Social Media

How StalkDaily Opened a Gaping Hole in Twitter


UPDATE 2: a second Twitter attack, named "mikeyy" occurred on Sunday morning. See the article mikeyy: Another Twitter Worm on the Loose for the most recent coverage.

UPDATE: Minutes ago, Twitter confirmed that they have successfully closed the hole that allowed this worm to spread. You're safe to visit Twitter profiles again :) The below still stands as the most complete explanation of how the attack was conducted: please do give it a read!

Today one of our favorite sites, Twitter, was hit with a particularly nasty exploit: one that could infect users simply by visiting a friend's profile on

The nature of the attack was far more serious than previous exploits, since there was no need to click a link to get infected. We're hopeful, however, that Twitter will move quickly to prevent this form of cross site scripting (XSS) attack. In the meantime, we've looked into how the attack was executed, and how you can avoid it.

What Happened: Our Best Guess

While reports are still coming in and we're trying to keep this lightweight enough for everyone to understand, here's our draft summary of the steps taken by the attacker (please add info and explanations in the comments section and we'll continue to update this). The attacker:

1. Realized that Twitter allows you to insert not just text in your "bio" section, but also a script (a quick glance at the source suggests that the javascript used is hidden in the color attribute and hosted at a site called mikeyylolz dot uuuq dot com)

2. Created one or more Twitter profiles with malicious code in the bio sections, enticing Twitter users to visit the pages by following those users (one malicious account may have been called "gangsterboyhah")

3. When the profile is visited, the script has a delay of approximately 3 seconds before requesting the Twitter cookie and username from your browser

4. These details are used to create an authentication token, allowing the script to execute any of the actions allowed through the Twitter API

5. The script sends out Tweets on the affected account

6. The script also inserts the itself into the user's Bio section, making their Twitter account a host.

What To Do

If you're affected, you need to:

1. Go to your Twitter account settings and switch your bio back to normal

2. In your browser settings, clear out your cache and cookies

3. As a precaution, change your Twitter password

To prevent re-infection, you need to:

1. Avoid visiting Twitter profiles until the issue is fixed

2. If you do land on a Twitter profile with StalkDaily as the URL, you have 3 seconds to close the tab before you're affected!

3. Since these attacks only work when visiting Twitter profiles on the web, you might want to consider using a desktop Twitter client like TweetDeck or Seesmic Desktop.

We love Twitter and we hope they'll patch up this hole quickly so we can all get back to our regularly scheduled Tweeting.

PS. Given that StalkDaily is a seemingly harmless site (we looked at the code) and the attack actually resides in Twitter bios, it's possible that StalkDaily itself was not associated with the attack at all. Either way, its name is now associated with the most sophisticated Twitter attack to date.

Load Comments

The New Stuff

The Next Big Thing

What's Hot