Twitter accounts are being hijacked for spam

Re:Twitter accounts are being hijacked for spam by edent on Sunday May 26, 2019 @10:56AM (#20015209)

The preview card can be exploited by Twitter.

Visit https://cards-dev.twitter.com/validator and paste in the spam URL there. You'll see that the validator warns that it is being redirected, but follows it anyway.

CNN is blameless (as far as I can tell).

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by beager on Sunday May 26, 2019 @11:07AM (#20015271)

So the exploit is fake site -> user-agent specific redirector -> CNN. That would clear CNN.

I’m thinking through how Twitter would combat something like this. IMO they would flag new domains for manual approval (or hey, require TFA for self-serve ad accounts!) but both of these add to the cost and friction of their adtech.

Always a bummer when good security practice gets overruled by the need to squeeze every cent of revenue they can.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by jdietrich on Sunday May 26, 2019 @11:37AM (#20015432)

>I’m thinking through how Twitter would combat something like this.

Display the real link domain by default, but offer custom domains for manually verified advertisers. That obviously involves some degree of cost, but it's worthwhile to preserve trust in the platform.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by rubyfan on Sunday May 26, 2019 @11:25AM (#20015366)

Maybe twitter could show something on the card “CNN.com via malicious.example.com”? Personally I like knowing when I’m clicking a tracked or affiliate link anyway.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by liability on Sunday May 26, 2019 @11:33AM (#20015412)

I'm not sure how many people that would work for. If malicious.example.com were some pithy little domain on a trendy ccTLD like bit.ly, I think most twitter users would ignore it, assuming it was yet another URL shortener.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by nkozyra on Sunday May 26, 2019 @11:28AM (#20015378)

This is probably the only viable choice other than randomizing user agents, which is dicey enough on its own.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by leeoniya on Sunday May 26, 2019 @11:17AM (#20015318)

> I’m thinking through how Twitter would combat something like this.

twitter's bot can pull the link via Tor with a randomized UA

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by rubyfan on Sunday May 26, 2019 @11:23AM (#20015351)

Can’t you just time the redirect so that when you create the card you point to CNN then change the redirect to something malicious afterward?

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by Sephr on Sunday May 26, 2019 @12:31PM (#20015736)

The list of Tor exit nodes is public.

I can detect public Tor IP addresses and give them a different redirect with Zerodrop: https://eligrey.com/blog/zerodrop/

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by lozenge on Sunday May 26, 2019 @12:57PM (#20015891)

For ads they can verify domain ownership (TXT dns record, or verification file or HTML meta tag served from your domain).

For links in Tweets, they can show the actual URL (domain part at least) instead of the t.co shortened URL.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by JetSpiegel on Sunday May 26, 2019 @03:08PM (#20016785)

But not using t.co means Twitter doesn't track every single click on their platform, defeating the purpose.

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by caffeinewriter on Sunday May 26, 2019 @12:03PM (#20015593)

This isn't a new problem. Cloaking[1] has been around for a long time. Google[2], and Facebook[3] have been fighting this problem for years. Even Google hasn't had perfect luck with fighting off cloakers[4].

[1]: https://charlesngo.com/cloaking/ [2]: https://support.google.com/adspolicy/answer/6020954?hl=en#31... [3]: http://fortune.com/2017/08/09/facebook-cloaking-spam-adverti... [4]: https://wp.josh.com/2019/05/06/breaking-news-google-adwords-...

[ Parent | on HN ]

Re:Twitter accounts are being hijacked for spam by TazeTSchnitzel on Sunday May 26, 2019 @12:45PM (#20015824)

There is a proper solution, and that is to show the actual URL. If that hurts URL shorteners and trackers, so be it.

[ Parent | on HN ]