Twitter new follow button clickjacking attack

[pierz]

Yesterday Twitter released a new follow button which allow to instantly follow a user by clicking it if your connected.

I've done a POC to exploit this button through a clickjacking attack, it makes an invisible button which automatically follow the mouse of the user, hence, making him following you when he click everywhere on the site.

The exploit and the demo are available on my blog :
http://serphacker.com/twitter/twitter-new-follow-button-clickjacking-attack.html

 

[robertw]

thanks for the share, what is your method for implementing this script? Any results??

 

[fung1990]

you r awesome.

 

[ch0pper]

does this work on wordpress?

 

[bookmarc]

does it work on phpbb?

 

[Aim100IM]

M gonna chk it now. Lets see if it is actually as good as your post

 

[clin407]

I'm logged into twitter and clicking on the demo page just makes a window popup.

 

[sunbros]

thank you buddy

 

[ch0pper]

you have be logged on twitter for it two work

I'm logged into twitter and clicking on the demo page just makes a window popup.

 

[clin407]

you have be logged on twitter for it two work

My first few words mentioned I'm logged into Twitter, did you read that?

 

[spirit of $]

Great share, I just try it too...very good. Thanks

 

[unknown00]

nice!!

 

[futurestic06]

i have never heard about this and also don't believe it
how it is possible to guide my mouse where to click without me???????

 

[pierz]

yes you can put it where you want WP/phpbb/whatever, it's just pure HTML/javascript. The script is just a demo, you could set the opacity to 0 in order to make the box invisible and catch the onclick event to remove the box immediatly after the user clicked. You can force the click by putting the button over an image/a link...

 

[coolmaster82]

cool stuff

 

[masterfl]

your demo worked like a charm, now time to think of the best way to implement it ^__^

 

[DavidHunke]

I think this will be working good with all and with wordpress too.

 

[webworld99]

Ill pay $100 for detailed instructions on how to set this up and use. Someone help please

 

[masterfl]

Ill pay $100 for detailed instructions on how to set this up and use. Someone help please

it was a pleasure doing business with you. enjoy the modified version of the code

 

[rawturtle]

i have never heard about this and also don't believe it
how it is possible to guide my mouse where to click without me???????

It is the power summoned by Javascript.