{"id":509,"date":"2010-09-22T18:22:12","date_gmt":"2010-09-22T18:22:12","guid":{"rendered":"http:\/\/www.hgitsecurity.com\/?p=509"},"modified":"2020-09-10T18:41:49","modified_gmt":"2020-09-10T22:41:49","slug":"3-things-we-can-learn-from-the-twitter-security-flaw","status":"publish","type":"post","link":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/","title":{"rendered":"3 things we can learn from the Twitter security flaw"},"content":{"rendered":"

According to the official twitter blog<\/a>, the cross-site scripting<\/a> programming error that allowed the recent mouse over exploit had been “discovered and patched…last month”.<\/p>\n

Twitter stated that the flaw was then reintroduced after a recent site update. Based on a report<\/a> from the guardian.co.uk, two developers, a Japanese developer, Masato Kinugawa<\/a>, and a Scandinavian developer, Mangus Holm<\/a>, were (separately) experimenting with the flaw when things got out of control.  The flaw was eventually identified and exploited by more nefarious characters. Aside from serving as a reminder that the Internet can be a dangerous place, what other lessons should organizations take away from this?<\/p>\n

    \n
  1. The importance of a solid <\/strong>change management<\/strong><\/a> (and revision control) process<\/strong> – While no person is infallible, and no process is perfect, the fact that the update was reintroducing a previously fixed vulnerability should have been caught.<\/li>\n
  2. It’s not always the bag guys that get you <\/strong>– While you can argue that they were acting irrisponsibly, it doesn’t appear Mangus and Masato intended to do harm. Our organizations are filled with people (even in the IT dept.) who are “just curious”, or “in a hurry”, or “didn’t realize it would do that”.<\/li>\n
  3. The fragility of the Internet ecosystem – <\/strong>This is a reminder that any one of the hundreds of thousands of services and systems that we come to rely on is susceptible to human error.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    According to the official twitter blog, the cross-site scripting programming error that allowed the recent mouse over exploit had been “discovered and patched…last month”.<\/p>\n","protected":false},"author":3,"featured_media":8137,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"content-type":"","footnotes":""},"categories":[1],"tags":[51,49,48,46,47,50],"yoast_head":"\n3 things we can learn from the Twitter security flaw | HealthGuard<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"3 things we can learn from the Twitter security flaw\" \/>\n<meta property=\"og:description\" content=\"According to the official twitter blog, the cross-site scripting programming error that allowed the recent mouse over exploit had been “discovered and patched…last month”.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/\" \/>\n<meta property=\"og:site_name\" content=\"HealthGuard\" \/>\n<meta property=\"article:published_time\" content=\"2010-09-22T18:22:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-09-10T22:41:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Apolonio Garcia\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@healthguardsec\" \/>\n<meta name=\"twitter:site\" content=\"@healthguardsec\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/\"},\"author\":{\"name\":\"Apolonio Garcia\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/19e63e3e2ab94d82417a803ec8e06430\"},\"headline\":\"3 things we can learn from the Twitter security flaw\",\"datePublished\":\"2010-09-22T18:22:12+00:00\",\"dateModified\":\"2020-09-10T22:41:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/\"},\"wordCount\":251,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg\",\"keywords\":[\"cross site scripting\",\"incident\",\"security\",\"twitter\",\"vulnerability\",\"xss\"],\"articleSection\":[\"Blog\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/\",\"url\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/\",\"name\":\"3 things we can learn from the Twitter security flaw | HealthGuard\",\"isPartOf\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg\",\"datePublished\":\"2010-09-22T18:22:12+00:00\",\"dateModified\":\"2020-09-10T22:41:49+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#primaryimage\",\"url\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg\",\"contentUrl\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg\",\"width\":2560,\"height\":1707},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.healthguardsecurity.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"3 things we can learn from the Twitter security flaw\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#website\",\"url\":\"https:\/\/www.healthguardsecurity.com\/\",\"name\":\"HealthGuard\",\"description\":\"HIPAA Security 3.0 for Hospitals\",\"publisher\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.healthguardsecurity.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#organization\",\"name\":\"HealthGuard\",\"url\":\"https:\/\/www.healthguardsecurity.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/HG_Logo-Updated.png\",\"contentUrl\":\"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/HG_Logo-Updated.png\",\"width\":921,\"height\":250,\"caption\":\"HealthGuard\"},\"image\":{\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/healthguardsec\",\"https:\/\/www.linkedin.com\/company\/healthguard\/\",\"https:\/\/www.youtube.com\/user\/HealthGuardSec\"],\"description\":\"Risk Management software and services for hospitals.\",\"email\":\"info@healthguardsecurity.com\",\"legalName\":\"CAPC Group, LLC\",\"foundingDate\":\"2001-07-06\",\"numberOfEmployees\":{\"@type\":\"QuantitativeValue\",\"minValue\":\"1\",\"maxValue\":\"10\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/19e63e3e2ab94d82417a803ec8e06430\",\"name\":\"Apolonio Garcia\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/7cce05681385e6479c0c98a8657c8f46?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/7cce05681385e6479c0c98a8657c8f46?s=96&d=blank&r=g\",\"caption\":\"Apolonio Garcia\"},\"sameAs\":[\"http:\/\/www.healthguardsecurity.com\"],\"url\":\"https:\/\/www.healthguardsecurity.com\/author\/agarcia\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"3 things we can learn from the Twitter security flaw | HealthGuard","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/","og_locale":"en_US","og_type":"article","og_title":"3 things we can learn from the Twitter security flaw","og_description":"According to the official twitter blog, the cross-site scripting programming error that allowed the recent mouse over exploit had been “discovered and patched…last month”.","og_url":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/","og_site_name":"HealthGuard","article_published_time":"2010-09-22T18:22:12+00:00","article_modified_time":"2020-09-10T22:41:49+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg","type":"image\/jpeg"}],"author":"Apolonio Garcia","twitter_card":"summary_large_image","twitter_creator":"@healthguardsec","twitter_site":"@healthguardsec","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#article","isPartOf":{"@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/"},"author":{"name":"Apolonio Garcia","@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/19e63e3e2ab94d82417a803ec8e06430"},"headline":"3 things we can learn from the Twitter security flaw","datePublished":"2010-09-22T18:22:12+00:00","dateModified":"2020-09-10T22:41:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/"},"wordCount":251,"commentCount":0,"publisher":{"@id":"https:\/\/www.healthguardsecurity.com\/#organization"},"image":{"@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#primaryimage"},"thumbnailUrl":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg","keywords":["cross site scripting","incident","security","twitter","vulnerability","xss"],"articleSection":["Blog"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/","url":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/","name":"3 things we can learn from the Twitter security flaw | HealthGuard","isPartOf":{"@id":"https:\/\/www.healthguardsecurity.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#primaryimage"},"image":{"@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#primaryimage"},"thumbnailUrl":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg","datePublished":"2010-09-22T18:22:12+00:00","dateModified":"2020-09-10T22:41:49+00:00","breadcrumb":{"@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#primaryimage","url":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg","contentUrl":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/moran-8cMPxOqkLE8-unsplash-scaled.jpg","width":2560,"height":1707},{"@type":"BreadcrumbList","@id":"https:\/\/www.healthguardsecurity.com\/3-things-we-can-learn-from-the-twitter-security-flaw\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.healthguardsecurity.com\/"},{"@type":"ListItem","position":2,"name":"3 things we can learn from the Twitter security flaw"}]},{"@type":"WebSite","@id":"https:\/\/www.healthguardsecurity.com\/#website","url":"https:\/\/www.healthguardsecurity.com\/","name":"HealthGuard","description":"HIPAA Security 3.0 for Hospitals","publisher":{"@id":"https:\/\/www.healthguardsecurity.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.healthguardsecurity.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.healthguardsecurity.com\/#organization","name":"HealthGuard","url":"https:\/\/www.healthguardsecurity.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/HG_Logo-Updated.png","contentUrl":"https:\/\/www.healthguardsecurity.com\/wp-content\/uploads\/HG_Logo-Updated.png","width":921,"height":250,"caption":"HealthGuard"},"image":{"@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/healthguardsec","https:\/\/www.linkedin.com\/company\/healthguard\/","https:\/\/www.youtube.com\/user\/HealthGuardSec"],"description":"Risk Management software and services for hospitals.","email":"info@healthguardsecurity.com","legalName":"CAPC Group, LLC","foundingDate":"2001-07-06","numberOfEmployees":{"@type":"QuantitativeValue","minValue":"1","maxValue":"10"}},{"@type":"Person","@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/19e63e3e2ab94d82417a803ec8e06430","name":"Apolonio Garcia","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.healthguardsecurity.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/7cce05681385e6479c0c98a8657c8f46?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/7cce05681385e6479c0c98a8657c8f46?s=96&d=blank&r=g","caption":"Apolonio Garcia"},"sameAs":["http:\/\/www.healthguardsecurity.com"],"url":"https:\/\/www.healthguardsecurity.com\/author\/agarcia\/"}]}},"_links":{"self":[{"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/posts\/509"}],"collection":[{"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/comments?post=509"}],"version-history":[{"count":0,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/posts\/509\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/media\/8137"}],"wp:attachment":[{"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/media?parent=509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/categories?post=509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.healthguardsecurity.com\/wp-json\/wp\/v2\/tags?post=509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}