Wednesday, April 17, 2013

Boston Malware Alert


In an unbelievable turn of events and another example of just how far some cyber criminals will go to inflict misery on our computers it has been discovered that cybercriminals have exploited interest in the breaking news story of the explosions at the Boston Marathon by spreading malware.
 
Messages spammed out by attackers claim to contain a link to video footage of Monday's terrorist activity in Boston, with subject lines such as "2 Explosions at Boston Marathon".
 
 
 
Other subject lines used in the campaign include:
 
  • Aftermath to explosion at Boston Marathon
  • Boston Explosion Caught on Video
  • Video of Explosion at the Boston Marathon 2013


  • If you make the mistake of clicking on the link, however, you are taken to a website which - while showing you genuine YouTube videos of the horrific incident - attempts to infect your computer with a Windows Trojan horse that Sophos products detect as Troj/Tepfer-Q.
    If installed, the malware makes changes to the Registry and installs the following files, allowing hackers to gain remote access to infected computers:
     
    <System>\drivers\npf.sys
    <System>\Packet.dll
    <System>\wpcap.dll
     
    The file NPF.sys is registered as a new service named "NPF", with a display name of "WinPcap Packet Driver (NPF)".
    Clearly, there are no depths to which cybercriminals are not prepared to stoop in their hunt for victims.
     
    The sick truth is that malware authors and malicious hackers lose no sleep about exploiting the deaths of innocent people in their attempt to infect computers for the purposes of stealing money, resources and identities.
     
    Remember to be on your guard against such tactics. Maybe it's time to get your news from legitimate news websites rather than an unsolicited email which arrives in your inbox?
     
    If you would like to watch videos from the Boston tragedy you should go to a respected news source directly such as ABC, NBC, CBS, FOX or CNN. Do not click on unsolicted links in your email.
     

    No comments:

    Post a Comment