Attacks/Breaches
1/24/2011
08:15 PM
50%
50%

Twitter Worm Unleashes Fake AV Attack

Google's goo.gl link shortening service, as well as code obfuscation with RSA public key cryptography algorithm are spreading malicious links via a bogus antivirus campaign.

A Twitter worm is behind a new, fake antivirus campaign now in the wild.

According to Kaspersky Lab security researcher Nicolas Brulez, the new worm "is spreading fast, using the 'goo.gl' URL shortening service to distribute malicious links."

The attack, which was first spotted on Thursday, tweets a single, malicious link, with no additional message text, though all of the attacks list Mobile Web -- Twitter's app for generic mobile phones -- as the client used to post the tweet. Clicking on the malicious link sends users to one of various domains which feature an HTML page named "m28sx.html," which then redirects users to a static Web page with a Ukrainian top-level domain address. From here, users are redirected to pages which hawk fake AV, aka scareware.

Like all fake AV, "the user is invited to remove all the threats from their computer, and will download a fake antivirus application called Security Shield," said Brulez. Interestingly, the graphical user interface of the rogue AV software shows up in the operating system's default language.

Twitter is aware of the attack and is working to block it. On Thursday, Del Harvey, head of Twitter's Trust & Safety group, tweeted: "Did you follow a goo.gl link that led to a page telling you to install 'Security Shield' Rogue AV? That's malware. Don't install." She added in a second tweet: "We're working to remove the malware links and reset passwords on compromised accounts."

Security Shield appears to be an update of a previous strain of fake AV known as Security Tool, since "the Web page is using exactly the same obfuscation techniques …, which is an implementation of RSA cryptography in JavaScript to obfuscate the page code," said Brulez.

Attackers seem to favor RSA over other obfuscation techniques, he said, likely because key length can be kept relatively short, and also because private keys can be called via JavaScript.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.