A Twitter worm was seen spreading through malicious goo.gl links. Twitter said it is pushing out password resets to anyone affected.
A new Twitter worm has surfaced that abuses Google's goo.gl link shortening
The worm has been seen spreading with the following links: "goo.gl/R7f68"
and "goo.gl/od0az." Twitter is aware of the attack and stated in a tweet
it is pushing out password resets to anyone affected. The microblogging site
also advised users to check oAuth connections and revoke any they didn't
Users who clicked on the shortened links were redirected to the compromised
Website of a French furniture company before being redirected to other domains.
According to reports, the worm appears to have been spreading through mobile
Twitter platforms. Many Twitter users tweeted warnings Dec. 7 in response to
the spread of the links. Gerry Egan, director of Symantec Security Response,
told eWEEK the malicious URLs in the attack actually point to a copy of the
Neosploit attack toolkit.
"This toolkit looks at information about users' systems to select
attacks with the greatest chances of success against each individual machine,"
Shortened links have often been used to hide attacks, particularly on
Twitter, which requires messages to be 140 characters or fewer. In a
blog post, Symantec
researcher Hon Lau noted that URL shortening services
can make it difficult for users to recognize dangerous domains-let alone block
"Some URL shortening services are better than others insofar as they
offer previewing capabilities," Lau wrote. "In the case of tiny.cc,
it even offers a stats page where anybody can see how many hits were made as
well as the destination of the shortened URL. Some services, such as bit.ly,
have also integrated link blacklisting services, automatically filtering out
attempts to create shortened links to known malware sites."
Security pros have pointed out however that malicious links come in all
shapes and sizes, and a shortened
URL isn't necessarily
more likely to be malicious than one that isn't.
Lau advised users to be wary of "bizarre-looking messages on Twitter,"
especially those found in the trending feeds, and to avoid clicking on