David Marcus
Director, Security Research
Dave Marcus currently serves as Director of Security Research for McAfee® Labs, focusing on bringing McAfee’s ...
|
|
We have discussed previously that malware writers and cybercriminals read the same news that the rest of us do. They use the same tools as we do and go to the same sites we go to as well. Over the last several years we have seen cybercriminals and malware writers consistently use high-impact news events as the social lure in spams, scams, and malicious websites. Recently they have begun to set their sites on the popular social networking service Twitter; this should come as no surprise because more than 75 million people globally use the service.
The recent happenings in the Middle East simply presented cybercriminals with too good of a lure to pass by: the Gaza Flotilla. It is all over the news as a quick Google Search shows.
So we did a little quick searching to see what we could find–starting with a great tool called BackTweets:

BackTweets is great; it lets you search Twitter for keywords and links. These very simple and quick searches gave some interesting results. Using just the words Arabs, Israel, and exe (so we could easily connect the main words to an executable program in a tweet), we got the following results, in no particular order:

As well as:

You might notice in the second search that there was also a bit of celebrity abuse (a common device) using some of the same tags. Both of the account profiles referenced were seemingly created just to distribute these:

and:

Looks suspicious! Especially when you check the low follower and following counts–and the files themselves linked to malware that at the time of this writing had very little detection:

With the explosion in popularity of social media and networking technologies such as Twitter we can expect to see this type of abuse skyrocket in the coming months. As more and more users take advantage of social networking platforms to get news (or other information), so will the malware writers and cybercriminals.
|
|
Dave, I’ve been looking for this story and your contact info ever since your presentation in Boston on June 16. You mentioned you might be doing a video showing this exploit. Is there one? Your demo was very compelling. I find that people are much more prepared to absorb this stuff from video.
Thanks for documenting this exploit!
wk
Longest virus name ever
Submit your own comments / message for this post