Sindiket
Portal, Web Directory And Gurus Internet Marketing Forum

One of the advantages of working at Google is that you get to see neat products and features before the rest of the world does. But that can also be a disadvantage. Sometimes I’d like to talk about a fun Gmail Lab or a new Calendar feature but I’m honestly not sure whether the outside world can see the new feature. I don’t want to leak something that the outside world can’t see, so I usually I play it safe and end up not talking about any Gmail Labs, for example. I’d enjoy giving more Gmail tips but I also don’t want to show my actual email that might contain secret stuff.

I think I’ve figured out a way to solve this issue. I’ve created a new Gmail account, siliconvalleyuser (at) gmail.com. Let’s say it belongs to John Q Public, a power user living in Silicon Valley. Feel free to send John non-Google-related emails about fictional events: “Hey John, want to come to the party on Saturday?” or “John, here are those pictures from the fireworks this past weekend.” or “Hey John, I saw in the newpaper that you won the California lottery--congratulations!” Then when I want to do a screencast or demo some power feature of a Google account, I’ll have some realistic email to show.

Just one note: please don’t email anything to John about Google. I get way too much email about Google already, and the purpose of this account is to show different features of Gmail or Calendar. To keep this email address completely separate, I created a filter that deletes any emails that mention Google or me:

Again, please don’t email about Google-related stuff, but feel free to email John about interesting fictional things at siliconvalleyuser (at) gmail.com! I’m hoping that I can do some blog posts or videos with good tips.

As you already know, Authorize.net is experiencing an outage due to the Fisher Plaza Fire which took place in Seattle, Washington. Authorize.net isn't the only place experiencing outages. It turns out that Microsoft's new search engine, Bing, is...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

The most amazing fireworks show in the country; Red, White, and Boom will be held in downtown Columbus, Ohio, on July 3rd, 2009. This will be the 29th year it has been around. The website states that food, fun, live entertainment, and obviously...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

All Headline News is reporting that authorize.net is experiencing a server outage after a fire at one of the Seattle Data Centers. According to All Headline News, the fire took place at Fisher Plaza. This is causing many problems, but the main one;...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

I was reading the Lesbian Life at About dot Com and there was an interesting post about Diana Taurasi and whether or not she had a boyfriend, or instead, if she were lesbian. According to the post, Taurasi made "some comments that had them (the...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

There is not a Crystal Defanti torrent. I realize that a lot of people are disappointed by this, but I for one am not. This women has gone through enough. As stupid as she may be for accidentally dragging a file onto the DVD maker program, it's...

[[ This is a content summary only. Visit my website for full links, other content, and more! ]]

GoDaddy is sometimes hard to take seriously; its marketing department seems to be run by the same bunch of teenage boys in charge of Axe commercials.  But GoDaddy is still the world's largest domain registrar, and it's poised to help Twitter with a new step in its registration process.

GoDaddy seems to have made the assumption that anyone wanting to create a website will also want to establish a presence on Twitter.  Adam Ostrow reports that it's actually "integrated Twitter registration into its domain manager, allowing you to see if the Twitter username that matches your URL is available, and if so, register it."

This says a great deal about how important Twitter has become to the people at GoDaddy (and indeed, you can find GoDaddyDeals, GoDaddyJobs, and GoDaddyGuy Twitter accounts, with that last one being rather popular and putting out about ten tweets per day). 

 

It says something about what GoDaddy thinks its customers want, too.

And since every single GoDaddy customer probably hasn't been switching back and forth between the domain registrar and Twitter while trying to name a company, this development may introduce Twitter to a lot of new people.

There has been more than one story in the news recently about Twitter accounts being hijacked. The most recent examples of note include the accounts of Britney Spears and famed blogger/entrepreneur Guy Kawasaki. These issues have highlighted some potential dangers of using the service, or really social networks in general. Have you encountered security issues with Twitter or other social networks? Share with WebProNews readers.

Amit Klein, CTO of Trusteer, a security firm, who counts the nation's largest direct bank, ING Direct, among its customers, feels that Twitter account hijacking is an issue that more people need to be aware of. WebProNews asked Klein a few questions about it, and the following is the resulting Q&A session.

WebProNews: Please talk a little bit about what is happening when Twitter (and other social network) accounts are hijacked.

Amit Klein: Typically, criminals hijack Twitter accounts in order to spread malware. That is, they abuse the hijacked accounts to post messages to all the "followers", with a link to a site that serves malware. In the Guy Kawasaki incident, for example (not a classic account hijacking, but still a malware spreading campaign), of the 139,000 followers, it is estimated that hundreds got infected. Earlier this year, accounts of 33 celebrities (among them Barack Obama - 1.6 million followers, and Britney Spears - 2.1 million followers) were hijacked.

WPN: How big of a problem is hijacking of Twitter (or other social network) accounts?

AK: This is quite bad, since a twitter account enables one to send malware links and plain spam to all followers. Of course - the more followers, the more widespread the attack is.

WPN: How common is it?

AK: Over the last 10 days, we've seen two high profile incidents, in which an account was abused to serve spam and malware. One is the Guy Kawasaki incident, and another is Britney Spears.

WPN: Has it been limited to "high profile" accounts, or is it becoming common for regular users as well?

AK: Obviously the media covers only the high profile attacks (celebrities, politicians, etc.). We believe that attacks against more average accounts are also taking place - quite possibly via mass production utilities.

WPN: What are the dangers that come with it?

AK: The most obvious danger is that a hijacked account can be used to serve malware and spam automatically to all a user's followers. An account can be hijacked a long time before it is abused. Attackers usually wait for the right opportunity to hit as many users as possible.

While twitter is currently used to spread malware, it's a perfect platform to commit fraud as well. Followers trust the messages that come from the person they follow, while in reality the message could be spam trying to convince followers to fall to a scam. A very simple example would be a request to donate a small amount of money to charity (for example to support the situation in Iran). The link would go to a fraudulent website that records credit card numbers. A high profile account that sends such a message could result in hundreds of thousands of compromised credit cards.

Another example is false rumors about companies and stock, which could result in pump and dump attacks.

WPN: What can users do to protect their accounts?

AK: To secure their Twitter presence, users needs to take several actions:

1. Protect their twitter credentials - users need to be vigilant and keep on the look out for Twitter phishing attacks, and pharming (DNS poisoning) attacks. Users can install client side security tools that ensure they are only providing their Twitter credentials to the genuine twitter website. In doing so, they will protect their credentials against keyloggers or malicious browser plug-ins ("man in the browser" attacks).

2. Control and protect their twitter information. As tempting and convenient as it may be, using 3rd party applications and services that enhance Twitter may increase the exposure of users to abuse. Every website which is allowed to automatically post to a user's Twitter account adds attack surface that criminals may exploit.

WPN: Please feel free to discuss anything else related to the subject that you feel people should know.

AK: Somewhat akin to phishing, is a practice called "twitter-squatting", wherein names of people/organizations are registered by fraudsters (or sometimes pranksters). It makes a lot of sense to monitor for such registrations, or better yet, to register brand names and individual names as early as possible to thwart such attacks.

Another threat associated with Twitter is abusing "Trending Topics" to serve malware. The attack involves sending many tweets (with malicious links) with some special keyword in them, so that this keyword will show up as a trend in the "Trending Topics" list at twitter.com. A user that views a sample tweet for this keyword and clicks on the malicious link will be served malware.

Both examples show how well established web attacks carry over into the twittersphere. Cyber squatting is a well-known practice on the web, which is now occurring in Twitter. Likewise, search engine poisoning is a common practice on the web, and now in Twitter also.

Security-wise, Twitter should be treated both as an individual website with its own potential security issues, and as a microcosm into which many existing web attacks can be mapped. This makes securing Twitter harder than protecting typical websites.

Wrapping up

WebProNews would like to thank Amit for sharing the above insight into Twitter security issues. Has your Twitter account ever been hijacked? Have you been a victim of Twitter abuse of any kind? Tell us about it.

Twitter has started linking hashtags in tweets to Twitter searches. A few other Twitterers have started to notice as well:


The move makes sense, considering that the hashtag phenomenon has reach tremendous popularity. They often appear in the trending topics.

The move also illustrates a greater emphasis being placed on Twitter Search, which only this year has become a focus of the company. It wasn't that long ago that it was added to the Twitter home page, and it is already sparking big interest in real-time search throughout the entire search industry.