More rogue Flash ads
Rogue ads infiltrate Expedia and Rhapsody sites.
Following on from last month's feature on the SWF.AdHijack family (see VB, January 2008, p.12), malicious Flash ads were found to have made their way into popular travel site Expedia.com and music download site Rhapsody.com.

According to Trend Micro researchers, the Expedia site was infiltrated by a variant of the SWF.AdHijack family - clicking on the ad led to a number of redirections, which eventually resulted in the installation of a piece of rogue anti-spyware detected by Trend as TROJ_GIDA.A.
The malicious ad found on the Rhapsody site similarly redirected users to a page that attempted to install a bogus program on the user's machine by reporting a (non-existent) system infection, and then urging them to purchase the software needed to 'clean' the infections.
Investigators estimate that the ads were active on the Rhapsody site for six days before being removed. According to Expedia an 'imposter advertiser' managed to circumvent the company's advertising policy. At the time of writing the company didn't know how long the ad had been active.
01 February 2008
Tags:
flash ads, rogue ads, rogue anti-malware.
del.icio.us
digg this
Poll
Do you use the same password(s) across multiple websites?Leave a comment
View 4 comments

Virus Bulletin
In this month's magazine:- Social networking meets social engineering
- Flying solo
- Geneva convention
- 7th German Anti Spam Summit 2009
- Anti-phishing landing page: turning a 404 into a teachable moment
- An update on spamming botnets: are we losing the war?
- Windows Server 2008 Standard Edition SP2 x86

Subscribe now!
Virus Bulletin currently has 190,859 registered users.

