Social engineering is the art of manipulating people’s behaviour. Some malware authors rely on social engineering to disguise their code and get it executed on a user’s machine. A key element of a successful malware campaign, which relies on social engineering to lure its victims, is the visual appeal of the attack. Under the right circumstances, a malware which is strikingly similar to a file it is trying to impersonate, is more likely to get executed by a naive user.
Fake Anti-Virus malware authors, for example, are known to put in considerable effort to make their scare ware messages look more authentic. We had blogged about one such sample, which even goes to the lengths of copying malware descriptions from security vendors’ websites, in order to get the user into executing it.
Recently, we came across a website which takes this visual aspect of social engineering quite seriously. The site under discussion, www.vista.[Removed] claims to provide a number of [already freely available] applications for download. Here’s a brief list of the files that were distributed from this site over the last week:
- Divx.exe
- MySQL.exe
- VideoLAN.exe
- WinPcap.exe
To boost the chances of having the files downloaded and executed, each software listed in the site has a brief description of itself, screen shots, user reviews, comments etc. It appears that the author of the site has spared no expense, at least in terms of effort, in plagiarizing the content from other genuine software distribution sites, making the site appear as legitimate as possible, to lure people into downloading and executing the files.
Not all that glitters is gold though. Closer inspection reveals that all files downloaded from this site are around 2.5 MB in size and on execution, the files prompt the user to send an SMS to a premium rate number, from which a reply is sent back with a code to unlock and install the applications. While the files don’t do any damage to the user’s computer, the innocent user still ends up getting charged for the premium rate SMS that was probably sent. One can only assume that this site could be a landing page for a broader attack scheme.
Social engineering (not to be confused with social networking!) based on PEBCAK (Problem Exists Between Chair And Keyboard) is a very potent weapon for effecting malware execution on various operating systems, including those on mobile devices such as Android. It thrives on temptation, ignorance, and fear on the part of the victim. Even though descriptions of social engineering are ubiquitous and some may consider the topic to be mundane, we at K7TCL feel it our duty to keep the general public at large informed about the use and abuse of social engineering so that users are less likely to be seduced by malware authors. Do not invite the thief through your front door.
Image Courtesy of www.publicdomainpictures.net
Lokesh Kumar
K7TCL
