Security experts spot holes in Twitter malware filter

• Tags:
• Twitter,
• Filter,
• Malware

Vivian Yeo ZDNet Asia

Published: 05 Aug 2009 09:14 BST

• 
• 
• 
• 
• 

Twitter's new malware filter is a sign the social-media site is stepping up efforts to stem attacks, but the measure has its shortcomings, say security experts.

Twitter's filtering mechanism was highlighted by Mikko Hyppönen, chief research officer of F-Secure, in a blog post on Monday. When a user tries to submit a tweet with a suspect web link, the following warning appears: "Oops! Your tweet contained a URL to a known malware site!".

Twitter's latest security measure was a positive one, especially in light of the current threats directed at the site, Hyppönen told ZDNet Asia in an email interview. The site, he noted, has been "attacked in many ways", including spam, worms such as Mikeyy, and phishing, he noted.

"None of these problems are at epidemic levels yet, but it's great to see Twitter take real action on this," he said.

Hacking is another challenge faced by the popular microblogging site. In May, Twitter confirmed its network was hacked and some individual account information was leaked.

Dancho Danchev, independent security consultant and cyberthreats analyst, noted that the site's latest security move was an indication "Twitter is finally moving from reactive to proactive security practices". However, he pointed out in a blog post on ZDNet.com that the malware filter was "clearly still in development" and showed "disappointing results".

Danchev pointed to how a MySpace phishing page used in a tweet triggered the security filter, but was eventually accepted by adding a 'http://' or removing the 'www'.

He noted that the site also allowed tweets containing links to several known malicious sites listed in Stopbadware's database, which has identified over 380,000 sites identified as unsafe. While it would not prevent the abuse of Twitter in the longer term, the failure to integrate such databases listing known malware was a "missed opportunity", Danchev said.

Twitter did not respond to email queries at press time.

• 
• 
• 
• 

• Share this article:
• Digg
• Slashdot
• Del.ici.ous
• Stumble
• Reddit

• Most Recent
• Most Popular
• Most Discussed