Google Readers at risk from unsocial Facebook worm

Davey Winder
Wednesday, 29 October 2008 16:42

Your IT - Home IT

Facebook worms are, sadly, not that uncommon. However, they do all tend to share a common tactic of using a non-existent video requiring a Trojan disguised as a new codec download to work. Now one enterprising scumbag is using Google to leverage trust amongst Facebook victims.

This year we have seen worms in space and worms promising Paris Hilton will toss a dwarf on the street. We have seen worms targeting specific routers and worms aimed at mobile phone operating systems.

We have also seen a fair number of Facebook specific worms which is hardly surprising given the incredible popularity of the social networking phenomenon and the incredible willingness of Facebook users to morph into link clicking idiots.

What we have not seen is any real ingenuity on behalf of the cybercriminals behind these worms, beyond that of coming up with clever and often amusing hook-lines together with appealing sounding non-videos to entrap the unwary.

Until now. Fortinet’s FortiGuard Center tells me it has uncovered a new malicious Facebook worm that uses Google Reader to gain the trust of victims. Sure, a malicious video is still involved and is distributed through the Facebook worm, but this then attempts to socially engineer trust by redirecting out of Facebook and straight onto a Google Reader share site.

It all starts with the Facebook user getting a message on their wall telling them that someone has uploaded a video of them on YouTube that they should see. Actually, why anyone would fall for this from the get go is beyond me if the Fortinet example message is anything to go by.

It says: "Sommebody uupload a viideo wiith you on utubee, you shuold ese."

If you are mug enough to bother clicking on the link that follows you end up at a Google Reader share. Google Reader lets users share news and online content that they have found interesting, both with their circle of friends and the wider general public.

Find out what happens next, and how you can avoid being just another victim of this illiterate malware crook on page 2...

CONTINUES