Here's how that major Tweetdeck vulnerability works

The popular Twitter app Tweetdeck is shutting down after the discovery of a serious security vulnerability in the software:

We've temporarily taken TweetDeck services down to assess today's earlier security issue. We'll update when services are back up.

— TweetDeck (@TweetDeck) June 11, 2014

Tweetdeck is vulnerable to what is known as a cross-site scripting attack that allows hackers to execute code on the victim's computer. The attack makes use of the JavaScript programming language, which powers most of the web's interactive content. If someone puts JavaScript code into a tweet, your Twitter client is supposed to convert that into harmless plain text. But the Tweetdeck forgot to do that, causing the user's computer to execute it instead.

JavaScript programs are executed within a "sandbox" that sharply limits what they can do

The result: if you were running Tweetdeck, anyone in your Twitter timeline could force your computer to execute JavaScript code. For example, it could cause annoying popup messages to display on a user's screen. Or create viral tweets that spread by causing users to automatically retweet them.

Fortunately, JavaScript programs are executed within a "sandbox" that sharply limits what they can do. In this case, malicious code can only do things that the Twitter app itself is allowed to do, like tweet, follower users, or retweet others' messages. But it likely can't access private files on a user's hard drive, read a user's email, or install long-lived spyware on the computer.

This is an important virtue of the web compared with conventional desktop software. If a bug is discovered in a traditional Mac or Windows application, the attacker will often gain total control over a user's computer. In contrast, web browsers (and apps like Tweetdeck built on web-based technologies) are carefully designed to limit the damage that malicious JavaScript can do.

A security problem in Twitter, Facebook, or Gmail can still cause a lot of headaches for users. It could allow hackers to access private emails or spam victims' friends. But in most cases, it won't give the attacker total control over your computer or even other websites.

Will you join us?

Our biggest supporters are our readers — and we’re so grateful to everyone who has made a contribution during our September campaign. We’re less than 1,000 contributions away from reaching our goal for the month, which in turn will allow us to say yes more often when our incredible journalists come to us with questions they want to answer and projects they want to pursue. Will you make a contribution before the month ends and support our policy coverage through 2024 and beyond?

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via