Sophos warns of Twitter attacks

Twitter users have been warned of an evolving attack that tries to fool them into giving away personal information and opens them up to online fraud.

Security company Sophos said it had received reports that people were getting direct messages that purported to be from friends, with links saying they can view pictures or blogs about themselves and even win an iPod.

However, the messages are spoofed and the links go to a page that looks like the regular Twitter login page, but which is actually a phishing website.

This allows the criminals to steal the unwary user’s Twitter log-in details. These are then used to continue the scam and pass on the messages to more Twitter users. However, Sophos said that the information about a person gained thought the Twitter attacks could be used for more frauds.

Graham Cluley, Sophos’ senior technology consultant, said: "It would be bad enough to hand your Twitter username and password over to a criminal, as they could pose as you online and spread malware and spam to your friends and followers.

“However, as an alarming 41 per cent of internet users foolishly use the same username and password for every website they access, the potential for abuse is even greater.

"Compromised social networking accounts are valuable for hackers as they can use them as a springboard for spam campaigns, identity theft attacks and other online crime.”

According to Sophos, thousands of Twitter users have reported getting these messages with writer, TV star and Twitter celebrity Stephen Fry among those who unwittingly clicked on the link. The original messages over the weekend pretended to point to funny pictures or blog articles about the recipients:

"Hey, I found a website with your pic on it... LOL check it out here."
"Hey! Check out this funny blog about you."

However, clicking on the links would take users to a bogus Twitter page that would steal users' login names and passwords. Other messages are claiming that recipients could win an Apple iPhone if they visit a web link:

"Hey. I won an iPhone! Come see how here."
"Wanna win the new iPhone? It's so easy and cool, I love this thing!"

Twitter users who may have lost control of their accounts need to change their passwords as a matter of priority before more harm is done, warned Sophos.