Trojan Attacks Via Parking Violation Notices

New attack blends the physical and virtual worlds to infect victims

Dark Reading Staff, Dark Reading

February 7, 2009

1 Min Read

Cybercriminals took their malware to the streets in Grand Forks, N.D., where some motorists recently found parking violation notices on their windshields instructing them to visit a URL to view photos of their purported infraction. The phony parking ticket scontained a malicious URL that requires them to download a toolbar, which is actually a Trojan.

The "toolbar" shows photos of parked cars in the area; the user is prompted with a pop-up with a fake security alert, attempting to lure the victim into installing phony antivirus software to clean up their machine.

"The malicious programs were run-of-the-mill; however, the use of flyers was an innovative way of social-engineering potential victims into visiting a malicious website," said Lenny Zeltser, a SANS Internet Storm Center analyst in a blog post on the attack.

Zeltser, who analyzed the malware and the attack, says the initial malware is automatically installed as a browser helper object for Internet Explorer. It then downloads code from a notoriously bad domain that's well-known among security researchers (, and then uses the fake security alert to trick the victim into installing more malware.

"Attackers continue to come up with creative ways of tricking potential victims into installing malicious software. Merging physical and virtual worlds via objects that point to websites is one way to do this. I imagine we'll be seeing such approaches more often," Zeltser blogged.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights