Here's another post from our colleagues in Spain (http://www.eset.es): mistakes in interpretation are down to me (David Harley).
We have frequently talked about and shown examples of threats that take advantage of Black-Hat SEO (Search Engine Optimization). This technique (BHSEO) is used by malware authors to position the malicious links in the top results when a potential victim uses certain topical search terms.
ESET's Technical Department at Ontinet.com have mostly seen this technique used to infect users of online games, and more recently, targeting to a much greater extent the many millions of users of social networks that play games.
As already discussed, malicious URLs turn up at or near the top of searches to do with gaming tricks, guides, weapons and a number of improvements, depending on the application. In addition, the text of the link promises user instant gratification and increase in gaming advantage, cultivating the attention of gamers who want to take shortcuts to achieve immediately what might take others days..
Another technique that is in fashion is the development of what are passed off as hacks for social networking games: however, to achieve the promised advantages, the victim must execute a suspicious application or, as in the example we show below, copy javascript code or a URL into a browser, resulting in the download of malicious software applications targeting millions of users of games such as FarmVille or Mafia Wars.
As shown below,the victim may also find himself on a purchase page where, depending on improvements that he may want to achieve, the game incurs some sort of cost , without any guarantee that the buyer will get what he thinks he's paying for..
ESET's technical department at Ontinet.com advises that users of this type of online application use caution. Trying to get somet gaming advantage through untrustworthy channels and resources may result in infection, and we advise you not to trust pages or applications such as those we show in this post, if you come across them..
David Sánchez
http://www.eset.es
Blog: http://bota.me/blogesetspain
David Harley CITP FBCS CISSP
ESET Research Fellow
ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter:
http://twitter.com/esetresearch; http://twitter.com/ESETblog
ESET White Papers Page: http://www.eset.com/download/whitepapers.php
Securing Our eCity community initiative: http://www.securingourecity.org/
Also blogging at:
http://amtso.wordpress.com/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macvirus.com/
http://chainmailcheck.wordpress.com
http://smallbluegreenblog.wordpress.com/
