The second point of interest is why the sudden flurry of attempts to compromise Twitter accounts. It’s been suggested that one reason is that the compromised accounts will be used to promote sites in to search engines, based on the recent development of search relationships between Yahoo and Microsoft’s ‘Bing’. Getting hold of the Twitter accounts would have been the first stage of the operation; the idea would be to automate those accounts to ‘spam’ other users with other links over the next few weeks to attempt to increase the search engine standing of those links.
But the thing that’s surprised me most is how often people have actually gone along with the phishing request – to enter your Twitter user name and password into an anonymous web page, with no indication as to what the page is! To be honest, it stuns me. And it isn’t just Internet neophytes – according to this BBC story an invitation to improve one’s sex life was followed through on by banks, cabinet ministers and media types. Quite funny, in a way, but also quite disturbing – after all, these are people who’re likely to have fairly hefty lists of contacts on their PCs, and whilst an attack like the one detailed in this article is quite amusing, a stealthier attack launched by a foreign intelligence service against a cabinet minister’s account would be of much greater potential concern.
There are no doubt technical solutions that twitter can apply to their system to reduce the risk of the propagation of these Phsihing attacks. For example, looking at the content of DMs sent from an account and flagging up a warning if a large number of DMs are sent containing the same text. Twitter have also been forcing password changes on compromised accounts – again, this has to be a good move. It might also be worth their while pruning accounts that have been unused for a length of time – or at least forcing a password change on them.
A further part of the problem is with the use of Link Shortening services like Bit.ly to reduce the length of URLs in Tweets. This means that you can’t even take a guess at the safety or otherwise of a shortened link; a link that is goobledegook could lead to the BBC Website to read the story I mentioned above, or to a site that loads a worm on to a Windows PC – or prompts you for your Twitter credentials. perhaps a further move for Twitter would be to remove the characters in URLs from the 140 character limit. That way, full URLs could be entered without shortening.
But ultimately a lot of the responsibility for Twitter phishing attacks lies with us users. We need to bear the following in mind:
- If you get a DM or Reply from ANYONE that says ‘Is this you’ or ‘Read this’ form a friend, then to be honest, check with the person concerned to see whether they have sent them. If you get such a message from anyone who’s not well known to you, then just ignore the message.
- DO NOT enter your Twitter username and password in to any website that a link takes you to. If you do do this, change your password as soon as possible, and don’t use the Twitter password on ANY other system.
- Keep an eye on your Followers – if there is someone you don’t like the look of, just block them. It may seem extreme but it stops possible miscreants ‘hiding in plain sight’.
- Ensure your anti-virus and anti-malware software is up to date – this is your last line of defence designed to stop malware that YOU have allowed on to your machine by falling for phishing scams. 🙂
So…play your part in reducing the impact of Twitter Phishing attacks by not clicking those links!
One of my professional interests is in Artificial Intelligence – AI. I think I’ve had an interest in the simulation of human personality by software for as long as I’ve been interested in programming, and have also heard most of the jokes around the subject – particularly those to do with ‘making friends’. 🙂 In fiction, most artificial intelligences that are portrayed have something of an attitude problem; we’ve had HAL in 2001 – insane. The Terminator designed to be homicidal. The Cylons in the new version of Battlestar Galactica and the ‘prequel’ series, Caprica – originally designed as mechanical soldiers and then evolving in to something more human with an initial contempt for their creators. The moral of the story – and it goes all the way back to Frankenstein – is that there are indeed certain areas of computer science and technology where man is not meant to meddle.
Well, the fuss over the launch of the iPad has died down somewhat – it wasn’t the Second Coming or the Rapture, the world didn’t suddenly turn Rainbow coloured (not for me. anyway) and the Apple Fans have gone quiet. So, perhaps it’s time to take a few minutes to think about what the iPad might mean in the future.
Many years ago there was a joke in techy circles that likened Microsoft to the Star Trek aliens ‘The Borg’. It appeared at the time (mid 1990s) that Microosft were indeed determined to assimilate everything they encountered and absorb the technology of other companies in to their own. Well, like the Borg in Trek, Microsoft finally found that they couldn’t assimilate everything.
I’m not overly paranoid about people knowing where I’ve been on the Internet; I’m aware that it’s pretty easy for a website to feed your browser ‘tracking cookies’ that can be used for marketing and advertising purposes, and these can then be picked up on other sites, thus providing a path of footsteps that you have followed online.
I have to admit to being quite saddened by
In a recent article,