03 March 2009 | 11,414 views

Koobface Worm Variant Hits Facebook

Prevent Network Security Leaks with Acunetix

Koobface is computer worm that targets the users of the social networking websites Facebook and Myspace. Koobface ultimately attempts, upon successful infection, to gather sensitive information from the victims such as credit card numbers.

A new variation of Koobface has popped up aggressively on Facebook and is attempting to steal login credentials for other social networking sites.

It’s heavy on the user of Social Engineering by using the old familiarity ploy and trying to lure users into execution the spurious malware.

Researchers at Trend Micro report that a new variant of the Koobface worm is squiggling through Facebook, infecting users and attempting to steal cookies with log-in information for sites such as MySpace.com, MyYearbook.com, Bebo and Hi5 Networks. The Koobface worm first appeared in 2008.

Researchers at Trend Micro are reporting that a new variant of the Koobface worm is spreading on Facebook.

Koobface first appeared in 2008, with separate variants striking members of Facebook and MySpace.com. Now the Koobface worm is back again, with an eye toward stealing cookies for other social networking sites.

According to Trend Micro, the new variant sends Facebook messages claiming to be from a friend. The messages link to a spoofed YouTube video. In an interesting social engineering ploy, the malicious landing page not only displays the friend’s name, but also a picture pulled from the person’s Facebook profile.

It’s a pretty standard modus operandi for malware distributors, a new version of Flash seems to be a very common theme amongst these kinds of worm.

It seems like quite a lot of thought has gone into the design of this worm and due to the pretty slick distribution method it might become quite a large scale infection. It’s endgame is to create some kind of botnet and to steal the real information of value (banking details, credit card numbers etc).

The page prompts the user to install a new version of Adobe Flash. Users who agree are redirected to a download site for the file setup.exe, which is the new Koobface variant. Trend Micro detects the worm as WORM_KOOBFACE.AZ, and reported March 1 that its researchers had seen more than 300 unique IP addresses hosting the .exe file.

Trend Micro is expecting to see more.

“We’re only flagging a few hits at the moment, but the complexity with which this threat has been created shows how much work has been done to social-engineer social networks with the end game of creating [botlike] accounts to send out third-party links to almost anything,” said Jamz Yaneza, a threat researcher at Trend Micro.

The latest iteration of the worm runs on Windows 98, ME, NT, 2000 and XP and Server 2003. It sends and receives information by connecting to several servers, allowing hackers to remotely execute commands on a compromised machine.

Once infected the malware will search the users machine for Cookies from other social networking sites such as MySpace.com, Hi5 Networks, MyYearbook.com and Bebo.

As always, warn whoever you know that might use Facebook and generally tell people not to install or run anything that they aren’t expecting or didn’t specifically look for.

If they want to update Flash tell them ONLY to ever do it at the Adobe site.

Source: eWeek



Recent in Exploits/Vulnerabilities:
- Sony Pictures Hacked – Employee Details & Movies Leaked
- Gruyere – Learn Web Application Exploits & Defenses
- Critical XSS Flaw Affects WordPress 3.9.2 And Earlier

Related Posts:
- Ramnit Worm Stealing Facebook Account Passwords, E-mail Address & Bank Details
- Websense Offers Facebook Users Free ‘Firewall’ Service
- The First Reported Facebook Worm/Malware Pops Up – Secret Crush

Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 228,475 views
- AJAX: Is your application secure enough? - 119,243 views
- eEye Launches 0-Day Exploit Tracker - 85,115 views

Advertise on Darknet

5 Responses to “Koobface Worm Variant Hits Facebook”

  1. Mafiya 3 March 2009 at 11:24 am Permalink

    Any knowledge on how to get rid of it yet? Not that i have it, just that i work on computers, and we remove viruses. Would i do the Malwarebtyes, SuperAntiSpyware, HiJackThis, CCleaner? Or would that not get rid of it?

  2. Bogwitch 3 March 2009 at 6:42 pm Permalink

    @Mafiya.

    No experience of it myself, but as with any other trojan, the safest way would be a complete rebuild of the workstation, unless you keep computational hashes of all the executables on your customers drives for comparison to ensure they have not become infected. Or are you peddling fixes that cannot be verified?

  3. Mafiya 3 March 2009 at 8:45 pm Permalink

    Most customers are below 18, as i’m at a school. And we do it for free, just to gain experience. And what do you mean a complete rebuild? Just a clean install?

  4. Anonymous 4 March 2009 at 5:38 am Permalink

    Mafiya: Bogwitch does mean a complete reinstall of the operating system(s). As it technically isn’t spyware/adware, your mileage may vary using only the tools you’ve specified. Solid antivirus software _should_ be enough, but it’s far better to never get infected in the first place.

  5. masterstyles 25 March 2009 at 11:08 pm Permalink

    search for combofix , we use it a 1000 times a day, better than ur method, use it then mbam then ccleaner :)