Topic: Do Not Pass Go: Malware Taps Phony 'Monopoly' (monopoly.exe, monopoly2009.com)

[Samker]

Unsolicited invitation to play an online version of the popular board game can turn your computer into a spam-spewing zombie.

This time, hackers are luring unsuspecting users with an invitation to play an online game of Monopoly. But there's no Boardwalk or Park Place -- just a Trojan that, if activated, will turn your PC or mobile device into a spam distribution center.

The discovery was made Monday by members of McAfee's MX Logic security software team: http://go.internet.com/?id=474X1101&url=http%3A%2F%2Fwww.mxlogic.com%2Fitsecurityblog%2F1%2F2009%2F09%2FWant-to-Play-Monopoly--Spammers-Dont-Play-Fair.cfm

This so-called social engineering tactic isn't new, however, though it's fairly well done and conceived, according to Sam Masiello, MX Logic's director of threat management.

"If the recipient follows the link to the monopoly2009.com Web site, they are greeted with a Web page that actually looks fairly well done advertising the Monopoly 'game' and encouraging the user to download using several links dispersed throughout the page after giving a brief history of the game and providing some fun facts," Masiello wrote on the security team's blog: http://go.internet.com/?id=474X1101&url=http%3A%2F%2Fwww.mxlogic.com%2Fitsecurityblog%2F1%2F2009%2F09%2FWant-to-Play-Monopoly--Spammers-Dont-Play-Fair.cfm

The malware isn't installed on the user's machine by visiting the Web page. But if a user downloads and installs the monopoly.exe file it offers, a Trojan is activated on the computer or mobile device. The virus then connects with another computer behind the scenes to download a second piece of malware that activates the spamming application.

Masiello wrote that the faux Web site includes some features designed to trick people into installing the malware, including a hit counter at the bottom of the page that fabricates how many people are playing online right now and how many people have visited the site.

Security software experts say social engineering and event-related come-ons -- such as the death of a celebrity or breaking news story -- have become all the rage with hackers in recent months and advise users to think twice before downloading any unsolicited applications no matter how intriguing they appear to be.

(InternetNews)