Facebook malware scam takes hold
A link to malware purporting to be CNN coverage of a US attack on Iran is reaching hundreds of thousands of Facebook users
IDG News Service - A "worrying number" of Facebook users are sharing a link to a malware-laden fake CNN news page reporting the U.S. has attacked Iran and Saudi Arabia, security firm Sophos said Friday.
If users who follow the link then click to play what purports to be video coverage of the attack, they are prompted to update their Adobe Flash player with a pop-up window that looks very much like the real thing. Those who accept the prompt unwittingly install malware on their computers.
Within three hours of the scam's appearance, more than 60,000 users had followed a link to the spoofed CNN page, according to Sophos Senior Security Advisor Chester Wisniewski. Facebook removed that link, but others are still being shared.
"The bad guys are rotating through scam pages trying to stay ahead of Facebook," Wisniewski said.
In a statement, Facebook said it was "in the process of cleaning up this spam now, and remediating any affected users."
A representative status update shown in a screenshot on the Sophos blog reads, "U.S. Attacks Iran and Saudia Arabia. F**k :-( [LINK] The Begin of World War 3?"
Users who accepted the Flash player update prompt installed a fake antivirus tool on their computers. That tool would then alert them that their computer is infected with malware that can be eliminated for a fee. Such scams are one of the most lucrative, Wisniewski said, noting the irony that they net far more money than the legitimate security products Sophos and other security companies peddle.
In addition to exercising a healthy dose of skepticism that the U.S. would attack its ally Saudi Arabia, Facebook users can avoid the scam and others like it by updating Flash only from Adobe's own website rather than from pop-ups.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!