Twitter's malware filter has 'disappointing results', say security experts

Twitter's new malware filter is a sign the social media site is stepping up efforts to stem attacks but the measure has its shortcomings, say security experts.

Twitter's filtering mechanism was highlighted by Mikko Hypponen, chief research officer of F-Secure, in a blog post on Monday. When a user tries to submit a tweet with a suspect web link, the following warning appears: "Oops! Your tweet contained a URL to a known malware site!"

Twitter's latest security measure was a positive one, especially in light of the current threats directed at the site, Hypponen told silicon.com sister site ZDNet Asia in an email interview. The site, he noted, has been "attacked in many ways" including spam, worms such as Mikeyy and phishing, he noted.

"None of these problems are at epidemic levels yet but it's great to see Twitter take real action on this," he said.

Hacking is another challenge the popular microblogging site faces. In May, Twitter confirmed its network was hacked and some individual account information was leaked.

Dancho Danchev, independent security consultant and cyber threats analyst, noted that the site's latest security move was an indication "Twitter is finally moving from reactive to proactive security practices". However, he pointed out in a blog post on silicon.com's sister site ZDNet.com, that the malware filter was "clearly still in development" and showed "disappointing results".

Danchev pointed to how a MySpace phishing page used in a tweet triggered the security filter but was eventually accepted by adding a "http://" or removing the "www".

He noted that the site also allowed tweets containing links to several known malicious sites listed in Stopbadware's database, which has identified more than 380,000 sites identified as unsafe. While it would not prevent the abuse of Twitter in the longer term, the failure to integrate such databases listing known malware was a "missed opportunity", Danchev said.

Twitter did not respond to email queries from ZDNet Asia at the time of publication.

Original article: Twitter malware filter 'disappointing' from ZDNet Asia