Members
  • Total Members: 12814
  • Latest: Rono
Stats
  • Total Posts: 28517
  • Total Topics: 8240
  • Online Today: 976
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Second Worm in a Week atack to Twitter users  (Read 2116 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Second Worm in a Week atack to Twitter users
« on: 27. September 2010., 17:27:40 »


Twitter has put a stop to a worm that posted obscene messages to victims' Twitter feeds. It's the second worm attack the site has suffered in a week.

Those whose accounts became infected with the worm would see a message posted on their Twitter account that read in part "WTF:" followed by a URL, according to a blog post from Sophos, a security vendor: http://www.sophos.com/blogs/gc/g/2010/09/26/wtf-twitter-goat-viral-message-spreads

If someone clicked on the link, their profile would also be hijacked, reposting the same link and increasing the chance that one of their followers would click on it and spread the worm.

Sophos wrote that the worm used a cross-site request forgery (CSRF) technique in order to post to someone's account. In a CSRF attack, a Web application is tricked into honoring a request from a malicious Web site.

The attack was invisible to those who clicked on the link. "All the user sees if they visit the link is a blank page, but behind the scenes it has sent messages to Twitter to post from your account," wrote Graham Cluley, senior technology consultant for Sophos.

Twitter wrote on its status blog on Sunday that "a malicious link is making the rounds that will post a tweet to your account when clicked on: http://status.twitter.com/post/1192873885/malicious-links-on-twitter
Twitter has disabled the link, and is currently resolving the issue."

It the second time in a week Twitter has been hit with an attack as the result of a flaw in the site's coding. Last week it closed a cross-site scripting (XSS) flaw that could allow an attacker to steal data: http://scforum.info/index.php/topic,4557.0.html
Some of those who picked up on it wrote proof-of-concept code that combined JavaScript with the "onmouseover" function, which would launched a pop-up window. The problem was quickly fixed by Twitter.

(PCW)

Samker's Computer Forum - SCforum.info

Second Worm in a Week atack to Twitter users
« on: 27. September 2010., 17:27:40 »




AllSecurityUp

  • SCF Member
  • **
  • Posts: 39
  • KARMA: 10
    • Free Virus Spyware Adware Registry Scan
Re: Second Worm in a Week atack to Twitter users
« Reply #1 on: 04. October 2010., 13:51:26 »
Twitter jumped on these fairly quickly. To the suspicious eye I felt some of the links used by both these exploits seemed to look dubious.

The mouse-over exploit didn't seem to affect those behind Twitter clients such as TweetDeck and Seesmic. Also noscript can help in these situations.

The popular bit.ly shortening service, as one example, aims to try prevent malicious links. Also McAfee have released their own shortening service which also aims to try prevent users visiting malicious sites, including using Site Adviser data.

MyWot is also a useful tool in these situations.
Think before you think you'll do something.
Easy PC Security Tips

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
McAf.ee Secure URL Shortener BETA http://mcaf.ee
« Reply #2 on: 04. October 2010., 14:47:38 »
Quote
Also McAfee have released their own shortening service which also aims to try prevent users visiting malicious sites, including using Site Adviser data

This is new information for me...  "McAf.ee Secure URL Shortener BETA"  http://mcaf.ee/

Tnx ASU!  :up:

AllSecurityUp

  • SCF Member
  • **
  • Posts: 39
  • KARMA: 10
    • Free Virus Spyware Adware Registry Scan
Re: Second Worm in a Week atack to Twitter users
« Reply #3 on: 04. October 2010., 21:55:57 »
"McAf.ee Secure URL Shortener BETA"  http://mcaf.ee/

Samker you don't seem to miss much. The McAfee announcement seemed a bit understated during a heavy news period with the Twitter exploits, Zeus arrests and other MalWare warnings that probably kept you busy informing others as well.

Keep up the good work. :up:

I think the McAfee product is significant as SiteAdvisor has a long history of data and should really help, but I also believe McAfee does another check just before the user gets redirected.

I should also point out to other readers that bit.ly uses Sophos's extensive resources to help protect it's users as well.
Think before you think you'll do something.
Easy PC Security Tips

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Re: Second Worm in a Week atack to Twitter users
« Reply #4 on: 05. October 2010., 07:42:08 »

I should also point out to other readers that bit.ly uses Sophos's extensive resources to help protect it's users as well.

IMO, bit.ly is No1 URL Shortener right now, it include basic statistic information & security protection. We use them at SCF (via Twitterfeed service) for Twitter & Facebook Fan pages.



Keep up the good work. :up:

Tnx pal.  :thumbsup:

AllSecurityUp

  • SCF Member
  • **
  • Posts: 39
  • KARMA: 10
    • Free Virus Spyware Adware Registry Scan
Re: Second Worm in a Week atack to Twitter users
« Reply #5 on: 05. October 2010., 22:17:34 »
Agree Samker, bit.ly is my preferred as well, primarily for security but also it's easy integration and stats.

Also probably should highlight browser addons are available to help show the actual link for redirection services.
Think before you think you'll do something.
Easy PC Security Tips

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising