http://www.theregister.co.uk/2009/07/03/twitterpwn/



By John Leyden

The Register

3rd July 2009



The Month Of Twitter Bugs has begun with the publication of a flaw in a 

URL shortening service often used in conjunction with the micro-blogging 

service.



Four cross-site scripting (XSS) vulnerabilities in the bit.ly 

URL-shrinking service were published on Wednesday. TweetDeck, one of the 

most popular Twitter clients, integrates bit.ly, making the flaws much 

more risky than might otherwise be the case. Fortunately, three of the 

fours bugs were fixed before an alert was published. The last flaw was 

addressed hours after the release of a notice via Twitpwn, the home page 

of the Month Of Twitter Bugs project.



On Thursday, the Twitpwn project published details of a resolved 

cross-site scripting flaw in HootSuite toolbox.



The Month of Bugs series was inaugurated three years about with a four 

week period that offered a different browser bugs every day. Originally, 

the brainchild of HD Moore, of Metasploit fame, noted researcher Aviv 

Raff is applying the idea to Twitter and associated service during July. 

He notes that the idea might just have easily be applied to any other 

Web 2.0 service.



[...]





_______________________________________________      

Attend Black Hat USA, July 25-30 in Las Vegas, 

the world's premier technical event for ICT security experts.

Network with 4,000+ delegates from 50 nations.  

Visit product displays by 30 top sponsors in 

a relaxed setting. http://www.blackhat.com



Received on Fri Jul 03 2009 - 02:20:48 PDT