Tech a byte

While thousands of people lined up the streets in Manila to witness the funeral procession of former Philippine President Corazon C. Aquino, millions of Filipinos here in the country and in other parts of the world are deeply relying on television and mostly on the Internet in keeping them up-to-date on the latest news on the last farewell of the "Icon of Democracy". That is why cybercriminals are taking advantage by exploiting the news from Cory Aquino's death up to her funeral day by poisoning search engine results that leads to malicious links and redirect users to malware distribution sites. These Blackhat SEO attacks are not new as these were used even on the deaths of famous people like Michael Jackson and Farrah Fawcett. Here are some additional search queries or words that I used to locate suspicious websites similar to what Trend Micro Labs has found:


"corazon aquino funeral"
"corazon aquino burial"
"cory aquino funeral"
"cory aquino burial"


Security experts advise users to exercise extreme caution in searching for related news and information. Keep antivirus up-to-date and not to click or try to visit unknown websites even if the links are posted in emails, tweets, live streams and social networking sites.

Google currently listed Datablitz.com.ph - the books, games and software distributor - as a 'Suspicious' site that may harm its visitors' computer. According to the Safebrowsing Diagnostic Page report, the malicious software is hosted on 1 domain, davtraff.com.


On the other hand, the Unmaskparasites report indicates two catalog index pages of Datablitz suspected to have malicious content. Website Administrators should constantly check the site and ask Google for a Malware review if listed as a suspicious site to avoid panic on its visitors.

Update:
(8/17/2009): Datablitz.com.ph is now unlisted in Google SERP as a 'suspicious' site.

Check out Twitter's redesigned look on its front page. Cool.

Twitter, the popular social networking and micro-blogging service, has currently took over security by cleaning up spam accounts. With this, you may lose followers who are not 'real people' as these accounts are bots that automatically follow Twitter users expectedly used for spamming, phishing and malware-related distribution.

Yesterday, I have posted that the PRC website was injected with malicious code. And now, Google has tagged the site as 'harmful' as it may hosted malicious software. I can't imagine how risky this will be on its users once the June 2009 Nursing Board Examination Results will be published. AFAIK, there are about 80,000 who took the June 2009 NLE exams.


By looking at Google Safebrowsing Diagnostic report, the malicious code is hosted on two domains -- gamemaill.com and f1y.in. Don't visit these sites.

Updates:

(7/19/2009): Site is currently offline.
(7/25/2009): Site is up and running. However, the malware warning in Google has not yet removed.
(8/27/2009): Malware warning was removed.
(9/2/2009): Site is again listed as 'suspicious'.
(9/4/2009): Malware warning was removed.