Feeds

Scareware tool dumps smut on Windows PCs

Rogue clean-up tool poses child abuse frame risk

3 Big data security analytics techniques

Rogue anti-virus slingers are getting even sneakier. Instead of offering to clean up non-existent malware threats as per the traditional approach, one rogue scanner offers to clean up images of porn it claims to have found on a prospective mark's PC.

In reality, these images get downloaded by the purported clean-up package itself. Victims were exposed to the pitch on behalf of a especially malodorous scareware package called Win Spy Protect simply by visiting a hacked website.

Roger Thompson, chief of research at security firm AVG, ran across the threat months ago but held back on publishing details until Thursday. Heightened concerns about how malware infection could result in presence of image of child abuse on the PCs of non-paedophiles prompted Thompson into publishing a video of the threat (below).

The hacked website linked to the attack was a children's site and the content strictly adult porn. However, the tactic could result in child abuse images getting dropped onto the machines of surfers whose only mistake was to stray onto hacked websites, as Thompson explains.

Fortunately, LinkScanner detects the rogue-spyware aspects of this and blocks it just fine, but without LinkScanner, these images would now be in the browser cache, and it would sure look like the owner was guilty. Worse still, the images could just as easily be kiddy porn, and just being your cache would be regarded as possession, and therefore highly illegal by most law enforcement agencies.

Poisoned blogs

In related scareware news, hackers have set up 260,000 fake blog pages on compromised sites in preparation for a scareware distribution campaign that relies on manipulating search engine rankings so that booby-trapped sites appear prominently in the search indexes for topical terms.

Between the latest attack (detected this week) and an even larger assault along the same lines detected in September, there are now well over 800,000 fake blog pages. Few of these pages are detected by Google as malicious, net security firm eSoft warns.

A blog post by eSoft explains the mechanism of the scam.

"The key to this scheme is JavaScript uploaded to the compromised server and used in the fake blog pages. The file, css.js, contains obfuscated JavaScript which redirect users to Rogue AV [anti-virus] if the site is accessed through certain search engines," it said.

"Using this technique allows the attackers to quickly and easily change distribution points and payloads. The current payloads have low detection rates among AV [anti-virus] scanners." ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.