Commentary

Andrew Conry Murray
 

Phishing For Tweets

A new phishing scam that targets Twitter users is a backhanded compliment to the messaging service.

A new phishing scam that targets Twitter users is a backhanded compliment to the messaging service.Twitter hit a new milestone this Saturday when the company posted a warning that phishers were targeting Twitter users. You know you've arrived when scammers decide your platform is big enough to be worth trying to spoof.

The scam relied on an e-mail message that claimed to come from Twitter. The message included a link to a false log-in page that would let the scammers capture the Twitter user's ID. The scammers could then use the ID to log on as a trusted Twitter user.


More Security Insights

White Papers

More >>

Reports

More >>

Webcasts

More >>

I'm guessing the next step for the scammers would be to send direct messages to other Twitter users, including a link that would download malware (keylogger, rootkit, etc.).

The blog post says it will reset the password of any Twitter user that may have logged into the fake site.

It's an interesting attack because it takes advantage of the trust between Twitter users. I know I click on links sent to me via other users all the time.

I'm not sure a phishing attack against the Twitteratti would be very successful. One the one hand, Twitter users are a fairly tech-savvy bunch, and might be wary of potential abuse.

On the other hand, the scammers used a potent bait: vanity! The scam message said something like "Hey, there's a funny post about you. Click this link!" I know I still get a thrill when I get an e-mail notification of a new follower, and could easily be tempted by such a message.

In any case, a snake has crept into the Twitter garden, and we'll all have to be on our guard.


Related Reading




Currently we allow the following HTML tags in comments:

Single tags

These tags can be used alone and don't need an ending tag.

<br> Defines a single line break

<hr> Defines a horizontal line

Matching tags

These require an ending tag - e.g. <i>italic text</i>

<a> Defines an anchor

<b> Defines bold text

<big> Defines big text

<blockquote> Defines a long quotation

<caption> Defines a table caption

<cite> Defines a citation

<code> Defines computer code text

<em> Defines emphasized text

<fieldset> Defines a border around elements in a form

<h1> This is heading 1

<h2> This is heading 2

<h3> This is heading 3

<h4> This is heading 4

<h5> This is heading 5

<h6> This is heading 6

<i> Defines italic text

<p> Defines a paragraph

<pre> Defines preformatted text

<q> Defines a short quotation

<samp> Defines sample computer code text

<small> Defines small text

<span> Defines a section in a document

<s> Defines strikethrough text

<strike> Defines strikethrough text

<strong> Defines strong text

<sub> Defines subscripted text

<sup> Defines superscripted text

<u> Defines underlined text

InformationWeek encourages readers to engage in spirited, healthy debate, including taking us to task. However, InformationWeek moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing/SPAM. InformationWeek further reserves the right to disable the profile of any commenter participating in said activities.

Disqus Tips To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.
T-Shirt Giveaway T-Shirt Giveaway: Each week we're selecting one great comment from our readers. The author of the comment will receive an InformaitonWeek Community t-shirt. So get posting!
Subscribe to RSS

Resource Links