LS-HACKS

Twitter was hit with at least three different worm attacks that started Saturday and continued into Sunday, the micro-blogging service acknowledged as it promised users it would review its coding practices.

"At about 2 a.m. on Saturday, four accounts were created that began spreading a worm on Twitter," company co-founder Biz Stone announced in a blog entry Sunday. "From 7:30 a.m. until 11 a.m. PST, our security team worked on eliminating the vectors that could identify this worm. At that time, about 90 accounts were compromised. We identified and secured these accounts."

That worm, which was widely reported on Saturday and dubbed "StalkDaily," exploited a cross-site scripting vulnerability in the Twitter service to infect user profiles. The original attack relied on tweets that referred to several malicious accounts allegedly created by Mooney; when users viewed those accounts' profiles, their own profiles became infected, and their accounts then sent more spam-style messages to entice friends to the just-infected profiles.

Those messages promoted the StalkDaily site with tweets such as "I love www.StalkDaily.com" and "Dude, www.StalkDaily.com is awesome. What's the fuss?"

Read More...