Video of Twitter Phishing: The BZPharma ‘LOL this is funny’ Attack
A phishing attack that began striking U.S. Twitter profiles last weekend is still going strong and isn’t showing any signs of letting up. As VentureBeat reports, the scam operates through a direct message reading, “Lol. this you?” Once users click on it, they’re sent to a fake Twitter login page, where they could be tricked into revealing their login and password.
The DM Messages include
Lol. this is me??
lol , this is funny.
Lol. this you??
followed by a link in the form of
|
|
http://example.com/?rid=http://twitter.verify.bzpharma.net/login
Do we need to mention that if you get a message like this, DON’T click on it?
Here ‘example.com’ can vary. As we have seen many variations of the URL in its entirety, you would be wise to avoid clicking on any links which refer to bzpharma.net at the very least.
After the first attack wave, however, the phishers are now using the compromised accounts to send out spam, which resulted in a huge amount of V!agra-related messages on Twitter, which read something similar to this: “Get bigger and have s3x longer. go here”, followed by an address that leads to a s3xual enhancement site.
IT security firm Sophos now has detailed info on the attacks and here is a video describing this Phishing scam:
|
|
Sophos researchers discovered that although the main wave of poisoned messages has been via private direct messages between individual users on Twitter, dangerous links are also being posted in public feeds. This means that innocent users can stumble across the links even if they are not sent it directly, or even if they are not a signed-up user of Twitter.
“This phishing attack has been causing headaches for Twitter users all weekend, resulting in thousands of users being put at risk of having their account broken into,” said Graham Cluley, senior technology consultant at Sophos. “It appears what is happening is that the messages are being shared more widely because of third-party services like GroupTweet which extend the standard Twitter direct message (DM) functionality and allow private messages to be sent to multiple users and optionally made public,” continued Cluley. “This has resulted in the bizarre site of Twitter accounts warning their followers about the phishing attack, only to subsequently fall victim to it themselves.“
Sophos also reports that the site being used for the Twitter phishing has also been constructed to steal information from users of the Bebo social network. Affected users are advised to change their passwords immediately.
Twitter Routing All Links Through New Anti-Phishing Service
Samsung Sells 2 Million Internet-Connected Smart TV Sets
Twitter's Money-Making Strategy Finally Launched - Promoted Tweets Are Live
Demolition Dash For iPhone and iPad; Destroy Cities 'Round The World'
Plants Vs Zombies Hits The PlayStation 3
Which Tech Gadgets Top the Holiday Wishlist This Year?
Teri (3)
Rent Textbooks. (2)
used tires (2)
Adeline (1)
Best Andriod Tablets R... (1)
The best way is to use http://www.knowurl.com it extracts original URL from shortened URL.
Like most Phishing attacks, the real problem here is not the URL where the users are being directed; rather the interface that is designed to imitate Twitter’s login page. Most users often tend to ignore the URL and start entering their login credentials as soon as they see a familiar login page.
That’s right. Can we trust all twitter apps?
.-= JK´s last blogpost >> How to automatically reject unwanted phone calls? =-.
Usually I’m not so comfortable sharing my twitter login credentials with a third party app unless I find out that it can be trusted!
Social comments and analytics for this post…
This post was mentioned on Twitter by raskenbo: RT @debasispradhan: Video of Twitter Phishing – http://bit.ly/c1oA7H …
I too used too got a lot of such this is you messages, I had a pre assumption that those were spam but never thought those were phishing attacks, I clicked on it once but the page never opened because my Chrome gave me a security warning and I do not tend to open sites which shows such warnings
.-= seo magazine´s last blogpost >> Paypal Indian Banks Withdrawal Issues Resolved!! More Problems Evolved =-.
Looks like you were saved by a whisker!
Well in that case, no one can help. People need to be careful.
Absolutely. It’s about time people should help themselves with getting educated with online risks and threats!
Thanks for suggesting.But I am not affected with phishing.
.-= Blogging Tips´s last blogpost >> Search Engine Optimization (SEO) – What is it? =-.
Being careful and getting educated is the key! Glad to hear that you have managed to stay away from phishing.
These phishers are really dangerous!!! I guess I’ve to be more safe in Twitter now than before…
Yes, as the old adage goes – it is better to be safe than be sorry!
lol…really dangerous phishers…
.-= Dev | Technshare´s last blogpost >> 12 ways to promote your blog offline =-.
It’s such a dangerous world. Isn’t it?
Phishing is widely used method to hack the accounts.. recently one of friend gone thru some phishing sites for which he has to pay his facebook and orkut accounts..
.-= Rajesh´s last blogpost >> TechCats Welcomes Guest Bloggers =-.
Can’t believe that people still falls prey to such attempts even after so much of media coverage about such attempts. I feel sorry for your friend.