Scareware Pushers Go Political and Target US Midterm Elections

A new black hat search engine optimization (BHSEO) campaign, used to push scareware programs, has poisoned search results related to the upcoming US midterm elections.

The 2010 US general elections will take place today and a lot of people are expected to go online and check out polls and other information.

Security researchers from security vendor Websense, warn that popular search keywords and phrases related to this important event have been targeted in new BHSEO attacks.

These include, for example, "2010 midterm election", "midterm election results", "midterm election latest polls", "midterm election season" or "midterm election latest polls gallup."

Black hat SEO involves artificially inflating the Google PageRank of malicious pages, with the purpose of pushing them at the top of search results for particular terms.

Such campaigns are commonly targeting important events, which attract the interest of a large number of people, and are usually used to spread scareware.

Scareware, also known as rogueware, is a term referring to rogue applications, that pose as antivirus programs, with the purpose of tricking people into paying for useless license keys.

They achieve this by scaring users with fake security alerts about fictitious infections allegedly found on their computers.

The Web pages distributing these programs employ similar techniques and they usually display fake antivirus-like scans, after which they serve executable files for download.

In this case, the file is called inst.exe and installs a variant of a notorious scareware application known as SecurityTool. It is currently detected by 10 out of 43 antivirus engines on VirusTotal.

"If you put the pieces together, the black hat SEO'd sites + blank redirect page + blank redirect page containing a URL leading to rogue AV sites, we can now conclude that the bad guys are actively prepping these Web sites for deployment tomorrow when the actual elections happen," the Websense researchers wrote yesterday.

"As always, be extra-cautious when clicking links, particularly those related to hot and trending topics and events," they advise.