Converting currency on Google can lead to malware attack

Converting currency on Google can lead to malware attack: "

One of the guys at the North American branch of SophosLabs recently stumbled across some Euros following an overseas trip, and wondered how much they were worth in dollars.

So he did what any of us would probably do. He Googled it.

215 euro to usd

Google very cleverly and kindly tells you what it believes the conversion rate to be, but you're also given a number of search results:

It's that final search result which is of interest to us. A quick search finds a number of other webpages which don't just use keywords related to currency conversion, but also other terms - 'dirty sexist jokes', for instance.

What is occurring here is SEO poisoning, where bad guys create poisoned webpages related to certain search terms in the hope that you will come across them and infect your computer.

The good news is that Sophos can offer a layered defence against this attack.

The initial webpage is blocked by Sophos as Mal/SEORed-A. It acts effectively as the doorway to the rest of the attack.

The site delivering the actual malicious payload is also blocked, and Sophos detects the exploit itself as Troj/ExpJS-BP.

Finally, the Java class files pushed by the exploit code are detected as Mal/JavaDldr-B.

Neat!

We see online criminals poisoning search engine results using blackhat SEO techniques a lot.

Fraser and Onur in our labs have written an excellent technical paper (PDF) which discusses the problem, and lifts the lid on how the bad guys are using automated kits to do their dirty work for them.

• Download the 'Poisoned search results: How hackers have automated search engine poisoning attacks to distribute malware' technical paper

It's a great read. Check it out now.

"

" The Roving Giraffe News Report " provided by Ace News

Profile Stalkers on Facebook? Check out the viral scam that's spreading

Profile Stalkers on Facebook? Check out the viral scam that's spreading: "

Another scam is being spammed out across Facebook, tricking users into helping its spread by fooling them into believing they will discover who is secretly viewing their profile.

Using a cartoon image of what appears to be a chimpanzee looking through binoculars,

the messages are being sent from other Facebook users who have already fallen into the trap of clicking on the link and following the scammers' instructions.

Clicking on the link contained inside the message (which I have obscured in the screen grab below) is a big mistake, as it takes you one step further into the criminals' trap.

WICKED! Now you can see who views your facebook profile.. i saw my top profile stalkers and my EX is still creeping my profile every day

Checkout your PROFILE stalkers

[LINK]

Now you can see who stalks your profile daily

If you do click on the link you are taken to a third-party webpage which urges you to cut-and-paste some JavaScript code into your web browser's address bar. The page claims that it is your unique code to view your Top 10 Profile Spys - but it's not true at all.

This is a trick being commonly used by scammers at the moment. If you paste their code into your address bar, it will typically pass the message onto other Facebook users - including your online friends. We recently saw it deployed in a Facebook scam offering a 'Dislike' button for instance.

Ultimately scams this typically end up with you being taken to a webpage which asks you to complete a survey - and the scammers earn commission for each survey completed.

Don't let the scammers make a monkey of you, and don't risk spreading a scam like this to your online friends.

If you use Facebook and want to learn more about spam, malware, scams and other threats, you should join the Sophos Facebook page where we have a thriving community of over 80,000 people.

Update: I'm reliably informed that the cartoon chimp is Curious George.

"

" The Roving Giraffe News Report " provided by Ace News

What is Zeus? Notorious malware under the microscope

What is Zeus? Notorious malware under the microscope: "

Zeus, also known as ZBot, has grown into one of the most popular (or should that be unpopular?) and widespread crimeware kits on the internet.

Its ease of use and effectiveness make it an attractive choice for today's cybercriminals.

And an infection by Zeus can be extremely costly. Whether you're an individual or an organisation, the impact of losing passwords and online banking details can be disastrous.

Clearly there's a significant demand for easy-to-use, information-stealing Trojans amongst the internet underground, and we can expect to see more from Zeus itself and its competitors.

Today SophosLabs expert James Wyke has published a technical paper, taking an indepth look at Zeus's functionality and behaviour of the Zbot binary, in an examination which gives some feeling for the malware's sophistication.

Download the free 'What is Zeus' technical paper now.

[no registration required]

" Everyone interested in security should download and share this information it is very revealing then upgrade your security to take care of any problems. One of the best is Advanced System Care 4 with Malware Fighter 3.0 to back up can be downloaded either FREE or with added facilities as Pro-Version,s at http://

" The Roving Giraffe News Report " provided by Ace News

Five Best Services for Quick Image Sharing [Hive Five]

Five Best Services for Quick Image Sharing [Hive Five]: "

When you want to share an image on Twitter, over IM, or in the comments of your favorite blog, full-fledged gallery webapps like Flickr or Picasa are overkill. That's where these quick sharing services come in, filling your need for quick, almost disposable image sharing. Here's a look at five of the most popular services for quickly and easily sharing images on the web. More »

"

" The Roving Giraffe News Report " provided by Ace News