Download - Help Net Security

arranged in the same manner that other reputable
news sites are arranged in also gives it
an air of legitimacy.
To illustrate the appearance of a reputable
site, this particular campaign included a slew
of supposed reader comments at the end of
the article. Some sang the praises of the
work-from-home system, while some provided
slightly skeptical views, done to undoubtedly
keep up the image of legitimacy. However, a
look at the source code shows that these
comments were written directly to the page
and avatars were stolen from comment sections
of various reputable Web sites, including
the New York Times.
Another feature that helps with the legitimacy
aspect is the use of geolocation in order to
customize the story and site to appear to be
local, making it more appealing to the reader.
The article in this example discusses the success
of a woman named Mary Steadman,
who just happens to be from the same town
as that of the reader (thank you, geolocation).
This is seen several times throughout the
story, including the title of the publication,
which is the [insert your state name here]
Catholic Business Edition. The story continues
to tell you how Mary “gets rich quick” using
Easy Google Profit to post links on various
Web sites, which most likely will aid the
scammer later through Search Engine
Optimization (SEO).
ALTHOUGH SHORTENED URLS WERE MADE POPULAR BY TWITTER!S 140-
CHARACTER LIMIT, SPAMMERS HAVE TAKEN ADVANTAGE OF THIS SIMPLE
TECHNIQUE TO POSE MORE DANGERS TO THE UNSUSPECTING
Although shortened URLs were made popular
by Twitter!s 140-character limit, spammers
have taken advantage of this simple technique
to pose more dangers to the unsuspecting.
One danger associated with URL shortening
is that users are blinded to the actual URL
they are about to visit, since they click on an
unknown link, which may contain a malware
download, phishing sites or other spamrelated
material.
Since the proliferation of Twitter, where shortened
links are commonplace, caution seems
to have gone by the wayside, and often times,
even the savviest users are too trusting and
they click on shortened URLs without hesitation.
Scammers capitalize on this fact, leading
us to the second danger of shortened URLs:
bypassing spam filters.
By shortening the URLs, scammers can bypass
spam filters because the actual domain
is not sent via e-mail. As a result, the malicious
link is more likely to evade some filters.
Currently, there are high volumes of spam utilizing
many different URL shortening services.
Finally, and something worth noting, shortening
services are typically free, do not check
the link or utilize any CAPTCHA technology to
prevent abuse. Such ease of access allows
cybercriminals to conveniently utilize automation
built-in by spammers, thereby allowing
them to abuse the service with efficiency.
Twitter
In this final section, we will delve further into
the topic of Twitter security as the craze surrounding
this micro-blogging site continues to
grow. 140-character “tweets” provide a unique
way to share information and an innovative
way for spammers, scammers and hackers to
once again trick the unsuspecting user.
Recently, Twitter has faced scrutiny for lack of
security, mostly surrounding password security.
Not too long ago, a hacker made his way
into a Twitter employee!s Yahoo account by
guessing the user!s security question, and
shortly before that, another Twitter employee!s
administrator account password was hacked
because he used the simple dictionary word
“happiness.” This was followed with blog
posts about the conquest, along with screenshots,
showing that the hacker gained administrator
access to such celebrity accounts as
Aplusk (aka Ashton Kutcher), Barack Obama,
Britney Spears, et al. All of this led to a media
lashing about Twitter!s inability, or lack of
www.insecuremag.com 36