GLOBALNO

Researchers have uncovered a new social engineering trick that leads users to a malicious extension fromGoogle Chrome impersonating to deliver Adobe’s Flash Player in order to lure victims in a click fraud campaign.

Security experts at TrendMicro believe that the malware is triggered by opening Facebook or Twitter via shortened links provided in any social networking websites. Once clicked, the links may lead victims to a site that automatically downloads the malicious [url=http://thehackernews.com/search/label/chrome extension]browser extension[/url].

MALWARE INVOLVES DOWNLOADING MULTIPLE MALICIOUS FILES

The process is quite complicated as the malware drops a downloader file which downloads multiple malicious files on the victim’s computer. Moreover, the malicious program also has ability to bypass Google's recent security protection added to Chrome against installation of browser extensions that are not in Chrome Web Store.

• manifest.json – contains browser extension description like name, script to load, version, etc.
  
  
• crx-to-exe-convert.txt – contains the script to be loaded, which can be updated anytime by connecting to a specific URL.
  
  

“The site is written in Turkish and phrases such as ‘bitter words,’ ‘heavy lyrics,’ ‘meaningful lyrics,’ ‘love messages,’ and ‘love lyrics’ appear on the page. This routine could be a part of a click fraud or redirection scheme,” fraud analyst Sylvia Lascano of the security firm Trend Micro said in ablog post.

Likes.com, one of the emerging social networking site and popular image browsing platform, is found vulnerable to several critical vulnerabilities that could allow an attacker to completely delete users’ account in just one click.

Likes.com is a social networking website that helps you to connect with people you like and make new friends for free. Just like any other social place, users can always follow their favorite tag or people who catch their fancy. It is much easier to use and is designed for those who want to look at pictures different people upload.

An independent security researcher Mohamed M. Fouad from Egypt has found a series of critical security vulnerabilities in the Likes website that really pose danger to its users. The vulnerabilities he found not only have capability to add any post, comment to users’ account as well as delete users’ account, but the vulnerabilities can be escalated to deface entire website by posting malicious URLs and delete all users accounts.

“It's so easy, I tried it but in some testing accounts. I was able to generate my malicious url in all posts by image_id (Post) then my malicious url was in thousands of posts as a comment. So any user who click it, his/her account will be deleted immediately,” Fouad told The Hacker News.

“Using same CSRF vulnerability, I can also force the user to post my malicious URL to his/her account, so that all his/her friends who will browse that link, their accounts will be deleted by just one click.”