IF YOU'VE BEEN USING Twitter recently, you might have noticed a message popping up on feeds saying, "I have spent 11.6 hours on Twitter. How much have you?", together with a link. Don't click on that link, whatever you do - it's a rogue app.
If you click on the bit.ly link in the message, it'll connect you to a rogue app called "Time on Tweeter" that connects to your Twitter account. If you do decided to connect, of course, it'll have access to your username and password, allowing it to spread the 11.6 hours message again with a tweet that appears to come from you. It will also lead you to a revenue-generating survey.
Graham Cluley of the insecurity firm Sophos was quick to notice the message spreading around. He said on the Naked Security blog, "Scams like this are very commonly encountered on Facebook, but are more rarely seen on Twitter."
"Sophos is in contact with bit.ly about closing down the offending link, but it's always possible that the scammers will use other links and other names for their rogue applications."
"So be on your guard and always think twice before allowing a third-party app to have access to your Twitter account."
You also have to wonder about the gullible Twitter users who have been willing to accept an unknown third-party application like this, and many have. µ
I make that a 0.483-recurring day exploit. ;-)