New variant hides 'elaborate' eBay fraud

Powered by SC Magazine
 

Security experts have warned web users to guard against a newly intercepted mutant of the Feebs trojan that attempts to dupe eBay users with an "elaborate" fraud.

Aladdin, the security firm that identified the new variant as JS.Feebs, noted that when the malware is executed by an unwitting recipient, it displays fake loading screens that look like several popular search engines. This is followed by a false error message stating that there was no available connection. The scripts do this to mask their own activities that sometimes include disabling the system's antivirus and other security-related products as well as executing other malicious code.

JS.Feebs usually arrives by email, but it could also exist in websites that would infect visitors upon access, Aladdin warned.

The mutant initiates an "elaborate fraud" attack similar to phishing. Unlike classic phishing, no phishing email or a link to be clicked exists. Rather, the script modifies the HOSTS file found on the compromised target PC.

This file, when modified, can override the default DNS servers, thus allowing users' internet browsers to receive one address and lead to another, leading users to a spoofed site when they try to access eBay. When personal information is entered, the user will be taken to the actual eBay website, completely unaware that the sensitive information just entered was, in fact, stolen. All this time, the eBay web address appears normally, days or even weeks after the original infection took place.

Although the propagation of this new variant may be slow, its infection impact is high, according to Aladdin, as it steals personal information pertaining to regularly used sites.

"We see this new fraud attempt as an illustration of the growing presence of dangerous phishing scams," said Shimon Gruper, vice president of technologies for the Aladdin eSafe Business Unit. "Although web attacks are more difficult to measure than email-related attacks, we expect this JS.Feebs variant to have a significant impact for infected users, as their browser no longer indicates they are visiting a phishing site," he said. "Thus, users are even more likely to provide their personal data, which then lands in the wrong hands."

Copyright © SC Magazine, US edition


 
 
 
Top Stories
Photos: iTnews Benchmark Awards countdown begins
Just a few days left until entries close for 2014.
 
Australian Govt to rethink cyber security strategy
Six-year old policy to be refreshed.
 
The failure of the antivirus industry
[Blog post] Insights from AVAR 2014.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  5%
TOTAL VOTES: 1064

Vote