Feeds

Bogus LinkedIn profiles punt malware to fools

Beyoncé's not your friend, you berk

The Essential Guide to IT Transformation

Bogus profiles on social networking website LinkedIn are punting malware to the credulous and starstruck.

Fraudulent accounts in the name of celebrities such as Beyoncé Knowles, Victoria Beckham, Salma Hayek and others are littered with links that take surfers to site harbouring malware, Trend Micro reports. The attack - which is still under investigation - represents a web 2.0 update of the old hacker trick of baiting infectious email attachments with celebrity lures.

As if to reinforce the point, one of the fraudulent profiles is registered in the name of Paris Hilton and tempts the foolhardy with supposed links to her infamous sex tapes.

Another bogus profile created in the name of Beyoncé Knowles claims to offer nude pics of the shapely singer, as recorded in screen shots obtained by Trend Micro here. A quick search of LinkedIn reveals that the offending profile has since been purged. We can expect the others fraudulent registrations to also disappear in short order.

Security researchers have identified that at least some of the maliciously constructed profiles punted malicious scripts, specifically the Decdec-A Javascript code, linked to Trojan attacks.

McAfee adds that hundreds of identikit bogus profiles have been created by miscreants. "The rogue profiles look all alike, with a picture of the celebrity and three links to the parts of the “nude video” like shown in the following picture," McAfee reports.

It's hard to imagine many (if any) would have been taken in by such a crude and transparently bogus ruse. Sophos reckons that the LinkedIn attack might at least partially be geared towards increasing the search engine ranking of hacker-controlled websites.

"Undoubtedly spammers, malware authors and other cybercriminals may be abusing the system to link to their webpages in the hope that it will generate a higher ranking in search engines like Google," a blog posting by Sophos security consultant Graham Cluley explains.

Whatever its main objective, the LinkedIn attack serves to illustrate increased hacker interest in exploiting social networking sites. Over recent days hackers hijacked celebrity profiles registered through micro-blogging service Twitter after exploiting flaws in the password-recover support tool. Separately, ne'er-do-wells launched a phishing campaign designed to trick regular users into handing over account login details. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.