Topic: Bogus LinkedIn profiles punt malware to fools (Decdec-A)

[Samker]

Bogus profiles on social networking website LinkedIn are punting malware to the credulous and starstruck.

Fraudulent accounts in the name of celebrities such as Beyoncé Knowles, Victoria Beckham, Salma Hayek and others are littered with links that take surfers to site harbouring malware, Trend Micro reports. The attack - which is still under investigation - represents a web 2.0 update of the old hacker trick of baiting infectious email attachments with celebrity lures.

As if to reinforce the point, one of the fraudulent profiles is registered in the name of Paris Hilton and tempts the foolhardy with supposed links to her infamous sex tapes.

Another bogus profile created in the name of Beyoncé Knowles claims to offer nude pics of the shapely singer, as recorded in screen shots obtained by Trend Micro here. A quick search of LinkedIn reveals that the offending profile has since been purged. We can expect the others fraudulent registrations to also disappear in short order.

Security researchers have identified that at least some of the maliciously constructed profiles punted malicious scripts, specifically the Decdec-A Javascript code, linked to Trojan attacks.

McAfee adds that hundreds of identikit bogus profiles have been created by miscreants. "The rogue profiles look all alike, with a picture of the celebrity and three links to the parts of the “nude video” like shown in the following picture," McAfee reports.

It's hard to imagine many (if any) would have been taken in by such a crude and transparently bogus ruse. Sophos reckons that the LinkedIn attack might at least partially be geared towards increasing the search engine ranking of hacker-controlled websites.

"Undoubtedly spammers, malware authors and other cybercriminals may be abusing the system to link to their webpages in the hope that it will generate a higher ranking in search engines like Google," a blog posting by Sophos security consultant Graham Cluley explains.

Whatever its main objective, the LinkedIn attack serves to illustrate increased hacker interest in exploiting social networking sites. Over recent days hackers hijacked celebrity profiles registered through micro-blogging service Twitter after exploiting flaws in the password-recover support tool. Separately, ne'er-do-wells launched a phishing campaign designed to trick regular users into handing over account login details.

(The Register)