Gifts Under $30 Gifts Under $50 iPhone Emergency SOS Saves Man MyHeritage 'Time Machine' Guardians of the Galaxy 3 Trailer White Bald Eagle Indiana Jones 5 Trailer Black Hole's 1,000 Trillion Suns
Want CNET to notify you of price drops and the latest stories?
No, thank you

Twitter targeted by malware attacks

Attackers create fake profile to lure Twitter users to download malware. Another vulnerability allows Twitter users to force other users to automatically follow them.

Twitter's time has finally come.

The microblogging service, once the playground of the Web 2.0 digerati, is now mainstream enough to be targeted by online criminals.

Kaspersky Lab has uncovered a fake Twitter profile created solely for the purpose of infecting people's computers.

The profile, with an alias that means "pretty rabbit" in Portuguese, has posted a link that purports to be a pornographic video, but is instead Trojan software masquerading as MP3 files that steals data from the machine, according to the Kaspersky's blog.

The fake Twitter profile with a link purporting to show video porn but which actually steals data.

"If you click on the link, you get a window that shows the progress of an automatic download of a so-called new version of Adobe Flash, which is supposedly required to watch the video. You end up with a file labeled Adobe Flash (it's a fake) on your machine; a technique that is currently very popular," the blog says.

The attack is dangerous because it does not require programming skills and could spread easily if it ends up high in Google search engine rankings. That is possible because Google indexes unprotected Twitter profiles.

This isn't the only security problem to hit Twitter. Last week, researcher Avi Raff launched a Web site devoted to security issues with Twitter called Twitpwn.

In his first dated post, he writes about a vulnerability he discovered that allows an attacker to force someone to follow him automatically. The vulnerability could still be exploited on Internet Explorer, he wrote on Monday.

"A spammer or phisher could abuse this vulnerability to gain thousands of 'followers' and attempt social engineering attacks," Ryan Naraine, security evangelist at Kaspersky, wrote on the Zero Day blog of CNET News affiliate ZDNet.