tl;dr

Twitter today went nuclear under the weight of a little hack dubbed the “don’t click” attack:

For a better description of how the attack worked than I could hope to write, I recommend you read Daniel Sandler’s page or Mack Staples’s writeup, both of which are excellent.

In brief, though, it was a tiny, simple web page with a button labelled “Don’t Click!”; hidden from the user, but overlaid with that website, was the Twitter homepage, with a tweet pre-loaded containing the text “Don’t Click http://tinyurl.com/aaaaa”. If the user clicked the “Don’t Click!” button, the browser sent the click to the Twitter homepage instead, which would post a tweet from the user. The tinyurl.com address leads back to the “Don’t Click!” button page. In this manner, it spreads from one user to another much like a virus.

How it worked was pretty simple; what interested me was finding the source of the hack, so I pounded on the advanced search in Twitter.com for a while. The earliest use of it in English I could find was from user @sfnick and dated 10:03 am on the 11th of February, showing that this attack spread rapidly once it was translated into English. However, digging further showed that this has been spreading around in French-language tweets for several weeks — with the prefix text “Le Truc du Jour”.

Searching Twitter for that phrase turned up a different tinyurl.com address, presumably leading to a similar attack page (although it has been disabled now so I cannot check). Tracing that different tinyurl.com further back in time eventually led me to this search which shows where the attack came from:

I contend that the user @umoor is where this attack came from, firstly, because he has the first three tweets in Twitter’s search index with the string and secondly, because the attack is hosted on the domain “umoor.eu”. All three of those tweets have been deleted from his history — I believe this was him testing the functionality of the exploit.

Amazingly, within minutes, the attack had spread to four more users — none of whom seem to follow @umoor. I would like to know what attack vector the URL was delivered by; it’s possible that they were all following @umoor at the time. If I worked for Twitter now, I’d be making some graphs of how this exploit spread from person to person — there is some fascinating research there.

@umoor, however, didn’t write the exploit. The exploit was detailed in theoretical form in a blog post by James Padolsey on Jan 20th, ten days before the search results from @umoor. Comparing the source code of James Padolsey’s example and @umoor’s in-the-wild hack show they are largely identical in details such as the ordering of CSS elements and HTML indentation, strongly suggesting that @umoor essentially cut-and-pasted Padolsey’s example.

On the left, the exploit source code from umoor.eu; on the right, Padolsey's example. Click to enlarge.

Additionally, at the bottom of his exploit page, @umoor links to (and credits) this page on the French-language site korben.info, which contains source code identical to that used in @umoor’s page. It’s not clear whether the information went from Padolsey->Korben->umoor, or if @umoor is involved in the Korben page is some way. (Edit — see the comment below from Korben himself, which confirms that my first explanation was correct).

Either way, @umoor doesn’t deserve any credit for figuring out the attack, and should probably be criticised for making a large number of people panic that their Twitter account had been hacked.

Tech