News
Personal Computing
Malware gang exploits Middle East tension Malware gang exploits Middle East tension |
|
|
| Written by Matt Chapman | |
| Wednesday, 09 July 2008 | |
Hackers are trying to infect computers using the camouflage of a news report claiming that the USA has invaded Iran. According to IT security and control firm Sophos, the widely spammed out emails use subject lines such as "Third World War has begun", "20000 US Soldiers in Iran", and "US Army crossed Iran's borders".
However, the emails contain links to a malicious webpage that displays what appears to be a video player showing the mushroom cloud of a nuclear explosion with the following text beneath: "Just now US Army's Delta Force and US Air Force have invaded Iran. Approximately 20000 soldiers crossed the border into Iran and broke down the Iran's Army resistance. The video made by US soldier was made today morning. Click on the video to see the first minutes of the beginning of World War III. God save us". However, Sophos warns that users visiting the webpage and clicking on the 'video player' run the risk of being infected by a Trojan horse, designed to compromise their computer. Sophos detects the malware hiding behind the fake video as Troj/Tibs-UO and a malicious JavaScript hidden on the website as Mal/ObfJS-AY. "Receiving or reading the emails themselves does not mean you are infected - but visiting the link contained in them, or trying to watch the video, is definitely a bad idea,” said Graham Cluley, senior technology consultant at Sophos. "Hackers are taking advantage of the fact that many people today get their fix for breaking news via the internet.” Cluley warned everyone to keep their anti-virus protection up-to-date and never follow links in unsolicited email messages. This is not the first time news about rising tensions between Iran and the West has been exploited by hackers. In 2005, a widespread spam campaign pretended to be a link to news about the controversial decision by Iran to continue work at a nuclear plant, but was really an attempt to infect users with a Trojan horse. The year before, the Cycle worm dropped a message complaining that European governments were supporting the regime in Tehran, because of the war in neighbouring Iraq.
|