The bug only appears to affect the twitter.com website, not third-party apps such as CoTweet, TweetDeck, etc. Therefore, until Twitter fixes this flaw, you might want to avoid the twitter.com website and only use third-party apps to access your Twitter stream.

The bug has to do with the Javascript OnMouseOver parameter. Inserting an OnMouseOver statement into a tweet, using the correct syntax, allows the tweeter to program an action to take place when any other user moves their mouse over the tweet. The user doesn’t need to click on the tweet, they just have to move their mouse over the link in the tweet to have the preprogrammed action executed (and be redirected to another site, or have something else done).

There doesn’t appear to be any word from Twitter yet on their official blog or on their @safety account about this situation or a time estimate on its repair. So be careful until this is fixed.

UPDATE #1: The Twitter @safety account just retweeted the following tweet from the head of Twitter’s Trust and Safety team: “The XSS attack should now be fully patched and no longer exploitable. Thanks, those reporting it.” So hopefully, this bug should now be fixed.

UPDATE #2: Twitter has posted a blog entry about this incident.

Here are other articles about this issue on Mashable and on TechCrunch.

Introduced in July, 2010, TwitSweeper’s new feature has reviewed over one million shortened links to detect spam,  malware or phishing sites. “We see this as a growing problem”, states Doug Braun, President of Emerge2 Digital.  “To date, this new feature has already flagged over 1,900 bad links, with more to come.”

According to Dasient, over 1.3 million web sites host malware, usually without their knowledge and often due to third-party widgets, advertising or applications on their websites being hacked.

“As we all know, where spammers see an opportunity to make money or disrupt commerce, they’ll take advantage of it.” Fortunately, TwitSweeper is slamming the door shut on Twitter malware and spam.

Here’s the issue. Our stats don’t support this assertion.

In fact, our numbers suggest that spammers are alive and well on Twitter. How do we arrive at this conclusion? In December of 2009 we launched TwitSweeper. Its only function is to detect undesirable followers (spam and spammers), identify them, and list them so TwitSweeper users can choose to remove and block them. It does this very well.

Here’s what we know.

To date TwitSweeper has checked more than 1.7 million followers. It has detected and flagged more than 83,000 followers as being spam or spammers. This suggests that almost 5% of all the followers we’ve checked are spammy.

The next question is: What is Spam?

The universal answer seems to be: “Everything I don’t want to receive from someone I don’t know.”

The problem with this definition is that it can include everything. Promoting body enhancement products is a nuisance to most, but a blessing to some. One man’s garbage is another man’s gold.

Is Twitter doing a good job going after spammers? I’m sure they are making best efforts. Are they winning the battle? It’s too early to say. Do they have spam down to 1%? Our stats certainly don’t confirm that. If our stats indicate that 5% of followers are spammers, you’ve got to know the actual number is even higher.

Conclusion: As TwitSweeper’s Spam Detection Methodology continues to improve, we see a corresponding rise in spammy followers that are found. This suggests there are more spammers out there. Whereas, Twitter’s reported 1% spam figure is merely the portion of spam that they happen to have found so far.

In the end, everyone’s objective should be to keep the Twitter ecosystem clean of spam. But we aren’t there yet.

Don’t confuse your “followers” (those who have chosen to follow you) with those that you are “following.” They are two different groups of Twitter users that are associated with your Twitter account.

You should follow other Twitter users that you find interesting. The tweets from these people show up in your timeline (your Twitter feed). They should be users that provide you with information, entertainment, dialogue or whatever it is that you find interesting about them.

If you tweet about things that others find interesting, then others will find you and follow you. It’s really that simple. Over time you should build up a loyal following of users who are interested in what you have to say.

However, it all breaks down and new problems occur if you start reciprocal following.

Problem # 1 – Your Timeline

When you start manually following those that follow you, or worse yet, use a script or online service to automatically follow everyone who follows you, you immediately pollute your timeline with all the miscellaneous, unfocused topics and trivia from the gang of people who found your tweets interesting. But does that mean that you will find their tweets of value to you? All of their subject areas and personal commentaries? I don’t think so.

Now your timeline is overflowing with reams of chatter “all over the map” and tweets from the previously hand-picked people who you had chosen to follow are now all mixed in with tweets from this bunch of people from all walks of life. You’ve lost control of your timeline. Now you need to start putting your hand-picked users into lists or groups in your apps, or somehow filtering your timeline so that you can get back to the tweets from the people who you want to follow, who you want to read about. But wait, that’s what you had before you started reciprocal following. Hmmm….

Problem # 2 – Auto-DM Spam

You start getting auto-DM messages from many of these people that you reciprocal followed. Direct Messages (DM’s) are Twitter’s private messages between Twitter users. But you can only send a DM to another user, or receive one, if you are both following each other — if you both find each other’s tweets of interest.

However, online services have started to crop up that will send automatic DM’s to people after you initially follow them (e.g. “thanks for following me!”), and after you tweet certain things, and after you reply to one of their tweets, and at timed intervals, and for a variety of reasons.

It’s a two step process: They start by using online services that will automatically follow as many people as they can, anyone, not because they are interested in those people, but because they are hoping that some of these people will reciprocal follow them back — so they can then go to step two and auto-DM them! These auto-DM’s are usually very self-serving, spammy, contain links, pitches, and are extremely annoying after awhile, and you have no way of turning them off other than to unfollow those people. Of course, if you hadn’t reciprocal followed them in the first place, you would not be receiving these crazy spam DM messages at all.

Problem # 3 – Phishing Attacks

In the last few weeks, Twitter users have been hit by a large number of phishing scams. They involve a DM from a hacked Twitter account to you saying something like “Is this a picture of you? <link>” or some other hook comment and a link. Always a link. The link takes you to what looks like a Twitter login page, but it is a page on the hacker’s site. When you enter your account login info, then the hacker’s program breaks into your Twitter account and uses it to send the same scam to all of your contacts using more DM’s.

But wait, you would not have been able to receive any of those phishing DM scam messages if you hadn’t reciprocal followed all of those people (since you both need to be following each other to be able to send or receive a DM). And further, if your Twitter account ever becomes hacked for any reason, the hacker would not be able to use your account to DM your contacts if you hadn’t reciprocal followed all of them. So a double benefit of not receiving and not spreading Twitter-based phishing attacks if you don’t reciprocal follow.

Problem # 4 – Malware Attacks

A variation on Problem # 3 is the spreading of malware via a download link which is spread by DM messages using hacked Twitter accounts. As in the above, you would almost eliminate the ability to receive such DM messages from hacked followers if you are not reciprocal following, and also your account (if ever hacked) would not be able to spread any such malware to all of your followers if you are not reciprocal following.

Summary

So let’s see. We can reciprocal follow all of the people who follow us: it is nice for them and it’s a practice that used to be done in the very early years of Twitter usage when there weren’t many people using Twitter. However, with the tens of millions of users on Twitter now, and:

• all of the online services sending marketing spam
• services providing countless and useless mass followers (who are not interested in you)
• services that do automatic mass reciprocal following for you
• automatic tweeting of marketing messages by renting out your account for a few bucks (aka “sponsored tweets”)
• the proliferation of annoying, machine-generated auto-DM messages
• the phishing scams and malware being spread by DM’s, and
• the pollution of your timeline with a very low signal-to-noise ratio of meaningless trivia overpowering the occasional helpful tweet

it is long overdue to stop the ancient practice of reciprocal following that now only seems to generate useless, time-wasting noise, scams and malware to the ultimate benefit of mostly nefarious practitioners.

Agree? Disagree? Sound off in the comments…

You may now sign-up for TwitSweeper for 3-month, 6-month or 12-month periods after the free trial period. The free trial is still available!

So if you don’t want to commit to a 12-month period — no problem. Just select one of the other periods.

It is a recurring term of whatever duration you select. To continue providing service to your account, the payment gateway will automatically renew for your selected duration at the end of each period, unless you cancel the renewal, which you can do at any time. You can login to the PayPal payment system and cancel the recurring subscription, or you can remove your Twitter accounts from the TwitSweeper system if you wish. Or you could just let us know and we can cancel your renewal. So, no one is locked in to any upcoming renewal. Use the system, benefit from it, and if you ever want to stop any future renewal, you have multiple ways of doing so.

Of course, we hope that you would instead find the service useful and helpful as it continues to check your Twitter followers for undesirable ones, removes and blocks them, and as we continue to add more features to it and to respond to users’ many great suggestions. Thanks for using TwitSweeper!

The universal answer seems to be: “Everything I don’t want to receive from someone I don’t know.”

So that leaves us with approximately six billion different opinions. The problem is, Viagra is a nuisance to some, a blessing to others. So who decides what are spammy or undesirable tweets?

Over the weekend I did a Twitter search for ‘twitter spam.’ The list of spam complaints from Twitter users was endless.  However, I still had no clear definition of what twitter spam was.

So we’re asking you, what might be on your list when defining spam:

• Tweets that are misleading, i.e. the tweet has nothing to do with its link
• Anyone promoting ‘how to make money online’
• Multi-level marketing promotions
• Lonely hearts club – (look at my pictures variety)
• Pornography
• Spam-robot factories
• Annoying people that tweet endlessly about mindless stuff
• Malware or viruses
• Sponsored tweets
• Corporations advertising and marketing their products and services

I would like to hear from you. What’s your definition of spam (or spammers and undesirables)?

Is twitter spam different from email spam?

How bad is twitter spam in comparison to email spam (where 80% of emails are estimated to be spam)?

There’s no question Twitter will be used by business and corporations to get their brand message out to consumers, that’s to be expected. Dell and others are doing this very effectively right now. However, as Twitter puts it, “Twitter is what you make of it – receive a lot of information or just a tiny bit…from breaking world news to updates from friends.”

Look at the stats posted in Main by Pingdom:

• 247 billion emails on average every day
• 1.4 billion email users worldwide
• Approximately 81% of emails sent are spam

How does that compare to Twitter?

• Estimated 27.3 million tweets on Twitter per day for the month of November 2009 (Pingdom)
• RJMetrics estimates 12 to 13 million active (monthly) users at the end of 2009
• TwitSweeper stats confirm Twitter spammy followers are over 4% and growing

How big Twitter’s is going to become is anyone’s guess, but I do know we have to stop Twitter spam before it reaches email proportions.

BACKGROUND: When TwitSweeper finds spammy or otherwise undesirable followers on a user’s Twitter account, it queues those followers for confirmation. When the user returns to TwitSweeper, they are presented with a list of the undesirable followers and asked to confirm (or retain) them. These undesirable followers are currently displayed in one long list.

SUGGESTION: We received a suggestion for enhancement today from a TwitSweeper user asking if this confirmation page could be paginated into smaller chunks so that these undesirable followers could be confirmed in smaller groups (so the page wasn’t so long if you had hundreds of bad followers to confirm).

YOUR PREFERENCE PLEASE: Could we please have YOUR feedback or preference on this proposed change by answering the following two questions in a Comment below:

(1) Should the confirmation page be paginated?  Yes (paginate it) / No (leave it as-is as one long page)

(2) If Yes (paginated), how many undesirable followers should be displayed on each page to confirm (before moving on to the next page of followers)? e.g. 25, 50, 75, 100, 200, other:____

We look forward to your thoughts on this change. Comment away please… (and thanks for helping!)

TwitSweeper is an “always on service.”

TwitSweeper scans your account on a regular basis. You may login to your TwitSweeper Dashboard at any time to review your statistics and the date(s) that your Twitter account was last checked. You can register multiple Twitter accounts under one TwitSweeper Dashboard. You can enable TwitSweeper to send an email when activity has taken place on any of your Twitter accounts.

Automatic or manual block – it’s your choice.

• Automatically remove spammy followers
• Remove spammy followers after a 72-hour notification to you
• Notify you to review suspect followers – Wait for you to confirm

Expand the list of spam phrases.

TwitSweeper is preloaded with thousands of phrases most often used by spammers. You can add your own phrases for maximum control. Any phrases that you add only affect your account(s).

All of this for one low annual fee.

Most services for Twitter are free. TwitSweeper is not one of them. We developed TwitSweeper because we hate being annoyed by spam and spammers. So we built the application on our servers so you don’t have to worry about downloading any apps to your computer. Our servers do the work and provide you with your personal account stats on an ongoing basis. It’s as easy as that. It depends on how you value your time and freedom. Our goal: Set it and forget it – cut down the annoyance factor, save time, make your Twitter experience easier and more enjoyable. It’s a small price to pay, but with real benefits.

You can try a free trial at http://TwitSweeper.com

Last week Mashable posted an article about a dangerous “Twitter Worm” that promises more followers, this is what they had to say…

“One of the sites involved asks for your Twitter username and password and appears to be associated with the Twitter account @GetFreeFollowers, which has been suspended by Twitter. Another that I came across may be far more damaging, as it appears to be spreading malware through what look to be YouTube videos (but actually work like Koobface). A similar scam also seems to be fairly widespread in Portuguese.”

In the future, there will be many more attacks popping up like this, so be careful to always watch out for schemes like this. Have you received any threats or suspicious spam on Twitter?

Issues such as the ease at which someone can insert spam into the real-time search results, and also instantaneous impacts on reputation management and the inability to resolve any such negative real-time issues inserted into the search results. And let’s not even talk about safety issues for children using Google search for projects and the real-time spam that is now getting inserted into their regular search results.

Here are some good articles that describe these issues in greater detail:

• Google Enables Real Time Spam and More – Outspoken Media
• With Real-Time Search, Comes Real-Time Spam – WebProNews
• The anatomy of a deceptive Tweet spamming Google Real-Time Search – Sebastian’s Pamphlets

What do you think of these changes? Add your comments below…

This past week Bit.ly said that it had partnered with the following security organizations to help it detect such undesirable users or target sites and disable their related bit.ly links:

• VeriSign’s iDefense IP reputation service. The iDefense system is focused on detecting and defeating malware.
• Websense Threatseeker Cloud service analyzes the web content behind bit.ly links in real time, using heuristic tools and reputation data to flag spammy URLs, malicious content and phishing sites.
• Sophos, whose behavioral-analysis technology goes beyond blacklists, to proactively detect spam and malware.

This should be a good thing for the Twitterverse and elsewhere online so that more of these questionable links will be rendered non-operational.

Other articles about Bit.ly’s latest move: Bit.ly Blog, Wired Magazine, TechCrunch Blog.

Do you agree or disagree with the direction that Bit.ly is taking this? (reply in the comments)

Set up your Account the right way

First and foremost – add an avatar, something personable – a picture of yourself is always easiest. Fill in your bio honestly, describe what you do, don’t use capitals. Just think of this as the first tweet to introduce you to the twitter world.
Try something like this

I am an avid Social Media and internet lover, I enjoy all things media – music, movies, art. I currently reside in Mytown, California!

Don’t tweet trending topics just to be part of the list…

You have seen them before clicking on a trending topic – the top 5 or so tweets include all the trending topics. Don’t be one of those people… if you want to tweet about a trending topic – well tweet something interesting about one of them. Here’s what mashable.com has to say about “trending topic spam” – link.

Don’t Follow Spammers

If you don’t want to be tagged as a spammer – why relate yourself to them. Don’t just follow anybody, only follow users that are worth following (their tweets are on a topic that interests you).

Don’t Automate your tweets

When tweeting – make it personable, don’t be a robot. Twitter is about communicating with other normal people, we don’t want to see auto-generated or program-generated messages.

Auto DM’s

Plain and Simple. Don’t sign up for those stupid apps that auto DM (Direct Message) someone that follows you. DM Spam is a very annoying twitter spam technique – many users don’t even look in their DM inbox anymore due to auto-generated DMs. Of course, a spammer can only auto-DM you if you are both following each other, so only follow other users that you are interested in hearing about.

Follow Spam

Follow spam is the act of following mass numbers of people, not because you’re actually interested in their tweets, but simply to gain attention, get views of your profile (and possibly clicks on URLs therein), or (ideally) to get followed back. Many people who are seeking to get attention in this way have even created programs to do the following on their behalf, which enable them to follow thousands of people at the blink of any eye. – Twitter | Reference Link

Content is KING

Twitter is a great application, and a useful tool – there is a sea of great quality content out there – links to tech news, design showcases, breaking news and etc… Next time you tweet, ask yourself “Is this something useful – will my followers be interested in this”

Do you have any suggestions on how not to be seen as a Twitter spammer?

Password

This is simple… make sure you have a good password, and an independent password – use a different password for Twitter, Facebook, Flickr, gmail (I know it’s hard). If you use a common password for all of them, just think of the problems if someone discovered that 1 password (they would have access to your entire web life). So make sure you protect yourself with a solid and separate password.

Report to Spam

You used to use the @spam twitter function, but Twitter just recently added a Report to Spam function which makes that all that much easier. When on targeted spammers profile page – there is a report to spam link.

TwitSweeper

Use TwitSweeper (shameless plug?) – We developed the app for a reason (to automatically get rid of your spammy followers on an ongoing basis).

Say no to Spam Topics

Stay away from spam topics… the more you mention spam related topics – the more attention you will bring to your account – and this is the wrong type of attention. There are applications out there that search for spam and then connect spammers together – it’s an easy way to get their numbers up.

Don’t use Automated Programs

“Receive 10,000 followers in one day, just click here”, Sure that sounds great, but you need to be realistic, it’s not going to happen that easy. Again you can purchase programs that will follow a whole whack of people in hopes that they follow you. Remember Twitter is a communication tool – keep it personable, tweet good content, you might not get as many followers, but you will appreciate the quantity of your followers.

Don’t follow Spammers

1. Before you choose to follow someone – check their name – does it feel like it was automatically generated – ie. JohnSmith101
2. Bio – Usually Twitter Spammer’s include some spam messages in their bio ie. Make money online fast.
3. Tweets – Look at their 10 most recent tweets – is it spam, is there useful content there. – If you see any mention of making money online fast, or get rich quick, lose 20lbs in 10 days just look the other way or better yet – report to spam.

How do you protect yourself from Twitter Spam? Tell us in the comments.

“Earn an income for the rest of your life”

“GET PAID FOR BEING A AFFILIATE MARKETER”

“To Earn INCOME you just invite people to watch this amazing video”

“Learn the trick discovered by a mom to turn yellow teeth white”

Ugh… Don’t you just hate seeing these stupid messages in your Twitter stream. I love using Twitter don’t get me wrong, and it’s a service that has done very well for it’s self and is growing rapidly. With everything else online, with huge growth in numbers there are bound to be some bad apples in the mix.

Twitter Spam – we see it on a daily basis whether in trending topics, or auto followers. Sure some of us might not see it, but if your audience took a look at your followers and 50 out of the 100 were spammers, you might be seen as a spammer yourself for indirectly endorsing them.

With all this said – Twitter Spam is a daily frustration for some, including us – so we decided to brainstorm and find out how we can help the Twitter-sphere. We decided to target the spammy followers, hopefully targeting them will help remove the spam masses from Twitter or at least reduce their influence. We have created a new app called “TwitSweeper” that automatically cleans up the spammy followers on your various Twitter accounts and continues to do so on an on going basis.

Introducing The Dustpan

During our research and development of TwitSweeper we thought, “This isn’t just a problem for us, millions of users are frustrated with these same problems,” hence The Dustpan blog was created as a place to “sound off” on this irritating topic. This is not your regular old blog – it is not about a product or service – it is a place for anyone to talk about the topic of Twitter Spam. We all share similar frustrations and problems related to this, and we all want to hear other people’s solutions, suggestions or feedback on how to best combat this growing annoyance.

We’ll talk a bit about how TwitSweeper can help with a portion of the problem (spammy followers), which will be our contribution, but there is so much more to talk about… so many more solutions out there, no doubt, and I’m sure we’re not alone in wanting to hear about these ideas (from you!)

Get Involved

If you want to get involved, or share your thoughts on the topic, head over to our Contribution page by navigating to the top of the sidebar and click the Contribute link to get started. It’s a simple form to fill out, or you can register for an account and become a one-time or periodic contributor, there is no commitments, just think of it as advanced commenting.

Also, be sure to follow us on Twitter and our RSS Feed to stay up to date with all things Twitter Spam related. We are striving to help diminish the Twitter Spam problem and hope that everyone will benefit by the sharing of information on how to best deal with Twitter Spam on our various Twitter accounts.

What have your experiences been with Twitter Spam thus far? Tell us all in a comment.