Twitter onmouseover security vulnerability widely exploited. Demo from Sophos

[rahxephon52]

look @ mac tanking those exploits.

[ThePsychoticScyth396]

@rahxephon52 thats because they're ment for pc. cause gee, idk, MORE PEOPLE USE PC!!

[rahxephon52]

@ThePsychoticScyth396 true true. 

[MaZe741]

is this possible only on twitter? it seemed like a javascript ui trigger..... which should work on like 99% on all websites on the internet?

why is this called the "twitter"-exploit?

[ddstar]

Only if twitter was around when "The God Message" was around.

[MilesGuitarist]

@ddstar whats that?

[ddstar]

@MilesGuitarist It was a technique where you base64 encoded a program into the browser. When someone visited the website it automatically ran the program that was encoded.

[iqbaldisouza1]

love u maria

[Psypherion]

Was that Maria Ozawa? :D

[ariuszarim]

@Psypherion I think it is

[kilome15]

@coolcharles87 Cool story, take your adopted sister and get raped.

[shaunno2009]

OMG that is really bad for a website so big, all you need to use is htmlspecialchars will be safe then.

[hurizam]

so powerful HACKER

[pupydejz]

only idiots use twitter anyway

[EmperorofCartoons]

Firefox+Noscript+Adblock+Flash­block

Never surf with anything less.

[monica24b]

well..im glad i didn't use twitter that day.

[kilome15]

Twitter is for twits, twits work as Twitter workers, the Twitter world if twitful.

[yummigum93]

hope it doesnt happen on facebook next D;

[incredibad1]

Yay, more social networking exploits.

[uberswampmonsta]

firefox & noscript blocks it, but twitter sucks so who cares?

[MmmCouchPotato]

Solution: Don't use Twitter.

[Avantime]

0:49 lol I didn't know that Maria Ozawa is still at 1Pondo XD

[JABALLEGAS]

@sophoslabs (or someone): Where could I get the effect that has the arrow in the video? I'd love it for my Mac. Thanks!

[Albinorama]

so?What is the fix?...thank.s

[allanonmage]

That girl is hot, but she fully clothed: wheres the porno man???

[JuneSiyu]

@allanonmage She is famous man! Her name is Maria Ozawa!

[hdzsound]

LOL

[asgardpker]

damn yo, you can do just about anything with that

[Leomar6335]

I NEVER LIKED A VIDEO THAT YOU START TALK, I DON´T WANT YOU TELLING ANY UNESSESSARY INFORMATION.

[Khamug]

@Leomar6335 SOLUTION FOR YOU: MUTE THE SOUND

[mplsridah]

so how the hell does onmouseover work? if you teach me how to hack it, i'll follow u, lmao

[EmperorofCartoons]

@mplsridah Its not really a hack so much as it is an exploit, but if you wanna know how to do it, go to any Javascript site and they probably have instructions or snippets of code you can customize. People have been using this legitimately for years (And as you can see, you can you use it very illegitimately too.).

Its basically a JavaScript that turns a portion of text / picture / or even just page background into a link to something else that goes off when the mouse cursor is moved over it.

[EmperorofCartoons]

@mplsridah I am pretty sure you can do it without Java also, but I may be wrong. It has been YEARS since I messed with any page coding, so take my advice as suggestion not 100% writ.

[austyn1234567891]

wow tats a good hack

[vista71234567890]

maria ozawa!!!

[St9ler]

I clicked these links and nothing happend to me.. :P

[islemjskTheOne]

8....................

[EllieAsksWhy]

The content-based advertisements and youtube suggestions for your channel at this moment are pretty funny, it's just a few minutes after the Sophos vid appeared. I'll take a screen shot and post, first need to confirm whether or not that is against youtube TOS.

;@)

[xSheCantBeTamed]

annoying.

thanks for explaining it to me. us lol

lol

[iamgodgvn]

ah Maria Ozawa

[Wiejeben]

I agree, it's annoying....

[BoogsterSU2]

This kind reminds me of Futurama's Attack of the Killer App. This is like Twitter's VERY FIRST TwitWorm!! :@ I'm so scared.

[djbennett]

@BoogsterSU2 This is why Twitter needs a 24 hour report line... Could of fixed this hours ago!

[djbennett]

Just to point out.

The page the first one goes to sends you to a page warning people of the exploit.

The tweet is there for reference and Ive been sending it to twitter and other people warning them of the exploit.

Looks like people are exploiting it and putting in MY LINK lol. - Ravenatic.

[djbennett]

Just to also point out. I didn't "create" it. I just tested it.

All are deleted par one that goes to my page alerting of the issue :-)

- Ravenatic