Britain all atweet over Twitter phishing attack

IDG News Service - The latest phishing attack on Twitter users swept the U.K. overnight claiming several prominent users.

The result was evident on Friday morning when users woke up to find messages on compromised accounts that read, "hey, i've been having better sex and longer with this here," followed by a link to a Web site selling sexual-performance drugs.

Although the number of people affected is difficult to determine, it made top news on the country's TV networks and news sites perhaps in part because of those affected. They include at least one member of Parliament and several journalists.

Ed Miliband, a British Cabinet member and the country's secretary for energy and climate change, tweeted on Friday morning, "Oh dear it seems like I've fallen victim to twitter's latest 'phishing' scam." The tweet had been removed from his Twitter stream.

Another of those who saw his account hacked was Matt Wells, head of audio at The Guardian newspaper, who tweeted, "Good morning. I am neither female, nor have I been having better sex lately. (Although if there are any offers...). First-time Twitterhacked." The offending tweet was still available on his page at time of writing.

Other reports said BBC correspondent Nick Higham and the country's Press Complaints Commission were also hit.

While some of the accounts are believed to have been hacked by software programs looking for weak passwords, at least some were through Twitter direct messages that tried to entice users to click through to see a message from a young, attractive woman. Upon clicking the link users were taken to a look-a-like Twitter log-in page where they were asked to enter their username and password.

Twitter posted a message to its Twitter Safety channel late Thursday local time warning users to beware of direct messages. "If you get a DM from an enthusiastic lady wanting to converse by IM, please ignore. User is likely compromised & request is spam."

The phishing attack mirrors a similar one a week earlier that saw messages asking "LOL this you?" sent to users.

It's the kind of thing that will persist on social networking services, said Graham Cluley, senior technology consultant at security company Sophos.

"The fact is that social networking accounts have a financial value," he said. "They can be used as a springboard for sending out more spam, malware or selling things."

Users on sites like Twitter and Facebook tend to feel safer when using the sites than others on the wider Internet but should be every bit as aware, he said. Messages received through the sites don't necessarily come from friends, but could be from anyone with access to the account.