Washington Post
Security experts are warning users of Facebook, MySpace and other social networking communities to be on guard against a new strain of the "Koobface" worm, which spreads by tricking users into responding to a message apparently sent from one of their friends.
The latest version of Koobface arrives as an invitation from a user's friend or contact, inviting the recipient to click on a link and view a video at a counterfeit YouTube site. Visitors are told they need need to install an Adobe Flash plug-in to view the video.
The bogus plug-in instead installs a Trojan horse program that gives Koobface author(s) control over the infected user's computer, according to security firm Trend Micro, which documented the new strain on its blog.
In addition, the worm also hijacks the victim's social networking account, by sending out additional invites in order to spread the worm to the victim's friends and contacts. The worm currently is spreading across multiple networks, including hi5.com, friendster.com, myyearbook.com, bebo.com and livejournal.com.
Trend also reports at least two different bogus Facebook apps being used to harvest users' personal data. Last week, a rogue Facebook app called "The Error Check System" quickly spread among Facebook users, arriving in a notification that told users that one of their friends "has faced some errors when checking your profile." Hours later, Trend spotted another rogue Facebook app, which urged recipients to click a link to find out why they had supposedly been reported to Facebook for violating the site's terms of service.
It's important to note that practicing basic online street smarts can save you from falling for these types of attacks, regardless of the medium. As always, be extremely cautious about clicking on links in unsolicited messages, even if they appear to have been sent by a friend or acquaintance. Also, don't install applications or programs if you didn't go looking for them. Before you install anything, take a few minutes to research the program and its vendor first. If you decide to install the application, make sure to download it directly from the vendor's Web site, if possible.
No comments:
Post a Comment