Malware on The Tube New Trojans Ride Web Video Wave Susan Kuchinskas
A good phisherman goes where the phish are — and that's massively popular Web sites such as YouTube. And that's exactly where two new phishing schemes have been found.
Two security companies have sighted malicious files masquerading as videos on Google's video-sharing site. Secure Computing Corp. this week reported a new "zlob" disguised as a video file on YouTube. A zlob is a Trojan that opens a back door into users' computers.
When users clicked on this particular zlob, it bombarded them with ads. Secure Computing, which markets security software for enterprises and small businesses, said it's likely that the ads would give way to malware.
The bogus video was titled "YouTube - Afterworld Episode 6 - Hibakusha." The snippet of description sounds compelling: "99% of the population is missing. Technology is dead … "
Afterworld is a made-for-the-Web animated science fiction series that takes place after a mysterious event wipes out modern civilization.
Afterworld has huge potential. Electric Farm Entertainment created the 16 webisodes, which are hosted on YouTube and the Afterworld site. In February, Sony Pictures Television International acquired all
international rights to the series for platforms including television, gaming, and mobile.
The multimedia site will be fleshed out with archived back episodes, daily journal entries, community blogs, interactive content applications, and online games, Sony said.
Secure Computing's warning said that the file did not require users to download an .EXE file in order to run, making it doubly dangerous.
A YouTube spokeswoman, noting that she experienced nothing untoward by clicking the link forwarded by Secure Computing, said security is a top concern at YouTube.
"If we find a party is using our brand or site to encourage the download of a virus from another location, we will take action to investigate and prevent this."
These malicious files may stay up for only a short time, according to Paul Henry of Secure Computing. He said the bad guys go after sites like YouTube because of their high visitor counts.
"If they hit YouTube, maybe it will only be up for a few hours, but in that few hours they'll get enough hits to make it worth their while."
Even with unasked-for pop-ups, he explained, a small percentage of people do click through to porn sites and open accounts. And, in the case of key-loggers, the bank account information and passwords obtained are extremely valuable.
Secure Computing warned that most firewalls aren't capable of blocking code returned from external Web servers, which is the trend for exploits.
David Perry, global director of education at Trend Micro, said Web sites are now the preferred method of launching exploits.
"We've stopped trusting e-mail. You don't open that e-mail that comes from a bank; you're not falling for it any more.
But there's the Web, so what they are doing is they are finding places where they can put up something that looks like a popular Web item but has a backdoor, Trojan, rootkit or one of the various beasties we track."
Last week, Trend Micro, a competitor to Secure Computing, reported on another Trojan masquerading as an Afterworld video. According to the company, TROJ_BANLOAD.CZE downloads a variant that's known for stealing online banking information.
Perry said yesterday's exploit, in which more than 10,000 compromised computers redirected visitors to sites hosting malicious
software payloads, is the shape of things to come.
The Afterworld exploits shouldn't harm the brands of Afterworld or Sony, both agreed, just as banks aren't blamed for the constant phishing e-mails in their names. But Web publishers must be diligent in keeping their sites clean, Perry said.
"We're in the dawn of this era, with people still waking up to the fact that it's going to take more policing of their Web sites."
Secure Computing identifies an average of 45 Web sites per day that are using JavaScript to install malware on PCs in what's termed "drive-by hacking," where simply visiting a site activates the bad stuff.
The security experts find an additional 18,000 sites per day where users must click a link to get slammed.
While many tools are available to combat the exploits, and many more are in development, Perry said, security companies must evolve tools more rapidly than the exploits evolve.
