« 419er's Revenge on 419-Baiting? | Main | New Training Course Brochure »

August 26, 2007

The so-called Storm worm continues to mutate, using more and more believable social engineering tricks to lure unsuspecting users to perform risky behavior—notably to install a Trojan on their PCs that can do anything from installing keyloggers to surrendering the machine to a botnet controller.

Last week saw a ton of simple email messages that provided a login and temporary password to join a host of different types of organizations. Everything, of course, was a complete lie. Visiting the linked (and hijacked) site caused a Trojan to download.

This week, the conveyance of choice is a message that is similar to the types you get everyday from friends and relatives, telling you about some cool YouTube video:

Subject: LOL, that is too cool.....

You need to take this offline, it is in everyones email. :-( check it out yourself http://www.youtube.com/watch?v=BbEor9cWCQ4

Underneath the bogus YouTube URL is a real link address to a server that displays a real YouTube logo (sourced from youtube.com). The destination site silently tries to download the Trojan. If the automatic download fails, the web page will lure you further:

Your Download Should Begin Shortly. If your download does not start in approximately 15 seconds, you can click here to launch the download and then press Run.

The "click here" link downloads a file named video.exe, an executable file that will likely cause you untold grief if you run it on an unprotected Windows PC. Unfortunately, in these days of zero-day attacks and continuously morphing Trojan packages, there is no guarantee that any PC (or Mac or Linux box for that matter) is protected.

The best protection continues to be a refusal to click links arriving in unsolicited messages (email, IM, and even within closed messaging systems), especially from people you don't know.

UPDATE: There are probably dozens of message subjects and bodies, but here is another I've personally seen:

Subject: man, who filmed this thing?

LMAO, I cant believe you put this video online. Everyone can see your face there. LOL take a look, lol...[bogus YouTube URL here]