Feeds

Twitter phish pwned profiles push penis pills

As Facebook 'goldmembers' hoodwinked into costly SMS scam

Secure remote control for conventional and virtual desktops

Twitter users were hit by potent phishing attacks over the weekend that have already led to spam runs from compromised accounts.

Miscreants posted messages disguised as humorous updates on the Twitter micro-blogging service as part of an ongoing attack that started on Saturday. The messages - which featured phrases such as "Lol. this is me??", "lol , this is funny." and "Lol. this you??" - included links to a counterfeit Twitter login page hosted in China, located under the domain BZPharma.net.

The micro-blogging site warned of the attack on Sunday. It advised anyone that had fallen for the ruse to change their passwords quickly, before hackers had a chance to alter login credentials to hijack compromised accounts.

The BZPharma.net domain prospective marks are directed towards is actually designed to harvest Twitter login details for later misuse in spam and identity theft-based attacks. Initially, the phishing lures appeared as direct messages on Twitter, but later dangerous links were posted in public feeds often via a service called GroupTweet, net security firm Sophos reports. GroupTweet coallows direct messages to be sent to multiple and, optionally, distributed more widely.

The miscreants behind the attacks have already begun spamvertising herbal Viagra from the compromised accounts, Sophos warns, adding that the BZPharma.net domain associated with the Twitter phish has previously been used against Bebo users.

Fools' gold

In other social networking insecurity developments, many Facebook users are getting hoodwinked into joining a bogus group in order to enjoy supposed benefits of a non-existent Gold account. The scam started as a prank on the notorious 4chan image board back in 2007, but has now taken on a life of its own. Scammers are using the supposed benefits of the fictitious group to hoodwink users into taking part in a survey that involves subscribing to text messaging services in order to get the results.

Scammers likely receive a cut of the profit as affiliates of these services. A blog posting by Rik Ferguson of Trend Micro explains: "The survey I tested linked (via a couple of affiliate marketing services) to a 'Werewolf vs Vampire' quiz which promised to tell me which I am, (surely I should know that already?) At the end of the ten questions I am invited to enter my mobile phone number to receive my results. If I do that I am agreeing to pay a £9.00 joining fee followed by £9.00 every week until I cancel my membership via SMS."

Ferguson, who told El Reg that the scam is targeted at UK mobile users, has passed on his findings to PhonePayPlus, the UK regulator of premium rate phone services. ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.