Just as your average Joe starts to 'get' the importance of online security, and that means using anti-virus software, so the bad guys start exploiting this new found understanding by flooding the Internet with fake AV products.
Security researchers at SophosLabs have today identified a major new fake anti-virus software campaign which is threatening to flood the Internet with malicious security products.
The widespread spam campaign is designed purely with one goal: to get the unwary recipient to open HTML files attached to the messages which then redirect web browsers to hacked sites that come complete with a malicious iFrame to launch the fake anti-virus attack. Of course, fake anti-virus is nothing new but the scale of this latest attack is causing concern.
These attacks take the usual form of pop-ups warning that your computer is infected and offering to remove the threats for a software registration fee. "A scam like this can be extremely successful at passing revenue directly and quickly into the hands of hackers - so we all have to be on our guard," said Graham Cluley, senior technology consultant at Sophos. "The attacks are designed to trick people into paying to remove threats from their computer that never really existed in the first place. Once a user's computer is infected with fake anti-virus, the software will continue to bombard the user with bogus warning messages to encourage them to pay for threats to be removed or install more malicious code onto their PC. If computer users are concerned about the security of their machine, they should go directly to a legitimate IT security site, rather than put their trust in a criminal hacking gang."
So far the emails that SophosLabs have intercepted include subject matters as diverse as credit card charges to holiday photography services. Sophos has seen emails promising parking permits, suggesting an appointment is being confirmed, insisting various e-billing is ready, confirming orders for various items. All of which are designed to prey on the curiosity of the recipient, often making them think there is something they might have to pay for if they do not respond or offering a peek at photos which purport to belong to someone else, for example. The end result can often be the successful leading of an innocent into downloading dangerous software onto their computers and handing over their credit card details.
Sophos has put together a video providing further information on fake anti-virus software:
[youtube]2DzBdhqB73I[/youtube]
