Bank of Melbourne Twitter account hacked, spreading phishing links

Bank of Melbourne Twitter account hacked, spreading phishing links

Summary: The Twitter account of Bank of Melbourne was compromised last Wednesday, and was used to spread phishing links as direct messages to the account followers.

SHARE:

The Twitter account of Bank of Melbourne was compromised last Wednesday, and was used to spread phishing links as direct messages to the account followers, according to reports coming in from affected users.

In a tweet, the bank said that:

ATTN: Unauthorised DMs sent bw 4-5pm today, do not click link. No customer/personal data compromised. Apologies for the inconvenience. ^TT

Followed by another one, once the incident was resolved:

Thanks for all your support. We take security very seriously & will be strengthening our policies to further protect our social channels ^TT

It's worth discussing how Bank of Melbourne got is social channel hacked in the first place. Moreover, what contributed to the ease of obtaining the login credentials for their Twitter account?

For starters, it would have been highly impractical to brute force the password for their Twitter account, no matter the fact that the CAPTCHA-solving process could be outsourced to vendors offering CAPTCHA-solving services to assist in brute forcing attacks.

Judging by the fact that the malicious attackers didn't just spread a prank or hacktivist message using the stolen credentials, it is highly likely that the attacker has a relatively advanced understanding of how the cybercrime ecosystem works. By spamvertising the phishing link using direct messages as an evasive element of the campaign, the attacker is attempting to take advantage of the trust factor established by the nature of direct messages.

Was Bank of Melbourne a victim of phishing attack, is there any chance that a malware-infected host within their network was successfully data mined for stolen Twitter credentials.

What do you think?

Talkback.

Topics: Banking, Security, Social Enterprise

Dancho Danchev

About Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

3 comments
Log in or register to join the discussion
  • RE: Bank of Melbourne Twitter account hacked, spreading phishing links

    "No customer/personal data compromised..."

    How, exactly, would they know this? If the hijacker sent out links, I don't see BofM being able to track if any of there customers clicked thru...

    As an Admin for Bank who doesn't leverage social media for this reason (and others)... I'd be curious to know of the "steps taken" to further strengthen their policies?

    sole use pc in a dmz for social? read only vm? I'm doubting it. Makes me wonder what other credentials were given up as well (of course, if that's the case, why would they show their hand hacking a twitter acct)
    UrNotPayingAttention
    • RE: Bank of Melbourne Twitter account hacked, spreading phishing links

      This is awful! Is the web safe anymore? <br>You guys need to do an article on what kind of security we need for our PC's. I'm average girl and work hard for my money. I don't want to get hacked. Where do I find the <a href="http://www.bestantivirus2012.com" target="_blank">Best Antivirus 2012</a>? Is that site good? or should I get free AV protection?
      reviewsgirl
  • RE: Bank of Melbourne Twitter account hacked, spreading phishing links

    Hi Dancho,

    I would say a phishing attack would seem the most likely way that the hackers obtained the Twitter credentials and could also explain why the bank knows that no customer/personal data was compromised.

    Lately there have been reports of false Twitter notifications. By clicking on the links in these emails you could be infected with a virus or perhaps you might be asked to enter your Twitter credentials. Unwittingly you are not logging in to Twitter but instead providing your Twitter password to phishers. Best security practice: only respond to direct messages and check out new followers by going to the Twitter website.

    Deborah Galea, contributor to Email Security Blog: http://blog.policypatrol.com.
    redearthsoftware