The New York Times
July 16, 2009, 8:14 pm
[ invalid url ]
By Brad Stone
Some Internet bad guys are exploiting heightened interest in the new Harry Potter movie to further their devious plot to take over the Web.
Their target is people who can be enticed to illegally watch a copy of the new film on the Web. (So perhaps there is some kind of perverse vigilante justice at work here.)
PC Tools, a security company bought by Symantec last year, described the attack Thursday on their ThreatFire blog.
The company says the bad guys are populating sites like Digg.com and Blogspot and sending spam e-mail with enticements to “‘Watch “Harry Potter and the Half-Blood Prince online free” and links to a bogus film site. They are also flooding the comment sections of these sites with various Harry Potter related keywords, to try to trick search engines into displaying their site in search results.
People who fall for it and visit the bogus film site are then treated to a barely credible Harry Potter page on Google’s Blogspot service (although PC Tools says the location of the site changes) with images from the movie. (Here’s a screenshot.)
And finally, for the people who are both gullible and simply cannot wait to see the movie in the theater, clicking further on the page prompts a download of a file called “streamviewer,” and well, you can imagine what happens from there. PC Tools reports that the victim’s computer is visited by a rotating selection of choice malware, including the koobface worm.
“This is headline malware,” said Mike Greene, vice president of product strategy at PC Tools. “When Michael Jackson passed away we saw a surge around that. Whenever you see a headline, you can be pretty confident you will find some hot malware.”