Hackers exploit Obama site to spread malware
My.BarackObama.com still serving up Trojan a week after being notified, says Websense
Computerworld - A social networking site operated by the 2008 Barack Obama presidential campaign is serving up malware to unwary visitors a full week after the tactic was reported, a security researcher said today.
My.BarackObama.com, still active after the innauguration last week of President Obama, is being used by hackers trying to dupe users into downloading a Trojan horse, said Dan Hubbard vice president of security research at Websense Inc.
My.BarackObama.com provides tools that enable visitors to join groups of Obama supporters, raise funds and create a personal blog hosted on the site. The criminals have set up bogus accounts and used them to create blogs. When a user reaches one of the fake blogs, a YouTube-like video window is displayed; clicking on that video frame takes the user to a malicious Web site packed with pornography.
If the user clicks to view the porn, a message pops up claiming a video codec must be downloaded and installed. The executable file is no codec, but rather a Trojan horse that hijacks the PC.
"The group behind this is one of those that's infecting people with fake antivirus software," said Hubbard, referring to so-called scareware programs that pose as security software but are actually useless. Until the victim pays for the worthless program -- prices range between $40 and $50 -- he or she is deluged with fake pop-up warnings.
The cybercrooks don't just try to grab people browsing through My.BarackObama.com, Hubbard added; rather, they are actively polluting search engines with the URLs of their bogus blog accounts in an attempt to take advantage of My.BarackObama.com's reputation and popularity.
Although Websense first uncovered the phony blogs a week ago, it has had no luck reaching someone responsible for the My.BarackObama.com site. "We've been constantly trying to reach them, and tried every possible angle, from e-mail to the site itself to the phone, but we haven't heard back," said Hubbard. "Obviously, they've been fairly busy."
Multiple bogus blogs on the site are still serving the Trojan, Hubbard confirmed today.
A call Monday by Computerworld to the contact phone number listed in the site's terms of service was not returned.
This is not the first time Obama's name has been used to spread malicious code. The weekend before his inauguration, sites claiming that Obama would refuse to take office infected users with the Waledec bot Trojan; last November, the day after Obama won the U.S. presidential election, hackers launched a major malware campaign based on a site that claimed to have final vote tallies.
Read more about Security in Computerworld's Security Topic Center.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts