The second point of interest is why the sudden flurry of attempts to compromise Twitter accounts. It’s been suggested that one reason is that the compromised accounts will be used to promote sites in to search engines, based on the recent development of search relationships between Yahoo and Microsoft’s ‘Bing’. Getting hold of the Twitter accounts would have been the first stage of the operation; the idea would be to automate those accounts to ‘spam’ other users with other links over the next few weeks to attempt to increase the search engine standing of those links.
But the thing that’s surprised me most is how often people have actually gone along with the phishing request – to enter your Twitter user name and password into an anonymous web page, with no indication as to what the page is! To be honest, it stuns me. And it isn’t just Internet neophytes – according to this BBC story an invitation to improve one’s sex life was followed through on by banks, cabinet ministers and media types. Quite funny, in a way, but also quite disturbing – after all, these are people who’re likely to have fairly hefty lists of contacts on their PCs, and whilst an attack like the one detailed in this article is quite amusing, a stealthier attack launched by a foreign intelligence service against a cabinet minister’s account would be of much greater potential concern.
There are no doubt technical solutions that twitter can apply to their system to reduce the risk of the propagation of these Phsihing attacks. For example, looking at the content of DMs sent from an account and flagging up a warning if a large number of DMs are sent containing the same text. Twitter have also been forcing password changes on compromised accounts – again, this has to be a good move. It might also be worth their while pruning accounts that have been unused for a length of time – or at least forcing a password change on them.
A further part of the problem is with the use of Link Shortening services like Bit.ly to reduce the length of URLs in Tweets. This means that you can’t even take a guess at the safety or otherwise of a shortened link; a link that is goobledegook could lead to the BBC Website to read the story I mentioned above, or to a site that loads a worm on to a Windows PC – or prompts you for your Twitter credentials. perhaps a further move for Twitter would be to remove the characters in URLs from the 140 character limit. That way, full URLs could be entered without shortening.
But ultimately a lot of the responsibility for Twitter phishing attacks lies with us users. We need to bear the following in mind:
- If you get a DM or Reply from ANYONE that says ‘Is this you’ or ‘Read this’ form a friend, then to be honest, check with the person concerned to see whether they have sent them. If you get such a message from anyone who’s not well known to you, then just ignore the message.
- DO NOT enter your Twitter username and password in to any website that a link takes you to. If you do do this, change your password as soon as possible, and don’t use the Twitter password on ANY other system.
- Keep an eye on your Followers – if there is someone you don’t like the look of, just block them. It may seem extreme but it stops possible miscreants ‘hiding in plain sight’.
- Ensure your anti-virus and anti-malware software is up to date – this is your last line of defence designed to stop malware that YOU have allowed on to your machine by falling for phishing scams. 🙂
So…play your part in reducing the impact of Twitter Phishing attacks by not clicking those links!