Slashdot Mirror
Domain: spywareguide.com
Stories and comments across the archive that link to spywareguide.com.
Stories · 12
-
Gamerscore Hacking and Its Underground Economy
An anonymous reader writes "There's a writeup on SpywareGuide that explores the world of Xbox Gamerscore hacking, and how high Gamerscores are proving to be a big target for hackers and phishers. It also talks about how a recent release of a Gamerscore-altering program onto forums for hacking & cheating is proving to be lucrative business for both eBay sellers and those who want to artificially inflate a Gamerscore before selling that account, or trading it for credit card details." -
Scammers Target Neopets Users
An anonymous reader writes "If you have children that play on the popular virtual world game Neopets, you might want to warn them of a social engineering scam gleefully targeting 12-year-old kids. Neopets users looking for rare items are sent private messages from the scammers, who direct them to sites hosting keyloggers & trojans. They then use the infected PC as a means to get to data the parents might have stored there, be it credit card details, Paypal accounts or online banking. Seeing the screenshots of some of these people talking about putting these children into botnets is just unbelievable — if ever you wanted proof that people up to no good online will go to any lengths to get their hands on some money (or even just feel good about outsmarting a 12-year-old), here it is." -
Homer Simpson and the Kimya Botnet
An anonymous reader writes "As all hardcore Simpsons fans know, Chunkylover53@aol.com was revealed to be Homer Simpsons' email address in one particular episode, registered by one of the shows writers, who would reply to fans as Homer himself. After a flood of messages, 'Homer' signed off — seemingly forever. Well in the last few days, security company Facetime Communications reports that anyone who had Homer on their AIM buddy list would have noticed his sudden reappearance. Unfortunately for all, he appears to have been hacked and pushing malware links which deposit those unlucky enough to run the file into a Turkish Botnet. The message claims the file is a 'web exclusive' episode of the TV show — an interesting way of targeting a specific group of fans who would assume Homers return would only coincide with something special like (say) a TV episode just for them. What I want to know is, is Homer smart enough to run an AV scan?" -
Security Researcher Chases Virus Maker Off the Net
An anonymous reader writes "There is a great writeup over on CNET covering the pursuit of a virus writer who created a fake Grand Theft Auto game, crippling PCs by causing them to endlessly reboot. Despite the police apparently not being very interested, a security researcher pursued his man anyway, culminating in a teary eyed 'I'm leaving the internet' post from the virus writer himself. Awesome stuff, and one in the eye for the bad guys (for once)." -
MySpace Phishing Attack Leads Users to Zango Adware
An anonymous reader writes "Security site Spywareguide.com reports that a new worm is doing the rounds on MySpace. Taking advantage of the HREF feature in Quicktime movies, a fake login bar is displayed on infected users profiles via some JavaScript coding. If you login (via one of the many hacked servers hosting the JavaScript and movie file) you'll find you start spamming messages containing a pornographic movie. That movie leads to a site that's pushing Zango Adware left, right and center. Is this more evidence that Zango has yet to clean up their affiliate networks?" -
IE Used To Launch Yahoo IM Clickfraud
An anonymous reader writes, "There's a new Instant Messaging worm in the wild that is taking the idea of Botnet clickfraud up a level. It trades in automated drones (prone to malfunction and detection) for real live people who (of course) have the option of not actually clicking anything, thus theoretically making their clicks harder to identify as 'fraudulent.' This IM attack doesn't even need a victim to physically run anything to become infected — simply visiting a certain site in Internet Explorer will cause the files to download and start sending infection messages. At this point, their homepage is changed to a site using Mesothelioma (a rare form of cancer) to ring up high-paying results on the perpetrators' Google ads. As the researcher who discovered the infection notes, 'It's way, way harder to trace some random boob who has a ton of (partially) unconnected people shunting IM links all over the place. Try staying anonymous as a Botnet owner who just had the entire details of his server splattered across the net by Shadowserver. What will be interesting to see is if some of the smaller Botnet guys ditch their technical woes and jump on the much-easier-to-maintain IM bandwagon to get their clickfraud kicks.'" -
IM Worm Attack Cloaked in Virtual Card Hoax
An anonymous reader writes "There's a new Instant Messaging Worm on the loose that is wrapped up in more than a few interesting twists. The people behind the infection lure users in with a message on a Russian hosted website claiming to have 'a virtual card for you' — a reference to the famous Email hoax listed on Snopes and numerous other web hoax sites. At the point of infection, the worm opens up a picture of a heart (from a site called Quatrocantos.com that tackles web scams on a daily basis) — this picture itself related to a different 'virtual card' hoax from 2002. Bearing in mind the people behind this attack are deliberately serving up an image from a 'good guy' website related to virtual card hoaxes, the question is — are they attempting to create a real life infection out of a web-based piece of lore, making a calculated move to tie this attack into numerous Web hoaxes, possibly to confuse infected users looking for help online or simply having a little fun at the good guy's expense?" -
Pipeline Worm Floods AIM With Botnet Drones
Several reader write about a new AIM threat dubbed the "AIM Pipeline Worm" that uses a sophisticated network of "chained" executables to attack the end user. Security Focus has a brief note. One anonymous reader writes: "Using this method, there is no starting point for the attack — a malicious link via IM can send you to any given file, at which point the path of infection you take depends entirely on the file you start off with. The hackers can then decide which order to install malicious software, depending on their needs at the time. At a bare minimum, you will become a Botnet Zombie — if you're really lucky, you might be Trojaned, have a Rootkit installed on your PC, and be used for spam, file storage, and DOS attacks. Unlike similar attacks that have been attempted in the past, the removal of a file from the chain will not stop the attack — you will simply end up with something else installed instead, in the form of a randomly named executable dumped in your system32 folder. You'll still spam an infection link to all your contacts." -
New IM Worm Installs Own Web Browser
Aquafinality writes "A new IM worm discovered recently takes the novel step of installing its own web browser onto the victims PC. Ironically titled "The Safety Browser", its default settings actually make your PC less secure - switching on pop-ups, changing your home page and hijacking your desktop with a looped music track that plays every time you switch your computer on. It's clear people cannot resist clicking "yes" to anything they're presented with via IM - with this in mind, what on Earth can we do so stop the spread of garbage like the above? To put it another way, will reducing the amount of potential "suckers" out there dissuade the bad guys from coming up with ever-more elaborate ideas such as this latest scam? Or is IM safety a lost cause?" -
iDownload Tries to Silence Spyware Critics
Doug Muth writes "According to this article over on DSL Reports, yet another spyware author, iDownload, has been sending out cease and desist letters to sites that classify their iSearch toolbar as Spyware. Some research reveals that yes, iSearch really does take over users' computers. A search on Spyware Guide also turns up a writeup on iSearch." -
iDownload Tries to Silence Spyware Critics
Doug Muth writes "According to this article over on DSL Reports, yet another spyware author, iDownload, has been sending out cease and desist letters to sites that classify their iSearch toolbar as Spyware. Some research reveals that yes, iSearch really does take over users' computers. A search on Spyware Guide also turns up a writeup on iSearch." -
eXeem Lite Public Beta Released
TheKarateMaster writes "Just days after the release of eXeem Open Beta comes eXeem lite 0.19 Public Beta. Much like with KaZaA, the official version of eXeem comes chock full of spy/adware -- specifically, cydoor. eXeem lite is spyware free and free of bloat -- and free. Version .20, which should fix a few minor bugs, is expected 'in next coming days.' (read: soon)"