The bug only appears to affect the twitter.com website, not third-party apps such as CoTweet, TweetDeck, etc. Therefore, until Twitter fixes this flaw, you might want to avoid the twitter.com website and only use third-party apps to access your Twitter stream.

The bug has to do with the Javascript OnMouseOver parameter. Inserting an OnMouseOver statement into a tweet, using the correct syntax, allows the tweeter to program an action to take place when any other user moves their mouse over the tweet. The user doesn’t need to click on the tweet, they just have to move their mouse over the link in the tweet to have the preprogrammed action executed (and be redirected to another site, or have something else done).

There doesn’t appear to be any word from Twitter yet on their official blog or on their @safety account about this situation or a time estimate on its repair. So be careful until this is fixed.

UPDATE #1: The Twitter @safety account just retweeted the following tweet from the head of Twitter’s Trust and Safety team: “The XSS attack should now be fully patched and no longer exploitable. Thanks, those reporting it.” So hopefully, this bug should now be fixed.

UPDATE #2: Twitter has posted a blog entry about this incident.

Here are other articles about this issue on Mashable and on TechCrunch.

UPDATED: Twitter Security Flaw Today – OnMouseOver is a post from The Dustpan - Discussing Twitter Spam

Don’t confuse your “followers” (those who have chosen to follow you) with those that you are “following.” They are two different groups of Twitter users that are associated with your Twitter account.

You should follow other Twitter users that you find interesting. The tweets from these people show up in your timeline (your Twitter feed). They should be users that provide you with information, entertainment, dialogue or whatever it is that you find interesting about them.

If you tweet about things that others find interesting, then others will find you and follow you. It’s really that simple. Over time you should build up a loyal following of users who are interested in what you have to say.

However, it all breaks down and new problems occur if you start reciprocal following.

Problem # 1 – Your Timeline

When you start manually following those that follow you, or worse yet, use a script or online service to automatically follow everyone who follows you, you immediately pollute your timeline with all the miscellaneous, unfocused topics and trivia from the gang of people who found your tweets interesting. But does that mean that you will find their tweets of value to you? All of their subject areas and personal commentaries? I don’t think so.

Now your timeline is overflowing with reams of chatter “all over the map” and tweets from the previously hand-picked people who you had chosen to follow are now all mixed in with tweets from this bunch of people from all walks of life. You’ve lost control of your timeline. Now you need to start putting your hand-picked users into lists or groups in your apps, or somehow filtering your timeline so that you can get back to the tweets from the people who you want to follow, who you want to read about. But wait, that’s what you had before you started reciprocal following. Hmmm….

Problem # 2 – Auto-DM Spam

You start getting auto-DM messages from many of these people that you reciprocal followed. Direct Messages (DM’s) are Twitter’s private messages between Twitter users. But you can only send a DM to another user, or receive one, if you are both following each other — if you both find each other’s tweets of interest.

However, online services have started to crop up that will send automatic DM’s to people after you initially follow them (e.g. “thanks for following me!”), and after you tweet certain things, and after you reply to one of their tweets, and at timed intervals, and for a variety of reasons.

It’s a two step process: They start by using online services that will automatically follow as many people as they can, anyone, not because they are interested in those people, but because they are hoping that some of these people will reciprocal follow them back – so they can then go to step two and auto-DM them! These auto-DM’s are usually very self-serving, spammy, contain links, pitches, and are extremely annoying after awhile, and you have no way of turning them off other than to unfollow those people. Of course, if you hadn’t reciprocal followed them in the first place, you would not be receiving these crazy spam DM messages at all.

Problem # 3 – Phishing Attacks

In the last few weeks, Twitter users have been hit by a large number of phishing scams. They involve a DM from a hacked Twitter account to you saying something like “Is this a picture of you? <link>” or some other hook comment and a link. Always a link. The link takes you to what looks like a Twitter login page, but it is a page on the hacker’s site. When you enter your account login info, then the hacker’s program breaks into your Twitter account and uses it to send the same scam to all of your contacts using more DM’s.

But wait, you would not have been able to receive any of those phishing DM scam messages if you hadn’t reciprocal followed all of those people (since you both need to be following each other to be able to send or receive a DM). And further, if your Twitter account ever becomes hacked for any reason, the hacker would not be able to use your account to DM your contacts if you hadn’t reciprocal followed all of them. So a double benefit of not receiving and not spreading Twitter-based phishing attacks if you don’t reciprocal follow.

Problem # 4 – Malware Attacks

A variation on Problem # 3 is the spreading of malware via a download link which is spread by DM messages using hacked Twitter accounts. As in the above, you would almost eliminate the ability to receive such DM messages from hacked followers if you are not reciprocal following, and also your account (if ever hacked) would not be able to spread any such malware to all of your followers if you are not reciprocal following.

Summary

So let’s see. We can reciprocal follow all of the people who follow us: it is nice for them and it’s a practice that used to be done in the very early years of Twitter usage when there weren’t many people using Twitter. However, with the tens of millions of users on Twitter now, and:

• all of the online services sending marketing spam
• services providing countless and useless mass followers (who are not interested in you)
• services that do automatic mass reciprocal following for you
• automatic tweeting of marketing messages by renting out your account for a few bucks (aka “sponsored tweets”)
• the proliferation of annoying, machine-generated auto-DM messages
• the phishing scams and malware being spread by DM’s, and
• the pollution of your timeline with a very low signal-to-noise ratio of meaningless trivia overpowering the occasional helpful tweet

it is long overdue to stop the ancient practice of reciprocal following that now only seems to generate useless, time-wasting noise, scams and malware to the ultimate benefit of mostly nefarious practitioners.

Agree? Disagree? Sound off in the comments…

The Evils of Reciprocal Following on Twitter is a post from The Dustpan - Discussing Twitter Spam

You may now sign-up for TwitSweeper for 3-month, 6-month or 12-month periods after the free trial period. The free trial is still available!

So if you don’t want to commit to a 12-month period – no problem. Just select one of the other periods.

It is a recurring term of whatever duration you select. To continue providing service to your account, the payment gateway will automatically renew for your selected duration at the end of each period, unless you cancel the renewal, which you can do at any time. You can login to the PayPal payment system and cancel the recurring subscription, or you can remove your Twitter accounts from the TwitSweeper system if you wish. Or you could just let us know and we can cancel your renewal. So, no one is locked in to any upcoming renewal. Use the system, benefit from it, and if you ever want to stop any future renewal, you have multiple ways of doing so.

Of course, we hope that you would instead find the service useful and helpful as it continues to check your Twitter followers for undesirable ones, removes and blocks them, and as we continue to add more features to it and to respond to users’ many great suggestions. Thanks for using TwitSweeper!

Shorter Durations Now Available for TwitSweeper is a post from The Dustpan - Discussing Twitter Spam

BACKGROUND: When TwitSweeper finds spammy or otherwise undesirable followers on a user’s Twitter account, it queues those followers for confirmation. When the user returns to TwitSweeper, they are presented with a list of the undesirable followers and asked to confirm (or retain) them. These undesirable followers are currently displayed in one long list.

SUGGESTION: We received a suggestion for enhancement today from a TwitSweeper user asking if this confirmation page could be paginated into smaller chunks so that these undesirable followers could be confirmed in smaller groups (so the page wasn’t so long if you had hundreds of bad followers to confirm).

YOUR PREFERENCE PLEASE: Could we please have YOUR feedback or preference on this proposed change by answering the following two questions in a Comment below:

(1) Should the confirmation page be paginated?  Yes (paginate it) / No (leave it as-is as one long page)

(2) If Yes (paginated), how many undesirable followers should be displayed on each page to confirm (before moving on to the next page of followers)? e.g. 25, 50, 75, 100, 200, other:____

We look forward to your thoughts on this change. Comment away please… (and thanks for helping!)

Should Confirmation Page be Paginated? (request for user feedback) is a post from The Dustpan - Discussing Twitter Spam

Issues such as the ease at which someone can insert spam into the real-time search results, and also instantaneous impacts on reputation management and the inability to resolve any such negative real-time issues inserted into the search results. And let’s not even talk about safety issues for children using Google search for projects and the real-time spam that is now getting inserted into their regular search results.

Here are some good articles that describe these issues in greater detail:

• Google Enables Real Time Spam and More – Outspoken Media
• With Real-Time Search, Comes Real-Time Spam – WebProNews
• The anatomy of a deceptive Tweet spamming Google Real-Time Search – Sebastian’s Pamphlets

What do you think of these changes? Add your comments below…

Real-Time Spam from Google Real-Time Search is a post from The Dustpan - Discussing Twitter Spam

This past week Bit.ly said that it had partnered with the following security organizations to help it detect such undesirable users or target sites and disable their related bit.ly links:

• VeriSign’s iDefense IP reputation service. The iDefense system is focused on detecting and defeating malware.
• Websense Threatseeker Cloud service analyzes the web content behind bit.ly links in real time, using heuristic tools and reputation data to flag spammy URLs, malicious content and phishing sites.
• Sophos, whose behavioral-analysis technology goes beyond blacklists, to proactively detect spam and malware.

This should be a good thing for the Twitterverse and elsewhere online so that more of these questionable links will be rendered non-operational.

Other articles about Bit.ly’s latest move: Bit.ly Blog, Wired Magazine, TechCrunch Blog.

Do you agree or disagree with the direction that Bit.ly is taking this? (reply in the comments)

Bit.ly Fighting Spam, Scams & Malware is a post from The Dustpan - Discussing Twitter Spam

“Earn an income for the rest of your life”

“GET PAID FOR BEING A AFFILIATE MARKETER”

“To Earn INCOME you just invite people to watch this amazing video”

“Learn the trick discovered by a mom to turn yellow teeth white”

Ugh… Don’t you just hate seeing these stupid messages in your Twitter stream. I love using Twitter don’t get me wrong, and it’s a service that has done very well for it’s self and is growing rapidly. With everything else online, with huge growth in numbers there are bound to be some bad apples in the mix.

Twitter Spam – we see it on a daily basis whether in trending topics, or auto followers. Sure some of us might not see it, but if your audience took a look at your followers and 50 out of the 100 were spammers, you might be seen as a spammer yourself for indirectly endorsing them.

With all this said – Twitter Spam is a daily frustration for some, including us – so we decided to brainstorm and find out how we can help the Twitter-sphere. We decided to target the spammy followers, hopefully targeting them will help remove the spam masses from Twitter or at least reduce their influence. We have created a new app called “TwitSweeper” that automatically cleans up the spammy followers on your various Twitter accounts and continues to do so on an on going basis.

Introducing The Dustpan

During our research and development of TwitSweeper we thought, “This isn’t just a problem for us, millions of users are frustrated with these same problems,” hence The Dustpan blog was created as a place to “sound off” on this irritating topic. This is not your regular old blog – it is not about a product or service – it is a place for anyone to talk about the topic of Twitter Spam. We all share similar frustrations and problems related to this, and we all want to hear other people’s solutions, suggestions or feedback on how to best combat this growing annoyance.

We’ll talk a bit about how TwitSweeper can help with a portion of the problem (spammy followers), which will be our contribution, but there is so much more to talk about… so many more solutions out there, no doubt, and I’m sure we’re not alone in wanting to hear about these ideas (from you!)

Get Involved

If you want to get involved, or share your thoughts on the topic, head over to our Contribution page by navigating to the top of the sidebar and click the Contribute link to get started. It’s a simple form to fill out, or you can register for an account and become a one-time or periodic contributor, there is no commitments, just think of it as advanced commenting.

Also, be sure to follow us on Twitter and our RSS Feed to stay up to date with all things Twitter Spam related. We are striving to help diminish the Twitter Spam problem and hope that everyone will benefit by the sharing of information on how to best deal with Twitter Spam on our various Twitter accounts.

What have your experiences been with Twitter Spam thus far? Tell us all in a comment.

Cleaning Up Twitter Spam is a post from The Dustpan - Discussing Twitter Spam