Hackers quickly move to exploit Bhutto assassination

Security analystys find sites with bogus codecs, drive-by installations

Within hours of the assassination of former Pakistani Prime Minister Benazir Bhutto, malware makers exploited the breaking news to dupe users into downloading attack code, security researchers said Friday.

Searches for news about Bhutto's killing and the ensuing chaos in Pakistan listed sites pimping a bogus video coder/decoder (codec), said analysts at McAfee, Symantec and WebSense.

For instance, WebSense found such a site simply by using "benazir" to search on Google. Meanwhile, McAfee quickly located 10 sites hosted on Blogger.com, Google's blog service, that were spreading the fake codec.

The sites use the well-worn tactic of promising a video -- in this case one of Bhutto's assassination -- but telling Windows users that they need to install a new high-definition video codec, the program that decodes the digital data stream, to view the clip. Naturally, the so-called codec is no such thing, but is instead rigged code that downloads a variant of the Zlob Trojan horse, a back door that can infect the compromised PC with a wide range of other malware.

"Even death isn't sacred to some," said Symantec researcher Vikram Thakur in a post to the company's security response blog.

Other hackers are relying on the news of Bhutto's assassination to draw users to sites that forgo the codec angle and instead conduct drive-by attacks, said Rahul Mohandas, a security analyst at McAfee's Avert Labs unit. "There are a plethora of sites which attempt drive-by installations when unsuspecting users visit search-engine results for 'Benazir Bhutto,'" said Mohandas in a post to the Avert Labs blog this morning. "Many of these compromised pages have malicious scripts, which point to the 3322 domain. These pages contain obfuscated variants of the MS06-014 exploit, which is perhaps one of the most popular of all the exploits we see on a daily basis."

MS06-014, issued in April 2006, patched a critical vulnerability in an ActiveX control that is part of Microsoft Data Access Components (MDAC), which are packaged with Windows XP and Server 2003.

Shilling bogus codecs is a popular pastime of attackers. The technique has been used to plant malware on PCs from singer Alicia Keys' MySpace page, for example, and was the vector used by hackers who went after Macs last month.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?