STE WILLIAMS

Free whitepaper : Supercharge your infrastructure

The NSA violated privacy laws thousands of times in the last five years by spying on US citizens, an internal audit by the super-snoopers has disclosed.

The Washington Post reports that the intelligence agency also overstepped its legal remit since Congress gave it broad powers in 2008.

Most of the violations involved unauthorised surveillance of Americans and foreigners in the US. Problems arose thanks to clumsy operator mistakes, insufficient or inaccurate research, failures to follow the correct procedures and even typos.

Meanwhile, system errors led to further problems, such as failures to recognise foreign phone users who roamed onto US soil but whose data was hoovered up anyway.

An NSA internal audit, leaked to the Washington Post by former NSA contractor turned whistleblower Edward Snowden, logs 2,776 incidents of “unauthorized collection, storage, access to or distribution of legally protected communications” in the year to May 2012.

Most were accidental mishaps where procedures were not followed correctly, but some involved violations of a court order – such as a February 2012 incident involving the unauthorised retention of 3,000 files that a surveillance court had ordered the NSA to destroy.

Violations include unauthorised access to intercepted communications and the use of automated systems without built-in safeguards to prevent unlawful surveillance.

NSA ‘marking its own homework’

The audit only covers figures from the NSA’s Maryland headquarters and Washington DC offices and not those from its regional collection centres.

In some cases, the NSA decided that it didn’t need to report the unintended surveillance of US residents and citizens. One glaring example of unreported dragnet overreach occurred in 2008 when a programming error resulted in the interception of a large number of calls made in the Washington DC area: buggy software confused the US telephone area code 202 with intentional calls made to Egypt (country code +20).

In another case the Foreign Intelligence Surveillance Court was not told about a data collection programme run by the NSA until months after it was up and running. The court eventually ruled in October 2011 that hoovering up international communications passing through fibre-optic cables in the United States, was unconstitutional because Americans’ emails and other net traffic was collected. The agency was ordered to drop the collection programme within 30 days unless it figured out a way to filter out US citizens’ traffic.

Evading official scrutiny

Another leaked document instructs NSA analysts about how to explain their targeting decisions without giving “extraneous information” to overseers in the Department of Justice, Congress or the special court that scrutinises surveillance. NSA personnel are “instructed to remove details and substitute more generic language in reports to the Justice Department and the Office of the Director of National Intelligence”, the Post reports.

This relates to an internal NSA document [PDF] that offers rationales for targeting and provides examples of the kinds of people the NSA may spy on – and that’s besides amassing 1.6 per cent of the world’s net communications. The document makes for an interesting read.

Other training files explain that analysts do not need to report “incidental” collection of data from US citizens, green-card holders or companies to the NSA Inspector General because (in the opinion of the NSA) it is not deemed a violation of the rules.

Signals intelligence spooks are allowed to use anonymised sets of data routinely, and with supervisory permission they may unmask the identities of US persons in reports to the agency’s clients, such as the CIA and US military, among others.

FISA judge: We can’t investigate non-compliance

In response to the Post‘s revelations about its violation of privacy rules, the NSA said it attempts to identify problems “at the earliest possible moment, implement mitigation measures wherever possible, and drive the numbers down”.

“We’re a human-run agency operating in a complex environment with a number of different regulatory regimes, so at times we find ourselves on the wrong side of the line,” a senior NSA official told the Post in an interview.

The chief judge of the secret court tasked with overseeing the NSA’s dragnet surveillance said his court’s powers of scrutiny are limited because it is reliant on government reports of improper spying. There is no independent verification, the Post reports.

“The FISC is forced to rely upon the accuracy of the information that is provided to the Court,” its chief, U.S. District Judge Reggie B. Walton, said in a written statement to The Washington Post. “The FISC does not have the capacity to investigate issues of non-compliance, and in that respect the FISC is in the same position as any other court when it comes to enforcing [government] compliance with its orders.”

So the FISA court isn’t a rubber stamp, they’re just totally incapable of overseeing the NSA has to trust the gov. http://t.co/BpXOhnogGh

— Christopher Soghoian (@csoghoian) August 16, 2013

The judge’s frank admission pulls the rug out from under repeated assurances from President Obama and his officials that the secret intelligence court provides robust oversight of government surveillance. ®

Free whitepaper : Supercharge your infrastructure

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/16/nsa_internal_audit_privacy_violations/

Win Spectre Laptop with HP and The Register

Vid Cybercrooks in Australia are using 3D printers and computer-aided design software to manufacture ATM skimming devices.

New South Wales Police recently arrested and charged a Romanian national with fraud involving the use of an ATM skimmer made on a 3D printer to fleece Sydney residents, Australia-based iTnews reports.

Police in Sydney set up a dedicated taskforce in June after recording an increase in cash machine theft offences.

The taskforce identified one gang that targeted 15 ATMs across metropolitan Sydney, affecting tens of thousands of people and stealing around AU$100,000 (US$92,000).

Commander of the NSW Fraud and Cybercrime Squad, Detective Superintendent Col Dyson, told iTnews the gang was using 3D printers and CAD technology. Two unnamed banks are being targeted.

“These devices are actually manufactured for specific models of ATMs so they fit better and can’t be detected as easily,” Det Supt Dyson explained.

“Parts of the devices are internally fitted, either by the offenders moving part of the slot and replacing it with their own, and pushing circuitry into the machines. [Another model] is so small it’s entirely self-contained and entirely pushed in, with some force, into the card slot.”

Skimmers are designed to fit around the card slot of cash machines in order to read and extract data from the mag stripe of cards as they are pushed into a compromised machine. The devices are often used in conjunction with a hidden miniature pin-hole video camera, or an unobtrusive keypad overlay, to record PIN data.

The collated information, sent to fraudsters using mobile phone technology or stored for later retrieval, provides enough data to clone a magnetic-stripe-only credit card. Fake cards are then used in combination with stolen PIN information to make fraudulent withdrawals. Pictures of hardware-based ATM skimming devices, fake cash machine fascias and more can be found in a blog post by cybersecurity blogger Brian Krebs here.

Skimmers have been used by fraudsters for years but introducing 3D manufacturing into the process has obvious advantages to cybercriminals, according to veteran IT security expert Paul Ducklin.

“Crooks can quickly try a new design (or tweak an old one) in order to make their devices as surreptitious as possible,” Ducklin explains in a post on Sophos’s Naked Security blog. “The better a skimmer fits, the more smoothly it blends with the ATM’s shape, and the closer the colour, the more likely it is go unnoticed.”

“Also, 3D printouts can be made on demand, so that the crooks can quickly replace skimmers that have been detected, removed and destroyed,” he adds.

Previous controversial uses for 3D printers have famously included blueprints for “printing” parts for firearms at home. Home-made plastic gun parts routinely snap under the stresses of firing, if they work at all, but that hasn’t stopped the issue of the “Liberator” 3D-printed pistol and derivatives from creating a media fire fight storm.

In response, Danish 3D printer maker Create It Real has decided to ensure [PDF] its products can’t print a gun. Manufacturers might conceivably decide to do something similar to prevent 3D printers from being used to manufacture ATM skimmer parts.

One blacklisting snag might be that while blueprints for the Liberator gun are out there in public, any CAD design for an ATM skimmer would be a closely guarded secret.

If preventing the abuse of 3D printers isn’t an option, we can at least attempt to bolster consumer awareness about the threat posed by ATM skimmers.

A video from the Queensland Police Service stars Fiscal the Fraud-Fighting Ferret, who tells consumers how to spot ATM skimmers and guard against the possibility of fraud when using cash machines.

The use of ATM skimmers is a problem worldwide. Extensive background information on the problem in Europe can be found on the European ATM Security Team’s website here. ®

Win Spectre Laptop with HP and The Register

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/16/3d_printed_atm_skimmers/

Win Spectre Laptop with HP and The Register

Syrian hacktivists claim they are the vandals responsible for scribbling over the websites of CNN, Time mag and The Washington Post yesterday.

But these latest boasts by the Syrian Electronic Army (SEA) are somewhat misleading, according to computer security experts who say that the hacking crew actually ransacked Outbrain – a marketing biz used by WashingtonPost.com, Time.com and plenty of others to provided links to related articles and stuff online.

It’s understood the miscreants, who back Syria’s President Bashar al-Assad, compromised Outbrain’s systems and hijacked those embedded links to point to the SEA’s website. Outbrain confirmed its security was breached, which it said was pulled off using phishing emails posing as messages to staff from its chief exec.

Marc Gaffan, co-founder of web security firm Incapsula, explained: “The cause of the breach was actually performed by sending phishing emails to all Outbrain employees which caused them to surrender their email passwords. With access to employee email accounts the hackers were able to obtain or reset passwords to the admin areas of the content marketing platform, leading to the visible part of the breach.”

“If Outbrain’s admin areas had two-factor authentication enabled on them, this could have been prevented,” he suggested.

In a statement, The Washington Post added that one of its staffers did have his Twitter profile compromised by the SEA earlier this week, but explained that the main aspect of Thursday’s hack relied on breaking into Outbrain’s systems:

Earlier this week the Twitter account of one of our journalists was compromised as part of a larger attack aimed at social media management group SocialFlow, and Thursday an attack on content recommendation service Outbrain caused some of our stories to redirect to the the SEA homepage.

Outbrain responded to the hack by temporarily suspending its services. A detailed timeline on how the compromise unfolded can be found here.

The SEA, meanwhile, congratulated itself on drilling into Outbrain’s control panels on its official Twitter account:

@TIME, @CNN, @Washingtonpost websites hacked in one strike by hacking @outbrain #SEA #SyrianElectronicArmy #Syria pic.twitter.com/5OI1BE2oCM

— SyrianElectronicArmy (@Official_SEA16) August 15, 2013

Time, CNN and WashingtonPost Websites Hacked by #SEA | http://t.co/bkCzCDRsZe #SEA #SyrianElectronicArmy pic.twitter.com/2X2v9ZaeVU

— SyrianElectronicArmy (@Official_SEA16) August 15, 2013

‪Outbrain’s content-recommendation widget, embedded into web pages, is supposed to help internet publishers boost their online traffic. Users are offered links to articles and other stuff to read or watch.‬ SEA foot soldiers alleged they obtained access to Outbrain’s email spools, but this remains unconfirmed.

The Syrian Electronic Army is a loose-knit hacker group loyal to President al-Assad. Its campaign of online disruption began in mid-2011, and has involved distributed denial-of-service attacks against servers, phishing emails to hoover up passwords, pro-Assad graffiti on websites, and spamming against governments, online services and media outlets that are perceived hostile to the government of civil-war-torn Syria.

Its speciality is firing off spear-phishing emails to hijack Twitter accounts and other social-networking profiles run by media organisations and use the compromised logins to push links to pro-Assad propaganda.

Victims over recent months include Al Jazeera, the Associated Press, BBC, the Daily Telegraph, the Financial Times, the Guardian, Human Rights Watch, America’s National Public Radio, Thompson Reuters and more. Over recent weeks the group diversified into attacking into the backend systems of VoIP apps, namely Viber and Tango. ®

Win Spectre Laptop with HP and The Register

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/16/sea_outbrain_hack/

Win Spectre Laptop with HP and The Register

A fake Adobe Flash browser plugin that hijacks on-screen web adverts to tout hardcore smut is doing the rounds, we’re told.

The rogue add-on even slaps racy adults-only teasers on websites aimed at children, according to Jérôme Segura, a security researcher at antivirus firm Malwarebytes. The software nasty, named FlashPlayer11.safariextz, poses as a “Flash Player update” and is largely distributed via X-rated web portals and grumble-flick sites.

The file is downloaded from fplcdn.com, a domain registered at the end of last month; the registrant’s details in the WHOIS database appear to be fishy, said Segura. The Safari extension is also compatible with Firefox, Chrome and Safari but not Internet Explorer, according to tests by Malwarebytes.

“In addition to injecting adverts within every single page you visit, this malicious extension is capable of ‘hijacking’ legitimate ads and replacing them with its own,” Segura explained. “With such invasive adverts, cyber-crooks are likely to generate a lot of ‘views’ and even pay per clicks.”

Web surfers are urged to check the browser extensions installed on their computers, especially if they spot a serving of salacious plugs.

“If you believe you are seeing strange or inappropriate ads on the websites you regularly visit, it wouldn’t hurt checking the extensions installed in your browser and removing the offending ones,” Segura advised, adding that netizens can avoid getting hit by the scam by taking care to install software updates from vendor’s official websites.

The Safari component of the extension was not detected as malicious by any of the antivirus vendors listed in VirusTotal at the time Segura uploaded it. However, the executable used to hijack rival browsers was detected.

A write-up of the threat, together with screenshots, can be found in a blog post by Malwarebytes here. ®

Win Spectre Laptop with HP and The Register

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/16/fake_flash_browser_plugin_feeds_smut_ads/

Win Spectre Laptop with HP and The Register

North Korea has tasked 200 agents with the job of posting negative comments online, often using stolen online identities, in a bid to undermine the morale of their neighbours in the South.

The brigade of NORK trolls is part of a brigade of 3,000 cyber warriors and hackers that make up the Reconnaissance General Bureau information warfare force, according to the Police Policy Institute.

Ryu Dong-ryul of the Police Policy Institute said, “The North has established a team of online trolls at the United Front Department and the Reconnaissance General Bureau.”

About 200 agents post derogatory comments on South Korean portals using assumed identities stolen from South Koreans, the Chosun Ilbo newspaper reports.

The South Korean thinktank reckons other members of the NORK cyber army are building malware and launching hacker attacks while the trolls are posting comments with links to N Korea propaganda sites designed to sway public opinion in favour of Pyongyang.

North Korean agents posted more than 27,000 propaganda messages designed to turn people against the South during 2011 alone, the institute estimates. In 2012 this figure increased and more than 41,000 messages were posted, delegates at a seminar in Seoul earlier this week were told. Objectives of the campaign include getting unblock access to pro-North Korean sites for surfers visiting from the South.

North Korea is the prime suspect in destructive malware attacks against the computer networks of banks and TV stations earlier this year, the latest in a series of attacks. Cyber assaults included attempts to knock targeted sites offline have been going on within the Korean peninsular for some years. Ordinary North Korean citizens have only heavily regulated access to government controlled websites through local cybercafes.

The hermit kingdom does maintain various portals and propaganda outlets, some of which are hosted in China, such as Uriminzokkiri.

Using agents of the state in a propaganda offensive fought on social media sites and consumer portals is an unusual tactic but it’s not restricted to North Korea. As previously reported, cadres of the Iranian Revolutionary Guards include similar digital propaganda units.

Lim Jong-in of Korea University estimates 30,000 North Koreans are engaged in cyber and psychological warfare against South Korea, a group swelled every year by another 300 personnel “trained in the dark arts”, as Chosun Ilbo catchily describes it.

This hoard of cyber-ninja Death Eaters are arrayed against a much smaller South Korean force that is growing by only 30 personnel a year. ®

Win Spectre Laptop with HP and The Register

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/16/north_korea_recruits_troll_army/

Win Spectre Laptop with HP and The Register

North Korea has tasked 200 agents with the job of posting negative comments online, often using stolen online identities, in a bid to undermine the morale of their neighbours in the South.

The brigade of NORK trolls is part of a brigade of 3,000 cyber warriors and hackers that make up the Reconnaissance General Bureau information warfare force, according to the Police Policy Institute.

Ryu Dong-ryul of the Police Policy Institute said, “The North has established a team of online trolls at the United Front Department and the Reconnaissance General Bureau.”

About 200 agents post derogatory comments on South Korean portals using assumed identities stolen from South Koreans, the Chosun Ilbo newspaper reports.

The South Korean thinktank reckons other members of the NORK cyber army are building malware and launching hacker attacks while the trolls are posting comments with links to N Korea propaganda sites designed to sway public opinion in favour of Pyongyang.

North Korean agents posted more than 27,000 propaganda messages designed to turn people against the South during 2011 alone, the institute estimates. In 2012 this figure increased and more than 41,000 messages were posted, delegates at a seminar in Seoul earlier this week were told. Objectives of the campaign include getting unblock access to pro-North Korean sites for surfers visiting from the South.

North Korea is the prime suspect in destructive malware attacks against the computer networks of banks and TV stations earlier this year, the latest in a series of attacks. Cyber assaults included attempts to knock targeted sites offline have been going on within the Korean peninsular for some years. Ordinary North Korean citizens have only heavily regulated access to government controlled websites through local cybercafes.

The hermit kingdom does maintain various portals and propaganda outlets, some of which are hosted in China, such as Uriminzokkiri.

Using agents of the state in a propaganda offensive fought on social media sites and consumer portals is an unusual tactic but it’s not restricted to North Korea. As previously reported, cadres of the Iranian Revolutionary Guards include similar digital propaganda units.

Lim Jong-in of Korea University estimates 30,000 North Koreans are engaged in cyber and psychological warfare against South Korea, a group swelled every year by another 300 personnel “trained in the dark arts”, as Chosun Ilbo catchily describes it.

This hoard of cyber-ninja Death Eaters are arrayed against a much smaller South Korean force that is growing by only 30 personnel a year. ®

Win Spectre Laptop with HP and The Register

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/16/north_korea_recruits_troll_army/

Win Spectre Laptop with HP and The Register

San Francisco–based GitHub, the online repository popular among software developers, suffered a major service outage on Thursday morning due to what it characterizes as a “very large DDoS attack.”

This major attack follows a similar one on August 4th

The outage was first reported on the GitHub Status Messages page at 15:47 UTC (8:47am Pacific Time).

GitHub is a major code repository used by developers across the world. It hosts a mixture of public and private projects split across open and closed source.

The site works using the Git version-control system, which is a commonly used tool of devs across the world to deal with large code projects. Over the past few years, the site has become one of the main places that people push their repositories to, and for that reason an outage has a major effect on the developer community.

Public repositories can be posted for free, but companies must pay to gain private ones. The site is a frequent target of DDoS attacks: the last major attack was on August 4th, and before that July 29th, and before that July 19th.

One potential reason for why it is targeted so frequently is that it is a central repository for a large amount of projects, some of which are closed source. DDoS attacks are frequently used by hackers as a way of probing vulnerabilities in a site, so there is a chance these outages come from probing attempts by hackers keen to get at code stored on the service.

“The site continues to be operational, however we are going to keep the status at yellow while we continue to monitor closesly and work with our upstream providers,” the site’s Status Messages reported at 9:56 Pacific time. ®

Free whitepaper : Supercharge your infrastructure

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/15/github_ddos/

Win Spectre Laptop with HP and The Register

Java developers were warned, but they didn’t listen. Security researchers at Trend Micro report that old and vulnerable versions of the Apache Struts framework for Java are still in widespread use, and now Chinese hackers are using automated tools to exploit their flaws.

The vulnerabilities in question were patched in the July Struts release, according to a blog post by Trend Micro senior threat researcher Noriaki Hayashi. But many applications are still running on older, buggy versions that can allow attackers to execute arbitrary code.

The exploits are made all the easier by a new tool developed by Chinese hackers, which makes executing certain commands on vulnerable remote servers as easy as pushing a button.

With a few simple clicks, attackers can determine the name of the current user account, display the version number of the OS, view network and system configuration information, list the contents of directories, and – particularly worryingly – add new user accounts.

The tool also reportedly includes a “WebShell” feature that makes it easy to plant a backdoor into vulnerable servers. Once this is done, the hackers can execute arbitrary commands from their keyboards using only a web browser.

Here’s what attackers can do on your Struts server using a Chinese script-kiddie tool

The attack works on servers running either Windows or Linux, although the actual commands that can be executed will differ depending on the OS.

Trend Micro is hardly the first company to warn developers of vulnerabilities in open source frameworks and the dangers of running old versions. In March, a study by Sonatype and Aspect Software found that developers downloaded out-of-date versions of the most popular frameworks 33 per cent of the time, even though newer versions with security fixes were available.

Among the top Java frameworks, Struts is also a particular target for malicious hackers. A January report by CAST found that applications built using Struts were highly likely to be misconfigured, and they delivered the lowest code quality scores overall.

Of course, the tendency to stick with outdated versions of Java frameworks is somewhat understandable. Frameworks like Struts often power highly complex, mission-critical applications that require rigorous testing before any changes can be deployed.

Security patches can also sometimes break apps when vulnerable features are removed. But with flaws as severe as the ones now being exploited in Struts, it’s essential that Java development shops stay on the ball and migrate to secure versions ASAP.

In this case, blocking the Chinese automated exploit tool requires an upgrade to Struts 2.13.15.1 – which was released in July – or to any later version. ®

Free whitepaper : Supercharge your infrastructure

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/15/java_struts_automated_exploit_tool/

Win Spectre Laptop with HP and The Register

Microsoft has pulled a security update for Exchange 2013 after problems emerged with the latest patch to the email server software just hours after its release.

The critical MS13-061 security update for Exchange Server 2013 broke the message index service, preventing Exchange 2013 email users from searching their mailboxes. Specifically, after the installation of the security update, the Content Index for mailbox databases shows as Failed and the Microsoft Exchange Search Host Controller service is renamed.

Sysadmins who have already installed the faulty patch on Exchange 2013 servers need to apply a workaround, which involves editing of registry keys.

Wolfgang Kandek, CTO of cloud security firm Qualys, reckons resolving both glitches will be fairly simple, so an updated patch can be expected soon. A post on the Microsoft Exchange blog puts the problems down to shortcomings in Redmond’s testing process.

Exchange 2007 and 2010 users should still apply the fix since the security patch causes no difficulties if installed on older versions of Microsoft’s email server software.

“If you already installed MS13-061 on Exchange 2007 and or 2010 it looks like you should be good to go as the issue does not seem to occur with those versions,” explained Ziv Mador, Director of Security Research at Trustwave.

MS13-061 addresses three vulnerabilities in Microsoft Exchange that can stem from bugs in the third-party library Outside In, which is licensed from Oracle. This technology allows Outlook Web Access users to view content such as PDF files inside the email client’s preview pane without installing a proprietary reader.

Oracle published new versions of Outside In in April and July, and Microsoft has incorporated these new versions in the faulty update.

Sysadmins would be well advised to apply a stop-gap workarounds which includes turning off document processing involving Outside In – at least, pending the availability of a functional security patch. ®

Free whitepaper : Supercharge your infrastructure

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/15/faulty_exchange_2013_update_pulled/

Win Spectre Laptop with HP and The Register

Comp sci boffins spent a year buying up more than 100,000 fake Twitter accounts in a bid to help the teeny-tiny text transmitter beef up its spam defences. They also used their research to build a retroactive classifier that sniffed out the fakers so the Big Blue Bird itself could snuff them out.

A group of researchers, including two Twitter staffers, purchased a total of 121,027 Twitter accounts between June 2012 and April 2013 from 27 different merchants who advertised their services on web storefronts, blackhat forums, and freelance job listings sites.

The researchers suggested the @mongers were responsible for selling 10 to 20 per cent of all fake accounts flagged up as spam during the period of the experiment, racking up revenue of between $127,000 and $459,000 in the process.

These accounts are purchased and then “serve as stepping stones to more profitable spam enterprises”, such as selling dodgy anti-virus warnings and pharmaceuticals.

“Our findings show that merchants thoroughly understand Twitter’s existing defences against automated registration, and as a result can generate thousands of accounts with little disruption in availability or instability in pricing,” the authors wrote.

Like fine wines, cheeses or vinyl records, Twitter accounts also benefit from being aged, with some accounts left to mature for more than a month to make them appear more kosher. These pre-aged accounts are “a selling point in the underground market,” the boffins said.

Of course, this being a dodgy market to begin with, the spam-canners encountered a few scams. Eight of the merchants tried to sell them duplicate accounts, amounting to a total of 3,317 that they had already paid for, while one particularly shady seller tried to sell the same 1,000 three times.

At the end of the experiment, the researchers used their “insights to develop a classifier to retroactively detect several million fraudulent accounts sold via this marketplace, 95 per cent of which [they] disable[d] with Twitter’s help”.

Twitter is now building the boffins’ suggested defence mechanisms into its real-time spam busting system. After the study concluded, Twitter was briefly able to throttle 90 per cent of newly bought spam accounts at birth. One of the vendors told the researchers: “All of the stock got suspended. Not just mine. It happened with all of the sellers. Don’t know what Twitter has done.”

A Russian f@ker put up a sign on his website which said: “Temporarily not selling Twitter.com accounts.”

However, after the successful strategy worked briefly, the shady vendors were able to adapt and soon began to dodge Twitter’s beefed-up defences again.

“While Twitter’s initial intervention was a success, the market has begun to recover,” the researchers wrote. “Of 6,879 accounts we purchased two weeks after Twitter’s intervention, only 54 per cent were suspended on arrival.

The paper, “Trafficking Fraudulent Accounts: The Role of the Underground Market in Twitter Spam and Abuse”, can be read at Krebs on Security (PDF).

Free whitepaper : Supercharge your infrastructure

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/08/15/undercover_spam_scientists_build_army_of_fake_twitter_accounts/