« Another Privacy Exposure on the Web | Main | Staples to Start Recycling Program »

The Exploit Prevention Lab blog reports on how hackers are using Google sponsored links to infect machines with a variant of the MDAC exploit. Here's how it works -

Popular Google searches like "Better Business Bureau" will turn up a rogue link leading to a malicious site. In the case of "Better Business Bureau" search, the query actually turned up the rogue link as the #1 sponsored site. However, before taking you to the BBB site, it actually sends you to smarttrack.org which sounds innocuous enough...except that it's not.

Smarttrack.org uses a variant of the MDAC exploit to install a backdoor and a post-logger on your system. The postlogger targets the websites of top banks around the world with a phishing attack to entice online banking customers to unintentionally reveal vital information. What makes this both a clever and insidious use of Google links is that most browsers do not provide a preview address with Google sponsored links (the way they do with most other links).

And one other thing - Google suspended the accounts of the malicious sponsored links. Thought I should mention that. If you want to read the latest on this, here is a report with Google's response to this.

Posted by andreyee in Alerts/Warnings |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/1776