Social networking site LinkedIn is being used to find victims and then to send maliciously crafted emails to compromise enterprise workstations.
Prospective employers and job applicants aren't the only ones using LinkedIn
for research. Cyber-criminals are increasingly using the social networking site
for professionals to identify potential victims, according to security experts.
Security firm Trusteer uncovered spam messages designed to look almost the
same as legitimate notification messages from LinkedIn, Trusteer
CEO Mickey Boodaei wrote on the company blog June 2. When users click on
the link in the message, usually an invitation to connect with someone, they
are redirected to a malicious server in Russia serving up malware.
Through LinkedIn, cyber-criminals can build a profile of targeted
enterprises and locate key people within the organization. The spam messages
sent to those folks could be used to install malware, which could steal login
credentials or other confidential information.
"Sounds unlikely? Well, think again," Boodaei said.
The fraudulent LinkedIn messages take users to a salesforceappi.com domain.
Despite the name, the domain has nothing to do with Salesforce.com. It was
registered May 31, and the server associated with the IP address is based in
Russia.
The users are then hit by drive-by-download attacks based on the BlackHole
exploit kit to install the Zeus 2 Trojan on the computer, according to
Trusteer. This Zeus variant transmits the stolen data to a server in Zhejiang,
China.
While commonly associated with banking fraud, Trusteer's Boodaei said Zeus
has other capabilities and can allow attackers to access workstations and other
data stored on the corporate network.
"We've recently seen evidence of Zeus targeting enterprise networks in order
to steal proprietary information and to gain unauthorized access to sensitive
systems," Boodaei said.
A recent Trusteer survey found that 68 percent of enterprise users who
receive a fake LinkedIn message are likely to click on it. It's not entirely
their fault, as LinkedIn and other social networking sites "educate us to click
on links," Boodaei said. The sites regularly send out calls for actions to
encourage users into going back to the site.
"This is extremely dangerous as many users almost
automatically click on these links without trying to verify their
authenticity," Boodaei said, especially considering that LinkedIn hides the
link behind a button, which makes it even harder to check the URL.
It's increasingly becoming harder to identify
phishing and malicious email messages as attackers get more creative.
Trusteer recommends that users train themselves to never opening emails from
social networking sites, let alone clicking on the links in those messages.
Users should access the social networking Website by typing the address
manually, and handle all the notifications from the site directly, Boodaei
said.
Recent attacks against RSA and Oak Ridge National
Laboratory tricked employees into opening attachments or clicking on links in
malicious messages. "Cyber-criminals are putting a great deal of effort in
these attacks and are unfortunately successful," Boodaei said.
There have been several variations of the LinkedIn scam,
with researchers at Cisco
Systems reporting a similar campaign last fall.
The BlackHole exploit kit locates vulnerabilities on a
computer and prepares a customized payload depending on operating system and
installed software, according to BitDefender. It used to sell for $1,500 back
when it appeared on the black market a year ago, but nowadays can be obtained
for free.
Email
Print
