Massive faux-CNN spam blitz uses legit sites to deliver fake Flash
August 6, 2008 – 1:02 PMMore than a thousand hacked Web sites are serving up fake Flash Player software to users duped into clicking on links in mail that’s part of a massive spam attack masquerading as CNN.com news notifications, security researchers said today.
The bogus messages, which claim to be from the CNN.com news Web site, include links to what are supposedly the day’s Top 10 news stories and Top 10 news video clips from the cable network. Clicking on any of those links, however, brings up a dialog that says an incorrect version of Flash Player has been detected, and tells users they needed to update to a newer edition, said Sam Masiello, vice president of information security at Colorado-based security company MX Logic Inc.
One distinguishing feature of the attack, Masiello added, is the endless loop it uses to frustrate victims. If user clicks “Cancel” in the dialog that prompts for an update, another pop-up appears, said Masiello, that tells the victim that they have to download it to view the video. Clicking “Cancel” there returns the user to the first dialog.
“It puts you in this perpetual loop, so your only options are to kill your browser [session] or be brow-beaten into installing it,” said Masiello.
You must be logged in to post a comment.