FBI warns that fake bin Laden video is a virus

IDG News Service - The U.S. Federal Bureau of Investigation warned computer users Tuesday that messages claiming to include photos and videos of Osama bin Laden's death actually contain a virus that could steal personal information.

The warning comes as security companies said that they've spotted the first samples of malicious software disguised as photos of the dead Al Qaeda leader.

Security vendor F-Secure said Tuesday that criminals are e-mailing a password-stealing Trojan horse program called Banload to victims, and Symantec said it's seen criminals spamming victims with links to fake "Osama dead" news articles that launch Web-based attacks on visitors.

U.S. authorities do have photos of bin Laden, who was shot in the head during an early morning raid Monday in Pakistan. But these photos have not been released publicly.

Scammers have also used a technique called search engine poisoning to try to trick search engines into listing hacked Web pages that are loaded with malware in their search results. "It's unlikely you'll find pictures or videos of Bin Laden's death online -- but searching for one will certainly take you to sites with malware," wrote F-Secure chief research officer Mikko Hyponnen in a blog post.

The FBI warned Internet users to watch out for fake messages on social network sites and to never download software in order to view a video. "Read e-mails you receive carefully. Fraudulent messages often feature misspellings, poor grammar, and non-standard English," the FBI warning stated.

As a major international news event, bin Laden's death has shown the amazing way information can spread online. Many learned of the terrorist leader's death through Twitter, where the story first broke, or Facebook. But it also underscores how the unfiltered media can quickly spread bad information worldwide.

In the two days since the early morning raid, the bin Laden story has generated fake photographs, fake quotes, and plenty of scams.

Security experts said that shady marketers and so-called rogue antivirus vendors have also jumped on the bin Laden bandwagon. The rogue antivirus software bombards victims with pop-up messages telling them they have a computer problem. Its aim: to nag them into paying for bogus software.

Shady marketers are spreading messages on Facebook that try to lure victims into spreading the message to friends and visiting marketing Web sites, by claiming they have a censored video.

"Osama is dead, watch this exclusive CNN video which was censored by Obama Administration due to level of violence, a must watch," is a typical lure used in the scam. Users are encouraged to cut and paste malicious JavaScript code into their browser, which then sends the message to all of their Facebook friends. Security experts say never to cut and paste scripts into the browser.

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert's e-mail address is robert_mcmillan@idg.com