Twitter has put a stop to a worm that posted obscene messages to victims' Twitter feeds. It's the second worm attack the site has suffered in a week.
Those whose accounts became infected with the worm would see a message posted on their Twitter account that read in part "WTF:" followed by a URL, according to a blog post from Sophos, a security vendor.
If someone clicked on the link, their profile would also be hijacked, reposting the same link and increasing the chance that one of their followers would click on it and spread the worm.
Sophos wrote that the worm used a cross-site request forgery (CSRF) technique in order to post to someone's account. In a CSRF attack, a web application is tricked into honoring a request from a malicious website.
The attack was invisible to those who clicked on the link. "All the user sees if they visit the link is a blank page, but behind the scenes it has sent messages to Twitter to post from your account," wrote Graham Cluley, senior technology consultant for Sophos.
Twitter wrote on its status blog on Sunday that "a malicious link is making the rounds that will post a tweet to your account when clicked on. Twitter has disabled the link, and is currently resolving the issue."
Paul Vlissidis, technical director at NGS Secure, an NCC Group business, said, “Cross-site request forgery is a method of gaining access to a web application by exploiting the user’s logged-in session. This worm appears to be mischievous rather than malicious, but it does expose a serious issue in the Twitter security model which needs to be rectified to ensure that its users do not suffer weekly or daily incidents of this kind.”
TGDaily reports that celebrity blogger Robert Scoble was amongst one of the victims of this new worm attack.