eWeek Security Watch
Advertisement
Advertisement
July 10, 2009 11:52 AM

Koobface Worm Lands on Twitter



Twitter has suspended the accounts of users infected with the notorious Koobface worm that made its name targeting social networking sites such as Facebook and MySpace.

Koobface spreads by posting messages on the victim's Twitter account with a link that leads to a malicious site that will infect those who visit it with the malware. Researchers at Trend Micro reported that on July 9 a couple hundred Twitter users were infected in the span of a few hours.

Koobface first appeared in 2008, and since then various iterations have touched down on social networking sites from Facebook to Bebo. Just a few months ago, a variant of the worm sought to steal cookies with log-in information for sites such as MySpace.com, MyYearbook.com, Bebo and Hi5 Networks.

According to Trend Micro Advanced Threats Researcher Ryan Flores, Koobface first made its appearance on Twitter a few weeks ago, and used three shortened URLs to lure users to the malicious site. Now, Koobface has upped the ante, and is sending out even more links. The messages being blasted out include Tweets purporting to have home videos and a so-called "Michael Jackson testament."

The attack utilizes shortened URLs, something security researchers are increasingly warning users about as they grow in popularity. Symantec's MessageLabs reported earlier this week they had observed a significant spike in spam containing shortened URLs, and phishers have taken advantage of shortening services in the past to trick users on Twitter into visiting malicious sites.

There are some tools and services that can be used to see the full URLs, such as TweetDeck and the Firefox add-on LongURL.

"The danger of these short URLs is that you don't know where they will take you," warned Matt Sergeant, senior anti-spam technologist at MessageLabs. "They send an e-mail that's hard to stop with URL blocking services because they can't outright blacklist these places like TinyURL. The short URL obscures the real domain name. Spammers have been doing this for a while by trying to find redirection services, and this is the next level of that."

TrackBack

TrackBack

http://securitywatch.eweek.com/cgi-bin/mte/mt-tb.cgi/17417

Comments (2)

If it is popular than it is going to get hit by viruses and worms. Sorry Mac :)

Social networking is a key "ingredient" to a business. Although it just recently become popular from the past 5 years or so, it has definitely changed the way business run things now.

Keep the good info coming.

Chris Moniz
VP Marketing, Internet Marketing Professor
http://www.drdavehaleonline.com

Post a Comment

 
 
RSS Syndication
Advertisement

CAG

SEO

Advertisement
Security Watch     Contact Us | Advertise | Site Map
eWEEK Quick LInks

Ziff Davis Enterprise