Malicious software plays on legal fears

Hackers are trying to play on the fear of losing customers to trick businesses into downloading a harmful program distributed through targeted e-mails

Hackers are trying to play on business' fear of legal action from customers to trick them into downloading a harmful program distributed through e-mail.

The e-mails purport to come from the Better Business Bureau, an organization that monitors and arbitrates disputes between consumers and businesses in the U.S. and Canada. The e-mails assert that a customer lodged a complaint against the recipient's business, according to a warning on the Web site of Websense, a security vendor.

The e-mails contain a Microsoft Word attachment with the text of the supposed complaint and instructions for how to respond. But embedded in that document is a keylogging program that captures data on the victim's computer and then uploads it to a server in Malaysia.

The keylogger is purposely mislabeled with a ".pdf" extension -- Portable Document Format -- another widely used document format, to make it look harmless, said Henry Gonzalez, Websense's senior security researcher.

The trick is another variation of so-called "social engineering" methods used by hackers, which entice users to unknowingly install harmful programs on their computers.

A Better Business Bureau branch warned of a similar kind of attack in February. At that time, the e-mails contained hyperlinks to malicious Web sites. Some kinds of malicious software can be installed on a user's computer merely by viewing a site engineered to exploit a vulnerability within a Web browser.

The latest attack, using the Word document as the delivery vehicle for the malicious software, is a tactic hackers are increasingly employing.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

More about MicrosoftWebsense

Show Comments