Shouting fire in a crowded Twitter
September 22nd, 2010 | by jz | Published in cybersecurity, Future of the Internet | 3 Comments
Tweeting has become a foundational Internet technology. It’s not even dependent on the World Wide Web — people can send and receive tweets without having to visit twitter.com. And the act of tweeting isn’t even unique to Twitter — many other Internet platforms are seeking to compete by allowing people to “emote” an update to a self-designated group of followers. Thus Facebook has made central its desire to know “what’s on your mind,” and many other sites are seeking to let people casually share what they’re up to, such as users of Google Reader sharing items that they find interesting.
Foundational technologies like this can attract attacks the same way that banks beckoned Willie Sutton: crooks go where the money is. Here the money is people’s browsers and PCs; compromise them and you can potentially access their passwords, personal information, and even cause them to pay the attack forward — involuntarily tweeting the next attack vector. With many interlinked users, a vulnerability can be exploited with lightning speed. It’s a reminder that a feature we cherish about the Internet and Web — linking disparate people and sites seamlessly together — can also be a problem. Consider a standard Web page at, say, nytimes.com. You’re visiting the New York Times, and that’s where the page is thought to come from. But in a venerable practice echoed by nearly every other online news and content hub, nytimes.com serves up banner ads from a vendor like doubleclick.net. Your computer visits doubleclick at the instant of rendering the page for you so the an ad can appear in its designated real estate.
In fact, given its popularity as an ad server network, your computer probably visits doubleclick.net more than most any other site — even though you’ve likely never asked to go there yourself in your Web surfing. Doubleclick in turn gets the ads it runs from its customers: companies who want to sell you something or otherwise try to get to you click on their ads. So: visiting one site actually means you’re visiting a third party site, which in turn is getting information from fourth parties. Even the most careful site can thus become host to malware, if the ad content is designed to attack your browser, not just appeal to your eyeballs. Just ask the New York Times, which suffered this problem last fall. It’s akin to the fact that a hamburger from your favorite fast food outlet contains the meat of 100 cows from three continents. If just one source has E.coli — watch out.
What to do about it? In the short term: backup your data, update those virus definitions, and use an obscure browser, figuring Willie Sutton will go for the big banks over the small savings and loan. Over the longer term, we’ll need defense mechanisms that can react as speedily as an attack can hit — at least enough to eliminate its viral quality when passed around through a platform like Twitter. Ideally those platforms would be distributed rather than orchestrated by a handful of security vendors, so that the ability to block bad code isn’t so readily triggered by a single gatekeeper — or a government that can pressure it.
That’s because what’s true of code is also true of content. Perhaps a deeper lesson of this flash-in-the-pan Twitter pandemic is its suggestion of how quickly a meme can spread. Someone tweets a fascinating but false statement and it gets retweeted and retweeted — with no easy way for a correction to chase after it. Once alerted to yesterday’s virus problem, Twitter could set up an automated system to look for manifestations of dangerous code in a tweet and squelch it. Should we sleep better or worse with the thought that the same technique could be applied to another kind of clear and present danger: falsehoods designed to wreck a business, ruin a reputation, or incite a panic.
[A shorter version of this entry appears in the NYT's Room for Debate blog.]
September 23rd, 2010 at 1:51 am (#)
> … and use an obscure browser …
Ah, but this doesn’t work overall, because everyone can’t use an obscure browser 1/2 :-). It’s not clear to me which browsers might not be affected, given basic JavaScript functionality.
September 23rd, 2010 at 3:08 am (#)
I have to say (open source flag held high) – since I moved to Ubuntu 4 years ago – I’ve never (not once) had to worry about virii or malware. I can definitely see you concerns, since Windows-using friends have asked me countless times about the Twitter virus. Another point you’ve raised, people definitely underestimate what they are subject to “lose” if their system dies, crashes, or is attacked. Their music, their contacts, their passwords, their photos, their work, etc. Pay attention, update, and backup – or die.
September 28th, 2010 at 2:47 pm (#)
Pretty disappointing that a “foundational Internet technology” is completely in the hands of a small handful of one corporation’s engineers.