Computer Security Articles

Today there are many social networks on the internet and everyday new ones are being introduced with new and better features. They have unique and useful features, which makes it easy for users to remain updated with friends. They also offer apps for different smartphones providing even easier access to friends and other useful information. But at the same time these contacts and important details are also at risk with compromised security features.

Google Vs Facebook

Google and Facebook are two popular corporations offering online social networks and other useful applications. Over the past few years Facebook has gain significant recognition and has received large amount of users from around the world. These users share their private information on the web. There are security features that restrict strangers from accessing personal information but exposing personal data online is still a risk.

On the other hand Google is a popular search engine, which is now stepping in the world of social networks and has started offering new products such as +1, Hangouts and more.

But if you compare these two popular corporations a widely asked question is about their safety. Personal information can be fatal if it gets in wrong hands. Users can restrict others from viewing information by changing their privacy setting. For instance Facebook offer users to set “friends only” and “friends of friends” setting to files, which users can select according to their requirements.

Facebook users can also make groups and set privacy settings to it, and add friends and family to these groups. For instance if someone want to allow a group of people to view “photo album”, then it is good to create a group and allow only this group to view photos or albums.

Google+ Project

Google Corporation launched a project named Google+, which comprises of different smaller projects such as Google Circle. It is a social network and offers same security features of Facebook as “circle”. Google+ project comprises of number of projects such as Hangouts, +1, Circles, Sparks and more. All these applications are interconnected with each other all over the web such as with Google search engines, social networks, likes and video chat. With such a large online project users are more exposed to risk of information getting into wrong hands.

To coup with security risks Google launched different panels to advice users about secured content sharing such as Google Family Safety Center, which allow parents to have control on their children activities. Parents can also contact Google advice board and find the help they want. It is also important to remain cautious from malicious invitations and software downloads. For instance Google Hangout requires installing Adobe Air on the system. It is important to download such applications from authentic or official websites.

Facebook Risks

Facebook is a great way to connect with friends and family, but at the same time there are also band guys getting social on Facebook. An IT security firm reports that users are being spammed or sent malicious codes. Facebook offer good security features to restrict strangers from accessing personal information but unethical activities are still on the rise.

Facebook scammers know that in order to keep users falling for their scams, they have to use a variety of approaches.

For example, there was a time where rogue applications were the scammers’ preferred method of making sure that the scheme is propagated through the social network. Before that, they were more partial to trying to make the users copy/paste scripts into their address bars in order to achieve the same result.

As users become accustomed to ignoring one particular approach – and Facebook is becoming more adept at spotting and blocking the rogue apps – the copy/paste script one makes a comeback.

The most popular lure used by these scammers is the undying “See who viewed your profile” offer. The landing page could be a Facebook one or one hosted on another domain, and it asks the user to copy some Javascript into the browser address bar and press ?Enter?.

And just in case the user does not understand the instructions, the scammers have attached a video of the whole process. Once the directions are executed, the user is (predictably) asked to fill out a survey in order to finally get the results. In the meantime, the Java script works its magic.

“Depending on the configurations of the attacker, the script will post a new bait message to the user?s wall, send chat messages to friends, tag you in post messages or images, or even create an event and send an invitation to all your friends,” explains Symantec.

“Of course as always the attack is easy configurable through a toolkit. Since the script runs in the context of Facebook and uses your open session it can do a lot with your profile, it can do nearly everything you could do yourself.”

From likejacking to photo-tagging, Facebook scammers are constantly searching for new ways to get their scam campaigns to spread through the social network. Early this weekend, we observed a new type of scam, this one leveraging Facebook’s new social plugin for websites that allow for comments. This is being exploited by scammers to get their rogue websites visible on users’ news feeds, because for a scammer, the more eyeballs that see these posts the better.

Familiar Justin Bieber scam returns in a new form

There are various flavors of the scam making the rounds. However, the newest one to make the rounds focuses on a familiar Apple product: the iPhone. With rumors circulating about the iPhone 5, loyal Apple followers are drawn to the various news articles that cover these stories.  So, it’s no surprise that scammers have decided to piggyback on this for their latest scam.

iPhone 5 Scam spreading on Facebook

The scam begins with someone in your social network “commenting” on a post like the one above. The report claims to be from Wired News and has one of those headlines that is used to lure a user into clicking on the link.

iPhone 5 – Scam Page

Once a user clicks on the link, they are redirected to a random .info site. There have been over 10 of these in circulation for this particular scam. Before the user can click on anything, they are asked to answer a CAPTCHA-like verification form:

Human Verification overlay for Facebook Comments

This effectively tricks the user into inputing the number 5, which actually results in the user leaving a comment for the .info website through the use of the Facebook social-plugin layer for comments.  This is why users will see that ‘John Doe’ commented on randomsite.info on their Facebook News Feed.

iPhone 5 Scam Page: Download the ‘Exposure’ Video

Unlike most Facebook scams of late, at the end of this rainbow, there is no survey scam. Instead, the users are prompted to download an executable file.

Installer for ‘videogameboxinstaller.exe’

The executable file is videogameboxinstaller.exe and it is dubious in nature, as it downloads other pieces of software. “AnyLike” claims to allow users to “like” any and everything on the web.

AnyLike Browser Application Installation

“PageRage” allows users to add style to their Facebook pages:

PageRage – Be sure to read the terms!

PageRage notes in its terms above that it will display ads to the end user. Sounds like Adware? Four antivirus vendors agree, flagging this as Adware.Yontoo. This also seems to indicate that there is some affiliate program involved.  And sure enough there is:

Details on how to become an affiliate for PageRage

At the heart of all these Facebook scams lies the same principal: a way for the scammers to make money by tricking users. Survey scams have been working quite well, so it makes sense that scammers would begin focusing their efforts with pay-per-install affiliate programs.

There are other Facebook comment scams (dubbed “comment-jacking”) that are making the rounds, including one regarding Free Airline tickets aboard Southwest Airlines.

Southwest Airlines Comment-Jacking Scam

As we have advocated for many other Facebook scams, the key here is to be aware that scammers will do whatever it takes to make a fast buck on the backs of social networking users. That’s why they tend to jump on topics that might appeal to a user (Apple iPhone 5, Free Airline tickets, etc.).

If it looks too good to be true, there’s a very good chance that it is.  Look out for the people who are apart of your personal social network: friends and family members.  Let them know about scams like these, because awareness remains a big piece of the puzzle.

Note: At the time this blog was published, over 100,000 visits have been logged to the various links in circulation:

Over 100,000 Visits to the various scam pages

Scam Signature Message: 2 FREE Southwest Airline Tickets!

Scam Type: Click-Jacking, Bogus Offer

Trending: May 2011

Why it’s a Scam:

Clicking the wall post link takes you to the  following page: 

Clicking the “Comment” click-jacks your account and presents the following bogus offer:

If you read the fine, you must complete a total of 13 Sponsor Offers. Not only is this a ridiculous hoop to jump through, and will cost you a lot of money in the end, but the scammers are acquiring a treasure trove of your personal data. You will be required to provide your name, address, phone numbers and date of birth. This will enable the shady marketers to not only spam your Facebook account, but also harass you via snail mail, phone calls and text messages.   

How to Deal with the Scam:

If you did make the mistake of commenting on the main page, you are now spamming your friends with the scammer’s message. You should clean-up your newsfeed and profile to remove references to the scam. (click the “x” in the top right hand corner of the post).

The level of damage control required will largely depend on how many “special offers” you participated in. If you submitted your name, address, email, etc., then be on the lookout for more bogus offers arriving in your email and regular mail. Also be on alert for identity theft attempts.

Scam Signature Message: Father walks in on his Daughter… EMBARRASIN!

Scam Type: Survey Scam, Click-Jacking

Trending: May 2011

Why it’s a Scam:

Clicking the wall post link takes you to the  following page: 

On this screen you really don’t have to click the right answer – any input will do. Clicking submit click-jacks your account and loads the following survey scam:

Here we see the end game of a typical Facebook Survey Scam. Each time someone completes a survey, the scam creator gets a commission. The scam creator will possibly have your personal information to do you harm. (depending on the information you submitted in the survey) If you downloaded any games or other files then your computer could be infecting with a virus, trojan or other malware. Never download files from scams like this!   

How to Deal with the Scam:

If you did make the mistake of clicking “Submit” on the main page, you are now spamming your friends with the scammer’s message. You should clean-up your newsfeed and profile to remove references to the scam. (click the “x” in the top right hand corner of the post).

If you made the mistake of submitting your cell phone number for any of the surveys, then you should contact your carrier immediately to keep any bogus charges from appearing.

If you downloaded files or games while completing the survey scam, then your computer could very well be infected with a virus. Install and or update your anti-virus software and run a complete system scan.

It’s starting to seem like Facebook can’t win against those who wish to use their service to scam, spam and simply cause trouble. Over the last day or so, a new type of attack has been spreading using the phrase “OMG! I Can’t believe JUSTIN Bieber did THIS to a girl”.

It leads to a page asking you to verify a simple math problem to “prevent bots from slowing down the site”. In actuality, it is another clickjack-type scheme in which you are asked to type the answer into a box.

It doesn’t matter what you type, because it’s a social engineering trick. What you are actually typing is a comment that is used to share the link with your friends on Facebook. You can see the tooltip that says “Add a Comment” in the screenshot.

This bypasses Facebook’s recent attempt at detecting likejacking fraud. Links you comment on are not using the same mechanisms that Facebook is monitoring when you click “Like”.

Many moons ago, the first Facebook attacks started with illegitimate applications asking for permission to access your wall and spread their messages by spamming your friends through wall posts. While this worked well, it was a bit easy for Facebook to track down and remove the bogus apps.

Early in 2010 we saw the first attempts at likejacking. This technique involves layering one image over the top of a Like button and tricking the victim into clicking something that appears to play a video or a continue button, when in fact they are clicking the Like button hidden underneath.

More recently we have seen the attackers trying lots of new techniques. In the past few months we have seen them tagging people in photos they are not in to get you to click, inviting people to fake events and even making you an administrator of a Facebook page that isn’t yours.

While protecting yourself may not be as simple as not clicking anything that says “OMG!” that isn’t a bad start. Be skeptical, understand that messages from your friends may not in fact have been sent to you willingly, and if you are really tempted to click, take a short timeout to conduct a Google/Bing search.

As of the time of this writing some of the YouTube videos this scam leads to have been removed by YouTube. However, one video that is still working has over 525,000,000 views since February and thousands of comments in the last 24 hours — in other words, since this Facebook scam has been making the rounds.

To stay up to date on the latest threats, follow us on Facebook. For advice on how to configure your profile to protect your privacy check out our recommendations for Facebook settings.

Scam Signature Message: OMG! I Can’t believe JUSTIN Bieber did THIS to a girl

Scam Type: Survey Scam, Click-Jacking

Trending: April 2011

Why it’s a Scam:

Clicking the wall post link takes you to the  following page: 

On this screen you really don’t have to click the right answer – any input will do. Clicking submit click-jacks your account and loads the following survey scam:

Here we see the end game of a typical Facebook Survey Scam. Each time someone completes a survey, the scam creator gets a commission. The scam creator will possibly have your personal information to do you harm. (depending on the information you submitted in the survey) If you downloaded any games or other files then your computer could be infecting with a virus, trojan or other malware. Never download files from scams like this!   

How to Deal with the Scam:

If you did make the mistake of clicking “Submit” on the main page, you are now spamming your friends with the scammer’s message. You should clean-up your newsfeed and profile to remove references to the scam. (click the “x” in the top right hand corner of the post).

If you made the mistake of submitting your cell phone number for any of the surveys, then you should contact your carrier immediately to keep any bogus charges from appearing.

If you downloaded files or games while completing the survey scam, then your computer could very well be infected with a virus. Install and or update your anti-virus software and run a complete system scan.

If you or your Facebook friends are falling for tricks like this, it’s time to get yourself informed of the latest threats. Be sure to join the Facecrooks page on Facebook to be kept informed of the latest security issues.

Malware distribution via email is far from dead.  While we had a distinctly quiet period from October 2010 to March 2011, our stats show the bot herders are gearing up again with the proportion of spam with malware attachments rising, although still not as high as the peaks we saw mid last year when the Bredolab and Cutwail botnets were in full swing.

Malicious spam on the increase again

After the bot herders took a brief Easter break, they are back to sending new waves of malicious spam. The first spam campaign was sent by the Cutwail botnet earlier this week. The email claims to be an invoice from Bobijou Inc. – an online jewellery brand. There is a chance that people might fall into this trap especially as it claims money on your credit card was involved. But take a closer look at the subject line: Successfull Order 3677718, that wrong spelling should easily alert you that this email is a scam.

Cutwail Spam Campaign

Another malicious spam campaign originating from the Donbot botnet that came in later this week. It uses a common, uncreative theme with subject line like, “my hot pic : )“, “my naked pic is attached“, etc.  The Donbot botnet’s spam output is on the rise and this is the first time we have seen it spreading malicious attachments.

Dontbot Spam Campaign

Both spam campaigns contain a zipped attachment which, once extracted, contains an executable file that downloads – surprise, surprise – Fake Antivirus:

In addition, this week we have been seeing more of the Asprox botnet’s “Spam from your Facebook account” campaign, that preys on peoples fears about the security of their Facebook accounts. This campaign first came out last year, illustrating that the bot herders behind Asprox often cycle their spam campaigns between UPS, DHL, FEDEX and iTunes Gift Certificate among others.

Recent Facebook spam campaign sent by Asprox

The attachment is a Trojan that aims to seed the Aprox bot executable in the infected host, which is then used for spamming purposes.

SMTP transaction of an Asprox’s process ASPIMGR.EXE

We have blogged about these types of threats many times before.  In a sense, it’s the same old stuff with slightly different social engineering. Be wary.

In the absence of a genuine ticket to the real event, Facebook users are encouraging each other to reveal their Royal Wedding Guest name.

Here’s a typical message that is currently being spread by well-meaning users across the social network:

In honor of the big wedding on Friday, use your royal wedding guest name. Start with either Lord or Lady. Your first name is one of your grandparents’ names. Your surname is the name of your first pet, double-barreled with the name of the street you grew up on. Let’s do this! Post yours here. Then cut and paste it into your status.

Regally yours,
Lady Edith Spanky-Rushmoor

Do you see the problem?

By playing the game, you might be unwittingly making life easier for identity thieves and hackers.

Look at it this way. Think of all the websites which ask you to give it a “secret question” which can confirm your identity in the event of you forgetting your password.

If you tell everyone your Royal Wedding Guest name then you are giving away information which might help someone break into, say, your email account.

So, here’s my advice.

Firstly, don’t post this kind of personal information onto the internet – the few seconds worth of amusement you may get by telling people your Royal Wedding Guest name are not worth the potential pain of having your identity stolen.

Secondly, when websites ask you for a “secret answer” to reset your password… lie. You don’t need to tell the truth when you’re asked by a website what your mother’s maiden name was, or the name of your favourite TV show. So, say something random but memorable that no-one is likely to guess like “Xena Warrior Princess” or “Artichoke Sandwich”.

If you use Facebook and want to learn more about threats, you should join the Sophos Facebook page where we have a thriving community of over 70,000 people.

Of course, if you do happen to be one particular couple getting married tomorrow, you’re not going to have any chance keeping your grandparents’ names secret..

Hat-tip: Thanks to Naked Security reader Paul who brought this particular issue to our attention.

Scam Signature Message: 

The Ultimate Profile Viewer is now being released! Shocking for real! See who visits your profile real time! See who invisible you on their friend list chat! Check it now and you will be shocked who viewed your profile now ! See your results here ->

Scam Type: Survey Scam - Profile Peeker – Rogue Application

Trending: April 2011

Why it’s a Scam:

Clicking the wall post link takes you to the  following page: 

Clicking “Continue” will take you to the following Facebook application installation screen:

Proceeding with installation is not a good idea. You will be giving a rogue application developer access to all of your Facebook profile information, and they will use your account to spam your friends.

If you do “Allow” the application to install, the following survey scam will be presented:

Keep in mind that profile spy and stalker apps are all bogus and violate Facebook’s TOS, and developers do not have access to the information required to complete such applications. For more information about them check out our in dept article:

Facebook Profile Spy, Stalker & Creeper Apps – Everything you need to know

How to Deal with the Scam:

If you did make the mistake of pasting the code into your browser, you are now spamming your friends with the scammersmessage. You should clean-up your newsfeed and profile to remove references to the scam. (click the “x” in the top right hand corner of the post). If your installed anti-virus program caught the malware attempt, then your system should not be affected. If you don’t have anti-virus software installed, then you need to that immediately and run a full system scan.

If you or your Facebook friends are falling for tricks like this, it’s time to get yourself informed of the latest threats. Be sure to join the Facecrooks page on Facebook to be kept informed of the latest security issues.

Scam Signature Message: The BLOODIEST Fight EVER – BANNED FROM TV!

Scam Type: Survey Scam 

Trending: April 2011

Why it’s a Scam:

Clicking the wall post link takes you to the  following page: 

If you do follow their directions and click to “Watch the Video” you are taken to the follow page:

Here we see the end game of a typical Facebook Survey Scam. Each time someone completes a survey, the scam creator gets a commission. The scam creator will possibly have your personal information to do you harm. (depending on the information you submitted in the survey) If you downloaded any games or other files then your computer could be infecting with a virus, trojan or other malware. Never download files from scams like this!   

How to Deal with the Scam:

If you did make the mistake of pasting the code into your browser, you are now spamming your friends with the scammers message. You should clean-up your newsfeed and profile to remove references to the scam. (click the “x” in the top right hand corner of the post). It also appears that this scam creates a fake event on your wall. You need to delete this event as well.

If you made the mistake of submitting your cell phone number for any of the surveys, then you should contact your carrier immediately to keep any bogus charges from appearing.

If you or your Facebook friends are falling for tricks like this, it’s time to get yourself informed of the latest threats. Be sure to join the Facecrooks page on Facebook to be kept informed of the latest security issues.  Also check out:

Your Ultimate Guide to Facebook Scams and How to Deal with Them

How to spot a Facebook Survey Scam

Another Facebook spam mail pretending that your password is not safe, currently circulating on Internet.
The subject is: FaceFacebook Support. Personal data has been changed!ID55733.
The email comes with an attachment called New_Password_IN33494.zip.



The zip file (New_Password_IN33494.zip) contain New_Password.exe file, Quick Heal detects this file as a “Trojan.Menti.gen”.
New_Password.exe tries to fool the victim as it seems a Microsoft Word Document. You should never trust a file by its icon, always pay attention to the file extension. Also make sure that Windows Explorer is set to show file extensions option.



On execution New_Password.exe writes into the memory space of svchost.exe, deletes itself and downloads a file called document.doc from the domain profmiale. ru which is then saved to the desktop.This file conatins a username and password.



While the victim is looking at these new login credentials, another binary is get downloaded from profmiale. ru and saved to the %temp% folder as 1.tmp. Once 1.tmp is executed, the computer immediately reboots.

Files:
%userprofile%\Desktop\document.doc
%userprofile%\Local Settings\Temp\1.tmp


Thanks Mahesh Mane for the detail Analysis.