Japanese hacker blames Twitter attack to unheeded early warning
A Japanese hacker being pointed to as one of two instigators of the five-hour Twitter meltdown on Tuesday has blamed the incident to the micro-blogging site's failure to heed his earlier warning of an XSS vulnerability.
The hacker and Twitter user with the cyberspace alias Masato Kinugawa claimed he had warned the site on Aug. 14 about its XSS or cross-site scripting flaw. When the vulnerability was not addressed, Kinugawa created a Twitter account, @RainbowTwtr, that displayed messages in colors of the rainbow to expose the vulnerability in the hope that the site's administrator will act to patch the weakness.
However, Twitter user Pearce Delphin, a 17-year-old Australian boy who encountered @RainbowTwtr's colored message explored Kinugawa's code and learned that he could make a pop-up message appear when a mouse cursor moves over a link in his message.
Delphin tweeted the vulnerability and others tried the trick on running JavaScript programs on other computers. Soon, other Twitter users modified the code to open porn sites and replicate tweets.
The mouseover bug went out of control opening pop-up windows and automatically generating tweets from other accounts. Among the Twitter accounts affected were that of the White House press secretary Robert Gibbs and former British prime minister Gordon Brown's wife, Sarah Brown.
Twitter has since fixed the vulnerability and apologized to its two million users.