The FarmVille ‘Three Spring Eggs’ virus is a hoax

Panic is spreading quickly amongst FarmVille’s many online players following internet reports of a virus connected with sharing three eggs.

 

The Facebook farming simulation game, which is a huge hit on Facebook with over 80 million regular players, is currently being dogged with false reports that a virus is spreading via links which offer gamers the ability to send three eggs at once.

 

A typical warning being spread by concerned FarmVille players reads as follows:

RED ALERT!!! Norton has just informed me that the post for Send the 3 spring Eggs at a time is a virus, Rawand Bradosty is a HACKER from Pakistan, do not click on this post it is not legitimate, please copy and repost immediately.

The truth, however, is that we have not seen any virus being distributed in this manner and Rawand Bradosty appears to be having his name tarnished without justification. In fact, it could be argued that the warning is causing much more disruption and time-wasting than a genuine virus outbreak would ever have done!

Of course, you should always be careful about clicking on unsolicited links as they could lead you to page containing malicious content or a site designed to phish credentials from you. And you should ensure that you have up-to-date security on your computer, checking every link that you click on. But in this case, the scare has got out of hand and is proving to be a hoax that is hard to stamp out.

 

Do your bit – don’t forward virus alerts to your friends and family until you have confirmed that the alert is real with a reputable security company. Otherwise, you could be just helping to keep a hoax alive.

 

Don’t forget, if you’re on Facebook you may want to become a Fan of Sophos on Facebook to help stay up-to-date with the latest security news.

 

By Graham Cluley, Sophos

 

 

Malware attack spammed out disguised as email settings file

Sophos is intercepting a large number of malicious emails that have been spammed out around the world, posing as a new settings files for internet users’ email systems. However, attached to the emails is a Trojan horse.

 

Each email is carefully disguised in an attempt to lure the recipient into believing they are genuine. For instance, they use the recipient’s email address in the subject line and pretend to come from the support team at the recipient’s email domain:

A typical malicious email reads as follows (I’m assuming the user’s email address is username@example.com below):

Subject: A new settings file for the username@example.com has just be released

Attached file: settings.zip

Message body:
Dear use of the example.com mailing service!

We are informing you that because of the security upgrade of the mailing service your mailbox username@example.com settings were changed. In order to apply the new set of settings open zip attached file.

Best regards, example.com Technical Support.

Although the hackers behind this attack have clearly put a little thought into how they might infect as many people as possible, they have made some grammatical mistakes which may tip off potential victims that the emails are not genuine.

For instance, the subject line of

A new settings file for the username@example.com has just be released

is very clumsy.

 

Attached to each email is a file called settings.zip, which contains a copy of the Troj/Bredo-BE Trojan horse.

 

Stay on your guard against attacks arriving via email. Although we see many web-based attacks these days, the rumours of the death of email-based malware are greatly exaggerated.

 

By Graham Cluley, Sophos

 

 

Microsoft Warns of IE Exploit Code in The Wild

Microsoft on Monday said it is investigating a possible vulnerability in Internet Explorer after exploit code that allegedly can be used to take control of computers, if they visit a Web site hosting the code, was posted to a security mailing list.

Read more

Critical flaws fixed in Firefox 3.5.4

If your a user of the Firefox web browser then it’s time to update your software again, as Mozilla has issued an important update that fixes a number of critical flaws.

 

In total, 16 vulnerabilities are patched in Firefox 3.5.4 – with 11 given the highest rating of “critical”. What does that mean? Well, according to Mozilla’s own website a “critical” vulnerability is one which “can be used to run attacker code and install software, requiring no user interaction beyond normal browsing.”

 

In other words, critical vulnerabilities can be used to invisibly install and run malicious code on your computer – such as a Trojan horse or worm.

 

As we revealed in the Sophos Threat Report [PDF] published earlier this year, SophosLabs sees in excess of 23,000 new malicious webpages every day – infected with the intention of compromising your computer. So it’s really important that alongside running up-to-date with anti-virus software, you ensure your web browser – whether it be Firefox, Internet Explorer, Safari, Opera, or something else – is protected with the latest patches.

 

The update is now available from the Mozilla website, but hopefully most existing users will be pestered into updating by Firefox’s auto-update facility.

 

Firefox’s security is becoming ever more important as it creeps up on Microsoft Internet Explorer’s pole position as number one browser for the web. It is estimated that there are now over 330 million users of Firefox - more than the population of the United States!

 

by Graham Cluley, Sophos

 

WARNING: “98B351″ AMBER Alert Hoax Still Spreading on Twitter, Facebook

A very resilient hoax is making the rounds on Twitter and Facebook. It consists of a message that poses as an AMBER Alert about a 3-year-old kidnapped boy. The message further claims the boy has been kidnapped in a Mitsubishi Eclipse with the registration plate “98B351“, and many users have fallen for it, spreading it further via Facebook, Twitter, and SMS.

According to IT security company Sophos, the message is nothing more than a hoax, but the said license plate number is already ranking high among the most commonly searched terms on the internet, which means the hoax is working. Don’t fall for it!

A quick search on the reveals there are currently no active AMBER Alerts. Interestingly, this hoax has been making the rounds for several weeks, but – as hoaxes often do – it seems to now be resurfacing stronger than ever. An AMBER Alert is a child abduction alert issued upon the suspected abduction of a child; the best way to check if it’s real is to go straight to National Centre for Missing and Exploited Children’s website.

 

by Stan Schroeder from mashable.com