URL shortening services, including New Zealand developed Hurl.ws, are being used for the latest wave of Twitter spam. Graham Cluley, senior technology consultant at security company Sophos says social networking services were starting to take phishing more seriously but are well behind web-based email services like Hotmail and Gmail. While those sites often filter messages and links, social networking sites are only just beginning to do so.
The problem can be worse on Twitter because of the 140-character message limit. It encourages the use of URL-shortening services that hide the site's identity. Bit.ly, one of the most popular URL shortening services, recently started working with Sophos to scan links, said Cluley, but some others are yet to offer such a service. Many of the messages from Friday's attack were shortened using Hurl.ws, a service offered by New Zealand's Bluespark. Auckland-based Bluespark founder John Ballinger says he has taken action on the issue and had blocked the URLs within five minutes of the issue emerging. He says he has built a software tool to help speed that process. Ballinger says he is watching activity on Hurl.ws closely and if the attacks continue he is considering taking the service down or making it private. The latest phishing attack on Twitter users swept the UK overnight claiming several prominent users.
The result was evident on Friday morning when users woke up to find messages on compromised accounts that read, "hey, i've been having better sex and longer with this here," followed by a link to a website selling sexual-performance drugs.
Although the number of people affected is difficult to determine, it made top news on the country's TV networks and news sites perhaps in part because of those affected. They include at least one member of Parliament and several journalists.
Ed Miliband, a British Cabinet member and the country's secretary for energy and climate change, tweeted on Friday morning, "Oh dear it seems like I've fallen victim to twitter's latest 'phishing' scam." The tweet had been removed from his Twitter stream.
Another of those who saw his account hacked was Matt Wells, head of audio at The Guardian newspaper, who tweeted, "Good morning. I am neither female, nor have I been having better sex lately. (Although if there are any offers...). First-time Twitterhacked." The offending tweet was still available on his page at time of writing.
Other reports said BBC correspondent Nick Higham and the country's Press Complaints Commission were also hit.
While some of the accounts are believed to have been hacked by software programs looking for weak passwords, at least some were through Twitter direct messages that tried to entice users to click through to see a message from a young, attractive woman. Upon clicking the link users were taken to a look-a-like Twitter log-in page where they were asked to enter their username and password.
Twitter posted a message to its Twitter Safety channel late Thursday local time warning users to beware of direct messages. "If you get a DM from an enthusiastic lady wanting to converse by IM, please ignore. User is likely compromised & request is spam."
The phishing attack mirrors a similar one a week earlier that saw messages asking "LOL this you?" sent to users.
It's the kind of thing that will persist on social networking services, said Cluley.
"The fact is that social networking accounts have a financial value," he said. "They can be used as a springboard for sending out more spam, malware or selling things."
Users on sites like Twitter and Facebook tend to feel safer when using the sites than others on the wider Internet but should be every bit as aware, he said. Messages received through the sites don't necessarily come from friends, but could be from anyone with access to the account.
"Ultimately it's you, the human, that needs to do [the filtering,] Cluley said. "It's up to you to decide to enter your username and password. Fixing that bug in people's brains is an upgrade we are not capable of." — Additional reporting by Rob O'Neill