Switched has a new home! Huffpost Tech.

Click here to visit the new home of Switched!

Hot on HuffPost Tech:

See More Stories
AOL Tech

Fake Facebook 'Password Reset' E-Mails Hiding Malware

by Terrence O'Brien on October 27, 2009 at 03:57 PM


Facebook's good name is being leveraged for yet another brutal round of malware dispersal. The trojan, Bredolab, is being distributed via e-mails with the subject line "Facebook Password Reset Confirmation". The message generally reads:
Hey (insert username),
Because of the measures taken to provide safety to our clients, your password has been changed.
You can find your new password in attached document.

Thanks,
The Facebook Team
The attachment, a .zip file, will have the name "Facebook_Password_" followed by a short sequence of random numbers and letters. Inside, there is an identically named file, except that it's an .exe (or executable) file instead of an archive. Run that file and you'll be kick-starting a torrent of malware downloads, including a fake anti-spyware program. Bredolab is able to hide by injecting its own code into existing Windows components, and by automatically shutting down if it detects another program (such as an anti-virus package) investigating its activities.

Avoiding infection with this one should be pretty simple, though. First off, if you haven't requested a reset from Facebook, you'll never receive such a message. Secondly, even if you did reset your password, Facebook wouldn't send it to you as an attachment. That being the case, Facebook_Password.zip should be setting off alarms in your head. Anyway, you should really never open attachments in e-mails that you weren't expecting, or that aren't from a trusted source.

If you can remember those three things, you should be safe. [From: Mashable and Facebook and MX Lab]

Tags: bredolab, facebook, malware, scam, security, spam, top, trojan

Comments

7

Add your comments

Please keep your comments relevant to this blog entry. Email addresses are never displayed, but they are required to confirm your comments.

When you enter your name and email address, you'll be sent a link to confirm your comment, and a password. To leave another comment, just use that password.

To create a live link, simply type the URL (including http://) or email address and we will make it a live link for you. You can put up to 3 URLs in your comments. Line breaks and paragraphs are automatically converted — no need to use <p> or <br /> tags.

HuffPost AOL Social News Most Popular