New York (ECN)) - It seems like no one's identity and personal information is safe on the internet anymore. Hackers are able to break into websites, steal or alter information, and even attach viruses to things. Today, hackers attack social networking sites for both personal pleasure and the compulsion to have power over another person's information.
Twitter, a popular social messaging service used by hundreds of thousands for staying up to date and connected in real time, is the latest internet service to be hacked in to. Like social networking sites hacked before it like Facebook and Myspace, Twitter is the latest target of scam. This time, it's not just anyone that have been attacked, it's famous high-profile bloggers like president-elect Barack Obama, Britney Spears, Lance Armstrong, Rick Sanchez, MC Hammer, Stephen Fry, Dave Matthews, and Andy Murray. All had their Twitter accounts hacked into and messed with.
Hackers broke into tools used by the Twitter support team to assist users to refine the Email address affiliated with their account. Afterward, thousands of Twitter accounts were hacked and exposed through a password phishing swindle on the site that emboldened users to click on an imitation Twitter page. After logging in, the hackers had the user's information and was able to post obscenities, pornography, and personal information. Found on CNN broadcaster Rick Sanchez's Twitter, a post that said, "i am high on crack right now might not be coming to work today". On Britney Spears' Twitter, messages were posted about her unmentionables.
Attacks like this are certainly not unfamiliar in the social networking world. In 2005, MySpace fell victim to a serious computer virus called the "Samy" worm, which took precedence of a bug in the site's design to tally over one million MySpace users to the hacker's "friends list".
Officials stated there was no link to the celebrity hacks and no economical gains from the scam. Worried about the situation, Graham Cluley, senior consultant with security firm Sophos, said, "It appears that Twitter's systems were potentially exposing everybody's accounts to the dangers of being taken over by hackers - it's just that they chose some high profile accounts to abuse with their defacements."
The Washington Post examined the hack and traced it to the name "Gmz", who belongs to a hacker site called Digital Gangster. The hacked users' information was posted on Digital Gangster, giving anyone on the site access to these Twitter accounts.
After the attack, Twitter removed all of their support tools from the Internet. However, the site will resume normal operation once everything is safe and secure. Twitter defined the offense as "Monday morning madness", taking place subsequently to what is deemed a "wacky weekend" of intrusions.
However, according to Mary Landesman, senior security researcher at ScanSafe, the content and link that was deceptively posted on Barack Obama’s Twitter account could indicate a phishing scheme. Phishing scams trick users into visiting a bogus website and entering their login credentials for a legitimate sight.
“Phishing is the oldest trick in the book,” said Landesman. “Someone sends a link which leads to a Web page asking for the user’s login credentials. It’s a completely avoidable breach of security – never, ever enter your login credentials from a website accessed via a link received in email, IM, or twitter. While it must be embarrassing for the celebrities who were impacted, it should concern all citizens when the future president of the United States is among the victims.”
Phishing isn’t the only security vulnerability on social networking sites like Twitter, Facebook and Myspace. ScanSafe recommends the following the five tips to protect yourself on social networking sites.
1) Stop the virtual popularity contest. There’s a real trend among members of social networking sites to friend as many folks as possible, even if they don’t actually know them. The same goes for “following” and responding to unknown “tweets” on Twitter. Promiscuous friending provides ripe opportunities for would-be attackers to spread worms and other viruses.
2) Don’t go click happy. Regardless of whether you know the sender, never click on links received unexpectedly.
3) Be careful what you click for. If you do click a link that then requests you install something, don’t install it. If you have a reason to believe a legitimate update is required, visit that vendor’s website directly and update from there.
4) Be cautious with your login information. If you follow a link that then instructs you to provide your login credentials, don’t. Never login to a site accessed via a link received in email, instant messaging, or a social networking site. If you believe the login request is legitimate, visit the site as you normally would and login via the normal interface.
5) Always sign out and log off. Users should log off of sites they are not actively using. It does require a bit more discipline, since they will need to remember to sign out and will have to sign back in each time they wish to use the site. However, by taking this extra step, they will not only be enhancing their own security, but the security of their legitimate friends as well.
