Computerworld
Fake LinkedIn profiles promise pics, send malware instead
Expect more attacks to come from social networking services, says security expert
Gregg Keizer  08 January, 2009 09:00

Hackers have seeded LinkedIn, the business networking service, with bogus celebrity profiles that link to malicious sites serving up attack code, a security researcher said Wednesday.

Unlike Twitter, which had nearly three-dozen legitimate accounts hijacked Monday, LinkedIn was not compromised. Instead, criminals used the service to create phony profiles, gave them celebrities' names and slapped on the word "nude" to further entice users. Among the names: singer Beyonce and actresses Christina Ricci, Kirsten Dunst and Kate Hudson.

The identical profiles all sported links to sites that promised nude photographs of the celebrities, said Paul Ferguson, a threat researcher at security vendor Trend Micro. Users who clicked on those sites were shunted to malicious sites hosting malware.

"They're using the same mechanism as have earlier e-mail spam campaigns, telling users that they have to install a [video] codec," said Ferguson. The codec is nothing of the sort, but actually a disguised Trojan horse. "They're just casting a wider net using LinkedIn," he said.

LinkedIn reacted quickly, according to Ferguson, who said that the fake accounts first appeared on the site Tuesday. "Once they were notified, they quickly took them down. There's only a handful left when I last looked."

Rival security firm McAfee Inc. said yesterday that it had spotted "several hundred" bogus LinkedIn accounts.

The recent criminal activity on social-style sites -- Twitter was targeted with a first-ever major phishing campaign last week, for example -- will only get worse, Ferguson predicted.

"[Cybercriminals are] just trying to get more eyeballs on their handiwork," he said, explaining why they are turning to social networks such as LinkedIn and Facebook, as well as the micro-blogging Twitter service. "There's a blackhat SEO [search engine optimization] element here, too, since sites like LinkedIn and Facebook often float to the top of search engine results."

McAfee, in fact, came to its count of fake LinkedIn accounts simply by searching Google.

There's not a lot security software can do for users who keep clicking on links that more than likely lead to malware, Ferguson acknowledged. "There's always going to be that social engineering aspect," he said. "People should know by now not to click on links that promise nude pictures."

LinkedIn did not immediately respond to questions about the fake accounts, and what it plans to do to prevent a recurrence.

Comments

Post new comment

Login or register to link comments to your user profile, or you may also post a comment without being logged in.
The content of this field is kept private and will not be shown publicly.
Zones
Zone logoZones provide focussed content from Computerworld and leading technology partners.
Newsletter Subscription
Newsletter Subscription
Sign up for our Computerworld newsletters!
Syndicate content Syndicate content Syndicate content
 

Computerworld Webinar

Thursday, June 11th, 2009
10:30am EST (Sydney, Australia)
Screening at your PC

Computerworld is hosting a 30 minute live webinar to help you to learn how unified communications can save you money, foster innovation and business agility by making it easier for people to find, reach and collaborate with one another.

Register Now

Computerworld Community Comments
Whitepaper

Customer Experience Management: Improving the Consistency and Quality of Customer Interactions

Don't let your customers have a bad experience. Customer experience management (CEM) research from Ventana highlights the failures of traditional CRM and indicates many companies are hearing the message, but few have implemented the processes and technology to make it a reality. Download the report today!

Enterprise IT Buyer's Guide
Find Technology Vendors Fast
 
Find vendors by name | Find by category
Sponsored Links
 
Send Us E-mail | Privacy Policy
Features List | Media Kit | Advertising | Contact Us

Copyright 2009 IDG Communications. ABN 14 001 592 650. All rights reserved.
Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited.