Lewd Celebrity Photos Mask Trojan Payload

Angelina Jolie and Halle Berry were unwilling vectors of a massive spam campaign last month, in which naked pictures of the two actresses obfuscated a Trojan payload.

The coordinated attack, which delivered the Pushdo Trojan through an e-mail attachment, peaked over a 24 hour period where it accounted for four out of five infected e-mails.

Sophos senior security consultant, Carole Theriault, said while the machinations are predictable, Hollywood porn is still very effective enticing users to open unknown attachments.

“The trick of tempting users with scantily clad pictures of hot-looking girls is as old as the hills — but people still fall for it,” Theriault said.

“The Pushdo Trojan has been spammed out every Wednesday since March 2007 using a variety of enticing disguises, but cyber criminals [are now spamming] any time and day of the week.”

Jolie and Berry join the list of celebrities exploited by bot masters, which includes Brittney Spears and Paris Hilton who were used to deliver an .ANI animated cursor exploit and an IRC worm.

The number of infected spam e-mails gained .02 percent through the August-September period, accounting for one in every 833 e-mails.

Sophos detected 5,400 new Web pages hosting malicious code each day in September.

The two most prolific attack vectors, according to Sophos, are the Mal/Iframe and ObfJS which represent more than 75 percent of infected Web pages.

The attacks exploit browser vulnerabilities to surreptitiously run malicious scripts and download malware.

The company’s top 10 e-mail-borne attacks for September include W32/Netsky, Troj/Pushdo, W32/Mytob and W32/Zafi.

By Darren Pauli, Computerworld Australia