The most recent example: A new wave of phishing attacks, which are generally–but not always–sent via the service’s “direct message” feature. And which generally–but not always–feature language like “LOL is this you” in the message.

Like most phishing attacks, this one has some telltale signs, if you’re the kind of person who’s inclined to see them. There’s the odd text in the message itself. And the “bzpharma” text that appears in the URL address is a big giveaway.

But! As with many other phishing attacks, if you’re not looking for this stuff or you’re just clicking quickly, it’s easy enough to get duped. The fake Twitter homepage created by the phishers looks real enough, as does the “fail whale” message you get after entering your info.

One easy step you can take to arm yourself against this kind of thing: Follow Twitter’s “Spam Watch” account, which does a decent job of keeping people informed attacks like these. But while that account has 148,368 followers, and tends to get retweeted a lot, the majority of Twitter users still won’t learn about this stuff in advance. Maybe it’s time for Twitter to build some equivalent of the emergency broadcast system.

Meanwhile, if you don’t like reading, the video below from the Sophos security firm (via Mashable) gives you a good idea of what this is all about.

Certainly, it’s difficult to determine if the email is genuine. After all, its subject line is “Please change your twitter password,” and conventional wisdom is to never click a password-reset link in an email. That said, Twitter users who received it and followed its instructions have regained access to the service after being locked out.

So, if you’ve received such an email, tread carefully.

As of this writing, Twitter has not commented on these reports on its blog or status page, though that doesn’t necessarily mean anything. In any event, I’ve asked the company for an explanation and will update here if and when I receive one.

UPDATE: Twitter just sent me the following comment:

As part of Twitter’s ongoing security efforts, we reset passwords for a small number of accounts that we believe may have been compromised offsite. In one case, a number of accounts posted updates indicative of giving their username and password to untrusted third parties. While we’re still investigating and ensuring that the appropriate parties are notified, we do believe that the steps we’ve taken should ensure user safety. We’ll continue provide updates as warranted at @safety and @spam. We do, as always, encourage our users to read our help pages on what to do if your account is compromised: http://twitter.zendesk.com/forums/10713/entries/31796 and how to stay safe on Twitter: http://twitter.zendesk.com/forums/10711/entries/76036.

[Image credit: Andrew R.H. Girdwood]

Switching to an alternative Web browser like Firefox or Google (GOOG) Chrome is one possibility. For now, security companies like McAfee (MFE) have only identified the latest security exploit as an Internet Explorer issue, but there’s no guarantee that they won’t find vulnerabilities in other browsers that were involved in the broad attack on Google and others.

Generally speaking, a browser switch is going to be a lot easier for an individual than it will be for corporate users, where IT policies often dictate which browser people use on their computers. Graham Cluley, a senior technology consultant and security firm Sophos, said in a blog post Monday that companies may cause “more problems than it’s worth by summarily switching browsers” because of the potential for employee confusion and Web site compatibility problems caused by the new software.

Read the rest of this post on the original site

On Monday, Bit.ly announced partnership with several security firms, including Websense (WBSN), Sophos and VeriSign (VRSN), that it said helps to address that.

The three of them will provide malware and spam-detecting services designed to keep fraudulent links from making their way into Bit.ly URLs, which in turn are used extensively on Twitter, email and social-networking sites like Facebook and MySpace.

Read the rest of this post on the original site

Networks of fraudsters use spam and malware to direct Web traffic to phony pharmaceutical sites, wrote Graham Cluley, a technology consultant for Sophos.

“Although unwitting buyers do often receive some kind of drug as result of the transactional exchange, at best the drug doesn’t work and at worse it can pose serious health risks,” he added. Cybercriminals are “putting their customers’ health, personal information and credit card details at risk” with these counterfeit versions of Tamiflu.

Many of these fraudulent pharmaceutical sites originate in Russia, Sophos’s Dmitry Samosseiko noted in a paper on the topic. One network called GlavMed, for example, has more than 120,000 online pharmacy sites selling generic drugs under the name of Canadian Pharmacy.

Read the rest of this post on the original site

One message contains links supposedly of unpublished photos and a YouTube video of the singer, but the link prompts recipients to download a file that, when opened, opens a legitimate Web page while downloading and installing malware, according to San Diego-based security provider Websense.

Elsewhere, an email is circulating that reads: “Vital informations after the death of Michael Jackson’s I really need some one trusted & secretive to speak with with informations i have in my possession before its too late Kindly reply me and i will immediately respond back,Its for just secret between both of us,” warned Graham Cluley, a senior technology consultant at security firm Sophos.

Read the rest of this post on the original site

And Google (GOOG) is serving up ads on it.

To be fair, though, it’s no easy task for the search giant to keep Blogger malware-free. So in some sense, the fact that the service hosts just two percent of all malware and not 20 percent is an achievement, as Sophos’s Graham Cluley notes. “If you think about it, Blogger/Blogspot’s position is probably not surprising–it’s a phenomenally popular platform for people to create their own Web pages (blogs), and gives Internet users the ability to comment on other people’s blogs,” Cluley said in a post to his blog. “Inevitably, there are ne’er-do-wells out there who will try and abuse a great service like that, and try and plant malware and malicious links. For its part, Google–the company who own Blogspot–takes security seriously, and works hard to shut down Web pages serving up malware.”

And Google (GOOG) is serving up ads on it.

To be fair, though, it’s no easy task for the search giant to keep Blogger malware-free. So in some sense, the fact that the service hosts just two percent of all malware and not 20 percent is an achievement, as Sophos’s Graham Cluley notes. “If you think about it, Blogger/Blogspot’s position is probably not surprising–it’s a phenomenally popular platform for people to create their own Web pages (blogs), and gives Internet users the ability to comment on other people’s blogs,” Cluley said in a post to his blog. “Inevitably, there are ne’er-do-wells out there who will try and abuse a great service like that, and try and plant malware and malicious links. For its part, Google–the company who own Blogspot–takes security seriously, and works hard to shut down Web pages serving up malware.”

• 72% of respondents divulged one or more email address
• 84% listed their full date of birth
• 87% provided details about their education or workplace
• 78% listed their current address or location
• 23% listed their current phone number
• 26% provided their instant-messaging screen name

Yikes. You’d think institutional privacy concerns would be enough to make folks think twice about expanding their Facebook networks with reckless gusto, wouldn’t you? Guess not.

“It certainly doesn’t bode well when you’re talking about privacy concerns,” Ron O’Brien, a senior security analyst at Sophos, told InformationWeek. “The information they’re offering up could be just as valuable as credit card information for someone trying to build a profile of you. People need to be more selective about whom they provide information to. … Collecting ‘friends’ is encouraged by social-networking and business-networking sites,” he added. “It’s a status thing to see how many friends or contacts you can rack up. … This was intended to demonstrate to the average user that they need to exercise a lot of caution. The Web is a doorway and it shouldn’t be constantly open.”