Feeds

Twitter phish pwned profiles push penis pills

As Facebook 'goldmembers' hoodwinked into costly SMS scam

The Essential Guide to IT Transformation

Twitter users were hit by potent phishing attacks over the weekend that have already led to spam runs from compromised accounts.

Miscreants posted messages disguised as humorous updates on the Twitter micro-blogging service as part of an ongoing attack that started on Saturday. The messages - which featured phrases such as "Lol. this is me??", "lol , this is funny." and "Lol. this you??" - included links to a counterfeit Twitter login page hosted in China, located under the domain BZPharma.net.

The micro-blogging site warned of the attack on Sunday. It advised anyone that had fallen for the ruse to change their passwords quickly, before hackers had a chance to alter login credentials to hijack compromised accounts.

The BZPharma.net domain prospective marks are directed towards is actually designed to harvest Twitter login details for later misuse in spam and identity theft-based attacks. Initially, the phishing lures appeared as direct messages on Twitter, but later dangerous links were posted in public feeds often via a service called GroupTweet, net security firm Sophos reports. GroupTweet coallows direct messages to be sent to multiple and, optionally, distributed more widely.

The miscreants behind the attacks have already begun spamvertising herbal Viagra from the compromised accounts, Sophos warns, adding that the BZPharma.net domain associated with the Twitter phish has previously been used against Bebo users.

Fools' gold

In other social networking insecurity developments, many Facebook users are getting hoodwinked into joining a bogus group in order to enjoy supposed benefits of a non-existent Gold account. The scam started as a prank on the notorious 4chan image board back in 2007, but has now taken on a life of its own. Scammers are using the supposed benefits of the fictitious group to hoodwink users into taking part in a survey that involves subscribing to text messaging services in order to get the results.

Scammers likely receive a cut of the profit as affiliates of these services. A blog posting by Rik Ferguson of Trend Micro explains: "The survey I tested linked (via a couple of affiliate marketing services) to a 'Werewolf vs Vampire' quiz which promised to tell me which I am, (surely I should know that already?) At the end of the ten questions I am invited to enter my mobile phone number to receive my results. If I do that I am agreeing to pay a £9.00 joining fee followed by £9.00 every week until I cancel my membership via SMS."

Ferguson, who told El Reg that the scam is targeted at UK mobile users, has passed on his findings to PhonePayPlus, the UK regulator of premium rate phone services. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.