Topic: Second Worm in a Week atack to Twitter users

[Samker]

Twitter has put a stop to a worm that posted obscene messages to victims' Twitter feeds. It's the second worm attack the site has suffered in a week.

Those whose accounts became infected with the worm would see a message posted on their Twitter account that read in part "WTF:" followed by a URL, according to a blog post from Sophos, a security vendor: http://www.sophos.com/blogs/gc/g/2010/09/26/wtf-twitter-goat-viral-message-spreads

If someone clicked on the link, their profile would also be hijacked, reposting the same link and increasing the chance that one of their followers would click on it and spread the worm.

Sophos wrote that the worm used a cross-site request forgery (CSRF) technique in order to post to someone's account. In a CSRF attack, a Web application is tricked into honoring a request from a malicious Web site.

The attack was invisible to those who clicked on the link. "All the user sees if they visit the link is a blank page, but behind the scenes it has sent messages to Twitter to post from your account," wrote Graham Cluley, senior technology consultant for Sophos.

Twitter wrote on its status blog on Sunday that "a malicious link is making the rounds that will post a tweet to your account when clicked on: http://status.twitter.com/post/1192873885/malicious-links-on-twitter
Twitter has disabled the link, and is currently resolving the issue."

It the second time in a week Twitter has been hit with an attack as the result of a flaw in the site's coding. Last week it closed a cross-site scripting (XSS) flaw that could allow an attacker to steal data: http://scforum.info/index.php/topic,4557.0.html
Some of those who picked up on it wrote proof-of-concept code that combined JavaScript with the "onmouseover" function, which would launched a pop-up window. The problem was quickly fixed by Twitter.

(PCW)

[AllSecurityUp]

Twitter jumped on these fairly quickly. To the suspicious eye I felt some of the links used by both these exploits seemed to look dubious.

The mouse-over exploit didn't seem to affect those behind Twitter clients such as TweetDeck and Seesmic. Also noscript can help in these situations.

The popular bit.ly shortening service, as one example, aims to try prevent malicious links. Also McAfee have released their own shortening service which also aims to try prevent users visiting malicious sites, including using Site Adviser data.

MyWot is also a useful tool in these situations.

[Samker]

Also McAfee have released their own shortening service which also aims to try prevent users visiting malicious sites, including using Site Adviser data

This is new information for me...  "McAf.ee Secure URL Shortener BETA"  http://mcaf.ee/

Tnx ASU!  

[AllSecurityUp]

"McAf.ee Secure URL Shortener BETA"  http://mcaf.ee/

Samker you don't seem to miss much. The McAfee announcement seemed a bit understated during a heavy news period with the Twitter exploits, Zeus arrests and other MalWare warnings that probably kept you busy informing others as well.

Keep up the good work.

I think the McAfee product is significant as SiteAdvisor has a long history of data and should really help, but I also believe McAfee does another check just before the user gets redirected.

I should also point out to other readers that bit.ly uses Sophos's extensive resources to help protect it's users as well.

[Samker]

I should also point out to other readers that bit.ly uses Sophos's extensive resources to help protect it's users as well.

IMO, bit.ly is No1 URL Shortener right now, it include basic statistic information & security protection. We use them at SCF (via Twitterfeed service) for Twitter & Facebook Fan pages.

Keep up the good work.

Tnx pal. 

[AllSecurityUp]

Agree Samker, bit.ly is my preferred as well, primarily for security but also it's easy integration and stats.

Also probably should highlight browser addons are available to help show the actual link for redirection services.