Support 100 years of independent journalism.

  1. Politics
21 September 2010updated 27 Sep 2015 2:12am

Twitter hover hack causes havoc

Site is slow to plug security loophole.

By Jason Stamper

A security flaw in the latest version of the popular Twitter social networking user interface is causing havoc with the service, with the former PM’s wife Sarah Brown among thousands who have been hit by the flaw.

The bug is a further embarrassment for Twitter just a week after the new user interface was launched. It affects only those using Twitter directly, not those who access their Twitter account via third-party sites such as TweetDeck.

Sarah Brown, who has well over a million followers on Twitter, “sent” a link from her Twitter account that redirected users to a hardcore pornographic website.

The link will have been sent out from her account without her knowledge, as hackers have been able to exploit a scripting loophole in Twitter status updates which means that when you hover your mouse over malicious tweets, a particular function can be carried out — from redirecting you to another website, to sending out further messages without your knowledge, or worse.

Select and enter your email address Quick and essential guide to domestic and global politics from the New Statesman's politics team. A weekly newsletter helping you fit together the pieces of the global economic slowdown. The New Statesman’s global affairs newsletter, every Monday and Friday. The best of the New Statesman, delivered to your inbox every weekday morning. The New Statesman’s weekly environment email on the politics, business and culture of the climate and nature crises - in your inbox every Thursday. Our weekly culture newsletter – from books and art to pop culture and memes – sent every Friday. A weekly round-up of some of the best articles featured in the most recent issue of the New Statesman, sent each Saturday. A newsletter showcasing the finest writing from the ideas section and the NS archive, covering political ideas, philosophy, criticism and intellectual history - sent every Wednesday. Sign up to receive information regarding NS events, subscription offers & product updates.
  • Administration / Office
  • Arts and Culture
  • Board Member
  • Business / Corporate Services
  • Client / Customer Services
  • Communications
  • Construction, Works, Engineering
  • Education, Curriculum and Teaching
  • Environment, Conservation and NRM
  • Facility / Grounds Management and Maintenance
  • Finance Management
  • Health - Medical and Nursing Management
  • HR, Training and Organisational Development
  • Information and Communications Technology
  • Information Services, Statistics, Records, Archives
  • Infrastructure Management - Transport, Utilities
  • Legal Officers and Practitioners
  • Librarians and Library Management
  • Management
  • Marketing
  • OH&S, Risk Management
  • Operations Management
  • Planning, Policy, Strategy
  • Printing, Design, Publishing, Web
  • Projects, Programs and Advisors
  • Property, Assets and Fleet Management
  • Public Relations and Media
  • Purchasing and Procurement
  • Quality Management
  • Science and Technical Research and Development
  • Security and Law Enforcement
  • Service Delivery
  • Sport and Recreation
  • Travel, Accommodation, Tourism
  • Wellbeing, Community / Social Services
I consent to New Statesman Media Group collecting my details provided via this form in accordance with the Privacy Policy

“While most examples of the ‘onmouseover’ security flaw seem to be people playing around with code without specific malicious aim, there have already been numerous cases reported today of porn and shock site redirects, along with profile corruption and various other side effects,” said Christopher Boyd, senior threat researcher at GFI Software.

“While there’s a possibility that bad actors may use this to direct end-users to malware and phish pages, I’d like to think Twitter will have this under control before that happens. However, we are surprised that Twitter has not suspended the main website while it works on a fix.”

UPDATE: Twitter has just announced that the loophole has now been closed and there shouldn’t be any more “onmouseover” attacks.

Jason Stamper is the editor of Computer Business Review and NS technology correspondent.