Twitter gets its worm four times

Stan Beer
Tuesday, 14 April 2009 09:23

Business IT - Technology

The early bird gets its worm took on a whole new meaning over the weekend as the popular social networking site Twitter received four separate attacks with malware that compromised about 100 user accounts. A number of sources are attributing the attacks to a 17 year old US hacker.

On his Twitter blog, the social networking site's co-founder Biz Stone said malware similar to the infamous Samy worm that hit MySpace in 2005 attacked in four waves.

The first wave hit at 2AM on Saturday, compromising "about 90 accounts". That kept the Twitter team busy until 11AM.

"Later in the afternoon, a second wave of the worm hit Twitter and this time it was much more intense. We got back to work and the situation was contained. About 100 accounts were compromised. Again, we identified and secured the accounts. We also identified and deleted malicious content that could work to further spread the worm," said Biz Stone.

The first two attacks were followed by another two on Sunday morning and Sunday night.

"Again, we secured the accounts that had been compromised and removed any content that might help spread the worm. All told, we identified and deleted almost 10,000 tweets that could have continued to spread the worm," said Biz Stone.

A 17 year old hacker name Michael Mooney has reportedly taken "credit" for the attack saying that he created the worm because he was bored and wanted to draw attention to his website. Mooney reportedly used an XSS (cross site scripting) vulnerability in Twitter to inject the worm

Mooney was also reported as saying his intention was not to cause too much damage but to give developers an insight into the problems they faced and to promote himself. He also is reported to have said that he realises that he may get arrested for his activity.

As far as Twitter and its management is concerned, criminal prosecution may well be on the cards.

Referring to the MySpace Samy case, Biz Stone reminded readers on his blog that MySpace filed a lawsuit against the virus creator which resulted in a felony charge and sentencing.

"Twitter takes security very seriously and we will be following up on all fronts," Biz Stone said.