Skip to Content

Free TUAW iPhone app -- try it now!
AOL Tech

malicious posts

Filed under: Social Software, web 2.0, Microblogging

Twitter begins filtering malicious URLs - what took so long?


Earlier this week, the folks over at Sunbelt noted that Twitter was working on a new feature. While there's nothing posted to blog.twitter.com about the development, it's no secret that their developers have started giving the bird to malicious links.

As of now, Twitter's blocking powers are pretty limited. On a good note, the services appears to be tied in to Google's Safe Browsing service.

However, only bit.ly short URLs are supported - the other 30million providers are not. Furthermore, URLs which lack http:// or have are posted as downloadsquad.com (without the www.) are not checked. Sunbelt also points out that Twitter doesn't currently utilize Stopbadware.org's database of nearly half a million malicious URLs.

Ok, so it's not much, but it's a start. When you look at Twitter's popularity and the number of users (or bots) using the service to spread links to "questionable" websites, there's no denying this is a good thing. Since it doesn't take much more expertise than that posessed by a bored highschool programming student to spread a worm on Twitter, countermeasures are clearly necessary.

Hopefully they'll continue working to improve link filtering. No, Twitter isn't a security company, but this should be a very high priority. If Twitter really does want to be the "pulse of the Internet" as noted in those riveting leaked docs, they're going to have to make sure the circulatory system stays relatively disease-free.

Filed under: Security, Windows, Browsers, Windows x64

AVG offers standalone realtime web page scanning for Firefox and IE

AVG's LinkScanner browser protection isn't a new offering - it's been part of their antivirus protection suite since the release of version 8. Today, however, they have decided to release LinkScanner as a stand-alone plugin so that you can add its protection to your browser even if you don't run AVG as your Windows antivirus app.

The concept is similar to Web of Trust (which was one of my Firefox addon picks last year) in that it's designed to provide trust alerts and block access to potentially harmful sites. The toolbar includes both a search protection feature and "active surf" protection.

Links within pages are scanned and given a green check if determined to be safe, yellow exclamations if caution is needed, or a red x if unsafe. With active surf enabled, site will be blocked even if accessed directly from the address bar - LinkScanner will instead present a large, red warning that you're treading on dangerous ground.

AVG claims that one in eight users of LinkScanner has already been protected from a malicious site. While it may not be your cup of tea, LinkScanner could be a good way to keep less savvy users you know out of trouble - your parents and friends, perhaps?

[via AppScout]

Filed under: Internet, Security, Adobe

Adobe warns of critical vulnerability in Reader, Acrobat

Bad news for anyone that utilizes Adobe's Acrobat software, or Adobe reader to view PDF files. A critical vulnerability has been identified that can cause the applications to crash and allow an attacker to control the affected system. All versions from 7 forward on all operating systems are suspected to be at risk.

According to the announcement from Adobe, this isn't just a possibility, it's actually happening. Reports have already been made of the buffer overflow exploit being used in this type of attack. Adobe is also working with antivirus vendors to patch the holes, and patches to update the vulnerable apps are in the works. The bad news: patches aren't likely to be ready until March 11th, 2009.

That's not nearly fast enough considering the severity of the flaw. In the meantime, you'd be wise to install an alternative applications to handle viewing PDF files. Sumatra and FoxIt are both good alternatives for Windows.

The announcement doesn't specify whether the flaw is platform specific, so Mac users may want to play it safe and stick to using Preview. *nix is also at risk, though most users are likely already utilizing alternatives.

The
full bulletin is available on Adobe's web site.

Filed under: Internet, Security, Utilities, Features, Windows, Freeware

Lesser Known Weapons To Trick Out Your Malware Arsenal

Everybody knows the big names in the battle against malware - Adaware, Spybot, HijackThis. Today we're going indie, focusing on lesser known ways to avoid and remove all that bothersome software that your "friend" crapped up your rig with!

First things first. Try not to get infected in the first place.

It's common sense that if you can keep malware from getting its nasty little claws on your OS you won't have to bother with fancy removal tools anyway. But how to do it? Sure, real-time scanning will catch a lot of garbage, but why not give your PC a little extra help? Here are two really simple methods.

Outfox malicious sites using a hosts file. By making use of the lmhosts file win Windows, you can trick your computer into never seeing sites where a lot of malware originates. Our favorite is MVPS.org's; it's one of the most complete, frequently updated files you'll find on the net. All the nefarious domains are redirected to 127.0.0.1 - good ol' localhost - so any links to their evil apps just won't work because chances are pretty good that your PC isn't serving up WinSuperSpyRemover 2008. Gold.

Read more →

Filed under: Business, Developer, Internet, Security, Web services, Google, Search, web 2.0

Google Gmail hijacking

Google Gmail hijackingYour open Gmail account could be in severe jeopardy, thanks to a malicious script that initiates itself when a website is viewed,

The tables have turned from hacking your computer, to hacking your virtually stored information. Supposedly hackers are not seeing the benefits of attacking your protected and firewalled computer these days, and are much happier to go after hacking Web 2.0 API's. Such is the case in a recent exposure of a critical process that executes a filter looking for specific incoming emails, sending them to another email address for snooping and prying. The filter would be in place until the Gmail account owner deletes it from the Settings>Filter menu.

Gnucitizen broke the news on this, and it has been verified by a few sources. He is not planning on demonstrating this process, or releasing more details on findings until Google has fixed this concern. He is also urging that others do not expose anything until they have notified Google and a fix is implemented. But does say that the hacks are out in the open for anyone searching Yahoo or Google.

Filed under: Business, Developer, Internet, Security, Yahoo!, Troubleshooting

Trojan in banner ad avoided security testing

Trojans in banner adsYahoo! owned RightMedia has been serving ads to popular networks such as MySpace, Bebo and Photobucket that could wreak havoc on visitors' machines.

The Trojan which was reported to have been inserted by a third party ad server, was tracked down to RightMedia. The infected banner ad supposedly ran several million times over a three week period after it was first spotted on August 8th by a web security company before it was removed.

The ads used Flash to load an invisible iFrame which in turn would load content in from another website. RightMedia has said that it has systems in place to test and determine whether ads contain malicious code, and will flag them appropriately. Upon further investigation of the ad, code inserted was actually designed to tell the difference between RightMedia's protection systems and not display the Trojan when the company ran the testing process.

All we can say is, "Hello Firefox with AdBlock!"

Filed under: Business, Security, E-mail, Troubleshooting

Pfizer computers sending Viagra spam?

Pfizer computers sending Viagra spam?Pfizer is a pretty big drug manufacturer is it not? Then why have they been hawking Viagra and fake Rolex watches through their email network?

Apparently some of Pfizers computers have been sending out emails that are not part of their marketing efforts. Malware has infected a number of the drug giant's computers and instructed them to send out spam on behalf a very ingenious hacker that has penetrated their systems that should have been well sealed up. A security based company let Wired into what was happening, and has stated that Pfizer's computers have been sending out spam for the past six months from over 138 different Pfizer IP addresses hawking their own goods, as well as junk stocks and penis enlargement products.

There is no word from Pfizer whether they know what's going on inside their own computer network yet. Maybe they are keeping it a little hush hush for now until quarterly earnings prove that the hacker's efforts are affecting their bottom lines in a good way.

Filed under: Blogging, E-mail, Web services, Google, Troubleshooting

Blogger infections

blogger infectionsSome Google Blogger users have been stung with attacks over the past little while, causing disturbing infections. Or is it just a case of the splogs.

Malicious hackers have supposedly been successful in gaining access to some blogs and posting fake entries with weblinks that lead to infectious downloads on Windows PC's. A security researcher started noticing the corrupt links turning up in Blogger accounts on August 27th. Since then hundreds of blogs have been reported to contain the malicious links. The researcher could not tell how the links were posted. They could have been posted through a Blogger exploit, through a feature that lets users email an entry, or the blogs could have been also set up solely to host spam and no hacking could have occurred at all.

So far the links appear to pose as YouTube links, others are looking for software testers, and others are links to supposed digital greeting cards. No word from Google on the matter.

Filed under: Windows, Yahoo!, P2P

Yahoo! Messenger ActiveX flaw fixed

yahoo messenger flaw fixedYahoo! fixed a little flaw this week in Yahoo! Messenger for Windows that could have been used by hackers. The flaw was in the ActiveX control and allowed hackers to crash a chat session and Internet Explorer. Worse, it could have executed malicious code on the victim's machine. The initiation could have taken place if hackers prompted users to view HTML code that linked to a web site with malicious code.

Not to worry, though--Yahoo! has this "highly critical" bug all fixed, and is recommending that users who downloaded Yahoo! Messenger before November 2nd to install the new 8.1 update.

Filed under: Business, Internet, Utilities, Social Software

AOL badware?

aol badwareAOL has been blacklisted on StopBadware.org due to the main fact that it installs additional software with AOL 9.0 without telling the user. The test of the free AOL 9.0 that StopBadware.org tested, reportedly got the bad grade because AOL did not live up to their "rich legacy" as stated by StopBadware.org co-director John Palfrey. Palfrey says this was the only reason why AOL had got dumped into the same category as malicious badware providers.

AOL has said that they are reviewing the report, and that no company has done more to fight malware than AOL. AOL is taking steps to ensure that the issues are addressed, and that they involve only minor UI changes.

Featured Time Waster

The World's Hardest Game 2.0 - Time Waster

So, just how good at time waster games are you? Think you've got the stuff? Well, The World's Hardest Game 2.0 doesn't think you do. Yes, amazingly, it's possible to have a sequel to a game called "The World's Hardest Game". It doesn't seem logically possible, since if the first one was actually the world's hardest, how could another one come along and share the moniker? It made me doubt the name in the first place. That is, until I tried the game. The mechanics of the game are very simple. You are a small red square, ...

View more Time Wasters

Featured Galleries

Defective by Design, London: Protest Pictures
Microsoft Security Essentials
Chromium Pre-Alpha on CrunchBang Linux
Safari 4 Beta
10 Firefox themes that don't suck
IE8 RC1
Download Squad at the Crunchies After-Party
Download Squad at the Crunchies
WordPress 2.7
Cooking Mama: Mama Kills Animals
Windows 7 Hands On
Comodo Internet Security
Android First-look: Amazon.com MP3 Store
Android First-look: Twitroid
Google Reader Android
Android Hands-On
Twine 1.0
Photoshop Express Beta
Mozilla Birthday Cake
Palm stuff
Adobe Lightroom 1.1

 


Follow us on Twitter!

Flickr Pool

www.flickr.com

More Tech Coverage

AOL Radio

Joystiq

TUAW

Daily Finance

Autoblog

Urlesque

Engadget

WoW

Switched.com

FanHouse