Feeds

Bogus Beijing earthquake reports used to spread malware

Playing with Olympic fire

Protecting users from Firesheep and other Sidejacking attacks with SSL

Supected botnet operators are using false reports that a fictitious earthquake near Beijing could disrupt the Olympic games to spread malware.

Samples of the bogus alert doing the rounds, featuring subject lines such as "Million dead in Chinese quake", link to a website on a .cn domain. This site claims a quake measured in at 9.0* on the Richter scale has caused millions of casualties while throwing preparations for the games into turmoil. The page contains links to a supposed video that actually downloads the Nuwar-E worm onto the Windows boxes of marks credulous enough to fall for the ruse.

Net security firm Sophos reports that the .cn domains advertised in that attack are likely to be part of a botnet. Each DNS query for the domains returns a different IP address, indicating a changing network of compromised hosts are serving up the malware.

Using topical events to punt malware is one of the oldest social engineering tricks in the book. Baiting malware traps with "news" about non-existent calamities is hardly unprecedented either.

Its unclear where the hackers behind the latest scam are based. But if they're anywhere in China they are playing with fire. Last week police in south China arrested a man accused of spreading rumors of an impending earthquake after hacking into a government website. The 19 year-old suspect has reportedly confessed to breaking into the official website of the Guangxi earthquake administration on 31 May to spread the rumour, little more than a fortnight after a real earthquake claimed an estimated 68,000 lives in Sichuan province.

The technology worker (identified only by his surname, Chen) carried out the attack out of mischief, or to have "fun" as police sources put it, official Chinese news agency Xinhua reports. Somehow we doubt he's having much fun now. ®

* The Sichuan earthquake was measured at around magnitude 8.0 on the Richter scale. Earthquakes that weight in at over 9.0 on the Richter scale are very rare. The earthquake that triggered the Indian Ocean Tsunami of December 2004 measured 9.3 on the scale and is the second highest ever recorded. So the idea that news of such a disaster would first reach recipients by spam email really beggars belief.

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.