Bank Trojan botnet targets Facebook users
On the heels of one fake Facebook e-mail scam, a researcher warned on Wednesday of another such campaign in which users of the popular social network are being tricked into revealing their passwords and downloading a Trojan that steals financial data.
In the latest scam being blasted to e-mail in-boxes, a legitimate-looking Facebook notice asks people to provide information to help the social network update its log-in system, said Fred Touchette, a senior security analyst at AppRiver. When the user clicks the "update" button in the e-mail, they are directed to a fake Facebook log-in screen where their user name is filled in and they are prompted to provide their password.
This is a screen shot of the message in the body of the fake Facebook e-mail.
(Credit: AppRiver)When they provider that information, victims are taken to a page that offers an "Update Tool," but that is actually the Zeus bank Trojan that is designed to steal financial and personal data, Touchette said.
Users of smart phones that have the Facebook app installed can also easily be duped because the phishing e-mail appears as an actual Facebook notification complete with Facebook icon, he said. The message is received in the e-mail in-box on the phone as well as under the Facebook notification section in the app itself, he added.
There are likely to be a lot of victims given how many e-mails the scammers are sending. AppRiver has captured about 6 million e-mails in its filters and noticed that the messages were coming in at a rate of 30,000 a minute at one point, according to Touchette. That's about 10 times the usual botnet e-mail message rate, he said.
More details are on the AppRiver blog.
On Tuesday, researchers reported that a different botnet, Bredolab, was distributing fake "Facebook Password Reset Confirmation" e-mails that included a Trojan. As of late Wednesday night, security provider Cloudmark said it had seen more than 730,000 of the Bredolab-related e-mails.
To protect against such phishing attacks, people should be extremely cautious about clicking on links in e-mails and they can mouse over the link to see if the domain is a legitimate domain, Touchette said.
Meanwhile, Facebook users should easily be tipped off that the latest scam is just that, a scam, he said. "Facebook doesn't need all of its users to update their accounts in order for them to make changes to their site," he added.
If there is any question about the legitimacy of the e-mail or the link, users should close the e-mail and go directly to the site to check for important notices to customers, he said.
This is the prompt Facebook users get as part of the latest phishing scam. Downloading the "update tool" installs a Trojan.
(Credit: AppRiver)
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
Somehow I don't think anyone misses you though.
Never install programs sent unsolicited by email.
;-)
I'll go with the second option.
Dumb and dumber.
Note that I don't disagree with the idea that the only remotely secure winblows box is the one that is disconnected from any and all networks.
Okay, I know the admin password, but I never grant it from my user account.
tinyurl[dot]com/Cloudmark
Proven.
But they have a different approach regarding user setup.
XP comes with standard adminaccount enabled where Unix clones force you to create a useraccount and assign rights. Windows gave the users to much freedom and that created the problem.
Next Windows is so far more widespread that attacks have more profit to focus on Windows then on other systems.
The user is the dangerzone, not the OS.
- by MiamiWebDesigner November 7, 2009 4:15 AM PST
- Big Brother Has a Name, and that Name is CLOUDMARK: This 1984-ish content-based "spam signature" filter gives Network Solutions and other web hosts and ISPs complete control over what emails YOU are allowed to send or receive. They can define whatever they choose to be a "spam signature", including the name of a cause they don't support, or the business telephone numbers of people who do. Here is how I know: tinyurl[dot]com/Cloudmark
- Like this Reply to this comment
-
(21 Comments)