|Network Security Consulting SecurityFocus Article
Firms Atwitter Over Social-net Threats
Security firms have turned up the volume on their warnings that a variety of attackers — from phishers to rogue security applications — are now using social-networking applications to spread.
Earlier this month, companies alerted PC users that cyber criminals were using malicious URLs distributed through Twitter to send the victims to a Web site where their computers would be compromised. Last week, security firm Symantec, the owner of SecurityFocus, announced that spammers were using a Twitter-branded e-mail message in an attempt to convince the recipient to open up a .zip file to infect the victim's computer. And, on Monday, Finjan announced that it would tailor its Web security tool to stop malicious links on Twitter and other applications from affecting its users' PCs.
The short links used by Twitter users are a particularly bad idea from a security standpoint, Gary Warner, the director of research in computer forensics at the University of Alabama at Birmingham, said in a blog post.
"When you only have 140 characters, using a shortened URL makes sense," he said. "The problem is that you just really don't know where those links are going — and because of that searching on Twitter is a security nightmare. As an example, searching on 'Transformers 2' tonight, the first link took me to a site telling me how I could get rich on the Internet."
Concern of the security shortcomings of social networking applications and sites is nothing new. In April, a Web worm and its variants spread to hundreds of user accounts on Twitter's microblogging network over the weekend, producing upwards of 10,000 posts, or "tweets," to other users.
During the Black Hat Security Conference in Las Vegas last year, two security professions found that third-party applications on services such as MySpace and Facebook were full of flaws, but also found that users' trust was the biggest vulnerability of all.
If you have tips or insights on this topic, please contact SecurityFocus.
Posted by: Robert Lemos