MESSAGE
| DATE | 2010-01-23 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [NYLXS - HANGOUT] Twitter turns off MS dependent features and flash features because
|
From owner-hangout-outgoing-at-mrbrklyn.com Sat Jan 23 18:49:46 2010
Return-Path:
X-Original-To: archive-at-mrbrklyn.com
Delivered-To: archive-at-mrbrklyn.com
Received: by www2.mrbrklyn.com (Postfix)
id 0FD3B4FBEA; Sat, 23 Jan 2010 18:49:46 -0500 (EST)
Delivered-To: hangout-outgoing-at-www2.mrbrklyn.com
Received: by www2.mrbrklyn.com (Postfix, from userid 28)
id 0086A56E05; Sat, 23 Jan 2010 18:49:45 -0500 (EST)
Delivered-To: hangout-at-nylxs.com
Received: from mail2.panix.com (mail2.panix.com [166.84.1.73])
by www2.mrbrklyn.com (Postfix) with ESMTP id 742CA4FBEA
for ; Sat, 23 Jan 2010 18:49:45 -0500 (EST)
Received: from panix1.panix.com (panix1.panix.com [166.84.1.1])
by mail2.panix.com (Postfix) with ESMTP id A92CD38E44
for ; Sat, 23 Jan 2010 18:51:38 -0500 (EST)
Received: by panix1.panix.com (Postfix, from userid 20529)
id 9F44614B98; Sat, 23 Jan 2010 18:51:38 -0500 (EST)
Date: Sat, 23 Jan 2010 18:51:38 -0500
From: Ruben Safir
To: hangout-at-nylxs.com
Subject: [NYLXS - HANGOUT] Twitter turns off MS dependent features and flash features because
of MS security and China
Message-ID: <20100123235138.GC29226-at-panix.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.18 (2008-05-17)
Sender: owner-hangout-at-mrbrklyn.com
Precedence: bulk
Reply-To: hangout-at-mrbrklyn.com
Twitter cuts feature on site over security flaw
Fri, Jan 22 2010
By Jim Finkle
BOSTON (Reuters) - Twitter has temporarily disabled one of the features
on its website after a security researcher warned of a programing flaw
that left the login credentials of its users vulnerable to hackers.
Twitter co-founder Biz Stone said in an email that the company had
temporarily cut off access to a feature that lets users display Twitter
updates on their websites by using Flash technology.
"Our team has disabled the Flash widget while we look into the problem,"
Stone said.
Mike Bailey, a senior security analyst with Foreground Security of
Orlando, Florida, said that the problem exploits a widely known
vulnerability in Adobe Systems Inc's Flash programing language.
Adobe has told programmers how to address the vulnerability, which was
first discovered in 2006, Bailey added, but noted the operators of many
websites have failed to respond to those warnings.
The microblogging site's huge popularity has made it a prime target for
hackers looking to spread malicious software to Twitter's millions of
users.
"As simple as the attack is, I've been finding them all over the place,"
Bailey said.
Officials with Adobe declined to comment.
A hacker last month briefly hijacked the Twitter site and redirected it
to one that claimed to represent a group calling itself the Iranian
Cyber Army. That high-profile attack -- by a perpetrator who stole
credentials to the account that Twitter uses to route its traffic -- did
not compromise credentials of any Twitter users.
Bailey said his analysis of the Twitter site showed that it could have
been vulnerable to attacks for more than a year, but that it was
impossible to know whether hackers had actually exploited the Adobe
flaw.
He is scheduled to discuss his research on the Twitter flaw at the Black
Hat DC security research conference in Washington, which begins on
February 2.Twitter cuts feature on site over security flaw
Fri, Jan 22 2010
By Jim Finkle
BOSTON (Reuters) - Twitter has temporarily disabled one of the features
on its website after a security researcher warned of a programing flaw
that left the login credentials of its users vulnerable to hackers.
Twitter co-founder Biz Stone said in an email that the company had
temporarily cut off access to a feature that lets users display Twitter
updates on their websites by using Flash technology.
"Our team has disabled the Flash widget while we look into the problem,"
Stone said.
Mike Bailey, a senior security analyst with Foreground Security of
Orlando, Florida, said that the problem exploits a widely known
vulnerability in Adobe Systems Inc's Flash programing language.
Adobe has told programmers how to address the vulnerability, which was
first discovered in 2006, Bailey added, but noted the operators of many
websites have failed to respond to those warnings.
The microblogging site's huge popularity has made it a prime target for
hackers looking to spread malicious software to Twitter's millions of
users.
"As simple as the attack is, I've been finding them all over the place,"
Bailey said.
Officials with Adobe declined to comment.
A hacker last month briefly hijacked the Twitter site and redirected it
to one that claimed to represent a group calling itself the Iranian
Cyber Army. That high-profile attack -- by a perpetrator who stole
credentials to the account that Twitter uses to route its traffic -- did
not compromise credentials of any Twitter users.
Bailey said his analysis of the Twitter site showed that it could have
been vulnerable to attacks for more than a year, but that it was
impossible to know whether hackers had actually exploited the Adobe
flaw.
He is scheduled to discuss his research on the Twitter flaw at the Black
Hat DC security research conference in Washington, which begins on
February 2.
|
|
