Bogus Malware Warning From Big Name Sites Still Catching Thousands.

I will put up another post on this, since people are still being caught.  Apparently the perps changed tactics and are using banner ads other than dating ads (in fact the first one I saw after the last time I posted on this was from an ad that wasn't about dating.

If I understand the UK Register report "Thousands snared by malware warning from big-name websites " malware is being piggybacked on banner ads at certain popular sites.  The ads do not throw out the malware every time the ad is shown.  That help it get by the sensors of the legitimate site it is shown at.

Excerpt:

The scam is the latest to piggyback on banner ads that are fed to high-traffic destinations. Malicious code hardwired into the ads prompts a pop-up that warns of a bogus security threat on the visitor's machine. It offers to fix the problem in exchange for a fee and for credit card information. The ad then attempts to install a back door on the victim's machine.

"These are pretty well-respected, high-traffic websites," said Don Jackson, a researcher with security provider SecureWorks. "The point is to compromise [the user's machine] and basically have it on demand."

Jackson estimates the rogue ads have appeared on anywhere from "several hundred to 1,000" sites, which tend to be related to television and entertainment. Based on unique signatures of the javascript used in the attack, which researchers have seen passing over the net, he estimates thousands of people have fallen for the ruse.

Jackson has managed to shut down at least two servers serving the bad ads, but warns at least two more are still operational. He declined to identify the servers or the websites by name.

Those behind the scam make some money from the sale of the bogus software, but the real profit comes from selling the victim's credit card information and access to the infected computer.

Makes you feel like you want to puke, doesn't it?  You can read the rest at the Register.  No registration or subscription is required. 

Wait. I'll excerpt the names of the software the malicious ads ask you to buy:

When a person views a page that contains a malicious ad, a threat warning will appear if the victim clicks anywhere on the page or take most other actions. The bogus anti-spyware programs bear names including Spy-shredder, AntiVirGear, and MalwareAlarm.

I got caught once by a similar seeming ad I don't remember the name). Closing the ad only brought up more for a few minutes before I finally got them all closed at once and the popping up ended.  

tags: malware  banner ads  

links: digg this    del.icio.us    technorati    reddit