Osama Bin Laden news spurs wave of scams, malware

Malware creators are already using the news of Osama Bin Laden's death as a opportunity to try and dupe people into clicking on malicious links. According to cloud-security firm Zscaler, researchers were already seeing malicious sites emerge to capitalize on the news within hours of the announcement.

Zscaler uses the example of one Spanish language site that displays a purported photo of a murdered Osama Bin Laden and includes a story about the US led operation. The page includes a Flash Player window with a message indicating that the user must first update a VLC plugin, which is a popular media player, in order to view the video. The link is, unsurprisingly, a bad one, said researchers.

"When the user clicks on the link, they will download a file titled XvidSetup.exe. This file is actually a popular adware tool known as hotbar," according to the Zscaler blog post, which also notes 19 of 41 antivirus engines are blocking the file at this time.

See also: 5 tips to avoid getting phished

According to a post from Randy Abrams, Director of Technical Education, Cyber Threat Analysis Center, ESET North America, black hat SEO manipulators know all too well that big headlines mean people will search for news, and they also know how to make their malicious sites show up early in the search results. Cyber criminals also use a slew of social engineering and phishing techniques to lure people into malware traps.

"Always stick with well known sites for your news information," advises Abrams. "You can go to sites you haven't heard of before, as long as they are coming recommended by friends and you know that your friend actually did recommend them. That means a simple email, IM or Facebook post doesn't cut it& you don't know if your friend's account was compromised. You need to have a dialog with your friend."

Experts also advise being wary of shortened links on Facebook and Twitter that claim to lead to Bin Laden news. Obscured links are a popular way to con computer users into clicking on a malicious link.

Security firm Sophos warned Monday to watch out for links in email or on social networking sites offering additional coverage of the event.

"Many of the links you see will be perfectly legitimate links," said Sophos' Paul Ducklin in a Naked Security blog post. "But at least some are almost certain to be dodgy links, deliberately distributed to trick you into hostile internet territory."

Ducklin offers several tips to avoid being trapped. They include:

* Don't blindly trust links you see online, whether in emails, on social networking sites, or from searches. If the URL and the subject matter don't tie up in some obvious way, give it a miss.

* Use an endpoint security product which offers some sort of web filtering so you get early warning of poisoned content. (Sophos Endpoint Security and Control and the Sophos Web Appliance are two examples.)

* If you go to a site expecting to see information on a specific topic but get redirected somewhere unexpected - to a "click here for a free security scan" page, for instance, or to a survey site, or to a "download this codec program to view the video" dialog - then get out of there at once. Don't click further. You're being scammed.

Researchers with Imperva captured the inner workings of a black-hat SEO effort on a hacker forum. In Imperva's blog post, they provide details on the campaign, which is designed to generate inauthentic Facebook likes through obfuscated links.

Register now for the ARN Security Forum 2013 on June 4 at the Sydney Mint

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email ARN
• Follow ARN on twitter

• Share
  Share this article1

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark