Hackers harness popularity of blogging

Blogs used to harbour malicious code

Dinah Greek, Computeract!ve 14 Apr 2005

Cyber-criminals are now taking advantage of blog site to snare unsuspecting victims.

It warned webblogs are being used to harbour malicious code such as Trojans and keystroke loggers warned security firm Websense. The company, which said it had uncovered hundreds of bogus blog sites, said blogging was an attractive vehicle for hackers for several reasons.

Hackers can easily publish their own web pages at no cost and offer large amounts of free storage. They do not require any identity authentication to post information, and most blog hosting facilities do not provide antivirus protection for posted files.

In some cases said Websense, the culprits create a blog on a legitimate host site, post Trojans or keylogging software to the page. They attract traffic to the toxic blog by sending a link through spam email or instant messaging (IM) to a large number of recipients.

In other cases, the blog can be used as a storage mechanism, which keeps malicious code that can be accessed by a Trojan horse that has already been hidden on the user's computer.

Websense issued an alert last month detailing a spoofed email message that attempted to redirect users to a malicious blog, which would run a Trojan horse, designed to steal banking passwords. In this situation, the user received a message spoofed from a popular messaging service, offering a new version of their IM program.

When users clicked on a link they were redirected to a blog page that was hosting a password-stealing keylogger. When predetermined banking websites were accessed, the keylogger (bancos.ju) logged keystrokes and sent them to a third party.

"These aren't the kind of blog websites that someone would stumble upon and infect their machine accidentally. The success of these attacks relies upon a certain level of social engineering to persuade the individual to click on the link," said Dan Hubbard, senior director of security and technology research for Websense.

"In addition, the blogs are being utilized as the first step of a multi-layered attack that could also involve a spoofed email, Trojan horse, or a keylogger."

See also: