Security Insights: Phishing For Twitter Credentials Feb 25, 2010 – By Joris Evers
Cyberscammers are going after login credentials for
Twitter in a big way. At least, that’s if my
own Twitter friends are any indication for trending.
In the last week, two of the people I follow on Twitter and who follow me
back had their accounts hijacked and abused to send out spam and malicious
links via direct message, Twitter’s system for sending private messages
to friends who use the service.
Twitter phishing message.
The scams are very similar to what you might see in
an instant message or in an e-mail. A message arrives from a friend
saying: “haha. This you????” or “Lol. this you??”
followed by a link. This is a straightforward phishing scam. The link takes
the target to a Web site that looks like a Twitter sign in page, but is not.
If you look at the URL you see that it is hosted elsewhere and the actual
Twitter looks slightly different as well.
Fake Twitter login page.
Recognizing a fake login page can be hard, especially if you’re using a
mobile device to tweet. So keep in mind to think twice whenever you’re
asked to type in credentials, especially after you just clicked on a link and
didn’t follow your bookmark or typed in
www.twitter.com yourself.
We regularly see scams that dupe people into giving up their credentials for
online services by presenting a fake login page. These fake login pages are
designed to look just like a legitimate login page for a service like
Twitter, Facebook, Yahoo. Traditionally cybercriminals have gone after
credentials for online payment, banking and auction sites.
The scammers use credentials for social networking sites to spam all the
victim’s contacts. This increasingly happens on Facebook and Twitter.
Users should use phishing protection like the technology in McAfee’s security suites and
McAfee SiteAdvisor in addition to practicing good Internet safety habits
like double checking where links take you to and not typing in a user name
and password after following a link in an e-mail, instant message or Twitter
direct message.
If it was just your account that got phished/hacked:
1. Change your password immediately
2. Change the password on any service where you used the same password
3. Change the password on any service that uses Twitter like Twitterfeed
4. Notify your contacts what happened and apologize (after all, you were just
a victim yourself)
