Gary Warner: Twitter Hack: From "Harmless" Exploration to Criminal Action
‘The underlying discovery for all of the Twitter mischief yesterday was that when a URL was followed by an “@” sign, whatever followed the @ sign would also be interpreted as part of the URL. The primary use of this activity yesterday was to show that a URL, even a short and unresolvable URL such as “http://t.co/” could be followed with an “onmouseover=” command which would execute whatever javascript followed when a Twitter reader moved their mouse over that URL.’


