4 ms·

XSS in Tweetdeck (don't view in Tweetdeck...)

37 points by maaarghk 12y ago

hybridknight 12y ago
so fast
- maaarghk 12y ago
  Apparently it's fixed already http://thenextweb.com/twitter/2014/06/11/tweetdeck-users-xss-vulnerability-means-revoke-access-now/ http://thenextweb.com/twitter/2014/06/11/tweetdeck-users-xss...
  - ojii 12y ago
    Definitely not fixed here. Chrome on Linux, logged out and back in, closed and re-opened tab. Not fixed.
6thSigma 12y ago
A lot of people I follow must use Tweetdeck. This has been retweeted on my feed several times in the last few minutes.
- maaarghk 12y ago
  Somebody in my office got hit with it, that's how I found out.
basicallydan 12y ago
39,000 retweets and counting.
theboss 12y ago
What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention. <script>javascript</script> is the first payload you try when looking for the stupidest XSS you can find....
- guipsp 12y ago
  Has to do with the emoji support, I'm pretty sure.
- adambard 12y ago
  Apparently it was only activated if you included an emoticon (<3) in your tweet, possibly following the closing script tag.
  - ozh 12y ago
    Any UTF8 char actually 💩
- krapp 12y ago
  Some services will ignore security entirely at first, because it doesn't directly contribute to getting a viable product to market quickly (obviously, users will use an insecure site or app so long as they don't know how insecure it is). Then when the app becomes viable, they will continue to ignore security because it doesn't directly contribute to growth. Security becomes part of the nebulous "optimization" stage which is pushed somewhere down the road - and at some point the application becomes so complex that security isn't deemed worth the effort or the money. I'm not saying that's what happened here, and depending on the language and platform you're using, xss can be a difficult problem to solve. But it does seem to be a common trait to disregard security until you have to apologize for it.
adambard 12y ago
So apparently this was retweeted by @5SOS, a teen pop band with some 3 million followers, which is why most of the responses are confused teenagers. For some reason this is hilarious to me. Not the pinnacle of responsible disclosure, but no real harm done.
- yror10 12y ago
  Obviously their social media agent uses tweetdeck...
tarekmoz 12y ago
Security 101 ?
mrspeaker 12y ago
The replies to that tweet are beautiful. Sometimes you forget that not everyone in the world can recognize a cross-site scripting vulnerability when they see one!
k-mcgrady 12y ago
I guess the New York Times uses Tweetdeck[1]. I saw this because several people I follow had retweeted it and the Twitter app notifies you if several of your followers do the same thing. It's a useful feature. If Tweetdeck does the same thing it could make this spread really fast. [1] https://twitter.com/derGeruhn/status/476764918763749376 https://twitter.com/derGeruhn/status/476764918763749376
maaarghk 12y ago
Wonder if it's because of the emoji at the end? It's HEAVY BLACK HEART, U+2764, e29da4 in hex.
blackRust 12y ago
Looks like it might even be starting to loop around? The Guardian have already scurried an article about it [1]. [1] http://www.theguardian.com/technology/2014/jun/11/twitter-tweetdeck-xss-flaw-users-vulnerable http://www.theguardian.com/technology/2014/jun/11/twitter-tw...
DouweM 12y ago
I wonder if the poster of this "twitter worm" could get in legal trouble for this; it's quite similar to the Samy MySpace worm[1] of a decade ago, where the creator was charged with a felony (they plea bargained out). [1] https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm)
- nknighthb 12y ago
  Fortunately, the author appears to be German.
sp332 12y ago
Tweetdeck seems to be down now.
- ozh 12y ago
  It is: https://twitter.com/TweetDeck/statuses/476770732987252736 https://twitter.com/TweetDeck/statuses/476770732987252736 == "We've temporarily taken TweetDeck services down to assess today's earlier security issue. We'll update when services are back up."
zatkin 12y ago
"The most powerful Twitter tool for real-time tracking, organizing and engagement."
- michielvoo 12y ago
  So powerful, it even supports scripted tweets
rrss1122 12y ago
Someone's gonna get in trouble for using an eval in tweetdeck...

37 points by maaarghk 12y ago

hybridknight 12y ago

so fast

maaarghk 12y ago
Apparently it's fixed already http://thenextweb.com/twitter/2014/06/11/tweetdeck-users-xss-vulnerability-means-revoke-access-now/ http://thenextweb.com/twitter/2014/06/11/tweetdeck-users-xss...
- ojii 12y ago
  Definitely not fixed here. Chrome on Linux, logged out and back in, closed and re-opened tab. Not fixed.

6thSigma 12y ago

A lot of people I follow must use Tweetdeck. This has been retweeted on my feed several times in the last few minutes.

maaarghk 12y ago
Somebody in my office got hit with it, that's how I found out.

basicallydan 12y ago

39,000 retweets and counting.

theboss 12y ago

What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention. <script>javascript</script> is the first payload you try when looking for the stupidest XSS you can find....

guipsp 12y ago
Has to do with the emoji support, I'm pretty sure.
adambard 12y ago
Apparently it was only activated if you included an emoticon (<3) in your tweet, possibly following the closing script tag.
- ozh 12y ago
  Any UTF8 char actually 💩
krapp 12y ago
Some services will ignore security entirely at first, because it doesn't directly contribute to getting a viable product to market quickly (obviously, users will use an insecure site or app so long as they don't know how insecure it is). Then when the app becomes viable, they will continue to ignore security because it doesn't directly contribute to growth. Security becomes part of the nebulous "optimization" stage which is pushed somewhere down the road - and at some point the application becomes so complex that security isn't deemed worth the effort or the money. I'm not saying that's what happened here, and depending on the language and platform you're using, xss can be a difficult problem to solve. But it does seem to be a common trait to disregard security until you have to apologize for it.

adambard 12y ago

So apparently this was retweeted by @5SOS, a teen pop band with some 3 million followers, which is why most of the responses are confused teenagers. For some reason this is hilarious to me. Not the pinnacle of responsible disclosure, but no real harm done.

yror10 12y ago
Obviously their social media agent uses tweetdeck...

tarekmoz 12y ago

Security 101 ?

mrspeaker 12y ago

The replies to that tweet are beautiful. Sometimes you forget that not everyone in the world can recognize a cross-site scripting vulnerability when they see one!

k-mcgrady 12y ago

I guess the New York Times uses Tweetdeck[1]. I saw this because several people I follow had retweeted it and the Twitter app notifies you if several of your followers do the same thing. It's a useful feature. If Tweetdeck does the same thing it could make this spread really fast. [1] https://twitter.com/derGeruhn/status/476764918763749376 https://twitter.com/derGeruhn/status/476764918763749376

maaarghk 12y ago

Wonder if it's because of the emoji at the end? It's HEAVY BLACK HEART, U+2764, e29da4 in hex.

blackRust 12y ago

Looks like it might even be starting to loop around? The Guardian have already scurried an article about it [1]. [1] http://www.theguardian.com/technology/2014/jun/11/twitter-tweetdeck-xss-flaw-users-vulnerable http://www.theguardian.com/technology/2014/jun/11/twitter-tw...

DouweM 12y ago

I wonder if the poster of this "twitter worm" could get in legal trouble for this; it's quite similar to the Samy MySpace worm[1] of a decade ago, where the creator was charged with a felony (they plea bargained out). [1] https://en.wikipedia.org/wiki/Samy_(computer_worm) https://en.wikipedia.org/wiki/Samy_(computer_worm)

nknighthb 12y ago
Fortunately, the author appears to be German.

sp332 12y ago

Tweetdeck seems to be down now.

ozh 12y ago
It is: https://twitter.com/TweetDeck/statuses/476770732987252736 https://twitter.com/TweetDeck/statuses/476770732987252736 == "We've temporarily taken TweetDeck services down to assess today's earlier security issue. We'll update when services are back up."

zatkin 12y ago

"The most powerful Twitter tool for real-time tracking, organizing and engagement."

michielvoo 12y ago
So powerful, it even supports scripted tweets

rrss1122 12y ago

Someone's gonna get in trouble for using an eval in tweetdeck...