Traces of guilt

By John Leyden

9th November 2009 11:46 GMT

Free whitepaper – Creating an AUP: Common myths and mistakes

Innocent people have been branded as child abusers after malware infected their PCs, an AP investigation has discovered.

Technically sophisticated abusers sometimes store images of child abuse on PCs infected by Trojans that grant them illicit access to compromised machines.

The plight of those framed in this way is all the worse because paedophiles commonly use supposed malware infections of their PCs to explain the presence of images of child abuse. Because of this the "Trojan did it" defence is understandably met with scepticism from law enforcement professionals.

"It's an example of the old `dog ate my homework' excuse," says Phil Malone, director of the Cyberlaw Clinic at Harvard's Berkman Center for Internet & Society told AP. "The problem is, sometimes the dog does eat your homework."

AP interviewed former child abuse suspects who were arrested after depraved images were found on their computers, as well as police and computer forensic experts.

Michael Fiola, a former Massachusetts government worker, was arrested two years ago after child abuse images were discovered on his state-issued laptop computer after officials became suspicious of huge data use bills associated with the machine and began an investigation. He was eventually cleared nearly 11 months later after defence experts were able to show that the laptop harboured malware programmed to visit as many as 40 child porn sites per minute, far faster than a human surfer would be able to accomplish.

Forensics experts hired by the prosecution agreed with these findings and the case, which had nearly ruined Fiola's life, was dropped.

Fiola was fired from his job before enduring death threats and losing friends. His wife stood by him, however, and the couple were able to raise a $250,000 legal defence fund after selling their car, cashing in their savings and re-mortgaging their home. "It ruined my life, my wife's life and my family's life," Fiola told AP.

A cap on the amount of damages they might receive has effectively prevented the Fiolas from suing the state.

Child abuse webmasters sometimes use either compromised consumer or business systems as a warehouse for child abuse images and videos. Paedophile images can also land on systems as the result of a nasty prank or as an act of deliberate sabotage.

Two UK men were cleared of child-abuse offences in 2003 after it was shown that computer viruses were behind the presence of child abuse images on their PCs. One of the PCs was infected by a virus that changed the home page of the Windows machine to a child porn site. The other man's machines was infected by a virus that downloaded images of child abuse.

One of the two unnamed men lost custody of his seven-year-old daughter and spent a week in jail on remand because of the case.

In another case Chris Watts, a British computer forensics expert, helped clear a hotel manager whose colleagues found child porn on a shared workplace PC. The manager had been looking for ways to download pirated computer games when his web session was redirected to a child abuse site.

More details on the cases and discussion of the issue can be found here.

When Facebook attacks, it’s not pretty. We were just remarking on how new ways of spreading malware were plaguing social media, and now the second Facebook-related scam in the past week appears to be spreading.

Have a look at the picture below, and if you see a profile similar to what you see in the screenshot, do not click on the video link. If you do, you’ll see a similar “malware warning” to that pictured at right. If you keep following the prompts, of course, you’ll then actually be infected as the program pretending to warn you about malware installs its own malware payload.

 

 

 

 

 

 

 

 

 

 

 

 

 

This time the spyware appears to have the ability to create fake Facebook accounts and endow the profiles with these fake links. It’s troubling because it means the hackers have figured out a way to endrun around the captcha system that usually ensures the account creator is a real human.

Until Facebook has a chance to deactivate these rogue accounts, use caution when encountering any profile that looks similar to the above screenshot. Let us know in the comments if you’ve seen any of these fishy profiles in your travels around Facebook today.

Malware and spam are finding new ways to spread across social media. A few days ago, a nasty Twitter Worm spread through DMs. Today, we have received multiple reports that a new worm is spreading via Facebook wall posts and status updates.

The worm makes a post on walls and updates. The text is as follows:

IF YOU SEE THIS POST AND LINK, DO NOT CLICK IT! It is malware and dangerous to your computer. We have found multiple instances of this worm in Facebook’s Real-time search and through reports from our readers and friends.

IF YOU ARE ALREADY AFFECTED: Immediately change your password, delete all of the malware posts, and post a warning to not visit the link in question. We will update this post as we learn more.

Thank you Drew for the heads-up and for the image.

Last week, we reported on the supposed “Facebook Fan Check Virus,” which allegedly spreads malware via Facebook. The app itself promises to tell you who your top Facebook friends are, based on how much they engage with your profile.

As initially suspected, Facebook has confirmed that the app itself isn’t a virus, though this thread on the app’s fan page suggests that it is rather buggy. To that end, Facebook also tells us that they’ve “disabled some of its functionality due to other concerns.”

Nonetheless, the viral spread of misinformation via status updates (likely originating with the virus creators) is leading people to search Google, where many links to malware still exist as malicious sites promise “fixes” that actually install a virus onto the user’s computer.

The bottom line seems to be there’s not much to see here, but don’t (a) be duped into downloading a “fix” for a virus that doesn’t exist or (b) install what appears to be a buggy application that Facebook has at least some issues with.

 

 

 

 

 

 

 

We’ve received tips about a Facebook application called Fan Check; reports say this application is actually a virus, and should be avoided at all costs. We’ve dug a bit deeper, however, and it seems more likely that the rumor about Fan Check (even if the actual virus exists, which we’ve found no proof of) has been used to lead users to various malware and spyware ridden sites.

This alleged virus has only been described on a couple of blogs, such as this one, but we’ve found no reports about it on sites of security firms such as McAfee or Symantec.

The virus supposedly acts in the following way: if you try to access a Facebook application located at apps.facebook.com/fancheck/ (previously called StalkerCheck), you’ll get this message:

“FanCheck is adding new features and new capacity. This could take a few days.
Please become a fan, and we’ll send you an update when we’re back online”

According to sources, merely becoming a fan will “infect” your Facebook account, which is highly unlikely. All other reports about the virus seem to be created by spammers themselves. Google lists the phrase “facebook fan check virus” as a popular trend, but there lies the problem; if you actually try to search for this phrase, you’ll be bombarded by sites containing malware.

We believe that this is merely a two part hoax: on one hand, you have a defunct application that allegedly lets you see who’s been visiting your Facebook profile – which cannot work due to Facebook’s policies, and all applications claiming to do so are scams. On the other, spammers and malicious hackers are feeding the rumors around this application to lead people to search for a solution, and getting their computers infected by malware in return.

In any case, this is what you should do: stay away from Fan Check application – or any other Facebook application that hints at being able to tell you who’s been visiting your profile. Furthermore, don’t search for the “Fan Check Facebook virus,” as it is most likely a hoax.