YouTube “malware” sites threaten web users

By Alex Zaharov-Reutt
Friday, 10 October 2008 13:02

Opinion and Analysis

A warning has gone out that fake YouTube pages are loading malware onto users’ computers - how can you protect yourself?!

Have you seen a page with a YouTube style video window showing a message that it needs to download a “codec” to play the video file?

If so, you’ve come across a malicious site – one that is trying to get you to voluntarily install some malware onto your computer.

That malware could then do whatever its creator intended – deliver ads, log your keystrokes, do screen captures, steal information from your hard drive, join your computer up to a botnet or worse.

Now the news comes from the Associated Press (AP) that online criminals are creating pages that look just like YouTube pages to do the exact same thing, potentially even showing you the actual YouTube video you wanted to see after the malware was successfully loaded.

Much like phishing emails take you to a bank or other site that looks legitimate, hoping you’ll enter in your username and password, so are these “web phishing” sites using social engineering tactics to fool you into doing something that looks completely harmless yet is opening you up to the perils of malware.

The AP notes that hackers now have access to software that helps them build these fake sites, so an explosion of online fakery and drive-by download attempts (whether automatic or through a user “voluntarily” loading something after being fooled) is not only likely but clearly already happening.

As always, the advice is simple – if you see one of these “codec” requests at what appears to be a YouTube site, close the browser window and type in www.youtube.com into your browser instead.

But what’s the latest “click” threat that might make typing in a web address yourself less safe, and what can you do to protect yourself? Please read on to page 2.