Malicious Sites Post Heath Ledger Links To Dupe The Unwary - InformationWeek
04:52 PM
Connect Directly
Moving UEBA Beyond the Ground Floor
Sep 20, 2017
This webinar will provide the details you need about UEBA so you can make the decisions on how bes ...Read More>>

Malicious Sites Post Heath Ledger Links To Dupe The Unwary

Clicking on the malicious links redirects the victim to an unexpected Web site, which attempts to trick the user into downloading malicious programs onto his or her computer.

Ever keen to capitalize on people's interest in current events, malware authors have taken to using the name of recently deceased actor Heath Ledger to lure unsuspecting Internet searchers to infectious Web pages.

"Within hours of these reports, research project manager Ivan Macalintal discovered a couple of malicious URLs that turn up when users key in the search terms 'heath' and 'ledger,' " said Bernadette Irinco, a security researcher for Trend Micro, in a blog post. "This is very similar to the poisoned Google searches reported last Christmas."

Clicking on any of the malicious links redirects the victim to an unexpected site, which attempts to get the user to download a "new version of ActiveX Object." Anyone doing is inviting a number of malicious programs onto his or her computer.

With the commencement of the holiday season last year, Trend Micro observed that spammers and scammers had poisoned the Google index so that search terms like "christmas gift shopping" returned a significant number of sites carrying malware.

Search index poisoning is the malicious form of search-engine optimization, the practice of trying to create Web sites that appear at or near the top of search results pages for a given set of search terms. Whereas legitimate search-engine optimization strives to make sites that are relevant and easily indexed, its illegitimate form relies on, among other methods, creating large numbers of interlinked, auto-generated Web pages that create the illusion of relevancy to game search-engine ranking algorithms.

Google's PageRank algorithm, for example, considers a hyperlink to a given Web page to be a vote of confidence in the page's relevancy. Google poisoning thus can be thought of as a form of ballot stuffing. Google routinely removes malicious pages from its index, but new malicious pages can be easily created.

Other recent events such as the assassination of former Pakistani Prime Minister Benazir Bhutto also have been used to trick people into opening malicious e-mail or visiting malicious Web sites. And a year ago, the infamous Storm worm used similar tactics to spread.

According to Trend Micro, the malicious Heath Ledger URLs appear to point to the servers of a Czech Web hosting provider that was recently hacked.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
IT Strategies to Conquer the Cloud
Chances are your organization is adopting cloud computing in one way or another -- or in multiple ways. Understanding the skills you need and how cloud affects IT operations and networking will help you adapt.
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll