TweetDeck Hacked—Panic (And Rickrolling) Ensues

Image: Courtesy of TweetDeck

TweetDeck, the popular application for managing Twitter feeds that is operated by Twitter itself, announced that it was temporarily disabling its service after a number of accounts were affected today by hackers who exploited a vulnerability in the service.

TweetDeck attributed the problem to a cross-site scripting vulnerability, which allows an attacker to execute malicious code on a victim’s system generally by injecting the code into legitimate web pages in order to infect browsers and applications that visit or interact with the page.

Cross-site scripting vulnerabilities are often used by criminal hackers to quietly distribute malware that steals banking credentials or other sensitive data.

In this case, the affect was limited in that the vulnerability appeared to only allow someone in a TweetDeck user’s Twitter timeline to execute arbitrary pop-up messages on the user’s screen, force the accountholder to follow new users, or distribute Tweets like a worm by causing their account to automatically re-Tweet messages.

Pop-up messages yelling “Yo!”, “HACKED” and the RickRoll classic “NEVER GOING TO GIVE YOU UP, NEVER GOING TO LET YOU DOWN” appeared on the screens of TweetDeck users to broadcast the breach. Other Twitter users had strange retweets sent from their accounts.

Those affected included @NYTimes and @BBCBreaking, whose accounts were among some 30,000 Twitter feeds that inadvertently retweeted a script that appeared to come from @derGeruhn.

Twitter fixed the issue this morning with a patch and warned TweetDeck users to log out of their accounts, then log back in to initiate the patch.

But after users continued to be affected by the problem–even after reporting that they had logged out and back in–TweetDeck temporarily disabled the service to investigate the matter.

It’s not the first time that Twitter has been hit by a cross-site scripting hack. In 2010, thousands of users were affected by a cross-site scripting hack after Twitter re-designed its site.