|
|
|
Phishing The Easy Way to Compromise Twitter Accounts |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Présentation : Last week, Twitter announced that the details of around 250,000 of its users may have been compromised before it discovered and stopped an attack on their network. There is not much you can do when attackers go straight to the service provider to try to steal your data however, it is also common for attackers to approach the end-user in order to obtain account details. Phishing is a popular tactic used to steal account details this way. When thinking of phishing attacks, people usually think of bank account or credit card details as the type of information that is stolen but social network account details are also a popular commodity for attackers. Attackers see phishing on social network sites as an easy way to trick users into giving their credentials away. So let me take this opportunity to go over one particular attack that has been taking place on Twitter over the last few months and show you how this type of scam works. It starts out with spam in the form of a direct message DM or a tweet that asks the user to click on a link in order to view a picture of them. Figure 1. Spam message If the link is clicked, the browser is directed to a page that informs the user that they need to sign-in to their account to proceed. The page looks like it belongs to Twitter but it is actually a phishing page hosted on a server prepared by the attacker. No matter what is entered into the login fields, correct or incorrect credentials, the user will appear back in their session. Figure 2. Fake Twitter login page used in phishing attack However, another fake page informs the user that the page they were attempting to visit does not exist. The page then redirects back to the legitimate Twitter page and the user is unaware of anything malicious having taken place. Figure 3. Fake page purporting that the page the user was looking for does not exist Looking at the network data captured during one of these phishing attacks, you will see that the stolen account details were posted to the attacker s server hosting the fake Twitter login page. Figure 4. Network data showing location stolen data is sent to Later, the account will be hijacked and used to distribute spam that leads to sites such as the one shown in Figure 6 advertising diet supplements. Figure 5. Spam message Figure 6. Advertisement that some spam messages link to Many of you may be watching out for phishing attacks when it comes to entering your bank account or credit card details online, but you may not be as cautious when entering account details related to social networking sites. The attackers are aware of this and use it to their advantage. The end result in the example discussed in this blog is not incredibly severe, but much more damage can potentially be inflicted depending on the machinations of the attackers. As mentioned earlier, there is not much you can do when it comes to hackers attacking the service provider to steal your data, but you can definitely protect yourself from scams such as phishing. Always be suspicious of links sent from unknown users. Also, accounts are hacked all the time so even if a link is sent from someone you know it does not mean it is safe. It is also recommended that users install security software that protects against phishing attacks such as Norton Internet Security. You can also make sure your online accounts are more secure by using passwords or passphrases that are difficult to guess and are not in the dictionary. Ideally a combination of upper and lower case letters, numbers, and special characters should be used. It is also recommended that different passwords be used for each account that way, even if one account is compromised, the others will stay safe.
Les mots clés de la revue de presse pour cet article : twitter
Les videos sur SecuObs pour les mots clés : twitter
Les éléments de la revue Twitter pour les mots clé : twitter
Les derniers articles du site "Symantec Connect Security Response Billets" :
- What you need to know about election apps and your personal data
- Microsoft Patch Tuesday April 2016
- New Adobe Flash Player exploit used by Magnitude and Nuclear exploit kits
- Latest Intelligence for March 2016
- New Flash zero-day exploited by attackers in the wild
- Samsam may signal a new trend of targeted ransomware
- Four tax scams to watch out for this tax season
- Most prevalent Android ransomware in the West arrives in Japan
- Taiwan targeted with new cyberespionage back door Trojan
- Seven Iranians charged in relation to cyberattacks against US
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
