The Social Media Security Podcast

I’ve decided to gather and publish some statistics for the first 15 days of “Month of Twitter Bugs”.
There were 35 vulnerabilities disclosed for 15 different Twitter 3rd-party services.
12 of the 35 vulnerabilities were 0days (11 of them disclosed in the blog comments), which means there was no patch available at the time they were disclosed.
7 of those 0day vulnerabilities are still unpatched!
The average fix time for a vendor (not including bit.ly) is 18 hours.
The following pie chart shows the types of vulnerabilities found in MoTB.

As a bonus for the “Halftime statistics report”, I would like to present a bug that was submitted by Laurent Gaffie: Twitter Search Web Server Information Leakage.
The Twitter search server did not block access to the “.htaccess” file, which revealed the configuration of the Twitter search web server, including a block list of IPs (spammers?).
Status: Fixed.
Screenshot:

While this bug is nothing compared to the recent Twitter servers/employees hack disclosure, it still shows that Twitter needs to hire a security engineer, and fast!

What is Slandr
“Slandr delivers an enhanced mobile site for twitter, with: replies, direct messaging, etc..” (Slandr about page)

Twitter effect
Slandr can be used to send tweets, direct messages and follow/unfollow other Twitter users.
Slandr is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
27th place in the most used twitter clients, according to “TwitStats” – 3 twits

Vulnerabilities:
1) Cross-Site Request Forgery in main update page
Status: Patched.
Details: The Slandr index.php web page did not use authenticity code in order to validate that the HTTP post is coming from the Slandr web application.
This vulnerability could have been used by an attacker to send tweets on behalf of its victims.

2) Reflected POST Cross-Site in the Search page.
Status: Patched.
Details: The Slandr search page did not encode HTML entities in the “search” form field, which could have allowed the injection of scripts.
This vulnerability could have been used by an attacker to automatically send tweets, direct messages or follow/unfollow other twitter users on behalf of the victims.
Proof-of-Concept: http://tweetmeme.com/search.php?for=%3C/title%3E%3Cscript%3Ealert(%22xss%22);%3C/script%3E%3Ctitle%3E
Screenshot:

Vendor response rate
The vendor have published a blog post about these vulnerabilities.
The vulnerabilities were fixed 2 days after they have been reported. Good – 4 twits.

What is TweetMeme
“TweetMeme is a service which aggregates all the popular links on twitter to determine which links are popular. TweetMeme is able to categorize these links into categories and subcategories, making it easy to filter out the noise to find what your interested in.” (TweetMeme about page)

Twitter effect
TweetMeme can be used to send new tweets and reply to other Twitter users.
TweetMeme is using OAuth authentication method in order to utilize the Twitter API.

Popularity rate
6.5 Million unique visitors per month (According to Compete) – 4.5 twits

Vulnerability: Reflected Cross-Site in the Search page.
Status: Patched.
Details: The TweetMeme search page did not encode HTML entities in the “for” variable, which could have allowed the injection of scripts.
The vulnerability was also submitted, and publicly disclosed by d3v1l.
This vulnerability could have been used by an attacker to send tweets on behalf of its victims.
Proof-of-Concept: http://tweetmeme.com/search.php?for=%3C/title%3E%3Cscript%3Ealert(%22xss%22);%3C/script%3E%3Ctitle%3E
Screenshot:

Vendor response rate
Vulnerability was fixed 2 hours after it has been reported. Excellent – 5 twits.

What is Brightkite
“Brightkite is a location-based social network. In real time you can see where your friends are and what they’re up to. Depending on your privacy settings you can also meet others nearby.” (Brightkite home page)

Twitter effect
Brightkite can be used to send new tweets and reply to other Twitter users.
Brightkite is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
16th place in the most used twitter clients, according to “TwitStats” – 4 twits

Vulnerability: Reflected Cross-Site in the “Person not found” page.
Status: Patched.
Details: The Brightkite “Person not found” page did not encode HTML entities in the people query variable, which could have allowed the injection of scripts.
This vulnerability could have been used by an attacker to send tweets on behalf of its victims.
Proof-of-Concept: http://brightkite.com/people/zxxx%22%3E%3Cbody%20onload=%22alert(%27xss%27)%22%3E
Screenshot:

Vendor response rate
Vulnerability was fixed 1 hour after it has been reported. Excellent – 5 twits.

What is TweetGrid
“TweetGrid is a powerful Twitter Search Dashboard that allows you to search for up to 9 different topics, events, converstations, hashtags, phrases, people, groups, etc in real-time. As new tweets are created, they are automatically updated in the grid. No need to refresh the page!” (TweetGrid FAQ page)

Twitter effect
TweetGrid can be used to send new tweets and reply to other Twitter users.
TweetGrid is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
28th place in the Top 100 Twitter Services, according to “The Museum of Modern Betas” – 3.5 twits

Vulnerability: Reflected Cross-Site in the Search page.
Status: Patched.
Details: The TweetGrid search page did not encode HTML entities in the “q” variable, which could have allowed the injection of scripts.
This vulnerability could have been used by an attacker to send tweets on behalf of its victims.
Proof-of-Concept: http://tweetgrid.com/search?q=xxx%3C%2Ftitle%3E%3Cscript%3Ealert%28%2Fxss%2F%29%3C%2Fscript%3E
Screenshot:

Vendor response rate
Vulnerability was fixed 1 hour after it has been reported. Excellent – 5 twits.

What is Twitturly
“Twitturly tracks the URLs flying around the Twitterverse and provides a quick, real-time view of what people are talking about on Twitter.” (Twitturly about page)

Twitter effect
Twitturly can be used to send tweets to other Twitter users.
Twitturly is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
19th place in the Top 100 Twitter services of The Museum of Modern Betas Labs – 4 twits

Vulnerability: Persistent Cross-Site in Twitturly URLs view page.
Status: Patched.
Details: Twitturly did not encode HTML entities in the un-shortened URLs it displays, which could have allowed the injection of scripts.
This vulnerability could have allowed an attacker to send tweets on behalf of its victims.
Screenshot:

Vendor response rate
The vulnerability was fixed 2 hours after it has been reported. Excellent – 5 twits.

What is Twellow
“From our home at Twellow headquarters, we’re actively searching and categorizing millions of inter-personal exchanges available on the internet every day. Twellow.com is thereby able to assist you in finding real people who really matter. We’re doing the hard work of sifting out people who can help bring your vision to reality, whatever that vision might be.” (Twellow about page)

Twitter effect
Twellow can be used to follow and unfollow other twitter users.
Twellow is using Username/Password authentication in order to utilize the Twitter API.

Popularity rate
Indexing 6.2 million Twitter profiles, with over 175K unique visitors per month (according to Compete) – 4 twits

Vulnerability: Reflected POST Cross-Site Scripting in the Contact page.
Status: Patched.
Details: Twellow does not encode HTML entities in the form fields of the Contact page, which can allow the injection of scripts by submitting a rouge HTML form to the page.
This vulnerability could have allowed an attacker to automatically follow or unfollow other twitter users on behalf of its victims.
Screenshots:

Vendor response rate
The vulnerabilities were fixed 1 day after they were reported, although it took them 4 days to response to the initial email. Good – 4 twits.