A site that allows visitors to embed content in their AIM buddy profiles is being exploited by malware and adware distributors who create profiles laden with links to unwanted content.
Adult and other undesired content have been the choice of malicious parties who are trying to capitalize on a younger audience and gain access to their systems. Getting in front of a tech-savvy but less security-conscious audience has led to various enticements, the latest of which targets AIM users.
McAfee researcher Alyssa Myers noted what her colleagues at SiteAdvisor had found at BuddyProfile.com:
A SiteAdvisor crawl today turned up some profiles on BuddyProfile.com which immediately redirect the user to an adult site, which points to a file which is detected as Exploit-ANIfile, which is being used to install Adware-PestTrap which then displays "security warnings" to the user.
Just to recap:
1) Popular site, frequented by a large number of kids
2) Allows users to add their own HTML content
3) HTML content is being used on profiles to redirect people browsing this site (presumably said kids) to porn and surreptitiously-installed adware programs
Yuck. Seriously.
Chris "Paperghost" Boyd of Vitalsecurity.org told SecurityProNews this sort of abuse via sites like BuddyProfile is not uncommon:
Any site that lets the users dictate the content could launch attacks like the ones mentioned. For example, we recently saw people phishing for login details using the Myspace domain itself - rather than direct users to a fake login page hosted elsewhere, they'll create a fake profile, overlay it with something that requires you to login to the page and steal your Myspace details. The end user likely wouldn't have a clue that they had been scammed, and exploiting social networking sites in this way will continue to be a growing problem for the foreseeable future.
An AOL spokesperson said neither AOL nor AIM endorse BuddyProfile, and cautioned AIM users on avoiding clicking links in unfamiliar profiles. BuddyProfile had not replied to a request for comment by press time.
iEntry 10th Anniversary
RSS
Archive
Del.icio.us
Digg
Reddit
Furl
