Skip to navigation
Latest News

Sophos: malware mimicking Windows Updates

  • security
  • msfake

By Stewart Mitchell

Posted on 9 Jun 2011 at 09:37

Security experts are warning against malware that's dressed up as Microsoft Updates.

According to security firm Sophos, criminals are looking for increasingly believable ways to persuade consumers to download fake antivirus and mimicking Microsoft's own security is their latest wheeze.

“We are seeing the criminals behind fake antivirus continuing to customise their social engineering attacks to be more believable to users and presumably more successful,” said Chester Wisniewski on the Sophos blog.

“This week they've started to imitate Microsoft Update.”

msfake

According to Sophos, the drive-by page is an exact replica of the real Microsoft Update page, but only appears on Firefox, which is a giveaway that something is wrong.

“It only comes up when surfing from Firefox on Windows,” said Wisniewski. “The real Microsoft Update requires Internet Explorer.”

According to Sophos, the attacks are becoming increasingly complex and targeted and users need to start thinking about communications from software providers with the same level of suspicion previously reserved for fake bank emails.

“They use high quality graphics and are using information from UserAgent strings that are sent by the browser to customise your malware experience,” Wisniewski said.

“Just like visiting your bank, you should only trust security alerts in your browser if you initiated a check with Microsoft, Adobe, or any other vendor for updates to their software.”

Subscribe to PC Pro magazine. We'll give you 3 issues for £1 plus a free gift - click here

From around the web

User comments

eh?

I wasn't even aware you could get to windows update via any browser since XP?
(although my vista experience is what it should be... near zilch... as far as I know it doesn't work like that on vista either)

By Anonymouse on 9 Jun 2011

Why only Firefox?

Is it some exploit in FF that makes this appear? Does it appear in Opera, Safari, et al too?

Surprised it's taken so long to imitate the XP Update page for that matter - Didn't the malware guys want to infringe copyright?

By greemble on 9 Jun 2011

That will teach me...

To comment on new articles before my 5th cup of coffee.

I honestly thought this was an imitation of the 7 update screen.

*hangs head in shame*


I'll get my coat!

By Anonymouse on 9 Jun 2011

I blame Apple! says another SwissMac in a parallel universe

Can't see that it would be limited to FF only. All the netscape based browsers would be affected surely.

By mr_chips on 9 Jun 2011

I have to say...

I really dis-like all the posts I see baiting 'SwissMac'.

Thankfully, he/she? either doesn't see them or chooses to ignore the obvious-almost-trolling posts I see every day.

By Anonymouse on 9 Jun 2011

You means you don't think their posts aren't "obvious-almost trolling2?

By Ex_Sailor on 9 Jun 2011

Not really, no.

From what I see; SwissMac makes posts against window users in general and chamions the Mac at every oppurtunity.

Much like myself and many others who are not averse to calling out the fanbois on any number of things and promoting the benefits of MS's OS's but I rarely if ever see out of the blue posts made directed towards named single users.

I have to say, I could list the number of subjects I agree with swissmac on the back of a postage stamp, but he/she makes well versed and quite articulate points and I respect that.

There's an old forum saying/rule I like...

Attack the post, not the poster.


This is just the way I view it, and I would like to point out it is likely some of you have been here for much longer than me and maybe have a rappor with swissmac that I don't see.

It just reads sometimes like people try to use him/her as a scratching post to play with.

By Anonymouse on 9 Jun 2011

@Anonymouse

I would wager that most of us here are not adverse to Apple at all, just to their indoctrinated and brainwashed zealots who take every opportunity to not only champion Cupertino's cause, but also belittle everything else out there. And SwissMac is a rather extreme example of one of those.

It's not your average Apple user who posts "luckily Apple had already negotiated component prices" as the first reaction to the Japanese disaster.

In any case, he's normally the first one here to gloat and caw over MS/Android/Linux/anything issues, so he's rather brought this on himself :)

By TheHonestTruth on 10 Jun 2011

Truth

I didn't say that most here are averse to apple, I said...

"Much like myself and many others who are not averse to calling out the fanbois "


And you just said it yourself...

He 'gloats and caws' over MS/Andrioid/Linux.

That's different than the poster above baiting him by name.


I get the feeling you choose to ignore crucial aspects of posts you reply to, or maybe you just need to read tposts more carefully before ouy reply?

By Anonymouse on 10 Jun 2011

Gadzooks.

Please read my post more carefully. I never said (nor did I intend to say) that you said people here were averse to Apple. I was simply illustrating my point as to why SwissMac brings this particular reaction onto himself. Crikey.

Like how you realise I am staunchly anti-hacking and mentioned me by name in another thread long before I had posted. For the most part, it's all light-hearted and made/taken in good spirited fashion (except, it seems, by you!)

By TheHonestTruth on 10 Jun 2011

Hmmm?

I see you are choosing to ignore the bit where I said maybe there is a rappor I am not seeing.

Not to mention naming you was clearly not done in the same light as the posts directed towards Swissmac.

However, I will be sure not to address you in my posts in future.

My apologies if I caused any upset.

By Anonymouse on 10 Jun 2011

@Gadzooks

The BIG problem with SwissMac is that they are the equivalent of some one in a full theatre shouting fire ~ when there is none.

They are not needed or wanted...they are an unsafe person to be with.

Mark

By mprltd on 11 Jun 2011

@Gadzooks

The BIG problem with SwissMac is that they are the equivalent of some one in a full theatre shouting fire ~ when there is none.

They are not needed or wanted...they are an unsafe person to be with.

Mark

By mprltd on 11 Jun 2011

mprltd

You have just proven my point exactly.

If somebody posts what you think is nonsense... then post an opposing view.

There is no need to insult the poster.

By Anonymouse on 11 Jun 2011

Gadzooks2

And, you're choosing to ignore the bit when I very clearly stated that my post was purely to inform you of the “rappor” that you were not aware of. Again, I was simply illustrating to you, as you indicated you did not know, why so many people find him irksome. Ie: absolutely no "ignoring" on my part. Crikey!

And, yes, I do believe that naming me was exactly in the same light as people name SwissMac. No offence was taken, as I’m sure he doesn’t take any either – we’re all very used to this! ;)

By TheHonestTruth on 13 Jun 2011

Leave a comment

You need to Login or Register to comment.

(optional)

advertisement

More From PC Pro
Latest Blog Posts Subscribe to our RSS Feeds
Latest ReviewsSubscribe to our RSS Feeds
Latest Real World Computing

advertisement

Sponsored Links
 
SEARCH
SIGN UP

Your email:

Your password:

remember me

advertisement


Hitwise Top 10 Website 2010
 
 

PCPro-Computing in the Real World Printed from www.pcpro.co.uk

Register to receive our regular email newsletter at http://www.pcpro.co.uk/registration.

The newsletter contains links to our latest PC news, product reviews, features and how-to guides, plus special offers and competitions.