Osama Bin Laden news spurs wave of scams, malware

Osama Bin Laden news spurs wave of scams, malware

It only took a few hours for cybercriminals to start finding ways to use the Bin Laden news as a trap for malware-laden links

Malware creators are already using the news of Osama Bin Laden's death as a opportunity to try and dupe people into clicking on malicious links. According to cloud-security firm Zscaler, researchers were already seeing malicious sites emerge to capitalize on the news within hours of the announcement.

Zscaler uses the example of one Spanish language site that displays a purported photo of a murdered Osama Bin Laden and includes a story about the US led operation. The page includes a Flash Player window with a message indicating that the user must first update a VLC plugin, which is a popular media player, in order to view the video. The link is, unsurprisingly, a bad one, said researchers.

"When the user clicks on the link, they will download a file titled XvidSetup.exe. This file is actually a popular adware tool known as hotbar," according to the Zscaler blog post, which also notes 19 of 41 antivirus engines are blocking the file at this time.

See also: 5 tips to avoid getting phished

According to a post from Randy Abrams, Director of Technical Education, Cyber Threat Analysis Center, ESET North America, black hat SEO manipulators know all too well that big headlines mean people will search for news, and they also know how to make their malicious sites show up early in the search results. Cyber criminals also use a slew of social engineering and phishing techniques to lure people into malware traps.

"Always stick with well known sites for your news information," advises Abrams. "You can go to sites you haven't heard of before, as long as they are coming recommended by friends and you know that your friend actually did recommend them. That means a simple email, IM or Facebook post doesn't cut it& you don't know if your friend's account was compromised. You need to have a dialog with your friend."

Experts also advise being wary of shortened links on Facebook and Twitter that claim to lead to Bin Laden news. Obscured links are a popular way to con computer users into clicking on a malicious link.

Security firm Sophos warned Monday to watch out for links in email or on social networking sites offering additional coverage of the event.

"Many of the links you see will be perfectly legitimate links," said Sophos' Paul Ducklin in a Naked Security blog post. "But at least some are almost certain to be dodgy links, deliberately distributed to trick you into hostile internet territory."

Ducklin offers several tips to avoid being trapped. They include:

* Don't blindly trust links you see online, whether in emails, on social networking sites, or from searches. If the URL and the subject matter don't tie up in some obvious way, give it a miss.

* Use an endpoint security product which offers some sort of web filtering so you get early warning of poisoned content. (Sophos Endpoint Security and Control and the Sophos Web Appliance are two examples.)

* If you go to a site expecting to see information on a specific topic but get redirected somewhere unexpected - to a "click here for a free security scan" page, for instance, or to a survey site, or to a "download this codec program to view the video" dialog - then get out of there at once. Don't click further. You're being scammed.

Researchers with Imperva captured the inner workings of a black-hat SEO effort on a hacker forum. In Imperva's blog post, they provide details on the campaign, which is designed to generate inauthentic Facebook likes through obfuscated links.

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Tags securityzscalerscamsmalware



 IN PICTURES: VeeamON Tour in Sydney and Melbourne (+ 17 photos)

IN PICTURES: VeeamON Tour in Sydney and Melbourne (+ 17 photos)

The VeeamON tour showcased company's upcoming release of the Veeam Availability Suite v9. Veeam product strategist, Rick Vanover led the discussions in Sydney and Melbourne about the upcoming v9 and other Veeam innovations for the new year.​ VeeamON was held on September 23 at the Museum of Sydney, Warrane Theatre, and at Melbourne Museum in Melbourne on September 24.

IN PICTURES: VeeamON Tour in Sydney and Melbourne (+ 17 photos)
 IN PICTURES: Greentree A/NZ Partners Explore Japan (+ 13 PHOTOS)

IN PICTURES: Greentree A/NZ Partners Explore Japan (+ 13 PHOTOS)

As part of a regular strategic planning program for select Greentree A/NZ partners, they enjoyed a week in Japan combining strategic planning sessions with sightseeing. Principals and their partners from Star Business Solutions, Endeavour Solutions, Addax Business Solutions, GT Business Solutions, bizlinkIT and Verde Group joined Greentree chief executive, Peter Dickinson, channel director, Graham Hill, and R&D director, Stephen Sims in Tokyo and took in Hiroshima, Kyoto and Hakone, including travel on the famed bullet train which hit a top speed of 296 KPH.

IN PICTURES: Greentree A/NZ Partners Explore Japan (+ 13 PHOTOS) is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments