Lord Sugar was relieved not to have caused the Twitter 'hack bug'. Photograph: PA Sarah Brown and Lord Sugar were among thousands of Twitter users who yesterday found themselves directing people to third-party sites, including hardcore pornography, as the messaging website fell prey to an "embarrassing" hacking attack discovered by a Japanese programmer and then exploited by a number of others.
At one point more than 100,000 people on the service were estimated to have been affected, while the owners – who are based on the US west coast – were asleep. Graham Cluley, a consultant with the online security company Sophos, said a rogue code or worm spread throughout the service "like someone had just thrown petrol on a fire". The problem brought a renewed focus on the importance of Twitter, which restricts users to 140-character tweets, and has more than 100 million users around the world. With more and more organisations relying on the service to deliver information and keep people in touch, the potential for a worm to render it useless – or, worse, dangerous to use – echoed the problems suffered by users of Microsoft's Windows operating system when the ILOVEYOU worm spread through email and infected millions of computers a decade ago. The worm began spreading at 10.30am, but abruptly peaked at around 1.30pm, just as Sarah Brown, wife of the former prime minister Gordon Brown, who has 1.1 million followers on the service, was hit by a version which redirected anyone who hovered their mouse over the infected tweet to a Japanese hardcore pornography site. Because the worm worked on the web browser, any sort of computer could be affected. Only users of Twitter's mobile site, and those who read it through third-party applications such as Tweetdeck, Twhirl or Twitter's own iPhone and Android apps, were unaffected because those rendered the code ineffective. The original discoverer of the weakness appears to have been a Japanese developer called Masato Kinugawa, who says on his Twitter feed that he reported it to Twitter on 14 August – and thenfound that the new version of Twitter, launched on Tuesday last week, was also vulnerable. Others soon picked the idea up and realised they could use it to send messages, andremove people from Twitter entirely. As developers and malicious hackers played with the weakness they also discovered that they could make it activate as soon as someone logged in to Twitter received an infected tweet on their page. Richard Gaywood, a programmer and developer, watched the variants spread: "Other versions were hacked around by users to have all sorts of other effects, such as porn site redirects, rainbow text in their tweets, and so forth. Some of them popped up dialogue boxes designed to alarm the users, talking about accounts being disabled or passwords stolen (they weren't, in either case)." He added: "It's not that complex an attack at all either – rather embarrassing for Twitter that they were caught out by this." Once alerted to the problem, Twitter fixed it within 25 minutes – but the reputational damage may take some time to repair. That came as some relief to Lord Sugar. "Seems loads of people effected [sic] by hack bug thought it was me who caused it phew !" he wrote as the attack spread. Original source: http://www.guardian.co.uk/technology/2010/sep/21/twitter-internet-worm-hacking-attack/print Voice your thoughts in the blog to discuss the Rights of persons with disability bill at: http://www.accessindia.org.in/harish/blog.htm To unsubscribe send a message to accessindia-requ...@accessindia.org.in with the subject unsubscribe. To change your subscription to digest mode or make any other changes, please visit the list home page at http://accessindia.org.in/mailman/listinfo/accessindia_accessindia.org.in
