Update: Twitter says it has fixed a dangerous flaw that turned the Twitter Website into minefield Tuesday of potentially dangerous links. The company tweeted early Tuesday “The XSS attack should now be fully patched and no longer exploitable.”
Earlier in the day a security flaw turned Twitter’s Website into a chaotic and potentially unsafe place, filled with annoying pop-up windows that activated just by rolling the mouse over another user’s tweets.
The flaw is activated by inserting a line of JavaScript into the tweet, containing the command “onmouseover.” It seems that most people are using this exploit for playful trickery, generating bothersome but benign pop-up messages when the user’s mouse rolls over the text.
But according to Sophos, the Twitter hack could be used to send people to malicious third-party Websites. Sarah Brown, wife of former U.K. Prime Minister Gordon Brown, for example, has inadvertently sent users to a Japan-based hardcore porn Website.
To make matters worse, the exploit is also being used to fill and submit status updates when rolled over, leading to fast propagation. My twitter feed is overrun with messages containing the “onmouseover” JavaScript.
For now, Twitter users should either access the site from a third-party client, such as TweetDeck or Seesmic, or use mobile.twitter.com, to which the exploit does not apply.
Users who were already granted access to the new, redesigned Twitter.com should not run into this exploit.