Users of the MySpace and Facebook social networking sites are being warned of two variants of a new worm discovered by security vendor Kaspersky Lab.
The worm is called Net-Worm.Win32.Koobface, with .a and .b variants found to be in use. Koobface is spreading due to the fact it uses your friends to travel across the social networks infecting machines.
Typically you will receive a message from someone tagged as a friend on MySpace or Facebook, there are many messages in use including the following:
- Paris Hilton Tosses Dwarf On The Street
- Examiners Caught Downloading Grades From The Internet
- You must see it!!! LOL. My friend catched you on hidden cam
- Is it really celebrity? Funny Moments
The messages contains links to what looks like a YouTube address. Visiting the address does display a video clip, but clicking to watch it brings up a message box stating you need to download the latest Flash Player plug-in. The actual executable downloaded is called codecsetup.exe and this is what infects your machine.
Once infected the worm then uses your friends list to send out more messages in the hope of spreading further. Kaspersky also believe that the payload delivered means that infected machines will be used as part of botnets in the future.
Alexander Gostev, senior virus analyst at Kaspersky Lab commented:
Unfortunately, users are very trusting of messages left by ‘friends’ on social networking sites. So the likelihood of a user clicking on a link like this is very high … At the beginning of 2008 we predicted that we’d see an increase in cybercriminals exploiting MySpace, Facebook and similar sites, and we’re now seeing evidence of this. I’m sure that this is simply the first step, and that virus writers will continue to target these resources with increased intensity
Read more at Kaspersky.com, found via ZDNet UK
Matthew’s Opinion
Using friends on social networks is a clever idea because we do tend to turn off the safety thinking if a message from your friend pops up to read. I’d be a bit suspicious if my close friends sent me a video of Paris Hilton tossing a dwarf, but if I received one saying “You must see this”, then I would at least look at the message if not going as fas as clicking the link to the video. Many others obviously would.
The one clear problem all this malicious software seems to have is total lack of spelling or grammar. You only have to look at the example messages above to see this and it should be used as a good hint these messages are malicious, or at least written by friends whose English isn’t their strongest skill.
»read more from "Facebook and MySpace users hit by new Koobface worm"