Ask Marian

[#1]

Today's spam or hack of the day seems to be the Go0gle-Wizard hack. There's a lot of tweets coming in displaying big stories of quick money made with this unknown service. Most people believe it's a hack but I don't have enough information yet. I'll update this post as soon as I do but be careful and don't click those links! The messages look like this: Up to $240.30 so far today!!! i'll tweet another update later!! check out http: // Go0gle-wizard dot com.  I've been doing this for 8 days so far, up to $142.90 so far - (same website)

 I first noticed them in my friend's Facebook status then went to check Twitter to see if it's originating there. If you run a search in Twitter, you'll find hundreds of these cryptic messages. If you have any info on this, please post a comment!

Message Edited by marianmerritt on 07-31-2009 11:43 AM

Message Edited by marianmerritt on 07-31-2009 11:44 AM

[#2]

 I had this spam message get posted by my twitter account, and when I reported it, they suspended me!!! .  I don't think it is the result of any sort of spyware/trojan/virus, because I mainly use twitter via SMS, and the only time I do log onto the twitter.com website it is from my secure laptop running linux.

 It definitely seems like a hack or vulnerability on twitter's website to me, I have found dozens of (what seem like) legitimate accounts posting this spam message. 

also watch out for "http:// e a r n i n g -p r o f i t 3 .c o m"  (added spaces to prevent accidental clicks).  It is the exact same website, and some "hacked"(?) twitter accounts are posting messages with that link too. 

watch this search on twitter for people talking about it: 

http://twitter.com/#search?q=google-wizard

my (currently suspended) twitter account name is aliencam.  

I also posted about this on intense-debate, I have submitted a help ticket to twitter, and I am keeping tabs on this (and will be posting a list of twitter accounts that I think are legit that have this spam message) on my blog at:
http://blog.aliencam.net/2009/07/google-wizard-twitter-hacke/

[#3]

My Twitter account was hacked by the Go0gle-Wizard hack yesterday at around 2:44pm ET. (I have since changed my password for Twitter and just about everything else I could think of.)  Just FYI, I had never heard of, visited or logged into TwitViewer (I know they were stealing u&p and Twitter made an official warning about them). I don't know how it happened. 

What sort of info would be useful in moving forward to security experts such as yourself? Here's some info you might find relevant:

My Twitter account had links/connections to just two applications: FourSquare (an iPhone app) and SawHorse Media (a website)--both are apps/sites runs by trusted friends so I doubt the exploit came from there but I thought I'd throw that out there just in case many other users reported similar. Also, for my Twitter client 99% of the time I run Tweetie (v.1.2.2 currently) on my OS X machine and my iPhone. I log into Twitter.com about once every two weeks. About four months back I used TweetDeck for a while.

I keep my computer up to date and protected. My Twitter password was relatively weak but not stupidly weak (my mistake) but then again, I've been on the internet using similar sorts of password since 1990 and this was the first hack/compromise I've ever experienced. The original password was eight letters but nothing stupidly obvious. It's now 128-bit :-)

I am guessing they got a big u&p list from somewhere, but where? I wonder if the place they got them from originally got them from somewhere else? I really want some answers here.

You can contact the real me on twitter {at} tomloverro 

[#4]

@tomloverro  ... I was using foursquare also.

The only two things I had my account linked to were FourSquare and  TwitterBar (the latter stores my password locally on my secure laptop).  

[#5]

Hi all,

Thanks for sharing your experience with this. What I found from our internal Threat team is more to do with the destination site than how your Twitter account was hacked. I know a few more people to talk to who were at the Las Vegas Black Hat conference so I might get more on this after the weekend. Anyway, here's what we know about the destination site:

The site is just a front for news 7 dot org/...google-masters. , which is a blog site with a link to mysearch cashonline dot com.  . This is one of those ‘Work from Home’ + ‘Online Marketing’ plans. 

It looks pretty suspect to me. They want to get your credit card info, etc.   I've also invited other victims to post here; maybe we can get lucky and isolate the application or cause just by talking to each other.  Marian

Message Edited by marianmerritt on 07-31-2009 11:40 AM

[#6]

Hello, Marian,

Just wondering why you've included the Suspicious Web Link in the Article.

[#7]

too right. let me address that!

[#8]

I wonder if all hacked users had apps that took advantage of the Twitter API at one point or another. That is, I wonder if the issue is in the Twitter API...

[#9]

Newest versions of this that are spreading today: google - master, profit - master, and earning - freedom. Just sent Twitter.com/spam a message.

[#10]

My Twitter account also posted an EARNING-PROFIT3 link on July 30. The password is weak because I don't really care about Twitter, but this is definitely a hack, not a phish. I've admin'd Windows computers since 3.1, and I've never installed antivirus because I simply don't install viruses, so it's unnecessary. The last malware I came down with was Code Red in 2001, which exploited an IIS vulnerability. Even when I'm shopping and see a security certificate mismatch I investigate the problem (did the company just forget to associate the cert with their domain without www and it's actually valid?) so I can assure you this wasn't a phishing attack, but an application with a security issue or database hack. I certainly doubt anyone would brute force Twitter passwords in order to post spam. It did happen very close to the time I allowed Digsby to log into Twitter, so that is worth investigating.