A tale of two Twitter worms

happygeek 0 321 Views

It has not exactly been the best of weekends for Twitter, and for those whose tweeting has been hijacked by not one but two worms it could easily be considered the worst of times.

It all started when people noticed that a lot of their followers seemed to be recommending the same website. OK, so that's not exactly unheard of after all a lot of people use Twitter to pass on details of interesting finds to their social network. However, when those recommendations take the rather juvenile form of "Wooo, www-dot-StalkDaily-dot-com :)" or "Dude, www-dot-StalkDaily-dot-com is awesome" then eyebrows start to get raised.

The good thing about Twitter though, well one of the many good things about Twitter, is that news both good and bad spreads really quickly. So when people realised that their update messages were being hijacked to spread this spam, they started posting tweets warning their followers and asking them to spread the word. The author of the StalkDaily worm quickly caught on and hijacked messages soon started appearing which claimed "Virus!? What? www-dot-StalkDaily-dot-com is legit!"

Actually, what was happening was a typical cross site scripting attack, in this case spamming links across Twitter without the permission, or knowledge in many cases, of the users involved.

In his official Twitter blog, founder Biz Stone has confirmed that "a worm took center stage" but adds that "no passwords, phone numbers, or other sensitive information was compromised as part of these attacks."

Stone goes on to admit that in all the Twitter team "identified and deleted almost 10,000 tweets that could have continued to spread the worm" and points out that the "support team will have lots of email to go through on Monday so please bear with us and thanks for your patience."

It would appear that as Twitter was getting to grips with the StalkDaily worm so another cross site scripting attack took hold. The appears to have an agenda of gloating about the success of the first worm. Messages being spammed this time around included the likes of "Twitter really should fix this" and "Mikeyy I am done" as well as "Dud! Mikeyy! Seriously? Haha."

The Mikeyy concerned would appear to be Mikeyy Mooney, a 17 year old who is alleged to have taken responsibility for the StalkDaily worm. According to BNO News the teenager emailed them to claim it was him behind both worms, and warn that more could follow. Mikeyy Mooney being the owner of the StalkDaily website at the heart of the first worm spam messages. BNO News reports that he wrote "I am aware of the attack and yes I am behind this attack" created in order to "give the developers an insight on the problem and while doing so, promoting myself or my website."

Dani AI

Generated

Useful summary, . Brief technical context and practical follow-ups are below.

Client-side script injection lets arbitrary JavaScript run in the browser of anyone who views a crafted message. When that script can act with the viewer’s authenticated session it can post new messages, call APIs and thus propagate itself. Three common XSS types to watch for are stored (payload saved server-side), reflected (payload echoed in a response) and DOM-based (payload executed by client-side code).

Recommended immediate actions for account owners:

  • Revoke suspicious third‑party tokens and sign out of all sessions, then rotate passwords and enable two‑factor authentication.
  • Remove or hide any automated posts that contain unusual or repetitive payloads; treat any post containing raw script or long encoded strings as suspect.
  • Check browser extensions and run a full anti‑malware scan before reusing the account from that machine.
  • When sharing samples for diagnosis, escape payloads (show them as text) so they cannot execute in other browsers.

Recommended mitigations for site operators and devs:

  • Apply context‑sensitive output encoding (HTML escape for text nodes, attribute encode for attributes, JS encode for content inside scripts, URL encode for query parts).
  • Prefer templating engines that auto‑escape; sanitize rich text with a strict whitelist (avoid allowing raw HTML unless absolutely necessary).
  • Avoid DOM APIs that inject HTML (innerHTML, document.write) with untrusted data; use textContent or safe DOM builders.
  • Use cookie flags (HttpOnly, Secure, SameSite), rate limits, WAF rules, and monitoring for identical payloads or bursts of similar posts.

Quick example (Express): set a conservative Content Security Policy and block inline scripts:

res.setHeader('Content-Security-Policy',
  "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none';");

For investigations, search logs for repeated identical strings, long base64/escaped segments, or unusual characters. Treat payloads as active code until safely sandboxed.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview