Twitter disables Flash widget over security fears

Twitter has temporarily disabled one of the features on its website after a security researcher warned of a flaw that left the login credentials of its users vulnerable to hackers.

Twitter co-founder Biz Stone says the company had temporarily cut off access to a feature that lets users display Twitter updates on their websites using Flash. “Our team has disabled the Flash widget while we look into the problem,” Stone says.

Mike Bailey, a senior security analyst with Foreground Security says that the problem exploits a widely known vulnerability in Adobe’s Flash programming language. Adobe has told programmers how to address the vulnerability, which was first discovered in 2006, Bailey adds, but says the operators of many websites have failed to respond to those warnings.

The microblogging site’s huge popularity has made it a prime target for hackers looking to spread malicious software to Twitter’s millions of users. “As simple as the attack is, I’ve been finding them all over the place,” Bailey claims.

Officials with Adobe declined to comment.

A hacker last month briefly hijacked the Twitter site and redirected it to one that claimed to represent a group calling itself the Iranian Cyber Army. That high-profile attack – by a perpetrator who stole credentials to the account that Twitter uses to route its traffic – didn’t compromise credentials of any Twitter users.

Bailey says his analysis of the Twitter site shows that it could have been vulnerable to attacks for more than a year, but that it was impossible to know whether hackers had actually exploited the Adobe flaw.