Twitter Targeted by Malware Distributors

Outsmart Malicious Hackers


This one is of interest to me as I do actually use Twitter as a microblogging service and to keep up with what various friends are up to.

It’s quite an interesting wep app especially paired with something like Twitterfox in your browser and Twibble in your mobile phone.

It must have made it big now though because it’s starting to get targeted by spammers and scammers trying to pimp dodgy sites and spread malware.

Twitter’s time has finally come. The microblogging service, once the playground of the Web 2.0 digerati, is now mainstream enough to be targeted by online criminals.

Kaspersky Lab has uncovered a fake Twitter profile created solely for the purpose of infecting people’s computers.

The profile, with an alias that means “pretty rabbit” in Portuguese, has posted a link that purports to be a pornographic video, but is instead Trojan software masquerading as MP3 files that steals data from the machine, according to the Kaspersky’s Viruslist.com blog.

It’s a pretty standard hook and normal malware, nothing new to see here – just a new way of distributing it via Twitter.

I have seen more and more spam profiles on Twitter, they tend to mass add and follow everyone they can find then I think they send out fake @messages with tinyurls that point to spam sites.

“If you click on the link, you get a window that shows the progress of an automatic download of a so-called new version of Adobe Flash, which is supposedly required to watch the video. You end up with a file labeled Adobe Flash (it’s a fake) on your machine; a technique that is currently very popular,” the blog says.

The attack is dangerous because it does not require programming skills and could spread easily if it ends up high in Google search engine rankings. That is possible because Google indexes unprotected Twitter profiles.

This isn’t the only security problem to hit Twitter. Last week, researcher Avi Raff launched a Web site devoted to security issues with Twitter called Twitpwn.

It seems there are various other vulnerabilities one with auto-follow, which could be very dangerous. It reminds me of the Auto-digg vulnerability a while back where if you had a Digg account and were logged in when you visited the site it’d auto Digg the chosen page.

I’ll be keeping an eye out on TwitPwn and see what they get up to.

Source: Cnet (Thanks Navin)

Posted in: Malware, Spammers & Scammers, Web Hacking

, , , , , , , ,


Latest Posts:


OWASP ZSC - Obfuscated Code Generator Tool OWASP ZSC – Obfuscated Code Generator Tool
OWASP ZSC is an open source obfuscated code generator tool in Python which lets you generate customized shellcodes and convert scripts to an obfuscated script.
A Look Back At 2017 – Tools & News Highlights A Look Back At 2017 – Tools & News Highlights
So here we are in 2018, taking a look back at 2017, quite a year it was. Here is a quick rundown of some of the best hacking/security tools released in 2017, the biggest news stories and the 10 most viewed posts on Darknet as a bonus.
Spectre & Meltdown Checker - Vulnerability Mitigation Tool For Linux Spectre & Meltdown Checker – Vulnerability Mitigation Tool For Linux
Spectre & Meltdown Checker is a simple shell script to tell if your Linux installation is vulnerable against the 3 "speculative execution" CVEs that were made public early 2018.
Hijacker - Reaver For Android Wifi Hacker App Hijacker – Reaver For Android Wifi Hacker App
Hijacker is a native GUI which provides Reaver for Android along with Aircrack-ng, Airodump-ng and MDK3 making it a powerful Wifi hacker app.
Sublist3r - Fast Python Subdomain Enumeration Tool Sublist3r – Fast Python Subdomain Enumeration Tool
Sublist3r is a Python-based tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting.
coWPAtty Download - Audit Pre-shared WPA Keys coWPAtty Download – Audit Pre-shared WPA Keys
coWPAtty is a C-based tool for running a brute-force dictionary attack against WPA-PSK and audit pre-shared WPA keys.


4 Responses to Twitter Targeted by Malware Distributors

  1. Navin September 5, 2008 at 10:52 am #

    cheers!!! :)

  2. Morgan Storey September 6, 2008 at 2:24 pm #

    Wasn’t it just last month a similar Facebook one. It is getting really annoying, someone needs to do a plain html social networking site, that doesn’t allow you to put in your DOB or other id compromising data :P

  3. Navin September 6, 2008 at 3:47 pm #

    Nice idea….but I don’t think anyone will heed it…In this age of “the world is in your hands” technologies, with keywords such as “cloud computing” coming into play…I think a plain html soc-net site will instantly be pushed into the bag!!

  4. Morgan Storey September 7, 2008 at 11:03 pm #

    Navin: oh no I know the site I suggested would be borderline useless. Especially as a social networking site. I was just making a point that these companies need to really sacrafice some of their features for security, which is the age old problem.