Zero Day

Facebook worm finds a friend in Google Reader

Posted in:

Anti Virus
Arbitrary Code Execution
Botnets
Browsers
Exploit code
Facebook
Google
Malware
Social Networking Applications
Spam and Phishing
Spyware and Adware
Viruses and Worms
Web 2.0
Web Applications

The Facebook worm that has been squirming its way through the popular social network now has a new friend -- Google Reader. According to researchers at Fortinet, the worm's creators are wrapping Google's RSS reader around fake video downloads as part of a strategy to strengthen the social engineering component of the attack. From Fortinet's advisory:

This "hop" via a Google Reader share serves an essential purpose: it gives the targeted user the feeling that the video is hosted on Google. Thus it must be safe. Combo that with the "it's a message from a friend" factor, which naturally lowers down users' wariness shields, and you get quite a good chance of seeing your victim perform the dreaded click.

[ SEE: Web worms squirm through Facebook, MySpace ] Fortinet researcher Guillaume Lovet believes the cyber-criminals behind the Facebook worms registered Google Reader accounts (either manually, or automatically via phishing operations or automated CAPTCHA solvers) for the sole purpose of loading them with links to malicious sites. Fake video lures are used to infect Windows machines with rogue security software. Image source: Jacob Botter's Flickr photostream (Creative Commons 2.0)

posted by Ryan Naraine
October 28, 2008 @ 1:09 pm

Previous Post: HotJobs site flaw leads to Yahoo account theft
Next Post: Exploit published for Windows worm hole

Last 10 posts:

Opera patches 'extremely severe' security hole (11-23)
Exploit published for critical IE 7 zero-day flaw (11-23)
Inside the Google Chrome OS security model (11-19)
Microsoft finds security hole in Google Chrome Frame (11-19)
Mozilla locks out rogue Firefox add-ons (11-18)
Thousands of web sites compromised, redirect to scareware (11-17)
Microsoft confirms 'detailed' Windows 7 exploit (11-16)
Man-in-the-middle attacks demoed on 4 smartphones (11-13)
Microsoft bracing for malware attacks from embedded fonts (11-12)
Apple Safari exposes Windows to drive-by download attacks (11-11)