A new Twitter worm has surfaced that abuses Google’s goo.gl link shortening service.
The worm has been seen spreading with the following links: “goo.gl/R7f68” and “goo.gl/od0az.” Twitter is aware of the attack and stated in a tweet that it is pushing out password resets to anyone affected. The microblogging site also advised users to check oAuth connections and revoke any they didn’t approve.
Users who clicked on the shortened links were redirected to the compromised Website of a French furniture company before being redirected to other domains. According to reports, the worm appears to have been spreading through mobile Twitter platforms. Many Twitter users tweeted warnings Dec. 7 in response to the spread of the links. Gerry Egan, director of Symantec Security Response, told eWEEK the malicious URLs in the attack actually point to a copy of the Neosploit attack toolkit.
“This toolkit looks at information about users’ systems to select attacks with the greatest chances of success against each individual machine,” he said.
Shortened links have often been used to hide attacks, particularly on Twitter, which requires messages to be 140 characters or fewer. In ablog post, Symantec researcher Hon Lau noted that URL shortening services can make it difficult for users to recognize dangerous domains-let alone block them.
“Some URL shortening services are better than others insofar as they offer previewing capabilities,” Lau wrote. “In the case of tiny.cc, it even offers a stats page where anybody can see how many hits were made as well as the destination of the shortened URL. Some services, such as bit.ly, have also integrated link blacklisting services, automatically filtering out attempts to create shortened links to known malware sites.”
Security pros have pointed out however that malicious links come in all shapes and sizes, and a shortened URL isn’t necessarily more likely to be malicious than one that isn’t.
Lau advised users to be wary of “bizarre-looking messages on Twitter,” especially those found in the trending feeds, and to avoid clicking on suspicious links.