Twitter XSS Worm 2009

The Twitter Worm (2009) – "OnMouseOver" XSS Attack

This 2009 Twitter Worm was a self-replicating cross-site scripting (XSS) attack that exploited the onmouseover event in tweets. When users hovered over an infected tweet, the worm retweeted itself, spreading rapidly across Twitter.

How Did the Worm Work?

1. Exploited a Stored XSS Vulnerability

   • Twitter failed to sanitize user-generated content, allowing attackers to inject JavaScript into tweets.
   • Attackers inserted malicious JavaScript using the onmouseover event.

2. Auto-Execution When Users Hovered Over Links

   • The malicious JavaScript executed automatically when a user hovered over an infected tweet.
   • The script retweeted or posted itself from the victim’s account, continuing the spread.

3. Self-Replication (Worm Behavior)

   • Each infected user unknowingly spread the worm when others hovered over their tweets.

Example of the Exploit

The attacker injected the following JavaScript into a tweet:

<a href="#" onmouseover="document.getElementById('tweetbox').value='Worm Attack!'; document.forms[0].submit();">Hover Me</a>

• This script modified the tweet input field and automatically posted a new tweet with the worm.
• Users who hovered over an infected tweet instantly spread the worm.

Impact of the Twitter Worm

🔴 Thousands of users were affected within minutes
🔴 Users unknowingly spread malicious tweets
🔴 Twitter had to quickly patch the XSS vulnerability
🔴 Highlighted the dangers of unfiltered user input in social media

How Twitter Fixed It

✔ Sanitized User Input

• Twitter started properly escaping JavaScript in tweets to prevent XSS injection.

✔ Implemented Content Security Policy (CSP)

• Twitter blocked inline JavaScript execution to prevent future attacks.

✔ Added Filtering for Event Handlers (onmouseover, onclick, etc.)

• Prevented JavaScript events from being used inside tweets.

✔ Security Audits & XSS Prevention

• Increased automated security checks to detect XSS vulnerabilities before deployment.

Lessons from the Twitter Worm

🔹 XSS vulnerabilities can be wormable, causing mass infections.
🔹 Sanitize all user-generated content before rendering.
🔹 Never allow JavaScript event handlers (onmouseover, onclick) in user inputs.
🔹 Use CSP headers to prevent inline script execution.

The 2009 Twitter Worm was a powerful reminder that even simple XSS flaws can have massive security implications. 🚀