Hackers spoof MSNBC alerts in new twist on massive malware ruse
Last week's fake-CNN alerts becomes old news as crooks change tactics to plant Trojan horses
Computerworld - Hackers trying to plant malware on PCs have switched from touting news supposedly from CNN in come-on messages to pushing breaking stories said to be from rival network MSNBC, security experts said today.
The fake messages pose with subject headings that include the phrase "Breaking News," along with phony headlines, such as "Jerry Yang relinquishes control over Yahoo," "Mary-Kate Olsen responsible for Heath Ledger's death" and "Plane crashes into prep school, hundreds of kids killed," said researchers at F-Secure Corp. and Sophos PLC.
The criminals who launched that attack are also behind today's switch to MSNBC, said Sam Masiello, MX Logic Inc.'s vice president of information security. "Typically, we see copycats shortly after a major campaign, but this was sent by the same people," said Masiello.
Like the CNN spam, the MSNBC messages include links claiming to offer the complete news stories. However, people who click on those links reach a faux-CNN site where a dialog box claims that an update to Adobe System Inc.'s Flash Player is necessary to view a video clip.
The bogus update -- named "adobe_flash.exe," according to Masiello -- is actually a Trojan horse identified by security vendors as "EncPk-DA" and "Exchanger.mn," among other names. The Trojan horse, in turn, "phones home" to a malicious server to grab and install more malware.
The MSNBC campaign may just be getting started, said Masiello, who estimated the volume at midday Wednesday at 1.5 million to 2 million messages per hour. "But remember, it took about three days for the CNN spam to peak," he said.
One clue that the new spam is from the same group is that the page popping up when users click on the malicious links contains the CNN logo, not MSNBC's.
The CNN spam and malware enticements prompted Adobe last week to issue a warning to PC users. "Do not download Flash Player from a site other than Adobe.com," said David Lenoe, the company's product security program manager, in an entry on a company blog. "If you get a notice to update, it's not a bad idea to go directly to the site of the software vendor and download the update directly from the source. If the download is from an unfamiliar URL or an IP address, you should be suspicious."
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts