the problem is, someone experienced who sees this might do a haarmful tweet just like this, before twitter shuts the feature down. I'd still do it for the fun of it though
@@JulzDrogenstube Right, but that's exactly why this tweet needed to be made. If Andy never made the tweet and twitter didn't know about it, then someone could've done something malicious. Security through obscurity does not work
@@JesusMowsMaLawn A call/email/message to twitter support could have been made. That way the cybersecurity team could have fixed it privately. Publicly exploiting the bug could have attracted people with malintent.
@@58book Nine times out of ten they just ignore your message. With this tweet, they were forced to fix it immediately, hopefully before anything malicious could be done Obviously I'm not going to say if it was objectively right or wrong, because I'm not the judge of that, but I personally feel that this was justified
What I find so hilarious about this they could've done anything. This gave the initial tweeter the power to log into any Twitter account using Tweetdeck in the world, send every twitter user to a website for ad-revenue, show an ad, do literally anything. No, they made it retweet itself because it would be funny.
That’s being a responsible programmer. An experienced coder has the power to potentially cause a LOT of damage, but it’s the ability to decide whether or not to do the right thing with said knowledge which is important. They did the (almost) right thing and disclosed the bug in a mostly non-destructive way. It’s the whole “just because you can doesn’t mean you should” argument. TL;DR - Not all programmers are dicks who want to break everything!
@@thaichicken0210 from the author: "The ❤ was one of the UTF8 characters that got an visual upgrade that day. Before the update it would've displayed in the same font & color as the rest of the tweet. With the released update it was turned into an inline image. To display that HTML code was allowed within a tweet"
You know, if you think about it, this probably wasn't done with any malicious intent. The guy probably read the changelog for the emoji update, noticed the massive security hole it caused, and because a report to Tweetdeck's developers would take very long to notice or get a response (and in that time somebody could do something truly problematic with it), he made it incredibly and immediately noticeable with a completely innocuous script. What a nice guy!
@MikatGaming yes, if the website or app is not properly protected from it. That script would most likely be longer than the maximum allowed characters though.
Despite being an attack and all (and the fact he could have just sent a request for a longer script), kudos to him for programming a retweeting tweet that could fit in 140 characters!
Additional technical note: At 5:21, the closing script tag isn't optional as he is sorta implying. It is required for the attack to work, otherwise the rest of the page would also be inside the script tag and it would ruin both the attack and the web page :)
Just gonna point out that TweetDeck *did* sanitize their user input usually, but in this one case, the emoji broke something inside of TweetDeck's sanitation software, and so the script was rendered as a true script tag. There are often bugs like this, where in some edge case, the "safeties" are accidentally turned off, and a lot of cyber attacks revolve around finding these bugs, and exploiting them.
The biggest and most important detail of this bug is that whatever they used to parse unicode emoji into pictures accidentally made the rest of the tweet get read as HTML. The heart was the most crucial part of that tweet.
2014: _"Some fairly significant disruption to what has unbelievably become an important part of how the world communicates. Worrying, isn't it?"_ 2021: This is one of the LEAST worrying things about Twitter.
What a nice guy to not do anything malicious with this knowledge. He specifically did a harmless thing instead of querying usernames and injecting stuff to release password hashes. A really nice guy and deserving of recognition.
You should check out some of his Computerphile videos, like timezones, internationalis(z)ation, and electronic voting. Those are the rants of the century.
Despite several attempts,methods,techniques & even the people pretending to be hackers I've encountered,i was finally refereed to this hacker on Instagram who finally gave me all i wanted from my partners mobile phone.If you are in the same shoe as me,i'm referring you to his Instagram page for help[@elitecoding007]..
There are two versions of jQuery - the current version, and vulnerable versions. And the current version is also vulnerable - we'll find out how in, say, two weeks.
With all ES6 and ES7 additions, there is currently no reason to use JQuery at all. Except if someone actually enjoys its counterproductive syntax that violates all OO-languages (which JS actually is) principles.
@@TheLukasz032 While I agree that JQuery should be discarded from maintained projects and never included into new projects, I disagree with your implication that "OO" means "better".
That guy, the one who made the self-retweeting tweet was awfully nice, with the abilty to run a script in your browser he could have redirected you to an add, or even place it on your page and make tons of money, or make you download a virus, or anything else they wanted. Note:those or are the mathematical one, not the normal one.
Despite several attempts,methods,techniques & even the people pretending to be hackers I've encountered,i was finally refereed to this hacker on Instagram who finally gave me all i wanted from my partners mobile phone.If you are in the same shoe as me,i'm referring you to his Instagram page for help[@elitecoding007].
@@danlarkman2450 referees? Shoes? My word association algorithm thinks you're looking for soccer cleats. Is this correct? Oh, no, you don't wear shoes, because you're a bot
Emoji support was added to Tweetdeck only two days ago, which they managed to screw up by not processing them safely. Without the heart emoji stuck on after the closing script tag, the tweet would have been sanitised and all would have been well.
I like how he's so into what hes saying lol "you shoudn't ever ever ever everrr..." He explains so well, really good job man! Keep up your perfect work :)
Doing the math, working off the screenshot from the BBC Twitter at 0:18, that tweet got roughly 108 retweets per second on average. I'm sure the actual rate was exponential and not linear, but that's still devastatingly impressive.
I don't know if you're still making them, but I am a linguistics enthusiast and I have to say your videos on that topic are ABSOLUTELY BRILLIANT. Seriously they're amazing. Cheers.
I'm pretty happy to see that *andy was apparently not banned and is actually still actively tweeting. They also link followers to your video for explanation which is nice.
Just for everyone here trying to use HTML in their comments, etc. doesn't work in the comments. You need to use Google's tags *Bold* - put * either side of the text _Italics_ - put _ either side of the text -Strikethrough- - put - either side of the text
***** The thing is, you can do a lot more: you only need about twenty characters to embed an external script file hosted elsewhere. That file can be as long as you like, as long as the hosting's up to it...
Though, most browsers have something called the same-origin policy, which will automatically block any attempts to load an external javascript file from a different domain than the page you're on. Typically the best you'll get out of an XSS attack these days is unfiltered input from a form, or from the URL string (a "reflected" vulnerability), or if you're lucky, you'll find a situation like the one in the video where you save your malicious code on the server, and it's loaded up even on simple pages, and neither when you save it, nor when you load it does it filter out risky characters (a "persistent" vulnerability)
@@ryannorthup3148 and on Linux you can add init=/bin/sh to your boot options. Needless to say, if you have physical access to a computer you can do a lot more than people would assume.
Just to be clear: the solution to preventing XSS is not to sanitize input and remove something that looks like an html tag. The solution is to correctly encode text before you spit it out into an HTML document.
Hahaha, same here. I had watched this video before but didn't understand it much. Now that I have learned HTML, JS and much more, I can understand it all.
Hey, this is actually very clever way to spread the word. Making an XSS script as a test if it actually works, and it then turns into a self retweeting tweet. Fits nicely into the limited space and lets the users know about it and they don't even need to spread it further, the script does that for them automatically. Nice.
You’re way better at cop,wining code than my actual computer science teacher. If you made a Java programming tutorial I would be doing way better in this class.
Great video Tom! Quick to put out and quality content, as usual. But wouldn't they have to actively remove it for that filter to drop off? Was it a spelling error or did someone do it on purpose? Hrm...
Generally, the most likely cause of XSS in professional websites is someone adding an output without first filtering it. So, if someone creates a new kind of output, like when they implement a new way of adding emojis for example, and they forget to add the encoding command, it will create a vulnerability. This doesn't mean the filter was turned off manually, but it was simply forgotten when adding a new feature.
joeytje50 ah, true. You'd think that a filter like that is in the in the base-tweet, and not on smaller parts that make out the tweet. I mean a simple htmlentities() could have prevented this from happening as a whole.
Fennoman yeah it could have, but it only takes _one_ mistake to be completely vulnurable to XSS. If someone forgets that once, they're vulnurable. And I don't know what their internal structure is, so I can't say how they could have prevented it. Simply removing any < and > wouldn't work though, because then you'd also filter out all the tags required for the emojis.
I think you could have gone into more detail about *why* this is so important. Your viewers may just shrug off a self-retweeting treat as something kind of benign, and it is. But the tweet could have done so much more, like stealing login sessions of the user. This reason this is a big deal is because it exposes an XSS vulnerability, not that someone's tweet can retweet
Oh, hey look. Its Fluttershy! But seriously: That is something that should not have happened. Thats one basic thing the QA should have checked: HTML-Injections (It can be pretty harmless but would have been enough to see this error.) Many Frameworks that are used now a days even do that for you. They just don't let this happen. But still it happens now and then that someone finds an error in a well know and well used software, where other Software-Devs just ask 'How could have this happened?'
You should do a follow-up on what the author could have done if he was more malicious. Perhaps he could have redirected people to another page on Twitter with more malicious tweets. The initial tweet would just retweet and redirect, then subsequent tweets would do things like follow/unfollow people, steal cookies, collect account information, include other scripts, maybe even mine bitcoin or send a bunch of requests to a specific server (DDoS).
@Tom Scott: i just found this video even though i subscribed years ago. anyway: the twitter account still exists and his tweet as well, its pinned actually.
this is a good reminder. it isnt like when building a site completely from the beginning that there's some kind of preinstalled filter you have to turn off to make the xss possible but you have to check any user input and html-escape it yourself, something that can quickly be forgotten when doing MANY other security things, like storing passwords safely and so on.
More HTML: is a paragraph is a break between paragraphs serves as italics serves as bold Makes you type in the title font of your page is a divider inside text I could go on and on, but I won't.
Honestly if I noticed this mistake in the website I would do the same thing, this is the harmless possible way to get the devs to notice the problem as quick as possible while also being cool, I bet if they had tried notifying through normal measures they would have just been ignored for weeks upon weeks, resulting in a potential huge data breach
David Yue You do know what I mean by deprecation, yeah? As in, works, but it won't forever; they will deprecate it. has been highly recommended for use for *years* because "bold" is a stylistic attribute whilst "strong" is a functional one, hence the separation of layout and style.
Tim Stahel Browsers still show tags as being bold, but not necessarily forever. The idea is that you can override it, and make something that's "strong" by making it bigger, or a different colour, or anything. It isn't tied in with a specific visual type. It also means that it's more descriptive of its function rather than style. For example, what does "bold text" mean to a blind person? Nothing. What does "strong" or "emphasised" language mean? Exactly what it says on the tin. That's the idea, and although it's mostly about terminology, it's the early stages of separating lots of stuff out so that it has the same meaning for all devices, people, etc and is more future-proof!
Luckily, one person can only retweet once per tweet. Everyone had only one retweeded heart on their profile, but it spread like virus: if you visited with Tweet Deck either the original profile OR other profile that already retweeted, you would retweet as well.
