Koobface on the move hijacking Facebook accounts

ronjor · Jun 3, 2013

Koobface, the fast-spreading Internet worm cybergangs use to hijack Facebook accounts on a massive scale, is on the move once again.

McAfee this morning released a threat report showing samples of Koobface spiking in the Internet wild all through the first three months of 2013.

“The resurrection of Koobface reminds us that social networks continue to present a substantial opportunity for intercepting personal information,” says Vincent Weafer, senior vice president, McAfee Labs.
Click to expand...

http://lastwatchdog.com/koobface-move-hijacking-facebook-accounts

hogndog · Jun 3, 2013

Thanks for the heads up Ron..

Noob · Jun 3, 2013

This reminds me of an incident with my friends laptop.

Rmus · Jun 4, 2013

From the article:

Its [Koobface] creators initially sent Facebook users friendly messages asking them to click on a link to see a video. Doing so called up another message asking the recipient to click on an executable file — a small computer program — needed to upgrade a video player required to view the video.
Click to expand...

Koobface was first discovered in 2008. For those who don't remember,
this was a typical ploy presented to the user:

A year earlier in 2007, Bojan Zdrnja wrote in a isc.edu Diary, an analysis of an early exploit against MAC users:

The user is then prompted to install the package and during this process he will have to supply the administrator credentials. Yep, it’s game over from this point in time (and the attack is exactly the same as on Windows – keep in mind that these users *will* willingly supply these credentials.
Click to expand...

A year later, shortly after the discovery of Koobface, Marco at Prevx wrote on his blog,

People who download cracks from Peer to Peer, people who run false video or audio codecs, people that simply give administrator permissions to every software that asks for them...

You can even add limited accounts and every kind of protection, this would prevent some of malware, but social engineering is still the primary vehicle of attacks and against that there's really no solution if it's used against a so wide range of users.
Click to expand...

Five years later, it seems that this exploit method is still effective. See:

2013 Predictions: Better Exploit Mitigations Make Hackers Turn to Social Engineering
http://news.softpedia.com/news/2013...ckers-Turn-to-Social-Engineering-313017.shtml

In its latest Security Threat Report, Sophos makes some interesting predictions for 2013. According to one of them, the latest exploit mitigation technologies will make it more difficult for cybercriminals to leverage software vulnerabilities in their attacks.

We have secure boot systems, address space layout randomization (ASLR), Data Execution Protection (DEP), not to mention restricted mobile platforms to protect us against cyber threats.

While this is a good thing, it doesn’t mean that exploits will simply disappear. Instead, we’ll likely see a decrease in vulnerability exploits, but we’ll witness a sharp rise in social engineering attacks.
Click to expand...

----
rich

Log in or Sign up

Koobface on the move hijacking Facebook accounts

ronjor Global Moderator

hogndog Registered Member

Noob Registered Member

Rmus Exploit Analyst

Log in or Sign up

Koobface on the move hijacking Facebook accounts

ronjor Global Moderator

hogndog Registered Member

Noob Registered Member

Rmus Exploit Analyst

Useful Searches