Hoaxes can be used by crooks to deliver malicious software

Sep 5, 2014 09:16 GMT  ·  By

Twitterers started spreading the news that actress Betty White, aged 92, passed away at her home in Los Angeles, after misreading the title of a satirical piece, mistaking “dyes” for “dies.”

The title of the news is “Actress Betty White, 92, Dyes Peacefully In Her Los Angeles Home,” which, in all fairness, could be misinterpreted that the celebrity breathed her last at a quick glance.

But going deeper into the article reveals that the actress is not actually a natural blonde and constantly dyes her hair. An alleged statement from her representative is even included, saying that she is in fact a brunette and appealed to changing her hair color for decades.

Since the information was published on satirical website Empire News, this cannot be taken as the truth. Their disclaimer is clear, saying that “is a satirical and entertainment website. We only use invented names in all our stories, except in cases when public figures are being satirized.”

The potential security risk is obvious in this case, as many twitterers fell for the double hoax and expressed their regrets on the microblogging platform.

The fact that they did not even check the news article is even more concerning since cybercriminals can take advantage of such gross negligence and steer them to malicious online locations serving malware.

Crooks already have a malware distribution network set up, and all they need is to direct gullible users to the location where exploit kits and malware are hosted. Disguising the malicious files is not a difficult task and it has been employed successfully for years.

A single tweet from user @teri423, revealing the title of the fake news piece, did not prevent others from falling for the trick, as they still expressed sadness in the replies.

On the bright side, plenty of those viewing the title noticed the mistake and were quick at pointing it out. However, global access to a communication platform implies that plenty of the visitors cannot spot the language details, and believe the hoax.

Social engineering is known to be a well-honed skill for cybercriminals, so they could create a better hoax to catch readers into a trap.

Even if the security systems of the platform used to spread the fake news catches the malicious attempt, this cannot be done right away, and as is the case with phishing, crooks have an opportunity of at least a few hours to make some victims.

The advice in such cases is to check for details on reputable news outlets before believing the news. This is especially important when the links are shortened.