Twitter knew about worm bug a month ago

A serious bug that led to a series of fast-spreading worms on Twitter’s website Tuesday had been fixed in August but was accidentally re-introduced.

The bug caused havoc until Twitter got it under control later on Tuesday morning. One of the worms sent out a blacked-out Twitter message to all the victim’s followers. Another distributed Japanese pornography.

The worms were particularly virulent because victims didn’t need to click on a link to spread them to their followers. All they had to do was hover over a specially written link sent in a Twitter message. That was enough to execute the malicious code.

“Probably hundreds of thousands of people were affected,” said Beth Jones, a senior threat researcher with Sophos, which was early to report the issue. The cause: a basic Web programming error that allowed Twitter users to add JavaScript to their tweets.

It turns out that the whole mess could easily have been avoided. Indeed, it should have been.

“We discovered and patched this issue last month,” Twitter said in a blog post Tuesday. “However, a recent site update (unrelated to new Twitter) unknowingly resurfaced it.”

You can read the full article here.