tweets linking to an infected site, Twitter.com is under attack again. This new threat comes only hours after Twitter announced that it had closed a security vulnerability that had allowed the so-called, "StalkDaily" worm to spread through a script injection into user's profiles.

StalkDaily had earlier stated on their website that it had nothing to do with the attacks:

For everyone wondering, I did NOT promote and/or was involved with the spamming ON Twitter. All bad things you are hearing about this site is not true. Please reconsider as I am not the person who did this…StalkDaily is a website that follows the same functions as Twitter, except more advanced How? Well, instead of just adding an “update status”, people can add pictures and videos. Then you can stalk them, so when they upload a video or picture, or comment someone, you’ll know!

Later, an admission was reportedly made that Mikeyy Mooney, the 17-year-old owner of the StalkDaily site was responsible.
UPDATE: The site now shows an admission that he is the culprit.

And, now he is back!

This time, tweets are being sent out with the word, Mikeyy, or Mickeyy and have a twist - the tweets are disguised as warnings and include messages such as:
"Wow...Mikeyy."
"Man, Twitter can't fix shit. Mikeyy owns. :)"
"Dude! Mikeyy! Seriously? Haha. ;)"
"Dude, Mikeyy is the shit! :)"
"damn mikeyy. haha."
"Twitter should really fix this..."
"Mikeyy I am done..."
"Mikeyy is done.."
"Twitter please fix this, regards Mikeyy"

This time, however, the script is injecting obfuscated code into the Twitter profile CSS. As with the StalkDaily XSS injection, user profiles are being altered and anyone visiting an infected profile while logged on is finding their own profile infected.

Zymic, which was hosting the original script, has closed down the mikeyylolz.uuuq.com site for breach of its terms of service. You can go to it yourself to check if you like, but I'm not including a link to Zymic here - it is a free hosting service that has hosted a lot of hackers and scammers.

Clearly, Twitter has a major problem on its hands. However, the biggest problem is the viral nature of social networking itself. The Mikeyy/Mickeyy code was injected and sent out tweets, but Twitter users, by hitting the panic button and retweeting the worm's messages just compounded the problem. If you receive a tweet with the word Mickeyy or Mikeyy the best thing to do is ignore it. Twitter is aware of the problem and is apparently working on it. RT'ing is only building this jerks notoriety and ensuring his name won't be forgotten in a hurry.

If your profile has been infected, fix it by following these steps:

• Clear your browser cache and delete all cookies;
• Login to Twitter;
• Change your password;
• Delete any tweets made on your account that contain the Mikeyy or Mickeyy name;
• Look at all of your settings fields - name, URL, etc and if you find any script in these fields, delete completely and re-enter your information;
• Log out and do not login to twitter.com again until Twitter announces that this script has been taken care of.
  The Mikeyy script is in the CSS, and this is not editable by Twitter users. From initial reports, staying logged out keeps the account clear of script activity. Logging on and using Twitter through an external client does not trigger reactivation of the script.

In my earlier article StalkDaily Twitter XSS - Lessons Learned, I outlined things you can do to protect yourself against these types of XSS attacks. It's up to Twitter to secure their site, but its up to tweeters to minimise the damage such attacks can do. So far, we have been lucky that the attack has only been targeted at inconveniencing Twitter (and bringing fame to its creators) - next time, we could find ourselves being targeted.

UPDATE:

The worm is mutating so please be very careful when you login to Twitter! These JavaScript-based cross-site scripting injections are appearing on hacker sites and the vulnerabilities they are exploiting have been in the wild for several weeks (see: TheRegister). So far, accounts have not been damaged (although nobody yet knows how much personal information could end up being compromised) but Michael Mooney has said profile backgrounds will be removed next.

F-Secure has published information about these worms and said:

This is not over. There's going to be quite a few modified Twitter worms for a day or two. Be careful in Twitter, don't view profiles, don't follow links. It's beautiful outside, maybe go for a walk instead?

If you see tweets saying this is over and it's safe to visit profiles again, don't believe them until you have checked the Twitter status page for confirmation that Twitter is clean of infection.

If you enjoyed this post, make sure you subscribe to my RSS feed!