Flaw makes Twitter vulnerable to serious viral attack
Son of Samy? — Micro-blogging site Twitter suffers from a potentially devastating vulnerability that forces logged-in users to post messages of an attacker's choice simply by clicking on a link. — The XSS, or cross-site scripting …
Context & Ripple Effects
The flaw lands at the worst possible moment for Twitter's reputation: Nielsen data published the day before named it the fastest-growing U.S. member community site, with 1,382 percent year-over-year growth, and SXSW 2009 chatter had already flagged the service as saturating its core audience while bubbling up into mainstream media. The Register frames the bug by analogy to the Samy worm — the MySpace cross-site scripting payload that propagated itself across millions of profiles in 2005 — because the mechanics rhyme: one click turns each victim into an unwitting distributor.
Security doubts around the service are not new either — IT Project Failures argued back in December 2007 that Twitter was dangerous as a dependency, well before the platform carried this much traffic.
First-order effects
- Any logged-in Twitter user who clicks a crafted link has messages posted to their account without consent, and because those posts contain the same link, every victim recruits more victims — a self-propagating attack loop.
- Twitter's own users become the attack vector: the more densely connected and fast-growing the follower graph, the faster a single seeded link can spread.
Second-order effects
- Trust in links circulating inside tweets takes a hit, which pressures brands, journalists, and early corporate adopters weighing the service against rivals like Facebook for real-time communication — the displacement thesis an analyst publicly denied earlier in March 2009 becomes harder to argue with an unpatched hole open.
- The episode hands Twitter an engineering-credibility problem precisely as mainstream attention peaks, forcing security response speed to compete with feature velocity during hypergrowth.
Third-order effects
- If the pattern holds, self-replicating client-side attacks become a recurring structural hazard for every fast-scaling user-generated-content network, with Samy-era MySpace as the template and microblogs as the next host.
- Platforms whose value lies in one-click amplification face a durable trade-off: the same frictionless sharing that drives growth also lowers the cost of weaponizing the network against itself, pushing vendors toward stricter input sanitization and click-path controls as table stakes.
The trend: As social publishing platforms scale faster than their security practices, cross-site scripting worms that hijack users' own accounts are emerging as a defining risk class of the Web 2.0 era.