More rogue Flash ads
Rogue ads infiltrate Expedia and Rhapsody sites.
Following on from last month's feature on the
SWF.AdHijack family (see VB, January 2008, p.12),
malicious Flash ads were found to have made their way into popular travel site Expedia.com and music
download site Rhapsody.com.
According to Trend Micro researchers, the Expedia site was infiltrated by a variant of the
SWF.AdHijack family - clicking on the ad led to a number of redirections, which eventually resulted in the installation
of a piece of rogue anti-spyware detected by Trend as TROJ_GIDA.A.
The malicious ad found on the Rhapsody site similarly redirected users to a
page that attempted to install a bogus program on the user's machine by
reporting a (non-existent) system infection, and then urging them to
purchase the software needed to 'clean' the infections.
Investigators estimate that the ads were active on the Rhapsody site for
six days before being removed. According to Expedia an 'imposter
advertiser' managed to circumvent the company's advertising policy. At the
time of writing the company didn't know how long the ad had been active.
01 February 2008
Tags:
flash ads, rogue ads, rogue anti-malware.
del.icio.us 
digg this
