Hackers Exploit Obama Site to Spread Malware
A social networking site operated by the 2008 Barack Obama campaign is serving up malware to unwary visitors a full week after the tactic was reported, a security researcher said Monday.
Mon, January 26, 2009
Computerworld — A social networking site operated by the 2008 Barack Obama campaign is serving up malware to unwary visitors a full week after the tactic was reported, a security researcher said Monday.
My.BarackObama.com, still active after the inauguration last week of President Obama, is being used by hackers trying to dupe users into downloading a Trojan horse, said Dan Hubbard vice president of security research at Websense Inc.
The criminals have set up bogus accounts on My.BarackObama.com, which provides tools to join groups of Obama supporters, raise funds and create a personal blog hosted on the site, and they used the accounts to post blogs. When a user reaches one of the fake blogs, a YouTube-like video window is displayed; clicking on that video frame takes the user to a malicious Web site packed with pornography.
If the user clicks to view the porn, a message pops up claiming a video codec must be downloaded and installed. The executable file is no codec, but rather a Trojan horse that hijacks the PC.
"The group behind this is one of those that's infecting people with fake antivirus software," said Hubbard, referring to so-called "scareware" programs that pose as security software but are actually useless. Until the victim pays for the worthless program -- prices range between US$40 and $50 -- he or she is deluged with fake pop-up warnings.
The cyber-crooks don't just try to grab people browsing through My.BarackObama.com, Hubbard added, but are actively polluting search engines with the URLs of their bogus blog accounts in an attempt to take advantage of My.BarackObama.com's reputation and popularity.
Although Websense first uncovered the phony My.BarackObama.com blogs a week ago, it has had no luck reaching someone responsible for the site. "We've been constantly trying to reach them, and tried every possible angle, from e-mail to the site itself to the phone, but we haven't heard back," said Hubbard. "Obviously, they've been fairly busy."
Multiple bogus blogs on the site are still serving the Trojan, Hubbard confirmed Monday.
A call Monday by Computerworld to the contact phone number listed in the site's Terms of Service was not returned.
This is not the first time Obama's name has been used to spread malicious code. The weekend before his inauguration, sites claiming that Obama would refuse to take office infected users with the Waledec bot Trojan; last November, the day after he won the U.S. presidential election, hackers launched a major malware campaign based on a site that claimed to have final vote tallies .
