Posted by Virus Bulletin on Jan 1, 2008
Rogue ads infiltrate Expedia and Rhapsody sites.
Following on from last month's feature on the SWF.AdHijack family (see VB, January 2008, p.12), malicious Flash ads were found to have made their way into popular travel site Expedia.com and music download site Rhapsody.com.
According to Trend Micro researchers, the Expedia site was infiltrated by a variant of the SWF.AdHijack family - clicking on the ad led to a number of redirections, which eventually resulted in the installation of a piece of rogue anti-spyware detected by Trend as TROJ_GIDA.A.
The malicious ad found on the Rhapsody site similarly redirected users to a page that attempted to install a bogus program on the user's machine by reporting a (non-existent) system infection, and then urging them to purchase the software needed to 'clean' the infections.
Investigators estimate that the ads were active on the Rhapsody site for six days before being removed. According to Expedia an 'imposter advertiser' managed to circumvent the company's advertising policy. At the time of writing the company didn't know how long the ad had been active.
Posted on 01 February 2008 by Virus Bulletin
