As Twitter gains momentum there are more and more attacks on it, it’s users and the most recent is a phishing scam via DM (Direct Message).

It was uncovered recently that it was being used as a Botnet Control Channel, shortly before that it was subjected to a DoS attack.

This isn’t the first time DMs have been used in a Phishing attack too.

Phishers are targeting Twitter users in a new attack involving direct messages sent to Twitter users containing a link to a site requesting user log-ins.

There are reports of a new phishing scam making the rounds on Twitter. The attack seeks to steal user credentials by sending tweets out with links to a phishing site. The attack site requests the user’s log-in information; once the attackers have that, they can take over the account of the victim and use it to send out more messages.

According to messages from Twitter users, the tweets with the link to the phishing site have to do with the sender supposedly making a certain amount of money. Such periodic phishing attacks on users of the popular microblogging service have become a fact of life.

I’m not exactly sure why anyone would want to steal a bunch of Twitter accounts? Perhaps to monetize them somehow with spam/affiliate schemes.

But the current threat on Twitter is a phishing scam executed via DM with a link to various things including ways to make money, a video of you or some other juicy gossip.

The cornerstones of social engineering in phishing attacks.

In May, researchers at Sophos reported that a number of Twitter users were lured to a phishing site via a tweet with the message: “check this guy out [tinyurl address leading to the attack site].” As was the case in that instance, URL shortening services are increasingly being abused by attackers to mask the Websites they are sending their victims to.

Besides drawing attackers as it has grown, Twitter has also gotten the interest of security researchers, as shown by the “Month of the Twitter Bugs.”

Twitter warned users about the attack, stating in a message: “A bit o’ phishing going on—if you get a weird direct message, don’t click on it and certainly don’t give your log-in creds!”

If you are using Twitter you should follow @spam and keep up to date with what is happening on the network.

Source: eWeek

It seems the latest target for spammers, opportunists and those into Domain Squatting is the registration of interesting or possibly valuable Twitter usernames.

Twitter has exploded recently as a new ‘micro-blogging’ platform and it works really well, especially when combined with more traditional blogging and the host of tools that have been build around Twitter to enable you to find tweets about specific topics or events easily.

Now Twitter has created a new supply of valuable “names”: Twitter IDs. They take the form of twitter.com/stiennon for instance. Have you signed up for your free Twitter ID? Do you own your surname? Company name? Brand identity?

Is there evidence of Twitter squatting (squitting?) Let’s check. Yup, every single-letter TwitID is taken. Some are legitimate (Check out “S” for instance, that is a cool personal email assistant service) but X, Y, and Z are place holders. How about common words? Garage, wow, war, warcraft, Crisco, Coke, Pepsi, Nike, and Chevrolet are all taken. My guess is that Twitter squatters have grabbed all of these in the hopes that they will be worth selling in the not too distant future. Of course the legitimate holders of brands can sue for them and Twitter can just turn them over if asked. But, because the investment and risk for the squatter is zero, you are going to see the rapid evaporation of available Twitter IDs.

I wonder if this will be the next lucrative business, people registered thousands of Twitter usernames and speculating with them.

Imagine if your name or company name is taken, it’s gonna be cheaper than litigation to get it back to just pay the guy a few hundred or a few thousand dollars. If you haven’t gotten a Twitter ID yet I suggest you bag your name now before someone else does.

How to protect your own brand? Immediately go to Twitter.com and determine if your name is available. Get it while you can. While you are at it, reserve all of the names associated with your brand. You may decide that any domain you have invested in should have its Twitter ID. It is the domain name squatters who will jump on this new land grab first after all. Reserving multiple Twitter IDs is easy. Twitter attempts to limit reservations by requiring a unique email address for each sign-up. That is circumvented by using the Google “plus sign” email trick. Simply append something (your new Twitter ID for instance) to your Google email address like stiennon+itharvest@gmail.com. Gmail treats that as stiennon@gmail.com but Twitter thinks it is unique. I expect Twitter to fix this flaw shortly. They may even require email confirmation.

So go and get registering, especially if you have anything to do with the online presence of a real business – go and register the business name and derivatives now. You could save yourself some money when later the CTO or CEO thinks blogging and Twittering may really boost your brand equity.

Who knows? Better safe than sorry right.

Source: Network World