Twitter mouse-over flaw spawns potentially dangerous links

A security flaw has made Twitter's Website a chaotic and potentially unsafe place, filled with annoying pop-up windows that activate just by rolling the mouse over another user's tweets.

The flaw is activated by inserting a line of JavaScript into the tweet, containing the command "onmouseover." It seems that most people are using this exploit for playful trickery, generating bothersome but benign pop-up messages when the user's mouse rolls over the text.

But according to Sophos, the Twitter hack could be used to send people to malicious third-party Websites. Sarah Brown, wife of former U.K. Prime Minister Gordon Brown, for example, has inadvertently sent users to a Japan-based hardcore porn Website.

To make matters worse, the exploit is also being used to fill and submit status updates when rolled over, leading to fast propagation. My twitter feed is overrun with messages containing the "onmouseover" JavaScript.

Twitter says it is working on the problem. Georg Wicherski of Kaspersky Labs notes that "Twitter now properly escapes links, that specific vulnerability seems closed."

For now, Twitter users should either access the site from a third-party client, such as TweetDeck or Seesmic, or use mobile.twitter.com, to which the exploit does not apply.

Users who were already granted access to the new, redesigned Twitter.com should not run into this exploit.