Hackers spoof MSNBC alerts in new twist on massive malware ruse
Last week's fake-CNN alerts becomes old news as crooks change tactics to plant Trojan horses
Computerworld - Hackers trying to plant malware on PCs have switched from touting news supposedly from CNN in come-on messages to pushing breaking stories said to be from rival network MSNBC, security experts said today.
The fake messages pose with subject headings that include the phrase "Breaking News," along with phony headlines, such as "Jerry Yang relinquishes control over Yahoo," "Mary-Kate Olsen responsible for Heath Ledger's death" and "Plane crashes into prep school, hundreds of kids killed," said researchers at F-Secure Corp. and Sophos PLC.
The criminals who launched that attack are also behind today's switch to MSNBC, said Sam Masiello, MX Logic Inc.'s vice president of information security. "Typically, we see copycats shortly after a major campaign, but this was sent by the same people," said Masiello.
Like the CNN spam, the MSNBC messages include links claiming to offer the complete news stories. However, people who click on those links reach a faux-CNN site where a dialog box claims that an update to Adobe System Inc.'s Flash Player is necessary to view a video clip.
The bogus update -- named "adobe_flash.exe," according to Masiello -- is actually a Trojan horse identified by security vendors as "EncPk-DA" and "Exchanger.mn," among other names. The Trojan horse, in turn, "phones home" to a malicious server to grab and install more malware.
The MSNBC campaign may just be getting started, said Masiello, who estimated the volume at midday Wednesday at 1.5 million to 2 million messages per hour. "But remember, it took about three days for the CNN spam to peak," he said.
One clue that the new spam is from the same group is that the page popping up when users click on the malicious links contains the CNN logo, not MSNBC's.
The CNN spam and malware enticements prompted Adobe last week to issue a warning to PC users. "Do not download Flash Player from a site other than Adobe.com," said David Lenoe, the company's product security program manager, in an entry on a company blog. "If you get a notice to update, it's not a bad idea to go directly to the site of the software vendor and download the update directly from the source. If the download is from an unfamiliar URL or an IP address, you should be suspicious."
Read more about Security in Computerworld's Security Topic Center.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!