Month of Twitter Bugs focuses on Bit.ly flaws

By Robert Westervelt | Jul 2, 2009

0 comments [1]

Facebook [2]

LinkedIn [3]

Digg [5]

[6]

[7]

Thumbnail: 

A security researcher highlighting vulnerabilities in third-party Twitter applications this month focused on several serious cross-site scripting (XSS) flaws in the popular Bit.ly link-shortening service.

Aviv Raff launched the Month of Twitter Bugs [8] today, showcasing the Bit.ly errors. Raff gave notice to Bit.ly programmers and in less than three hours the final flaw was patched.

Bit.ly is one of the more popular URL-shortening services. Users who set up an account with the service can track their shortened links. The service is integrated with Firefox as well as several third-party Twitter organizer applications. In addition to Bit.ly, nearly a dozen other link-shortening services are available.

Raff highlighted XSS errors in the URL and keywords parameter and similar vulnerabilities in the username field of the Bit.ly login page and the content-type field of the URL info page. The flaws were discovered by security researchers Mike Bailey and Mario Heiderich. It took Bit.ly developers about a month to correct the errors, with the latest one patched today.

"With such a poor response rate to security vulnerabilities and with such a poorly coded website, in terms of security, we can only hope for the best," Raff wrote in his blog. "Please be careful clicking those shortened URLs." XSS errors enable an attacker to insert malicious coding into a link that appears to be from a trustworthy source. When someone clicks on the link, the embedded programming is submitted as part of the client's Web request and can execute on the user's computer, typically allowing the attacker to steal information. When Web forms contain XSS errors, attackers alter the HTML that controls the behavior of the form.

Link shortening services have come under increased scrutiny in recent months. A security breach in URL shortener Cligs (Cli.gs) last month redirected 2.2 million URLs to a single Web page. The Web page was not malicious, but it highlighted the threat posed by flaws in the link shortening services.

Raff announced in June that he planned to document Twitter related flaws. The security researcher documented browser flaws in a similar format in 2006. The latest project is being showcased on Raff's Twitpwn [8] website.

The bug tracking project is getting a lot of attention from security professionals who are dealing with an increased use of Twitter, Facebook and other Web-based social networking services.

Raff has been critical of Twitter and third-party services that rely on Twitter's API to connect to the Twitter platform. He said in a recent blog post that the API could be used as a springboard by attackers to create Twitter worms and spread malware to steal sensitive data from users.

The Month of Twitter Bugs is accepting submissions of vulnerabilities discovered by third-party Twitter services.

0 comments [1]

Facebook [2]

LinkedIn [3]

Digg [5]

[6]

[7]