Sophos reveals how Twitter, Yahoo and Google Adsense can be used to infect users with malware

According to Sophos' security consultant Chester Wisniewski, his interest was taken by a Twitter feed claiming that `Sophos acquires anti-spam specialist ActiveState'  referring to an old story on the Internet.

Wisniewski questioned why a story dating from 2003 was being tweeted in 2010, and checked out the profile of the person generating the messages on Twitter.

"It immediately became obvious it was a Twitter bot of some sort", he said, adding that the profile has a name that sounded like a company and had generated in excess of 10,000 tweets since early February,.

"That's 376 tweets per day... an awful lot. Even more concerning is that nearly 1,300 people are following it", he said in his security blog posting.

Wisniewski says that the links lead to a blog operating on WordPress using a plugin called `Post to Twitter' which auto-generates the tweets as the website is updated.

"The next questions were where was it getting the content, and why? It seemed unlikely someone was posting 376 articles every day in large bursts at 40-minute intervals", he said.

"From my research and analysis of the site contents, it became clear the site was automatically scraping posts and comments from Yahoo Answers and merging them into WordPress. It appears that the content may be coming from a few other sites as well, but nearly all of it is from Yahoo", he added.

So, says Wisniewski: Why go to such elaborate measures?

The site, he says, was created to generate traffic for Google AdSense which – with more than 1,000 followers and a little search engine optmisation – can generate a lot of traffic and a little cash.

Infosecurity notes that, what's interesting about Wisniewski's detective work is that, although the Twitter account isn't doing anything overtly illegal, it essentially acts as a proof of concept of a new potential hacker methodology.

As Wisniewski says: "Because of the legitimate appearance of the blog, users seeking answers they would find on Yahoo Answers may visit these manipulated sites and contribute to the problem."

And he gives the following advice: "It's very important to scan all web content coming into your environment, and be skeptical of any links you find on social media sites."

What’s hot on Infosecurity Magazine?