Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

6/9/2010
03:54 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

2010 World Cup Used As Bait To Spread MySecurityEngine Rogueware

NBA Championships also used in Black Hat SEO tactics

ORLANDO, Fla., June 9 /PRNewswire/ -- PandaLabs, the anti-malware laboratory at Panda Security, has reported the recent appearance of a number of Web pages distributing the MySecurityEngine fake antivirus. All of these pages appear in top Web search results related to the 2010 World Cup and NBA Championships.

"The 2010 World Cup is a worldwide event that hackers are logically taking advantage of," said Luis Corrons, Technical Director, PandaLabs. "Over the last few days, we have also noticed an increase in the number of malicious links that use the Roland Garros final, Rafael Nadal's win or the NBA finals as bait. We advise users that use search engines to look for information regarding the World Cup and other big news events to be careful when clicking links returned by search engines. We expect to see attacks like this increase over the next few days."

A screenshot of the recent malicious search results is available here: http://www.flickr.com/photos/panda_security/4684251897/

Blackhat SEO attacks like this were first introduced by hackers a couple of years ago. Since then, they have become increasingly frequent and sophisticated, managing to insert rogue websites into the top search results in search engine listings. The system is very simple: when users look for information about major events such as the World Cup or NBA championships, the results correspond to rogue Web pages professionally indexed to rank high. If the user clicks the link, they will be asked to download a file, a codec for example. If they do so, they will be inadvertently installing a malicious fake antivirus program on their computer.

PandaLabs advises users to take the necessary precautions when visiting Web pages through search engines. Make sure that sources are reliable and reject all downloads, as you could be infecting your PC. According to Corrons, "The best piece of advice I can offer is to use your common sense when surfing the Web. Reject requests from strangers and do not open any files that come from unfamiliar sources. Make sure you have the proper virus protection on your computer and that it is up to date. Currently there are free solutions like Panda Cloud Antivirus (www.cloudantivirus.com) that protect computers against this type of threat."

About PandaLabs

Since 1990, its mission has been to detect and eliminate new threats as rapidly as possible to offer our clients maximum security. To do so, PandaLabs has an innovative automated system that analyzes and classifies thousands of new samples a day and returns automatic verdicts (malware or goodware). This system is the basis of collective intelligence, Panda Security's new security model which can even detect malware that has evaded other security solutions.

Currently, 99.4 percent of malware detected by PandaLabs is analyzed through this system of collective intelligence. This is complemented through the work of several teams, each specialized in a specific type of malware (viruses, worms, Trojans, spyware, phishing, spam, etc.), who work 24/7 to provide global coverage. This translates into more secure, simpler and more resource-friendly solutions for clients.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4682
PUBLISHED: 2021-01-28
IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 186509.
CVE-2020-4888
PUBLISHED: 2021-01-28
IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker co...
CVE-2020-13569
PUBLISHED: 2021-01-28
A cross-site request forgery vulnerability exists in the GACL functionality of OpenEMR 5.0.2 and development version 6.0.0 (commit babec93f600ff1394f91ccd512bcad85832eb6ce). A specially crafted HTTP request can lead to the execution of arbitrary requests in the context of the victim. An attacker can...
CVE-2021-20620
PUBLISHED: 2021-01-28
Cross-site scripting vulnerability in Aterm WF800HP firmware Ver1.0.9 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2021-20621
PUBLISHED: 2021-01-28
Cross-site request forgery (CSRF) vulnerability in Aterm WG2600HP firmware Ver1.0.2 and earlier, and Aterm WG2600HP2 firmware Ver1.0.2 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.