Hackers quickly move to exploit Bhutto assassination

Security analystys find sites with bogus codecs, drive-by installations

Within hours of the assassination of former Pakistani Prime Minister Benazir Bhutto, malware makers exploited the breaking news to dupe users into downloading attack code, security researchers said Friday.

Searches for news about Bhutto's killing and the ensuing chaos in Pakistan listed sites pimping a bogus video coder/decoder (codec), said analysts at McAfee, Symantec and WebSense.

For instance, WebSense found such a site simply by using "benazir" to search on Google. Meanwhile, McAfee quickly located 10 sites hosted on Blogger.com, Google's blog service, that were spreading the fake codec.

The sites use the well-worn tactic of promising a video -- in this case one of Bhutto's assassination -- but telling Windows users that they need to install a new high-definition video codec, the program that decodes the digital data stream, to view the clip. Naturally, the so-called codec is no such thing, but is instead rigged code that downloads a variant of the Zlob Trojan horse, a back door that can infect the compromised PC with a wide range of other malware.

"Even death isn't sacred to some," said Symantec researcher Vikram Thakur in a post to the company's security response blog.

Other hackers are relying on the news of Bhutto's assassination to draw users to sites that forgo the codec angle and instead conduct drive-by attacks, said Rahul Mohandas, a security analyst at McAfee's Avert Labs unit. "There are a plethora of sites which attempt drive-by installations when unsuspecting users visit search-engine results for 'Benazir Bhutto,'" said Mohandas in a post to the Avert Labs blog this morning. "Many of these compromised pages have malicious scripts, which point to the 3322 domain. These pages contain obfuscated variants of the MS06-014 exploit, which is perhaps one of the most popular of all the exploits we see on a daily basis."

MS06-014, issued in April 2006, patched a critical vulnerability in an ActiveX control that is part of Microsoft Data Access Components (MDAC), which are packaged with Windows XP and Server 2003.

Shilling bogus codecs is a popular pastime of attackers. The technique has been used to plant malware on PCs from singer Alicia Keys' MySpace page, for example, and was the vector used by hackers who went after Macs last month.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Show Comments



Victorinox Werks Professional Executive 17 Laptop Case

Learn more >



Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?