Asia's Source for Enterprise Network Knowledge

Friday, April 18th, 2014

Information security threats

Twitter scam surfaces

A scam that has been making its way around Twitter for some time has resurfaced recently and promises to increase a user's followers, but really gives control of one's account to a questionable third party.

The ruse begins by employing some social engineering with a tweet that says "I will follow back if you follow me" and includes a shortened link. The link then takes you to a web site that offers a service which claims it can round up hundreds, even thousands, of new followers on a Twitter account.

According to Sophos' Senior Technology Consultant Graham Cluley there are several versions of the services out there.

"Although the graphics differ, the basic template of the site remains the same -- including options to either pay for a VIP plan or try out a free service that promises hundreds of new followers," Cluley notes in a blog post.

Cluley created a new Twitter account to test out the service through a "free trial." He quickly found the service required his Twitter username and password.

"That should instantly have you running for the hills -- why should a third-party webpage require your Twitter credentials? What are the owners of these web pages planning to do with your username and password? Can they be trusted?" he said.

Cluley also noted in the bottom right hand corner of the site, the service admits it is not endorsed or affiliated with Twitter.

After entering the login details for the test account, Cluley reports he was asked by Twitter to grant the application access to the account, which many unwitting victims often do.