Hackers spoof MSNBC alerts in new twist on massive malware ruse

Computerworld - Hackers trying to plant malware on PCs have switched from touting news supposedly from CNN in come-on messages to pushing breaking stories said to be from rival network MSNBC, security experts said today.

The fake messages pose with subject headings that include the phrase "Breaking News," along with phony headlines, such as "Jerry Yang relinquishes control over Yahoo," "Mary-Kate Olsen responsible for Heath Ledger's death" and "Plane crashes into prep school, hundreds of kids killed," said researchers at F-Secure Corp. and Sophos PLC.

Last week, security vendors had warned users of a massive scam that used messages masquerading as news alerts from CNN. At its peak, the blitz dumped nearly 11 million messages an hour on users.

The criminals who launched that attack are also behind today's switch to MSNBC, said Sam Masiello, MX Logic Inc.'s vice president of information security. "Typically, we see copycats shortly after a major campaign, but this was sent by the same people," said Masiello.

Like the CNN spam, the MSNBC messages include links claiming to offer the complete news stories. However, people who click on those links reach a faux-CNN site where a dialog box claims that an update to Adobe System Inc.'s Flash Player is necessary to view a video clip.

The bogus update -- named "adobe_flash.exe," according to Masiello -- is actually a Trojan horse identified by security vendors as "EncPk-DA" and "Exchanger.mn," among other names. The Trojan horse, in turn, "phones home" to a malicious server to grab and install more malware.

The MSNBC campaign may just be getting started, said Masiello, who estimated the volume at midday Wednesday at 1.5 million to 2 million messages per hour. "But remember, it took about three days for the CNN spam to peak," he said.

One clue that the new spam is from the same group is that the page popping up when users click on the malicious links contains the CNN logo, not MSNBC's.

The CNN spam and malware enticements prompted Adobe last week to issue a warning to PC users. "Do not download Flash Player from a site other than Adobe.com," said David Lenoe, the company's product security program manager, in an entry on a company blog. "If you get a notice to update, it's not a bad idea to go directly to the site of the software vendor and download the update directly from the source. If the download is from an unfamiliar URL or an IP address, you should be suspicious."

Read more about Security in Computerworld's Security Topic Center.