According to security software provider Panda Security, as many as 4900 videos on YouTube have associated comments that contain links to a webpage designed to download malware.
In yet another example of how cyber crime is being perpetrated through Web 2.0 sites, this continues atrend previously scene on sites such as Digg.com and Facebook.
Says Jeremy Matthews, head of Panda’s sub-Saharan operations: “The comments are normally suggestive, claiming that the link will take users to a legal Web page with pornographic content. However, when users click the link, they are taken to a page that spoofs the original and which is really designed to download malware. On this page, users will be prompted to download a file in order to be able to view the video. If they take the bait, users will really be downloading a copy of the PrivacyCenter fake antivirus.”
The downloaded malware does a fake system scan, supposedly to detect other malware and viruses. It then offers an “upgrade” to the software in order to clean up the system, at a fee. The unwitting victim then pays for the software, which is effectively worthless.
“The technique of using malicious comments on YouTube is not new in itself but what’s alarming is the quantity of links we have detected pointing to the same webpage,” says Matthews. “This suggests that cyber-criminals are using automated tools to publish these comments.”
Users are warned to be cautious of any sites that purport to sell this software, or any software that is downloaded onto a user’s system without express consent.
— Charl Lombard