New Malware Attack Tries To Trick People By Pretending To Be EFF
from the who-are-they-targeting? dept
The Electronic Frontier Foundation has put out an alert noting that, as part of a larger spear phishing attack campaign, to try to gain control over computers, a group has created a fake EFF website, designed to trick people into thinking they’re going to EFF’s actual website, but really installing some pretty nasty malware.
Electronicfrontierfoundation.org was not the only domain involved in this attack. It seems to be part of a larger campaign, known as ?Pawn Storm?. The current phase of the Pawn Storm attack campaign started a little over a month ago, and the overall campaign was first identified in an October 2014 report from Trend Micro (PDF). The group behind the attacks is possibly associated with the Russian government and has been active since at least 2007.
The attack is relatively sophisticated?it uses a recently discovered Java exploit, the first known Java 0-day in two years. The attacker sends the target a spear phishing email containing a link to a unique URL on the malicious domain (in this case electronicfrontierfoundation.org). When visited, the URL will redirect the user to another unique URL in the form of
http://electronicfrontierfoundation.org/url/{6_random_digits}/Go.class
containing a Java applet which exploits a vulnerable version of Java. Once the URL is used and the Java payload is received, the URL is disabled and will no longer deliver malware (presumably to make life harder for malware analysts). The attacker, now able to run any code on the users machine due to the Java exploit, downloads a second payload, which is a binary program to be executed on the target’s computer.
Needless to say, don’t visit the site unless you know what you’re doing — and also, a good reminder not to click on URLs in emails. Go directly to sites.
Filed Under: malware, pawn storm, spear phishing
Companies: eff
Comments on “New Malware Attack Tries To Trick People By Pretending To Be EFF”
Did the FBI not did something like this some time ago? For the right reasons, of course.
Personally, I wouldn’t click on electronicfrontierfoundation.org when I know for a fact it’s supposed to be https://eff.org. They’ve never used the full name in their URL in the time that I’ve been aware of them, and they adopted automatic encryption about the same time that this site did.
Re: Re:
It seems the first link is active even though I didn’t use tags. Please don’t click on it because I don’t think it’s safe.
Re: Re: Re:
uh dude I’m think of reporting it
Re: Re: Re:
Oh, for fuck’s sake.
Hello, Sheogorath. In the absence of anything else to do about it, I’ve hit Report. I suggest you and everyone else do the same.
Dear Techdirt, this page is now permanently serving Russian government malware, until you manually remove or alter the link. Well done.
As a strategy for dealing with this kind of issue in the longer term, I suggest you learn to FUCKING EDIT BUTTON, already. >:/
Re: Re: Re:
I absolutely HATE automagic linking =/
My sympathies xD
Re: Re: Re: Re:
I hate it too, especially when there’s no need for it because we easily can use tags when we want to turn text into active links.
Re: Re: Re:
It seems the first link is active even though I didn’t use tags. Please don’t click on it because I don’t think it’s safe.
I don’t see it as a link, but that is probably because I have disabled most of the javascript served up by Techdirt (unless Mike has already removed the tags.)
Then again, I occasionally submit comments with tags where it strips one or more of the tags (or, far more likely, I break it somehow,) leaving my comment with an unlinked link, but figure that if folks really want to follow it, they can copy and paste.
Re: Re: Re: Re:
I don’t see it as a link, but that is probably because I have disabled most of the javascript served up by Techdirt […]
It’s been fixed since.
[…] (unless Mike has already removed the tags.)
There weren’t any tags in the first place. I used tags on the official EFF website link, yes, but not on the fake EFF website link above it because it was my intention not to link to the fake site at all.
Re: Re: Re:2 Re:
It’s been fixed since.
Cool.
Re: Re:
uh can’t you delete it
Can the EFF petition to reclaim that domain name?
Re: Re:
I think the registrars can seize and forcefully transfer domains in these cases, can’t they?
Re: Re: Re:
According to the EFF’s post “the phishing domain has been reported for abuse–though it is still active”. I guess it just takes some time.
Re: Re: Re: Re:
They should have reported it as involved with copyright infringement, that would have led to it being taken down the same day the report was filed. Phishing though? Eh, they’ll get around to it eventually.
Re: Re: Re:2 Re:
Copyright and trademark infringement.
Re: Re:
EFF is not Hollywood.
/s
Good reminder, but I have a better one
This is a great reminder not to allow Java applets to run on sites until you understand exactly why you need it. If you are one of those lucky people who never interacts with sites that legitimately need Java, then you should completely block it in the browser.