Almost 24 hours after the first cross-site scripting (XSS) attack on Twitter, that resulted in thousands of tweets linking to StalkDaily, they are under attack again. This new threat comes only hours after Twitter announced that they had closed a security vulnerability that had allowed the so-called, "StalkDaily Worm" to spread through a JavaScript injection on user profiles.

A little while after the first exploit was patched, an interview with Mikeyy Mooney stated that the 17-year-old owner of the StalkDaily site was responsible. The StalkDaily site was then updated to show the following message:

I have came clean and have accepted the responsibility for the worm, read the interview here, http://www.bnonews.com/news/242.html.

Twitter thought it had sorted the issue and so they went to bed – well that's what it seemed, as it took them ages to notice the next wave. However, that wasn't it and as soon as Mikeyy got his newest script hosted, he activated wave 2, utilising an even bigger hole in the system. It enabled him to spam messages, as before, follow the user @onedegrees – who has now been suspended – change your name, your URL and your Twitter design's link colour.

This time, tweets were being sent out with the word Mikeyy in them and they included warnings to Twitter to fix the issue, such as:

Dude, Mikeyy is the shit! :)
Man, Twitter can't fix shit. Mikeyy owns. :)
Mikeyy. Woooo!
Wow…Mikeyy.
Dude! Mikeyy! Seriously? Haha. ;)
Twitter should really fix this… Mikeyy
Twitter please fix this, regards Mikeyy
damn mikeyy. haha.
Mikeyy is done..
Mikeyy I am done…

All you had to do was visit an infected user page and you too would become infected. It uses a simple XSS injection that, when executed, infects your own user page and spams your timeline with the above messages. Many people thought it was a virus that they had downloaded or that someone had logged into their account. This is not true, in fact, the script itself is completely harmless and does not compromise your Twitter password. It simply uses your web browser's cookies and JavaScript to tweet one of the random messages. No-one has actually logged into your account.

Once you had visited an infected user page, your name would be changed to "Mikeyy Owns", you would automatically follow @onedegrees, your link colour will have changed to a fluorescent blue and your URL changed to one of the many obfuscated JavaScript injections. This meant that every time someone else visited your page, they too would become infected. Truthfully, it was an extremely effective worm; it spread like wildfire.

Clearly, Twitter had a major problem on their hands. However, the biggest problem is the viral nature of social networking itself. The code sent out tweets under your name, but instead of users just ignoring it, they hit the panic button and re-tweeted anything they saw, which just compounded the problem. Twitter is aware of the problem and is apparently working on it. Any re-tweets are just adding to this guys notoriety and ensuring his name won't be forgotten in a hurry.

I saw a lot of tweets claiming you needed to change your password. This made the matter worse and gave people something more to panic about. Changing your password stops the script from running because the cookie made by Twitter gets destroyed (changing passwords means you would have to log out and back in, which resets your session). The session is what the script relies on to post the tweets. So even after changing your password, if you visited an infected user page, your account could still be reinfected. If your profile was infected, all you had to do was delete any tweets on your account that were not written by you and check all of your settings fields – most importantly name and URL. The coder never actually got to see any passwords, e-mails or names.

Twitter claim to have fixed the loopholes. Their blog post regarding the attacks gives us the low-down on what they did, are doing and going to do. According to that post, there were actually 3 waves of attacks, that began yesterday. The first and second waves compromised roughly 100 accounts each, while the third wave today, mangaged to rack up nearly 10,000 tweets. However, this whole experience is not over yet and there will likely be variations of this worm released over the next few days, so just be careful what you click.