Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
GET RECOGNIZED
Let an ISACA® certification elevate your career.
Register today and save
You are here: Home / Mobile Apps / TweetDeck Hijack Speaks Volumes
DDoS Protection Powered By Verisign
Wormlike TweetDeck Hijack Speaks Volumes
Wormlike TweetDeck Hijack Speaks Volumes
By Jennifer LeClaire / CRM Daily Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
JUNE
12
2014



Twitter has managed to stay out of the hacking news this year -- until now. The micro-blogging platform plugged a security flaw in its TweetDeck application this week, but revelations about the fallout continue.

"We've temporarily taken TweetDeck services down to assess today's earlier security issue. We'll update when services are back up," was the message people read when they logged into the service during the breach. But that's nothing compared with this: TweetDeck's systems randomly re-tweeted messages that contained could-be malicious code.

It all started with a tweet of a heart symbol loaded with a string of code. A 19-year-old computer geek in Austria named Florian coded the heart symbol using "&hearts." Little did he know it would behave like a worm, spreading far and wide. Florian told CNN he was just experimenting when he realized the heart symbol opened a back door to TweetDeck's software.

Wasn't a Hack

"It wasn't a hack. It was some sort of accident," he told CNN. The problem was he shared that information with the world and it drove a mass TweetDeck hijacking. According to CNN, one message from Twitter user @derGeruhn was shared more than 37,000 times.

"A security issue that affected TweetDeck this morning has been fixed. Please log out of TweetDeck and log back in to fully apply the fix," Twitter tweeted after solving the problem.

Although Twitter fixed the code issue quickly, CNN said it was affected and The Telegraph is reporting that the hack also compromised the Twitter accounts of the BBC and the White House.

Florian, who declined to give his name to the media due to privacy concerns, refuses to take the blame: "It's a pity that many people believe that in some way I 'hacked' TweetDeck and shut it down. I was getting lots of hate messages. Why? Because I reported a serious security bug?"

Some Answers

We caught up with Chester Wisniewski, senior security adviser at Sophos, to get his take on whether or not Florian was irresponsible to disclose the code publicly and what this really says about online security. He told us Florian may have been somewhat irresponsible, and it says plenty about online security.

"It seems Florian's intent was entirely innocent and he didn't himself craft a worm. He claims to have notified Twitter as well," Wisniewski said. "The unknown variable is who shared the trick with the people who meant to cause harm. He could have been quieter about it, but he seems honest enough."

As far as online security, Wisniewski said this incident shows that HTML was not intended to be an application programming language. Ajax and other code that has been layered onto it to make it capable of executing programs is a massive hack, and it is insanely easy to make a mistake that can be exploited.

"Writing Web programs is incredibly complicated because it was never meant to be done," Wisniewski said. "As specifications move forward and mature, hopefully we will have a more solid and appropriate base to build upon now that we see the importance of 'cloud computing' to the future."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY BE OF INTEREST
Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.
MORE IN MOBILE APPS
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Dairy Queen Latest Retailer To Report Hack
Known for its hot fries and soft-serve ice cream, Dairy Queen just made cyber history as the latest victim of a hack attack. The fast food chain said that customer data at some stores may be at risk.
 
Lessons from the JPMorgan Chase Cyberattack
JPMorgan Chase is investigating a likely cyberattack. The banking giant is cooperating with law enforcement, including the FBI, to understand what data hackers may have obtained.
 
Who Is the Hacker Group Lizard Squad?
Are they dangerous or just obnoxious? That’s what many are wondering about the hacker group Lizard Squad, which tweeted out a bomb threat that grounded a flight with a Sony exec aboard.
 

Enterprise Hardware Spotlight
Intel Intros Lightning-Fast PC Processors
Call it extreme. Intel just took the covers off its first-ever eight-core desktop processor, which is aimed at hardcore power users who expect more than the status quo from their computers.
 
HP Previews ProLiant Gen9 Data Center Servers
Because traditional data center and server architectures are “constraints” on businesses, HP is releasing new servers aimed at faster, simpler and more cost-effective delivery of computing services.
 
Apple Set To Release Largest iPad Ever
Tech giant Apple seems to have adopted the mantra “go big or go home.” The company is planning to introduce its largest iPad ever: a 12.9-inch behemoth that will dwarf its largest existing models.
 

Mobile Technology Spotlight
iWatch Watch: What Will Apple Ask Us To Wear?
There are still more questions than answers when it comes to details about the smart watch Apple seems poised to debut on Sept. 9. In fact, nobody seems completely sure that it will be a smart watch at all.
 
Samsung Maps Its Way with Nokia's 'Here' App for Galaxy Phones
Korean electronics giant Samsung has opted to license Here, Nokia’s mapping app -- formerly known as Nokia Maps -- for its Tizen-powered smart devices and Samsung Gear S wearable.
 
Google Successfully Tests Its Own Delivery Drone
While top technology companies are engaged in an "arms race" to develop drones that can quickly deliver goods to anyone anywhere, Google has revealed it successfully tested its own version.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.