Feeds

Erin Andrews peephole footage spreads Trojan

Malware risk to the unwary horny

Website security in corporate America

Updated Supposed hidden camera footage of US sports reporter Erin Andrews on offer online often leads to malware, security firm Sophos warns.

Websites claiming to provide nude video of glamorous ESPN reporter Erin Andrews are in reality a trick designed to trick both Windows and Mac surfers into installing malware. Hackers are taking advantage of hype around supposedly covert footage of the glamorous reporter to distribute Trojan horse malware.

Malicious code ultimately designed to fleece Windows users by tricking them into buying rogue security software of little or no utility is hosted on sites that can pose as affiliates of reputable news outlets, such as CNN. In reality the sites are complete fakes, but smut-seeking surfers might still find their way onto them anyway because of the use of black hat search engine optimisation techniques.

Surfers who visit the malicious sites are exposed to either the Jahlav-C Trojan horse on Macs, or the FakeAV-AY Trojan for Windows. In both cases, muck-fixated punters are tricked into downloading malware that poses as a video player supposedly needed to view footage of Andrews in her birthday suit. Code running on the hacker-controlled websites determines which strain of malware is offered up to visitors.

Sophos has posted a educational video on YouTube Vimeo (below) explaining the attack. It reports that following through on the trick will allow punters to see video of an unidentified, undressed woman, possibly in an attempt to take attention away from the malware infection happening in the background.

Meanwhile, back in the real world, lawyers acting for Andrews are taking legal action against anyone distributing copies of the illicitly-obtained footage online. The footage was obtained without either the knowledge or consent of the high-profile reporter. ®

Update

YouTube has pulled Sophos's video explanation of the threat, possibly in the false belief it might be malign or out of prudishness, after deciding it was “inappropriate content”. The run-down can still be found on vimeo here.

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.