IT security and control firm Sophos is reminding Twitter users
to be cautious when using the site, following news that the account
of pop star Britney Spears was compromised by an attack via third
party website, TwitPic.
In a tasteless stunt that was seen by her two million followers,
a hacker posted the following message to Spears's Twitter stream
earlier today:
'Britney has passed today. It is a sad
day for everyone. More news to come.'
The picture on Britney Spears's TwitPic account and the fake
post to Twitter have since been deleted.
"The millions of people who follow celebrities on Twitter have
to be grateful that all they witnessed this time was a sick prank
by hackers," said Graham
Cluley, senior technology consultant at Sophos, on his
blog. "But this kind of vulnerability goes to show how simple
it can be for hackers to break into accounts, which could then be
used to expose followers to malicious web links containing malware
or phishing pages. Although users should continue to be very
careful when clicking on links in tweets, especially ones that have
been obfuscated by link shortening services, this attack has
demonstrated that services like TwitPic need to be doing more to
protect their users."
The fake story of Britney's death was posted to her Twitter
followers via the TwitPic service, which automatically forwards
messages to the associated Twitter account. There are a number of
ways in which messages can be posted on TwitPic, including sending
a picture to a unique email address. It is thought that hackers
used this method to post the fake message, which would have
involved cracking a four digit PIN code. Following the attack on
Spears's account, TwitPic announced that it has fixed a
vulnerability with its email posting functionality.
More than 100 million users in 150 countries rely on Sophos as the best protection against complex threats and data loss. Sophos is committed to providing security and data protection solutions that are simple to manage, deploy and use and that deliver the industry's lowest total cost of ownership. Sophos offers award-winning encryption, endpoint security, web, email, and network access control solutions backed by SophosLabs - a global network of threat intelligence centers. With more than two decades of experience, Sophos is regarded as a leader in security and data protection by top analyst firms and has received many industry awards.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.