Hackers spoof MSNBC alerts in new twist on massive malware ruse
Last week's fake-CNN alerts becomes old news as crooks change tactics to plant Trojan horses
Computerworld - Hackers trying to plant malware on PCs have switched from touting news supposedly from CNN in come-on messages to pushing breaking stories said to be from rival network MSNBC, security experts said today.
The fake messages pose with subject headings that include the phrase "Breaking News," along with phony headlines, such as "Jerry Yang relinquishes control over Yahoo," "Mary-Kate Olsen responsible for Heath Ledger's death" and "Plane crashes into prep school, hundreds of kids killed," said researchers at F-Secure Corp. and Sophos PLC.
The criminals who launched that attack are also behind today's switch to MSNBC, said Sam Masiello, MX Logic Inc.'s vice president of information security. "Typically, we see copycats shortly after a major campaign, but this was sent by the same people," said Masiello.
Like the CNN spam, the MSNBC messages include links claiming to offer the complete news stories. However, people who click on those links reach a faux-CNN site where a dialog box claims that an update to Adobe System Inc.'s Flash Player is necessary to view a video clip.
The bogus update -- named "adobe_flash.exe," according to Masiello -- is actually a Trojan horse identified by security vendors as "EncPk-DA" and "Exchanger.mn," among other names. The Trojan horse, in turn, "phones home" to a malicious server to grab and install more malware.
The MSNBC campaign may just be getting started, said Masiello, who estimated the volume at midday Wednesday at 1.5 million to 2 million messages per hour. "But remember, it took about three days for the CNN spam to peak," he said.
One clue that the new spam is from the same group is that the page popping up when users click on the malicious links contains the CNN logo, not MSNBC's.
The CNN spam and malware enticements prompted Adobe last week to issue a warning to PC users. "Do not download Flash Player from a site other than Adobe.com," said David Lenoe, the company's product security program manager, in an entry on a company blog. "If you get a notice to update, it's not a bad idea to go directly to the site of the software vendor and download the update directly from the source. If the download is from an unfamiliar URL or an IP address, you should be suspicious."
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts