Twitter accounts are being hijacked for spam

Re:Twitter accounts are being hijacked for spam by beager on Sunday May 26, 2019 @10:49AM (#20015174)

One thing which I didn’t see clarified here was the deceptive CNN domain. Either the preview card can be exploited to spoof CNN (bad on twitter) or CNN.com has an open redirect (bad on CNN).

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by simongr3dal on Sunday May 26, 2019 @11:04AM (#20015253)

As I understood it, twitter is following redirects to show the user the final destination in the card. The problem is the scammers recognise when twitter is generating the card and redirects twitter to a different domain than the what the actual user will be redirected to.

The problem is that twitter follows the redirects to show the final URL, presumably to support advertising companies that use third-party link tracking software like bit.ly, if they just showed the actual link they wouldn't have this problem.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by edent on Sunday May 26, 2019 @10:56AM (#20015209)

The preview card can be exploited by Twitter.

Visit https://cards-dev.twitter.com/validator and paste in the spam URL there. You'll see that the validator warns that it is being redirected, but follows it anyway.

CNN is blameless (as far as I can tell).

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by beager on Sunday May 26, 2019 @11:07AM (#20015271)

So the exploit is fake site -> user-agent specific redirector -> CNN. That would clear CNN.

I’m thinking through how Twitter would combat something like this. IMO they would flag new domains for manual approval (or hey, require TFA for self-serve ad accounts!) but both of these add to the cost and friction of their adtech.

Always a bummer when good security practice gets overruled by the need to squeeze every cent of revenue they can.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by jdietrich on Sunday May 26, 2019 @11:37AM (#20015432)

>I’m thinking through how Twitter would combat something like this.

Display the real link domain by default, but offer custom domains for manually verified advertisers. That obviously involves some degree of cost, but it's worthwhile to preserve trust in the platform.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by rubyfan on Sunday May 26, 2019 @11:25AM (#20015366)

Maybe twitter could show something on the card “CNN.com via malicious.example.com”? Personally I like knowing when I’m clicking a tracked or affiliate link anyway.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by liability on Sunday May 26, 2019 @11:33AM (#20015412)

I'm not sure how many people that would work for. If malicious.example.com were some pithy little domain on a trendy ccTLD like bit.ly, I think most twitter users would ignore it, assuming it was yet another URL shortener.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by nkozyra on Sunday May 26, 2019 @11:28AM (#20015378)

This is probably the only viable choice other than randomizing user agents, which is dicey enough on its own.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by leeoniya on Sunday May 26, 2019 @11:17AM (#20015318)

> I’m thinking through how Twitter would combat something like this.

twitter's bot can pull the link via Tor with a randomized UA

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by rubyfan on Sunday May 26, 2019 @11:23AM (#20015351)

Can’t you just time the redirect so that when you create the card you point to CNN then change the redirect to something malicious afterward?

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by Sephr on Sunday May 26, 2019 @12:31PM (#20015736)

The list of Tor exit nodes is public.

I can detect public Tor IP addresses and give them a different redirect with Zerodrop: https://eligrey.com/blog/zerodrop/

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by lozenge on Sunday May 26, 2019 @12:57PM (#20015891)

For ads they can verify domain ownership (TXT dns record, or verification file or HTML meta tag served from your domain).

For links in Tweets, they can show the actual URL (domain part at least) instead of the t.co shortened URL.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by JetSpiegel on Sunday May 26, 2019 @03:08PM (#20016785)

But not using t.co means Twitter doesn't track every single click on their platform, defeating the purpose.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by caffeinewriter on Sunday May 26, 2019 @12:03PM (#20015593)

This isn't a new problem. Cloaking[1] has been around for a long time. Google[2], and Facebook[3] have been fighting this problem for years. Even Google hasn't had perfect luck with fighting off cloakers[4].

[1]: https://charlesngo.com/cloaking/ [2]: https://support.google.com/adspolicy/answer/6020954?hl=en#31... [3]: http://fortune.com/2017/08/09/facebook-cloaking-spam-adverti... [4]: https://wp.josh.com/2019/05/06/breaking-news-google-adwords-...

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by TazeTSchnitzel on Sunday May 26, 2019 @12:45PM (#20015824)

There is a proper solution, and that is to show the actual URL. If that hurts URL shorteners and trackers, so be it.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by avian on Sunday May 26, 2019 @11:04AM (#20015250)

Very likely this is the same issue that was recently discussed in the context of Google ads.

Ad campaigns commonly use tracking redirects and it may be an intentional Twitter feature that the preview card hides intermediate domains.

https://news.ycombinator.com/item?id=19858552

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by akersten on Sunday May 26, 2019 @10:56AM (#20015208)

The malicious webserver is probably redirecting the Twitter crawler based on its user-agent to CNN, and Twitter's redirect-busting is helpfully pulling in the "final" destination.

[ Parent | on HN ]