<?xml version="1.0" encoding="UTF-8" ?>
<?xml-stylesheet type="text/xsl" href="http://pandalabs.pandasecurity.com/utility/FeedStylesheets/rss.xsl" media="screen"?><rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:slash="http://purl.org/rss/1.0/modules/slash/" xmlns:wfw="http://wellformedweb.org/CommentAPI/"><channel><title>PandaLabs : Rickroll</title><link>http://pandalabs.pandasecurity.com/archive/tags/Rickroll/default.aspx</link><description>Tags: Rickroll</description><dc:language>en</dc:language><generator>CommunityServer 2.1 SP2 (Build: 61120.2)</generator><item><title>Ever heard the term "Rickrolling"? Malware distributors have...</title><link>http://pandalabs.pandasecurity.com/archive/Have-you-ever-heard-the-term-_2200_Rickrolling_22003F00_-Malware-distributors-have_2E002E002E00_.aspx</link><pubDate>Mon, 09 Feb 2009 10:21:00 GMT</pubDate><guid isPermaLink="false">b262f9bf-63e5-46e5-8a14-4069a6997bc7:961</guid><dc:creator>Sean-Paul Correll</dc:creator><slash:comments>0</slash:comments><comments>http://pandalabs.pandasecurity.com/comments/961.aspx</comments><wfw:commentRss>http://pandalabs.pandasecurity.com/commentrss.aspx?PostID=961</wfw:commentRss><description>



&lt;p&gt;&lt;strong&gt;Rickrolling&lt;/strong&gt; is an Internet meme typically involving the music video for the 1987 Rick Astley song &amp;quot;Never Gonna Give You Up&amp;quot;. The meme is a bait and switch: a person provides a web link that he or she claims is relevant to the topic at hand, but the link actually takes the user to the Astley video.&lt;br /&gt;
&lt;/p&gt;

&lt;p&gt;Over the past few months we have noticed attacker efforts to maximize blackhat SEO tactics and increase infection rates at the same time by abusing the popular social news aggregate site &lt;a href="http://www.digg.com" title="Digg"&gt;Digg.com&lt;/a&gt;. Digg allows users to create, vote, and comment on news stories.&lt;/p&gt;

&lt;p&gt;  Malware distributors have been creating false stories with catchy subject lines as an attempt to bait users into clicking links which lead to Malware. In some cases the attackers do not create the news story themselves, rather linking to others relevant content. Below is an example of the attacker (in red) taking advantage of a valid digg submission. The malicious comment reads, &amp;quot;Heath Ledger naked in the shower, playing with herself.&amp;quot; and is posted to a relevant story about Heath Ledger. The &amp;quot;playing with herself&amp;quot; part is a bit confusing but my guess is that the attackers are using automation scripts to auto-generate content based on topic relevancy or that they are manually doing this and have no idea who Heath Ledger is.&lt;br /&gt;
&lt;/p&gt;

&lt;p&gt;&lt;img alt="Example on Digg" height="513" src="http://support.us.pandasecurity.com/blog/digg_example.png" width="679" /&gt;&lt;/p&gt;

&lt;p&gt;My initial search identified 52 accounts posting news stories or comments with malicious URI&amp;#39;s. The links all point to various fake codec sites, which lead to rogue anti-malware infections.  We detect and block the malware as &lt;strong&gt;Adware/VideoPlay&lt;/strong&gt;.&lt;br /&gt;&lt;/p&gt;&lt;strong&gt;Update:&lt;/strong&gt;  &lt;a href="http://ddanchev.blogspot.com/2009/02/fake-codec-serving-domains-from.html"&gt;Dancho Danchev&lt;/a&gt; reported that there has been over 500,000 malicious comments posted via Digg since last year.  

&lt;p&gt;&lt;strong&gt;Some of the titles include&lt;/strong&gt;: &lt;/p&gt;

&lt;blockquote&gt;
&lt;p class="style1"&gt;&lt;sub&gt;Christian Bale freak out dubbed with video!&lt;br /&gt;
  Christian Bale Terminator Salvation Takes it Up the Ass&lt;br /&gt;
  Hot and sexy model Mayuko Lwasa in bikini &lt;br /&gt;
  Pregnant Ujwala Raut in Bikini&lt;br /&gt;
  megan fox naked secret videos&lt;br /&gt;
  Sexy Megan Fox having sex Sex Tape, rally nice and hot video&lt;br /&gt;
  Megan Fox naked NEW SEX TAPE &lt;br /&gt;
  Robert Pattinson: fotos, v&amp;iacute;deos, hist&amp;oacute;ria&lt;br /&gt;
  Jessica Simpson Hotel Sex Tape&lt;br /&gt;
  Batman is Naked aka Christian Bale &lt;br /&gt;
  Watch Grey&amp;#39;s Anatomy Season 5 online here&lt;br /&gt;
  Breaks Season 4 Episode 9&lt;br /&gt;
  Emma Watson Nude Video&lt;br /&gt;
  Watch Emma Watson Sex Tape online here&lt;br /&gt;
  Paris Hilton Sex Tape Update&lt;br /&gt;
  VANESSA ANNE HUDGENS NUDE, NAKED GALLERY, EXCLUSIVE 2009&lt;br /&gt;
  Naked Truth on Celebrity News and Edison Chen Sex Scandal&lt;br /&gt;
  Paris Hilton sex tape! Paris Hilton nude, naked movie!&lt;br /&gt;
  Celebrity and Angelina Jolie nude, naked, in bikini, gallery&lt;br /&gt;
  Tila Tequila topless nude and naked sex-porn gallery&lt;br /&gt;
  Alyssa Milano nude, naked, sex tape - free gallery!&lt;br /&gt;
  BRITNEY SPEARS NUDE, BRITNEY SPEARS NAKED &amp;amp; SEX TAPE (CLICK HERE)&lt;br /&gt;
  Lindsay Lohan&amp;#39;s nude Marilyn shoot&lt;br /&gt;
  Heath Ledger naked in shower, playing with herself!!&lt;/sub&gt;&lt;/p&gt;
&lt;sub&gt;&lt;/sub&gt;
&lt;/blockquote&gt;

&lt;p class="style1"&gt;&lt;strong&gt;Fake Codec Sites:&amp;nbsp;&lt;/strong&gt; &lt;br /&gt;
&lt;/p&gt;

&lt;p&gt;&lt;img alt="Types of Fake Media Codec Pages" height="291" src="http://support.us.pandasecurity.com/blog/media_codecs.png" width="679" /&gt;&lt;/p&gt;

&lt;p&gt;&amp;nbsp;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;New Version of MS Antispyware 2009&lt;/strong&gt; &lt;br /&gt;
&lt;/p&gt;

&lt;p&gt;&lt;img alt="Rogue Infections" height="427" src="http://support.us.pandasecurity.com/blog/rogue_infections.png" width="679" /&gt;&lt;/p&gt;

&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;img src="http://pandalabs.pandasecurity.com/aggbug.aspx?PostID=961" width="1" height="1"&gt;</description><category domain="http://pandalabs.pandasecurity.com/archive/tags/Social+Networks/default.aspx">Social Networks</category><category domain="http://pandalabs.pandasecurity.com/archive/tags/Malicious+links/default.aspx">Malicious links</category><category domain="http://pandalabs.pandasecurity.com/archive/tags/Rickroll/default.aspx">Rickroll</category></item></channel></rss>