Twitter Faces New Spam Attack Allowing Backdoors

Security researchers from security firm Trend Micro warned of a new spam attack doing rounds on Twitter to infect users' PCs with backdoors. These attacks use black hat search engine optimization (BHSEO) technique that is especially tailored for the micro-blogging site.

Ryan Flores, advanced threats researcher at Trend Micro, said that during the past two weeks, numerous accounts were created on Twitter just for the sake of tweeting Bifrost or Poison Ivy download links, reported SOFTPEDIA on June 30, 2010. It should be noted that Bifrost and Poison Ivy are both backdoors i.e. malicious programs facilitating an unauthorized access to the compromised machine.

Bifrost is a big family of Trojans. Bifrost is able to capture keyboard strokes, take webcam and screen captures, steal passwords, install other malicious files onto the infected machine or upload files from there to some remote location.

Similarly, Poison Ivy is again a Trojan that is based on a RAT (Remote Administration Tool) program. It enables the attacker to take full control over the targeted computer.

These backdoor trojans are uploaded to either of the two free Web hosting sites - leadhoster.com or freewebtown.com. Moreover, the fake accounts promote the same Web links through messages in both Arabic and English.

The text that comes together with the malicious links consists of keyphrases and keywords like America, Islam, Egypt, War with Israel, Arabs and Israel has to".

In this regard, Flores said that it appears as if cybercriminals are widening the scope of their social engineering techniques by using localization techniques.

It is interesting to note that fake Twitter accounts have either no or very few followers and following. This means that the potential victims could view the backdoor URL only by doing a Twitter search with suitable keywords. So, people have been warned against doing the search for these keywords.

The security experts in the meantime said that micro-blogging site Twitter is becoming an increasingly common medium for distributing malware, spam and all sorts of junk/malicious content. Recently, cybercriminals were found using Gaza and FIFA spam campaigns as social engineering techniques and there is no sign of decline in the number of these attacks.

Related article: Twitter Flaw Compels Victims to Follow Hacker’s Account

» SPAMfighter News - 7/10/2010