{"id":17,"date":"2010-05-05T02:29:50","date_gmt":"2010-05-05T01:29:50","guid":{"rendered":"http:\/\/www.stevenwhiting.com\/blog\/?p=17"},"modified":"2011-04-28T22:20:54","modified_gmt":"2011-04-28T21:20:54","slug":"twitter-security-hole-2","status":"publish","type":"post","link":"https:\/\/stevenwhiting.com\/blog\/?p=17","title":{"rendered":"Twitter Security Hole 2-NOW FIXED-"},"content":{"rendered":"

Same idea as the other security flaw I found. The change password page I thought would at least be secure but it appears, even this page, Twitter is sending the passwords out in plain text instead of encrypting them.<\/p>\n

Here the new password appears in the Username field of NetworkMiner. People may wonder what’s the use without a user name for these passwords. Well using other tabs in NetworkMiner you can get the username as well but I just never bothered to show that. Also, a lot of people have a bad habit of using the same password on other sites. So if someone gets your password for Twitter and you’re using it for, say, your googlemail account. If they find out your e-mail address then they’ll be able to get into that as well.<\/p>\n

<\/embed><\/object><\/p>\n

Further testing I changed the http to https before typing in the password. It’s making no difference. The password is still picked up by Wireshack and NetworkMiner. Meaning Twitter is sending the passwords in plain text.<\/p>\n

I’m crap at explaining stuff so for a better and easier to understand explanation of a Man in The Middle Attack, check out Hak5’s vid<\/p>\n

http:\/\/www.youtube.com\/watch?v=N86xJpna9Js<\/a><\/p>\n

UPDATE:<\/p>\n

netresec.com<\/a> used this video on their blog and said they reported this issue to Twitter security and got a swift reply. Good on them, but fuckers at Twitter never replied to me when I originally reported this. Besides, took them months to fix this which isn’t good.<\/p>\n","protected":false},"excerpt":{"rendered":"

Same idea as the other security flaw I found. The change password page I thought would at least be secure but it appears, even this page, Twitter is sending the passwords out in plain text instead of encrypting them. Here … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[53,69],"class_list":["post-17","post","type-post","status-publish","format-standard","hentry","category-security","tag-security-2","tag-twitter"],"_links":{"self":[{"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/17","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17"}],"version-history":[{"count":8,"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/17\/revisions"}],"predecessor-version":[{"id":541,"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/17\/revisions\/541"}],"wp:attachment":[{"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stevenwhiting.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}