중국 소셜 네트워크 Renren "Pink Floyd Videoo Worm" 등장!!

AV 전문업체인 Sophos는 중국 소셜 네트워크인 "Renren(중국판 트위터)" 에 Pink Floyd Video Worm이 등장하였다고 블로그에 기록하였다.

전체적인 내용으로 봤을때 AVI 파일에 웜이 삽입되어 있는 줄 알아서 깜놀!!

그런건 아니였고, 동영상을 클릭 할 시 JavaScript로 인하여 XSS (cross-site scripting)이 동작하는 방식이라고 한다.

끝으로 Pink Floyd 동영상을 보려면 DVD를 사거나 Youtube로 보라고 한다!! ㅋㅋ

자세한건 원문으로 확인!!

Sophos's recent Security Threat Report highlighted the growing number of attacks we are seeing via social networks such as Facebook and Twitter. In fact, 21.2% of those polled said that they had been on the sharp end of malware spread via a social networking site.

One thing that is sometimes forgotten, however, is that it's not just world famous social networking sites which can be exploited by cybercriminals. There are plenty of Facebook "clones" (for want of a better word) that have sprung up in countries around the world and have strong local followings.

One such social networking website is Renren, formerly known as Xiaonei Network, which is extremely popular in China with some 40 million registered users (making it more successful than Facebook in the country).

Boris Lau, one of the analysts in our labs, has blogged about a XSS (cross-site scripting) worm that has spread via user profiles on Renren, posing as a video of Pink Floyd's classic song "Wish you were here".

Clicking on the message results in a malicious JavaScript being run on your computer which in turn helps the malware spread further across the social networking site. Sophos detects the worm asW32/Pinkren-A.

(By the way, the Yupoo.com site advertised in the image above is a popular photo-sharing site in China).

XSS vulnerabiliies are nothing new to social networking sites of course, and can be a highly effective way to spread malware quickly.. For instance, earlier this year we saw the Mikeyy worms spread rapidly through Twitter.

So, don't forget, if you're really keen to watch a video of Pink Floyd's classic golden oldie "Wish you were here", your best bet might be to buy a concert DVD or do a quick search on YouTube:

 

Posted on August 25th, 2009 by Graham Cluley, Sophos

원문기사 : http://www.sophos.com/blogs/gc/g/2009/08/25/chinese-social-network-hit-pink-floyd-video-worm/

Sophos 분석 : http://www.sophos.com/security/analyses/viruses-and-spyware/w32pinkrena.html