Recognize-Security

Posted by Trancer on Apr 13 2009

For the past few days two web worms are spreading through Twitter, the popular social micro-blogging utility. The first worm, called the “StalkDaily” worm, start spreading on Saturday, infect user profile pages, steal users browser cookies and post unwanted tweets. A second variation called the “Mikeyy” worm, start spreading on Sunday and does pretty much the same.
The worms use a Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities to spread, which the Twitter guys already closed.
Both worms were created by Michael “Mikeyy” Mooney, a 17 year old teenager. You can read an interview with Mooney on CNET News.

Here’s both “StalkDaily” worm and “Mikeyy” worm JavaScript code, for educational purposes.

• Twitter “StalkDaily” worm code (unobfuscated).
• Twitter “Mikeyy” worm code (obfuscated).

Further reading:
Twitter Blog: Wily Weekend Worms.
F-Secure – Twitter worm outbreak over Easter.
Twitter Worm Analysis by Ryan Barnett.

Categories: Malware

0 Comments | Comments RSS | TrackBack URL

---