IT security: Fake ad, fake program download and virus combine to cause problems

Someone - as yet unidentified - posted a fake advert on auction site TradeMe.co.nz. The advert was ostensibly for Lonely Planet but when visitors clicked on it, they were taken to a link that told them they had a virus on their PC. A free fix was offered and, when users clicked on the download link, what arrived was - a virus.

Trade Me are the innocent victims but it's their reputation that is at risk.

Trade Me say "

In the last couple of days we’ve seen another little piece of evilness target Trade Me. It’s a combination of malicious software and advertising (“malvertising”). This involves cyber-criminals using an on-line advertisement to distribute malware.

"We have processes in place to prevent ads like this appearing but unfortunately this week one sneaked through. We’re sorry that it happened...

"It will only have affected members who: (i) saw the ad; (ii) have an out-of-date browser or operating system; and (iii) have out-of-date (or non-existent) anti-virus software. As soon as we became aware that the ad was causing issues for members we immediately removed it."

The potential for such activity as greatly increased with the growth of comments in blogs and bulletin / discussion boards often known as "Forums." (sic).

The ruse is simple: criminals look out for people asking for help with a specific problem. Often these people are too lazy to research possible solutions from authoritative sources or are technologically behind the curve, often for good reason such as age or working outside their capability.

Both groups are targets for criminals who post purported responses and give a link to a download or to another website which will either perform a drive-by-download or require some kind of registration including personal information and then a download - perhaps a key-logger and trojan.

Trade Me has been up-front and honest that it was targeted by criminals. But in truth, the exponential growth of blogging and forums means that the prospect of similar attacks, from website owners that do not watch what is posted, are substantially increased.