How The Self-Retweeting Tweet Worked: Cross-Site Scripting (XSS) and Twitter

tomscott.com - / tomscott - It should never have happened. Defending against cross-site scripting (XSS) attacks is Web Security 101. And yet, today, there was a self-retweeting tweet that hit a heck of a lot of people - anyone using Tweetdeck, Twitter's "professional" client. How did it work? Time to break down the code. (Remember the old Myspace worms? They worked the same way.)
THE SELF-RETWEETING TWEET: / 476764918763749376

[@kopissimooo]

"I'm simplifying massively, here..." is Tom's catch-phrase.

[@Karaboo7]

Tom thinks we're dumb. (and he's correct)

[@joshbuck1586]

*_-why-_*

[@kaaaallll]

"So today we're talking about the physics of a swing set and *im simplifying massively here* ..."

[@oliversmith1842]

Nah it’s definitely “AND it works!”

[@sacchar1n3]

ON MERCH

[@datar0t273]

"find the parents" ... I've been trying

[@parsonsmarcus]

I was just out grabbing some beer for 13 years ago. Relax, kid. Jesus.

[@rysea9855]

That's.. Deep

[@esoij]

Rumors say he's still looking to this day.

[@CrypticConsole]

Oof

[@senza4591]

Uuf

[@Radium_Alarie]

7 years later, the creator's account is still around, and this is his pinned tweet

[@jamesharding3459]

Awesome

[@CodaMission]

What a flex

[@crewrangergaming9582]

why shouldn't it be

[@MeiinUK]

If it is removed, the market will crash.... OooOoooOoooOoo... But I think some bigger sandboxes have been created now, hasn't it ? We can relax.

[@Jessev741]

He outlived Twitter

[@KorvusAracen]

You know, if you think about it, this probably wasn't done with any malicious intent. The guy probably read the changelog for the emoji update, noticed the massive security hole it caused, and because a report to Tweetdeck's developers would take very long to notice or get a response (and in that time somebody could do something truly problematic with it), he made it incredibly and immediately noticeable with a completely innocuous script. What a nice guy!

[@chsxtian]

***** Rather this than something that shows a fake login form or secretly mines your data

[@vengefulenigma]

didn't the guy get like 5 years in prison or something like that for this?

[@RWoody1995]

since the account has still been tweeting since (and the tweet itself wasn't even so much as removed) i doubt it.

[@baymax1550]

white hat+illegal stuff = grey hat good intention then he is a nice guy :)

[@quakducc2274]

@92Dups would YOU want someone rummaging around with your websites code with no idea on there intent?

[@jacobjp5487]

I swear Tom Scott is that cool subsitute teacher you never got Edit: thanks for all of the likes! I never imagined that I would get so much attention.

[@xuhuiming2694]

Jacob JP nevernevernevernevernevernevernever

[@sxes]

Never

[@lordfrog5740]

substitute*

[@EddieKMusic]

"cool"

[@TomboyCEO]

I got those before. One was a jeopardy champion.

[@GibusWearingMann]

Andy's profile picture and tweet still exist on Twitter. He's changed his profile picture to a different Fluttershy, even.

[@user-cl6jp5vj1g]

oof where

[@myjorts]

i know this comment is dead, but link in description to self-retweeting tweet

[@yanis7336]

Hi

[@zyugyzarc]

a flutter- what?

[@GibusWearingMann]

@@zyugyzarc the yellow pegasus pictured is named Fluttershy. Also, the tweet is still up four years later.

[@Sollace]

Up next: The self-liking KZbin video.

[@0_-]

please do that

[@inactive6200]

Well someone did make a KZbin video that knows it’s own url

[@p0xygen]

@@inactive6200 thats very easy though..multiple people have done it years ago and it's not an exploit

[@Slave-of-the-most-merciful]

I hate your pfp

[@h-Films]

Master I hate u

[@znefas]

I've never seen Tom so angry, seriously.

[@Netugi]

You should check out some of his Computerphile videos, like timezones, internationalis(z)ation, and electronic voting. Those are the rants of the century.

[@extrahourinthepit]

I’ve read him that angry, certainly. Really shouldn’t have sent him that email.

[@extrahourinthepit]

To those wondering whether I’m joking, I’m not. I REALLY should not have sent him that email

[@trubiso]

@@extrahourinthepit ???????????

[@nilen]

Google Cendrum Yep, the email was of bad character

[@deanobeany]

I don't really understand what we're talking about here, but I know that the filter should never ever ever ever ever EVER have been off.

[@xlorrix-6320]

yep never ever ever ever ever EVER turned off

[@HaustierYui]

A very good and easy to understand explanation of XSS. Very worthwhile watching. Keep up the good work.

[@Tagglink]

The explanation of XSS should be credited to the person who wrote the tweet. That was their purpose.

[@BakerbrothertvOfficial]

So anybody who looked at the tweet retweeted it?

[@Fennoman12]

Yes.

[@BakerbrothertvOfficial]

It's a shame that you can only tweet 140 characters otherwise he could have done a lot more!

[@TomScottGo]

***** The thing is, you can do a lot more: you only need about twenty characters to embed an external script file hosted elsewhere. That file can be as long as you like, as long as the hosting's up to it...

[@BakerbrothertvOfficial]

They could have had it retweet an advert and wrote @justinbieber @ pewdiepie

[@JackBond1234]

Though, most browsers have something called the same-origin policy, which will automatically block any attempts to load an external javascript file from a different domain than the page you're on. Typically the best you'll get out of an XSS attack these days is unfiltered input from a form, or from the URL string (a "reflected" vulnerability), or if you're lucky, you'll find a situation like the one in the video where you save your malicious code on the server, and it's loaded up even on simple pages, and neither when you save it, nor when you load it does it filter out risky characters (a "persistent" vulnerability)

[@Selur91]

That guy, the one who made the self-retweeting tweet was awfully nice, with the abilty to run a script in your browser he could have redirected you to an add, or even place it on your page and make tons of money, or make you download a virus, or anything else they wanted. Note:those or are the mathematical one, not the normal one.

[@coolguy284_2]

@maskyschannel dang, i know, because its totally false. modern js parsers are better than that, with all the exploits fixed

[@coolguy284_2]

not anything else, bc javascript is a limited language

[@danlarkman2450]

Despite several attempts,methods,techniques & even the people pretending to be hackers I've encountered,i was finally refereed to this hacker on Instagram who finally gave me all i wanted from my partners mobile phone.If you are in the same shoe as me,i'm referring you to his Instagram page for help[@elitecoding007].

[@joshyoung1440]

@@danlarkman2450 referees? Shoes? My word association algorithm thinks you're looking for soccer cleats. Is this correct? Oh, no, you don't wear shoes, because you're a bot

[@glitcher880]

I like how he's so into what hes saying lol "you shoudn't ever ever ever everrr..." He explains so well, really good job man! Keep up your perfect work :)

[@azenetmc]

AFAIK, the heart was mandatory for the injection to work.

[@MandrakeHorse]

Emoji support was added to Tweetdeck only two days ago, which they managed to screw up by not processing them safely. Without the heart emoji stuck on after the closing script tag, the tweet would have been sanitised and all would have been well.

[@ArturoStojanoff]

I don't know if you're still making them, but I am a linguistics enthusiast and I have to say your videos on that topic are ABSOLUTELY BRILLIANT. Seriously they're amazing. Cheers.

[@haider4899]

never EVER EVER EVA EVAAAAA

[@paintspot]

GETTING BACK TOGETHER -Paintspot Infez Wasabi! Like if you agree Reply if you've heard of me

[@Stallnig]

Fo eva? For eva eva?

[@skhtrm]

Love how the original tweet has a Fluttershy profile picture

[@skhtrm]

Iggy Tubmen ?

[@Chrnan6710]

+Iggy Tubmen Hey look, a tweet by a brony. Let's ignore what the tweet says and hate on something that ISN'T EVEN RELEVANT!

[@commentator3513]

+BigGamer2525 You should go back to school.

[@BigGamer2525]

SquidPlays no ur a back to school night

[@commentator3513]

BigGamer2525 Your grammar is atrocious. What are you, 9?

[@arooobine]

$('.xss').for(int i = 0; i < script.size(); i++){alert("How to make someone read nonsense code.");}END IF

[@Lou_0b1]

Can you actually increment and decrement with js?

[@Akronymus_]

of course you can. thats one of the most basic instructions

[@commentator3513]

How do you think cookie clicker works? That thing is pure js

[@Lou_0b1]

Commentator Instead of increment you could just say X=X+1.

[@itsthesola10]

END IF

[@hats1642]

As of March 2021, the original tweet is still up!

[@uuhamm]

Just to be clear: the solution to preventing XSS is not to sanitize input and remove something that looks like an html tag. The solution is to correctly encode text before you spit it out into an HTML document.

[@jarnMod]

alert('Yeah, I know it wont work');

[@Axel-ro7dn]

Here's why: special characters (like < which are needed for tags) are replaced by entities. They render the same as '

[@raskr8137]

I find a smiley! ;

[@BailsDaCableMan]

wait till Tom hears about the root user without a password in MACOS High sierra

[@ryannorthup3148]

Or the fact that there's an exploit in Windows 10 to create a user with admin privileges through the recovery boot command line (X:).

[@realjameskii]

@@ryannorthup3148 well that would have been nice to know regaining access of my computer

[@abc-li7cq]

@@ryannorthup3148 and on Linux you can add init=/bin/sh to your boot options. Needless to say, if you have physical access to a computer you can do a lot more than people would assume.

[@nodell8729]

@@ryannorthup3148 Again? Like c'mon windows, it has been already in 7

[@leBAT54]

Wait, I just realized that the tweet got sent at 5pm (UK) but you still managed to upload that video on that day. Big cheers Tom!

[@MeiinUK]

Suspicious isn't it ? In "real time" !

[@CZghost]

Hey, this is actually very clever way to spread the word. Making an XSS script as a test if it actually works, and it then turns into a self retweeting tweet. Fits nicely into the limited space and lets the users know about it and they don't even need to spread it further, the script does that for them automatically. Nice.

[@kaylasolace]

I love how the person who made this is a brony

[@lukenoble2539]

Correction: how the self-reXing X worked: Cross-Site Scripting (XSS) and X

[@bettercalldelta]

The fix is literally replace "

[@ToastGreeting]

I like their profile picture, Fluttershy is good

[@xtzyshuadog]

I learned some HTML, CSS, and JavaScript. And now I learned what $ means. Thank you.

[@nopenope7184]

Its from jQuery...

[@dcallstar51]

You should do a follow-up on what the author could have done if he was more malicious. Perhaps he could have redirected people to another page on Twitter with more malicious tweets. The initial tweet would just retweet and redirect, then subsequent tweets would do things like follow/unfollow people, steal cookies, collect account information, include other scripts, maybe even mine bitcoin or send a bunch of requests to a specific server (DDoS).

[@Megapixel8063]

You’re way better at cop,wining code than my actual computer science teacher. If you made a Java programming tutorial I would be doing way better in this class.

[@TaiTheDoggo]

Oh, hey look. Its Fluttershy! But seriously: That is something that should not have happened. Thats one basic thing the QA should have checked: HTML-Injections (It can be pretty harmless but would have been enough to see this error.) Many Frameworks that are used now a days even do that for you. They just don't let this happen. But still it happens now and then that someone finds an error in a well know and well used software, where other Software-Devs just ask 'How could have this happened?'

[@My1xT]

this is a good reminder. it isnt like when building a site completely from the beginning that there's some kind of preinstalled filter you have to turn off to make the xss possible but you have to check any user input and html-escape it yourself, something that can quickly be forgotten when doing MANY other security things, like storing passwords safely and so on.

[@alluviumboar]

Wait Tom writes H like a backwards N

[@felix56p]

my response is your username

[@rakinrahman890]

@@felix56p OOOOOOOHHHHHHHH

[@puspamadak]

Alternative title: When you don't pay the intern developer enough amount for their work

[@keaare9478]

Tom Scott had just forgot about acustics, i mean this should never happen, this is video basics 101 and yet here we are

[@shugaroony]

Love Tom's channel, but there is nothing duller than programming.

[@PhillipH-san]

Nice profile pic there, Andy! Lmao

[@JoseGonzalez-rt5fk]

Is it weird that I smelled the sharpie he was writing with and I thought he was using a pen? I did not have any open sharpie near me either.

[@zachogilman7397]

More HTML: is a paragraph is a break between paragraphs serves as italics serves as bold Makes you type in the title font of your page is a divider inside text I could go on and on, but I won't.

[@groszak1]

both , , and are newlines

[@TwoGoblinsInATrenchCoat]

Thanks. I'm an idiot, so it's nice to be walked through the process of how it all went down.

[@sarahlikestreez]

I watch your videos because they make me feel smart.

[@HomeGunMaker]

I remember in 2011 there was a tweet that exploited “on mouse runover” or smth like that, that also self-retweeted when people pased the mouse over it, and ir caused twitter to crash worldwide until they disabled it

[@dynomitediamond6296]

HomeGun Maker that was MySpace I think

[@hazardeur]

this is as emotional as i have ever seen this guy get. it's a topic dear to his heart

[@reichenwald-gm4qd]

I think some people don't have a job after this. XSS is something so simple and should never happen. And the filter isn't turned off as you said, it just isn't written im the code to filter the input befor showing it

[@RedsBoneStuff]

'); DROP TABLE *

[@ShimrraJamaane]

You forgot the '; --' at the end.

[@sethadkins546]

DROP ALL DATABASES

[@cscscscss]

*table falls through the ground*

[@bassam_salim]

I did that to my college's login page, the website was down but it did work the next day, I freaked out, thought I crashed the website and they will find me

[@lepels]

"That filter should never ever ever be turned off". It's not a filter you turn on, it's something you either develop or not, or a function you yourself have to run over the inputted text. Wish it would be as simple as having some filter always on by default, would prevent a lot of this stuff.

[@cole5411]

Honestly, I learned more about code in this video than most tutorials on here

[@K-----]

Anyone else go blind for a sec because of the black bars in the background. That was one hell of an optical trick looking away.

[@jamesjamesjsmes909]

I'm a nonce

[@jamesjamesjsmes909]

oops

[@ATP980]

nice code m8

[@jamesjamesjsmes909]

shh

[@Prawny]

That's not a nonce. A nonce looks more like b192fc4204

[@user-pq3do4wt6c]

hello

[@leoleo4469]

2:03 Hey, wait a second... you got hit with the self-retweet too, didn't you? I see you in that list.

[@thetruemizukageyagura9061]

God, Tom the end of this video gave me chills.

[@Sypaka]

Well this tweet spread faster then any other sickness on this planet.

[@michaelrandall4862]

Not there yet but I NOW understand everything regarding. new subscriber for sure.

[@keesalemon]

I don't think I've seen Tom so worked up in a while!

[@trombonista92]

you forgot to mention Fluttershy!

[@MrMathyMan]

Go away

[@trombonista92]

hmm.. ok...if you want me to (troll face)

[@Bluuu3]

krt you're 2 years late

[@KROLILP]

Gigantickookie and still so relevant

[@theywalkinguptoyouand4060]

trombonista92 using "(troll face)"? Seriously?

[@fabianehrmann832]

My friend found this problem in my schools online long response answers but you can select HTML in long response answers so you can make code that closes the tab whenever the marker hovers over the question, it is still to be resolved and the school is yet to realize.

[@Stardust_42]

Gotta love the fluttershy profile pic.

[@Phoenix-mh3rx]

Flutters!

[@MissyFaye]

thank you neopets coding for letting me understand this mad prank

[@MrUhlus]

ⓐⓛⓣⓔⓡⓘⓝⓖ ⓣⓔⓧⓣ ⓘⓢ ⓕⓤⓝ

[@thesolaruniverse9776]

How on earth did you do *that* ?!

[@solarity1239]

The Solar Universe *-its-* _an_ -a-*p*_p_

[@walterlol]

I will have to report you to google for XSS.

[@Hyblup]

Galaxy ⓈⒽⒽ

[@robertlinke2666]

wait, are those just regional indicators?

[@doubleu7313]

Reminds me of that 4chan raid on youtube a couple years before that, where everyone posted scripts as comments. That was patched quickly though, but still shows that Twitter wasn't an outlier in this regard.

[@Awanys]

Oh, really -bad- *great* video! _greetings from Czech republic_

[@_HappyRadio_]

yey fellow čech!

[@Awanys]

@@_HappyRadio_ yeey zdravíčko

[@F17A]

i know this wont work but meh

[@Tibromatic]

I love how a major tech company just named its next generation console XSS.

[@adre2194]

Hoping Elon brings this back

[@thecharmingnavigator9946]

I don't understand but somehow still enjoyed the video. You're a wizard Tommy

[@MegaBrokenstar]

Classic example of ethical hacking. Demonstrating a security hole so that it can be fixed, rather than taking advantage of it for something malicious.

[@d_akios3520]

2:27 someone please make 10 hours of never ever ever ever ever ever ever ever it sounds cool

[@ascentfevers]

I'll do it tomorrow if I remember

[@DankLordDemaar]

@@ascentfevers I think you forgot.

[@adygombos4469]

I would've tweeted "but most of all, samy is my hero"

[@NonTwinBrothers]

Nia

[@neoney]

Wow you just did that

[@rasmitdevkota5295]

this aged fantastically

[@DarkBraveStuff]

*yay now my text is bold*

[@namelessguy199]

never ever Ever EVER *EVER* *E V E R*

[@MikeyD594]

and here we are, 7 years later and java have missed an issue where someone can send some text and anything else they want to anyone

[@mattjw16]

2014: 2015: 2016: 2017: 2018: 2019: *Hey let’s put this is people’s recommended!*

[@leotamer5]

KZbin knows we require more Tom Scott.

[@joee374]

Best explanation of html and xss i’ve heard

[@Supuhstar]

gotta love Brony hackers

[@skhtrm]

Yup noticed it too

[@Supuhstar]

Tim Stahel Turns out, preferences in television shows have no bearing on intelligence! A hacker with the alias "Pinkie Pie" wins the Chrome hacking event each year! Google it if you don't believe me ;)

[@Crick1952]

+Orghter haxor unlocked. much fear

[@teamdoodz]

"You can use for italics" That didn't age well...

[@wariolandgoldpiramid]

What do you mean?

[@nazzlan]

*_-test-_*

[@Gami67]

what I want to know is why the accounts shown were the ones selected to be shown as the ones who retweeted it

[@danannytp8509]

hello there alert("You are watching Tom Scott")

[@patemathic]

How to make Tom Scott so angry he almost gets red as a tomato. Deactivate the XSS filter.

[@ItsTheJackpot]

Tom is passionate about that never ever ever that it became a little awkward

[@greenerell484]

how do you miss this I learnt this in high school computing class

[@notafox]

Self swiping Tinder accounts are next

[@rohaanomar7003]

I still don't think I quite understand the security part

[@trueboxguy5421]

I don't understand why twitter doesn't have CSP as an additional layer. I saw this years ago but I decided to watch it again.

[@legendgames128]

An alternate universe where it was a malicious piece of code meant to take down the Twitter company itself would have significantly changed the internet.

[@jamestheotherone742]

And I still don't have a Twitter account.

[@teranyan]

You think this is worrying? Javascript on websites is literal remote code execution that most people accept because they don't know any better. I'd say THAT is worrying.

[@Muhammad-sx7wr]

*The spreading love tweet.*

[@sciblastofficial9833]

Hey, self retweeting tweets are very useful! That’s how we can defend ourselves from chain mails! Here’s an example. How about this one I designed? If you don’t retweet this message to blahblahblah people, blahblahblahblahblah will happen. Then you retweet it, but it’s a self retweeting tweet, and then if Person 2 (abbreviated as P2) saw the message, they would get worried. But then things would get crazier as the message retweeted itself to more people, basically fulfilling its own purpose.

[@sciblastofficial9833]

Or another superweird one... A self retweeting tweet that hacks the victims computer to make it order 1 chocolate Hersheys bar from Amazon, then within the course of 24 hours, deletes itself

[@PA551ON]

I love how the guy who did this has a profile picture of Fluttershy

[@naverilllang]

It looks like this guy made the code as a warning to the devs to fix it, and not malicious.

[@Mr.FastZombie]

It did not happen in this case it seems, but even when it is non-malicious sometimes they still try to punish you.

[@JulzDrogenstube]

the problem is, someone experienced who sees this might do a haarmful tweet just like this, before twitter shuts the feature down. I'd still do it for the fun of it though

[@JesusMowsMaLawn]

@@JulzDrogenstube Right, but that's exactly why this tweet needed to be made. If Andy never made the tweet and twitter didn't know about it, then someone could've done something malicious. Security through obscurity does not work

[@58book]

@@JesusMowsMaLawn A call/email/message to twitter support could have been made. That way the cybersecurity team could have fixed it privately. Publicly exploiting the bug could have attracted people with malintent.

[@JesusMowsMaLawn]

​@@58book Nine times out of ten they just ignore your message. With this tweet, they were forced to fix it immediately, hopefully before anything malicious could be done Obviously I'm not going to say if it was objectively right or wrong, because I'm not the judge of that, but I personally feel that this was justified

[@chris-hayes]

What I find so hilarious about this they could've done anything. This gave the initial tweeter the power to log into any Twitter account using Tweetdeck in the world, send every twitter user to a website for ad-revenue, show an ad, do literally anything. No, they made it retweet itself because it would be funny.

[@JetFalcon710]

They made the tweet as a warning to the Devs, and didn't want to do anything malicious

[@__8120]

Anything as long as it fit into 140 characters

[@chris-hayes]

@@__8120 linking an external script wouldn't have that constraint, could've written a novel.

[@78Shockwave87]

That’s being a responsible programmer. An experienced coder has the power to potentially cause a LOT of damage, but it’s the ability to decide whether or not to do the right thing with said knowledge which is important. They did the (almost) right thing and disclosed the bug in a mostly non-destructive way. It’s the whole “just because you can doesn’t mean you should” argument. TL;DR - Not all programmers are dicks who want to break everything!

[@ammyvl1]

@@__8120 No you can just do

[@mayu-go3gz]

the heart emoji was actually necessary because it took advantage of how that unicode was processed by tweetdeck at the time

[@thaichicken0210]

how so?

[@Zlysium]

@@thaichicken0210 Tweetdeck did sanitize user input except for a bug with emoji that broke the sanitation. Without the emoji the XSS didn't work.

[@Sage_the_Turt]

@@thaichicken0210 from the author: "The ❤ was one of the UTF8 characters that got an visual upgrade that day. Before the update it would've displayed in the same font & color as the rest of the tweet. With the released update it was turned into an inline image. To display that HTML code was allowed within a tweet"

[@SiveenO]

->doesn't sanitize user input ->something bad happens ->surprised magic cat face

[@alicialay166]

Ik u didn't ask but I'm taking gcse computer science and the fact that I understood this comment makes me really happy, thanks

[@dexterhaxxor]

@@chy4e431 That's called sanitazation.

[@dexterhaxxor]

@@chy4e431 sanitizing user input means replecing special characters with escape sequences, such as '

[@cameronwebster6866]

Mrs. Roberts would be proud.

[@stroopwafelfalafel]

did you just call pikachu a magic cat?

[@-anton]

I'm happy he didn't use it for something malicious.

[@thesmellofpinetrees7688]

It's kinda sad he didn't make it retweet something offensive about a politician.

[@operator8014]

All modern politicians are offensive enough on their own, there's no more that it could have done.

[@gredangeo]

Just follow a politician on Twitter if you feel like reading some obnoxious tweets. There are some really stupid people out there.

[@BlockOfRed]

I know him, he's a nice guy and very friendly :)

[@kuipert4195]

@MikatGaming yes, if the website or app is not properly protected from it. That script would most likely be longer than the maximum allowed characters though.

[@pugpuggle3327]

"It should nevernevernevernevernevernever be turned off" *everyone tries code like KZbin forgot that never^6*

[@wolbobus2130]

I think i just had a stroke while trying to read that.

[@jimmyjim5yearsago376]

[@mothlastname2413]

Or you could not because its a felony to even attempt it

[@evaahh9584]

TIMΞ СнΛИGΣ which law exactly? Because there are very few things that are illegal to even attempt that aren’t just a separate crime.

[@stacklysm]

@@wolbobus2130 Lmao, I was starting to get angry at myself for not understanding