Conficker: ‘Headless Botnet’ Still Infecting Windows Users

Researchers say the notorious Windows worm has created a “headless botnet” – but one that continues to maintain a hold of millions of computers. A year after the infamous April 1 doomsday deadline, the investigation into the masterminds of the worm continues.

Read the rest of this article at eWeek

Identity Crisis?

What if confidence in a person’s identity were eroded to such a degree that it became impossible to prove who you are anymore?

If trust were eroded to such an extent that no one had the confidence necessary to trust a “proof” of identity, what would be the outcome? Would the local and even global financial system collapse as the risk of lending became too great? Would the world of online consumer commerce carry on regardless, asserting that “reception of funds is sufficient proof to ship” thus furthering the crisis of confidence as everyone’s bank accounts became a public and shared utility?

Read the rest of this article at Rik Fergusons blog

Apple IPad Hits Stores in the US

Apple Computer on Saturday started selling the iPad tablet, a handheld device through which users can view movies, surf the Internet, read e-books and play games.

Lines formed outside the Apple store in New York with customers eager to purchase the product, which is one of the most hotly anticipated devices since the iPhone was launched in 2007. The lines weren’t as long as they were for the iPhone, but buyers seemed ecstatic after getting the iPad in their hands.

Read the rest of this article at  PCWorld

Will Feds Use Letter Sent by Sovereign Citizen Group to Stage False Flag?

“…the government is looking for the right situation in order to crack down on the patriot movement. The establishment is infamous for staging fake terror and criminal events as a pretext to take drastic action against those who oppose their plans.”

Read the rest of the article at PrisonPlanet

Flawed Assumptions in the Albert Gonzalez Case

As attorneys and retailers argued recently about the sentencing and secrecy of Albert Gonzalez’s criminal empire, various fundamental retail realities were forgotten.

Consider, for example, arguments on both sides that JCPenney and Wet Seal would have their stock prices seriously hurt if word of their involvement leaked out. The federal judge overseeing that discussion said any stock impact from the retailer’s own doing, but he neglected to point out that there is absolutely no reason to believe that there will be any stock impact.

Read the rest of this article at CBS news

Until next time — Stay safe online!

Trademytweets[SCAM]com is a new variation of the old Tweeterfast, Tweeterfollow theme. Recent domains that have operated under the same gray umbrella are gettwitterfollowersforfree.com and
SpreadMyTweets.com.

Trademytweets claims:

“How does it work? When you sign in with your Twitter details, our system will find you 20, 40, 60 or 100 other Tweeters. Then with these people it will begin to make them follow you as you follow them, instantly. “An eye for an eye.” This service will continue until you choose to stop it.”

Current keyword tweets:with approximately 10 tweets per minute involving numerous affected accounts.

“Want some Free Twitter Followers?”
“Just used TMT for some free followers”
“Get Free Twitter Followers!”

Update for March 30, 2010:
You have been using this shortened link since March 25, 2010 http://isDOTgd/aXDme on Twitter.
Here is one example account with much more than ONE tweet every 20 hours…

You certainly have great marketing skills.

Update 8:49 PM March 30, 2010

It appears that if one receives more tweets from this service than one tweet every 20 hours, they are logging into the site and requesting to add more followers.  The site is currently down at the moment.

Until Next time – stay safe online!

I’ve been following the Tweeterfollow musical domain saga since late September 2009.  The theme never changes.  I’ve also written about their scam/phishing/twitter account hijackings here.

Yesterday the Tweeterfollow (AKA: TF) domain push on Twitter was via Twtxtreme.info (currently disabled) using short url services tinyURL and retwt.me.  Today it looks like TF is promoting twtkingz.info via retwt.me and kiwi.url.  TF consistently uses IP: 124.217.246.188 but because TF switches domains frequently, they have not been blacklisted.

The web login page is always the same:

Description: A place to add more followers for your twitter page. This is a twitter adder site

Keywords: get more twitter followers, tweet, twitter network,twitter train, get more followers on twitter, twitter, tweeter, tweeteradder, tweeterfollow, deadlyx, rawhood, hoodzone, followers, train, vip, tweet

Logged in to the TF Web GUI

Once you are logged in to their website you will automatically follow all VIP members. Then you click  on Twitter profile random images [graphics from a3.twimg.com] to follow regular users [SIC].

Once you have clicked on all 20 default regular users profiles, the pop-up below appears:

Click on the OK button and 20 new profiles will reappear.  You can click all day long and into the night and you will still get the congratulatory pop-up each time you click the 20th profile.

You are also encouraged to purchase a VIP membership using PayPal or a credit card. The account that TF is currently using at PayPal is registered to ryann.johnson2009@gmail.com.

Ability to view protected tweets

Using http://isfollow.com/ I wanted to see if the locked accounts that I randomly followed through the TF API were following me.  The accounts listed below were not following me but I was able to view their PROTECTED TWEETS!

afrheyy
aliamutia
ibaddbxtch
IamHoodBarbie
ohannaweb

Since the above account is not following my test account I should not have been able to view IamHoodBarbies protected twitter stream. Obviously these Twitter profiles are all compromised accounts. A simple change of password is probably not the band-aid that should be used.

The Twitter filter managed to nab the “100 followers” string and filtered these tweets from the test account Twitter stream.  The test account is also not currently accruing a steady stream of profiles from Twtkingz[TOX]info API like it was yesterday.  During the past six hours the test account has only followed one protected account via the TF API.  The test account is still able to view protected tweets of accounts that are not following the test account.

Who is behind all this?

With all the emphasis on botnets, security breaches, and malware; In comparison, Tweeterfollow appears harmless.  Is it?

Domain ID:D30737265-LRMS
Domain Name: TWTKINGZ.INFO
Created On:10-Dec-2009 15:10:50 UTC

Last Updated On:10-Dec-2009 15:10:59 UT

There is something big going down on Twitter

Any website hosted at Piradius.net in Kuala Lumpur, Malaysia should immediately raise  a red flag.

Update:  12-15-09  8:13 pm EDT

Update:  12-16-09

Update:  12-17-09

Update:  12-22-09

Test account data:

December 18:
5 tweets Total

Timing:
2 tweets @8:08  pm from API
1 tweet  @9:54  pm from API
1 tweet  @9:55  pm from API
1 tweet  @10:25 pm from API

URL Breakdown:
3 tweets to twtfollow[TOX] info via ohurl.com
1 tweet to twtfollow[TOX] info via retwt.me
1 tweet = “This site just gave me 100 followers using” no URL

December 19:
9 tweets Total

Timing:
1 tweet   @6:09  am from API
1 tweet   @8:33  am from API
1 tweet   @2:10  pm from API
1 tweet   @4:34  pm from API
4 tweets  @7:09  pm from API
1 tweet   @10:10 pm from API

URL Breakdown:
1 tweet to youtube.com [generic]
1 tweet to twtspeedy[TOX] info [via retwt.me]
2 tweets to twtfollow[TOX] info [via Safe.mn = flagged as a "Dangerous website: Phishing/Malicious Content"]
2 tweets to twtspeedy[TOX] info [via TinyUrl]
1 tweet to twtfollow[TOX] info [kiwiurl.com]
1 tweet to twtfollow[TOX] info [via shorten.ws]
1 tweet to twtfollow[TOX] info [via snipr.com]

December 20:
15 tweets Total

Timing:
1 tweet   @12:34 am from API
1 tweet   @1:10  am from API
1 tweet   @6:11  am from API
1 tweet   @7:12  am from API
1 tweet   @8:34  am from API
2 tweets  @1:31  pm from API
2 tweets  @1:32  pm from API
1 tweet   @1:33  pm from API
1 tweet   @2:11  pm from API
1 tweet   @6:36  pm from API
1 tweet   @7:29  pm from API
1 tweet   @7:33  pm from API
1 tweet   @10:12 pm from API

URL Breakdown is getting spammy, so for the sake of brevity – here goes:
The shorl you requested has been disabled due to abuse. We’re sorry for the inconvenience.
lu.mu disabled
kiwiurl.com disabled
nvg8.it disabled
twtfollows {TOX] Info still online
twtlimit {TOX] Inf still online
retwt.me = .twtspeedy[TOX] info

December 21:
26 tweets Total

Currently pushing the following Toxic URLs:

twtfollows[TOX] info
twtlimit[TOX] info
twtspeedy[TOX] info

Stay Safe Online!

Update: 10/06/2009

Though this was not an obvious phishing campaign that takes your money, McAfee Site Advisor Rating:

Phishing or other scams

This site uses your Twitter account info to send spammy messages to your followers. Here is an example:
“I got 100 followers using http://TwitPWR.com/swf/ . Check it out!”

This is a clear case identity theft. I advise you to not fill your twitter username and password in this site.
Posted at 09/23/2009-08:49:43 PM by Alexis Kauffmann

Ryan Johnson is currently running another spam campaign on Twitter via Followersquick<>info [IP:124.217.246.188] .

Toxic URLs on Twitter can get me fired up faster than any other social networking site.  I think it is because the time it takes for Twitter to notice that there is a problem, and then for Twitter to act on it —  leaves a huge security hole and enables the bad guys to maximize and control the dark side of Twitter.

I’ve been watching the dark side of Twitter for over 7 months now, and there is a lot of malware stories that do not unfold at my blog.  There are also security experts outside of Twitter who follow up and have become just as frustrated with Twitter Internet security as I have become.

For the record, I am highly vocal about the fact that I think Twitter has a social obligation to the Internet community as a whole.   I think that they need to act upon social networking threats that transpire at their site immediately, and to have a rapid response system in place to confirm or deny the validity of reported offenses and offenders.

Current keyword culprits that have gone viral are [note that all are posted via API abuse]:

“This site just gave me 100 followers using hxxp://xrl<>us/bfosj8″

“I just got 100 followers using hxxp://TwitPWR<>com/swb/”

“I got 100 followers using http://is<>gd/3BP6e Go check it out”

“This site is great I got 100 followers in a day using hxxp://twi<>cc/Bjry”

“Hey Get 100 followers a day using xxtp://yumurl<>com/9yPYKZ.  Its super fast!”

“You should check this site out if you want 100 followers a day” hxxp://tinyurl<>com/n3oeal

“If you want 100 followers a day use” hxxp://alturl<>com/kdqj

“I use hxxp://TwitPWR<>com/swg/ to get 100 followers a day. It work great”

“If you trying to get more followers go to hxxp://shorten<>ws/bee0c2.You will get 100 followers fast!”

tweeterfast<>com Originates from IP: 124.217.246.188.

tweeterfast<>com
tweeteradder<>com
www.tweeteradder<>com
www.tweeterfollow<>com
www.tweeterpro<>com

tweeterfast<>com has a 301 from quick-followers<>com

Whois Information for tweeterfast.com

Registar ENOM, INC.
Registration Data:
Registered on 2009-09-23
Last updated on 2009-09-23
Expires on 2010-09-23

Nameservers:
ns1.tweeterfollow.com: 124.217.246.188
ns2.tweeterfollow.com: (DOES NOT EXIST)

Owner:
Admin:
Tech:
ryanjohnson2007hotmail.com
Ryan Johnson
+1.4103563433
+1.5555555555
Deadly Is Great
1533 Blue St.
Baltimore, Maryland 21217
US

Current nameservers are listed under tweeterfollow<>com. Check out this interesting archived page.
Rest assured that before this campaign is done — TWEETERFAST will give you more than 100 followers…

Don’t forget to check out their rules. When you sign up for an account at Tweeterfast, you are giving them the login and password to your account to further promote their site and your Twitter account will be hijacked.

Stay tuned for continued updates on Twitter as they become available.

Until next time — Stay Safe Online!