Attacks/Breaches
1/24/2011
08:15 PM
50%
50%

Twitter Worm Unleashes Fake AV Attack

Google's goo.gl link shortening service, as well as code obfuscation with RSA public key cryptography algorithm are spreading malicious links via a bogus antivirus campaign.

A Twitter worm is behind a new, fake antivirus campaign now in the wild.

According to Kaspersky Lab security researcher Nicolas Brulez, the new worm "is spreading fast, using the 'goo.gl' URL shortening service to distribute malicious links."

The attack, which was first spotted on Thursday, tweets a single, malicious link, with no additional message text, though all of the attacks list Mobile Web -- Twitter's app for generic mobile phones -- as the client used to post the tweet. Clicking on the malicious link sends users to one of various domains which feature an HTML page named "m28sx.html," which then redirects users to a static Web page with a Ukrainian top-level domain address. From here, users are redirected to pages which hawk fake AV, aka scareware.

Like all fake AV, "the user is invited to remove all the threats from their computer, and will download a fake antivirus application called Security Shield," said Brulez. Interestingly, the graphical user interface of the rogue AV software shows up in the operating system's default language.

Twitter is aware of the attack and is working to block it. On Thursday, Del Harvey, head of Twitter's Trust & Safety group, tweeted: "Did you follow a goo.gl link that led to a page telling you to install 'Security Shield' Rogue AV? That's malware. Don't install." She added in a second tweet: "We're working to remove the malware links and reset passwords on compromised accounts."

Security Shield appears to be an update of a previous strain of fake AV known as Security Tool, since "the Web page is using exactly the same obfuscation techniques …, which is an implementation of RSA cryptography in JavaScript to obfuscate the page code," said Brulez.

Attackers seem to favor RSA over other obfuscation techniques, he said, likely because key length can be kept relatively short, and also because private keys can be called via JavaScript.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Cybercrime has become a well-organized business, complete with job specialization, funding, and online customer service. Dark Reading editors speak to cybercrime experts on the evolution of the cybercrime economy and the nature of today's attackers.