Twitter Followers Lead to Porn

Here is the example of Twitter and the dangers that lie waiting in the Twitter world. Twitter, if you don't know, is a micro blogging site where you can post what you are doing in 140 characters or less. People can then follow what you do. Well since I'm in computer security, I follow several in the field of computer security. I logged on Saturday night, and noticed I had an additional follower. A closer look at this follower turned up interesting results.

First, here is the screen on Twitter showing who follows me. I see that this Ana Torres is following me. See the screen shot below.



So I clicked on the link on Ana's name. Here is what I saw.


Here you see that Ana states that if I want to see her pictures, I can click on the tinyurl listed above. So the curious guy that I am, I decided to check to see where that tinyurl led me to before actually going there. (Notice it says I must register first please, to see her pictures).

I did a preview of the tinyurl and found what the true url behind that tinyurl. I took that address and ran it through Trustedsource.org and found that the true web site behind the tinyurl is actually a porn site.


So be careful out there. Don't just click randomly on these url's trusting someone you do not know. In the next few days, Twitter will catch up with this follower of mine and they will be removed. So be aware that hot girls will not follow you if you are a computer security professional. LOL. Or any other type of Twitterer you are.

Have a great Sunday and stay safe.

Social Networking Sites - Be Careful

Have you signed up on a social networking site? If you have, you've joined literally millions of others who are on FaceBook, MySpace, LinkedIn, and Twitter just to name a few. If you've signed up for any of these networks, you have probably wondered if there are security risks involved in participating in them. There risks associated with them and they are all related in one way or another.

First, the one common thread in all social networking sites is that you can associate (network) with friends and family, or work associates and share information with them. There is an inherent trust built in that if I allow you to be in my network, I trust you that it is really you and if you post anything, I'm assuming that it is you. Criminal hackers take advantage of this trust that is built in and if they can steal your login credentials to your account, they can pose as you and send all the friends in your network a message with a link that leads to a malicious web site. If successful, your friend's PC will have malicious code installed on their PC and this allows the criminal hacker to continue to take advantage of others as this process is repeated over and over with each friend who clicks on the malicious link.

Another risk of these social networking sites is what you actually post on these sites. One of the things you can do is share pictures with family and friends. You need to think twice before publishing certain pictures. One rule of thumb you should remember before you post anything on any web site is not to post anything that you don't want everyone to see. Even if you have posted a picture as "private", there have been instances in the past where the actual site you post pictures to has vulnerability in their systems which allowed "private" pictures to be stolen.

When you sign up for these sites, you can fill out a profile of personal information that you should limit what is available. For instance, you can add your birthday and you may choose to only put the month and day and drop the year of your birthday. Your birth date is one personally identifiable piece of information used in many things and you may want to exclude sharing the year of your birth. It is also a good idea not to post your phone number or your full address.

This one is specific to Twitter. First, what is Twitter? Twitter is a micro blogging system that allows you to share your status with anyone who follows you. These are called "tweets". These tweets are limited to 140 characters. Some folks who use Twitter like to share links to web sites that give you more information on a topic. Since links to web sites can be long, they use services that take a long web address, and shorten it. There are services like Tiny URL that do this. Criminal attackers have hacked high profile accounts that include CNN, the Obama campaign, and celebrities such as Brittney Spears. With control of these accounts, they can then abuse the trust issue mentioned earlier in this article and send out malicious links.

What can you do to protect yourself? Here are a few things.

• Keep your home PC patched which includes Microsoft updates as well as Adobe, QuickTime, and iTunes, just to mention a few.

• Think twice before posting any picture. A good rule of thumb is not to post anything that you wouldn't want everyone to see.
  

• Limit what information you share in the profile section of social networking sites.
  

• Trust no one. If a friend sends you a link, treat it like you have been trained with phishing e-mails. Don't click on unsolicited links.

Lessons Learned - Do Not Share Passwords

Passwords are an amazing thing. They are the key to many things in our lives. To our bank accounts, retirement accounts, e-mail, FaceBook, LinkedIn, and Twitter just to name a few. Today I have a story about my son and his ex-girlfriend who just so happened to know his password to his gmail account and his FaceBook passwords. I didn't ask, but I'm assuming that they were probably the same.

Lessons Learned

• Don't share passwords with anyone!

• Don't use the same password for multiple accounts.

• Don't rely on FaceBook to respond too quickly. Hacked accounts are common.

Today our lives are out there on the Internet with all the social networks. When accounts can be taken over by someone, things can start to go wrong quickly. Sometimes hackers take control of these accounts when they are able to compromise your PC due to you not keeping your PC software up to date. Or worse, some you know and loved but now you've parted ways. Sometimes not on the best of terms. That is when things can turn bad quickly. So protect yourself, my recommendation is not to share these passwords at all. Don't re-use the same password. Once a hacker steals your login credentials, they probably have many more of your accounts because if you are like most, you use the same user ID and password for multiple accounts.

OK, well have a super fabulous Saturday night and to the rest of the weekend also. Stay safe out there.

Trust No One - A Twitter Example

I don't hide the fact that I'm a Kansas University Jayhawk fan. And after reading an article from the Lawrence Journal World where someone purporting to be Xavier Henry who opened a Twitter account. Last weekend, whoever this person was, posted a tweet about Carl Henry said something about having second thoughts about Xavier and CJ Henry coming to KU next year.

Well, father Carl contacted rivals.com and confirmed that both Xavier and CJ were enrolled at KU and will be attending KU in the Fall. Of course some took this to be gospel and so the Henry's are probably not big Twitter fans.

This should be a lesson about social networking sites like Twitter, FaceBook, etc, that you really don't know who is behind those accounts. Take my advice, trust no one.

Be careful out there and stay safe.

Twitter Credentials Being Stolen

So recently, some Twitter users were offered a link to Twittercut to gain more followers. It appeared to be coming from a known contact, and they promised you to accumulate more and more followers.

It seems that TwitterCut appeared to be the real Twitter login page. A phishing site for sure.

If a person were tricked into entering their login credentials, Twittercut continued to send the same message you got to all of your contacts. At this point, it appears that no malware is being installed on victim's PCs.

For sure, Twittercut has the login credentials to many Twitter accounts. Twittercut has been listed on services that blacklist malicious sites but was still active just a couple of days ago.

This attack takes advantage of the trust that is built on networks like Twitter, as well as FaceBook, MySpace, LinkedIn, and other social networks. Always beware of messages that are unsolicited. My motto is "trust no one".

Stay safe and have a fabulous rest of the weekend.

Twitter Security Does Not Equal 'happiness'

If you have listened to the news lately, and you are a user of Twitter you have heard about a phishing attack that happened a few days ago, and then shortly after that. The story goes, there was an employee of Twitter who had a weak password and the 18 year old hacker used a dictionary attack on some Twitter accounts and just so happened to crack the password. Once the hacker knew what account they actually hacked, he realized that he was able to take control of anyone's Twitter account.

So, Bill O'Reilly, Brittney Spears, Barrack Obama, just to name a few, all had their Twitter account passwords reset and then they were under control of the bad guy. To make a long story short, the Twitter account that was hacked had a password that was a word from a dictionary. It happened to be 'happiness'. Any word that can be found in the dictionary is considered a weak password. So here is my lesson on creating passwords.

Steps in creating a strong password are as follows.
1) Make a passphrase that is more than 10 characters.
2) Use a combination of upper and lower case letters as well as numbers and special characters.
3) Don't use the same password for multiple accounts, especially financial accounts.

So you want examples? What about your favorite vacation spot? So you love to travel to Rocky Mountain National Park. So you could create a password that incorporates special characters, numbers, and upper and lower case letters. How is this for a password. iL0v3therock1es. There is a 15 character password that isn't too hard to remember. You can use all kinds of things like this to create you a strong password.

Don't be a twit. Use strong passwords. Have a great Friday tomorrow and I'm planning on a fabulous weekend!