Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Hackers spoof MSNBC alerts in new twist on massive malware ruse

Last week's fake-CNN alerts becomes old news as crooks change tactics to plant Trojan horses

August 13, 2008 12:00 PM ET

Computerworld - Hackers trying to plant malware on PCs have switched from touting news supposedly from CNN in come-on messages to pushing breaking stories said to be from rival network MSNBC, security experts said today.

The fake messages pose with subject headings that include the phrase "Breaking News," along with phony headlines, such as "Jerry Yang relinquishes control over Yahoo," "Mary-Kate Olsen responsible for Heath Ledger's death" and "Plane crashes into prep school, hundreds of kids killed," said researchers at F-Secure Corp. and Sophos PLC.

Last week, security vendors had warned users of a massive scam that used messages masquerading as news alerts from CNN. At its peak, the blitz dumped nearly 11 million messages an hour on users.

The criminals who launched that attack are also behind today's switch to MSNBC, said Sam Masiello, MX Logic Inc.'s vice president of information security. "Typically, we see copycats shortly after a major campaign, but this was sent by the same people," said Masiello.

Like the CNN spam, the MSNBC messages include links claiming to offer the complete news stories. However, people who click on those links reach a faux-CNN site where a dialog box claims that an update to Adobe System Inc.'s Flash Player is necessary to view a video clip.

The bogus update -- named "adobe_flash.exe," according to Masiello -- is actually a Trojan horse identified by security vendors as "EncPk-DA" and "Exchanger.mn," among other names. The Trojan horse, in turn, "phones home" to a malicious server to grab and install more malware.

The MSNBC campaign may just be getting started, said Masiello, who estimated the volume at midday Wednesday at 1.5 million to 2 million messages per hour. "But remember, it took about three days for the CNN spam to peak," he said.

One clue that the new spam is from the same group is that the page popping up when users click on the malicious links contains the CNN logo, not MSNBC's.

The CNN spam and malware enticements prompted Adobe last week to issue a warning to PC users. "Do not download Flash Player from a site other than Adobe.com," said David Lenoe, the company's product security program manager, in an entry on a company blog. "If you get a notice to update, it's not a bad idea to go directly to the site of the software vendor and download the update directly from the source. If the download is from an unfamiliar URL or an IP address, you should be suspicious."



Jump to comments

MSNBC

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

What People Are Saying

White Papers & Webcasts

Share our Strength
Download Now  

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...