The original discovery of the weakness, known as a "cross-site scripting" (XSS) hack, seems to have been made by a Japanese developer called Masato Kinugawa. He says that he reported an XSS vulnerability to Twitter on August 14 - and then discovered that the "new" Twitter, launched on Tuesday 14 September, had the same problem.

At about 10am BST (the afternoon in Japan, where he is based) he set up a Twitter account called "Rainbow Twtr", which showed how the XSS weakness could be used to make tweets turn into different colours.

Timing was key: on the west coast of the US, where Twitter is sited, it was the middle of the night, so nobody would have been watching for security flaws.

Kinugawa's idea was spotted by others. It's not clear whether some people had had the same idea, or realised the weakness, but next to spot the possibilty was a Scandinavian developer, Magnus Holm.

He spotted the idea and began playing with the idea - and then had the idea of extending the code so that it would retweet itself using the account of anyone signed in to Twitter.com when they moused over the link.

At first he thought the worm wouldn't really do anything: meh, this worm doesn't really scale. the users can just delete the tweet :( he wrote.

Then within a few minutes he saw that it had started spreading virally. "holy shit. I think this is exponential: "3381 more results since you started searching," he said - adding, a few minutes later "This is scary."

Others picked the idea up and mutations began to appear. Some were used by a Russian site; others by a Japanese hard-core pornography site. A fresh mutation didn't wait for you to put your mouse over the link (as the warnings about that began appearing within minutes): a revised version turned the whole of the Twitter.com page into a "link", so that any Twitter user who was signed in would automatically retweet the infected link to their followers.

Only users of Twitter.com itself were affected; nobody using third-party software clients, which represent the majority of users, were infected because those programs correctly escaped the URL (see below, How the hack works).

While all this was going on, Twitter was only just waking up. At 2.35pm BST - or 6.35am at Twitter HQ - it put out its first warnings. 25 minutes later, it had solved the problem: "The XSS attack should now be fully patched and no longer exploitable. Thanks, those reporting it." said.

How the hack works

Richard Gaywood, a British developer and blogger, explains:

The exploit was a classic piece of Javascript injection. Suppose you write a tweet with the following text:

"http://www.guardian.co.uk/technology is the best!"

When you view the Twitter web page, that becomes a link, like so:

<a href="http://www.guardian.co.uk/technology" class="tweet-url web" rel="nofollow">http://www.guardian.co.uk/technology</a> is the best!

The exploit attacked that link-making function. The raw text of the exploit tweet would read something like this:

http://a.no/@";onmouseover=";$('textarea:first').val(this.innerHTML);$('.status-update-form').submit();"class="modal-overlay"/

Which Twitter didn't protect properly, probably because the @" character combination broke their [HTML] parser. That link would generate the following page source:

<a href="http://a.no/@";onmouseover=";$('textarea:first').val(this.innerHTML);$('.status-update-form').submit();"class="modal-overlay"/ class="tweet-url web" rel="nofollow">

This means that executable content (the onMouseOver="stuff" bit) has ended up in the page source code. Not knowing any better, the browser runs this code. Because it's running in the user's browser, it can do anything the user does; most variations used this power to re-post the content, which is why it spread like a virus. To encourage the user to activate the code by mousing over, they also formatted the block as black-on-black using CSS [Cascading Style Sheets, which determines the page layout]. Other versions were hacked around by users to have all sorts of other effects, such as porn site redirects, rainbow text in their tweets, and so forth. Some of them popped up dialog boxes designed to alarm the users, talking about accounts being disabled or passwords stolen (they weren't, in either case).

Twitter fixed this not by blocking the string onMouseOver (which some dim-witted blogs were calling for) but by properly sanitising the input. The " marks in these tweets are now turned into " – the HTML-escaped form.

Technically this is a second-order injection attack; the attack string is inserted into the database and handled correctly, but then the attack takes place as the string is read back out instead. It's not that complex an attack at all either - rather embarrassing for Twitter that they were caught out by this.

[Updated explanation to turn " into " so it would make sense - CA]