Microblogging site Twitter says it has patched a hole in its software that would let any user force other Twitterers to follow him or her without their consent.

'We identified and resolved a bug that permitted a user to 'force' other users to follow them. We're now working to rollback all abuse of the bug that took place," said a post on Twitter's Status page Monday morning.

Gadget site Gizmodo was one of the first to publicize the security problem, which it attributed to a Turkish Twitter user, who detailed the flaw on his blog. Gizmodo also published the simple steps necessary to make anyone -- including celebrity Twitter users like Ashton Kutcher or Conan O'Brien -- follow any user.

The exploit boiled down to a user typing two words: Accept 'username.'

Numerous reports confirmed the hack enabled a user to force themselves into the users followed by another. However, Twitter's staff moved quickly to address the issue, although admins had to reset users' number of followers back to zero, a problem they said on the site's Status page would "shortly be resolved."

It isn't the only time that Twitter has had security problems recently.

In January, hackers discovered that a known flaw in Adobe's Flash widget enabled them to get access to users' login credentials.

Twitter quickly fixed that security hole, as well.


Source: http://www.esecurityplanet.com/features/article.php/3881256/Twitter-Bug-Let-Users-Kidnap-Followers.htm