If you havn’t updated the official Twitter iPhone app on your iPhone/iPod recently, you may want to do so as I’ve found something in the app version (3.3.0) previous to the current one (3.3.1). If you’ve updated to the latest version since the 9th or so, you’re fine. This affects only the official Twitter app for iPhone/iPod, not Twitterrific or others.
I found a security hole in the 3.3.0 Twitter iPhone app! You can inject your own HTML, CSS and JavaScript into the iPhone client, this hack leaves users wide open to phishing scams and the sort.
I haven’t tested the full possibilities of this but I imagine there are loads here! The hack I’m demoing adds JavaScript remotely (in this case ‘tweet.js’) to the view, it executes, spoofs a warning pop up, tapping either ‘Ok’ or ‘Cancel’ brings you to a new page regardless, this page can be anything, in this case I’ve set it to look like a Twitter login page, which upon entering a users details, could, via a form, be emailed back to someone.
Heres the screenshots and a walkthrough:
1. Tweet containing the JavaScript to inject (the ‘<script>‘ bit)
2.Intial view with scrolling warning text
3.’Warning’ pop up, (appears after 3.5 secs), pressing either button sends you to our phishing site, no way out (*wimper*)
4.Fake Twitter account protect page
5.Upon press of ‘Protect Account’ button, sends you to my site (or any site with nastier stuff or could email entered details)
What you do?
UPDATE your Twitter app via the AppStore, should you be unable to do so, stay the hell away from any tweets that contain any tags like ‘<html>‘ or ‘<script>‘, you’ll notice the weird link. You can see if a tweet contains this from your main timeline view in the app.
Well at least she got 10 points…