Hackers quickly move to exploit Bhutto assassination
Attackers dupe users with fake codec, launch drive-by attacks
Computerworld - Within hours of yesterday's assassination of former Pakistani Prime Minister Benazir Bhutto, malware makers exploited the breaking news to dupe users into downloading attack code, security researchers said Friday.
For instance, WebSense found such a site simply by using "benazir" to search on Google. Meanwhile, McAfee quickly located 10 sites hosted on Blogger.com, Google Inc.'s blog service, that were spreading the fake codec.
The sites use the well-worn tactic of promising a video -- in this case one of Bhutto's assassination -- but telling Windows users that they need to install a new high-definition video codec, the program that decodes the digital data stream, to view the clip. Naturally, the so-called codec is no such thing, but is instead rigged code that downloads a variant of the Zlob Trojan horse, a back door that can infect the compromised PC with a wide range of other malware.
"Even death isn't sacred to some," said Symantec researcher Vikram Thakur in a post to the company's security response blog.
Other hackers are relying on the news of Bhutto's assassination to draw users to sites that forgo the codec angle and instead conduct drive-by attacks, said Rahul Mohandas, a security analyst at McAfee's Avert Labs unit. "There are a plethora of sites which attempt drive-by installations when unsuspecting users visit search-engine results for 'Benazir Bhutto,'" said Mohandas in a post to the Avert Labs blog this morning. "Many of these compromised pages have malicious scripts, which point to the 3322 domain. These pages contain obfuscated variants of the MS06-014 exploit, which is perhaps one of the most popular of all the exploits we see on a daily basis."
Shilling bogus codecs is a popular pastime of attackers. The technique has been used to plant malware on PCs from singer Alicia Keys' MySpace page, for example, and was the vector used by hackers who went after Macs last month.
Read more about Security in Computerworld's Security Topic Center.
- EndPoint Interactive eGuide In this eGuide, Network World, Computerworld, and CIO examine two endpoint trends - BYOD and collaboration - and offer tips and advice on...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!