Sharing Knowledge & Information

Mac OS X malware is being spread by sick messages spreading virally across Facebook, claiming to be a video of controversial IMF boss Dominique Strauss-Kahn.

The fake anti-virus attack first appears in your timeline as a message apparently posted by one of your friends.

oh shit, one more really freaky video O_O

IMF boss Dominique Strauss-Kahn Exclusive Rape Video - Black lady under attack!
[LINK]
IMF chief Dominique Strauss-Kahn rape scandal. Mother of Alleged Rape Victim: Dominique Strauss-Kahn Did Not Want To Be President of France - ABC News

(I have obscured the image used in the message in case it causes offence).

The message’s text refers to the news story of IMF chief Dominique Strauss-Kahn who is facing charges in New York over charges that he tried to rape a hotel maid.

In terms of sick headlines to entrap users, this one ranks right up there. It’s been, of course, a very big news story – and many people have been following the case with interest. And that probably explains why the hackers have used the promise of a video as bait.

Clicking on the link takes you to a webpage, which appears to consist of a still from a sex movie. However, when I visited the page on my Apple Mac I was rapidly redirected to a “Mac Defender”-style fake anti-virus attack, written specifically with the intention of infecting my computer.

Sophos Anti-Virus for Mac intercepted the attack as OSX/FakeAVZp-C.

What’s interesting is that up until now we have mostly seen these fake anti-virus attacks target Mac users by poisoning search engine results. But now we are seeing them being distributed by viral Facebook spam campaigns as well.

It’s probably not too difficult to put yourself in the shoes of a computer user who knows that they are possibly about to watch a seedy video, only to find themselves facing a screen warning them of numerous security threats.

In many ways this is a genius piece of social engineering to frighten unsuspecting Mac users into installing the software and handing over their credit card details.

It’s just a shame that Facebook’s own security systems are currently failing to stop these links from spreading.

Download Sophos’s free anti-virus for Mac home users. It’s automatically updated to protect against the latest threats. Another step you should take is changing the default settings on Safari – it’s not a complete defence, but it can help a little.

Related articles

• IMF boss rape video? Mac Facebook users hit by a sick scareware attack (nakedsecurity.sophos.com)
• Mac Defender malware now spreading virally via Facebook (zdnet.com)
• Male-only cleaners for Dominique Strauss-Kahn (mirror.co.uk)
• Blackhat SEO and Fake anti-virus – Like chocolate and peanut butter (blogoholic.in)
• “Former IMF Chief Dominique Strauss-Kahn Said to Maid While Assaulting her … “Don’t You Know Who I Am?”" and related posts (scaredmonkeys.com)
• “Strauss-Kahn Scandal Continues to Reverberate” and related posts (thenewspundit.com)