We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Hackers spoof browser malware warnings

Hoax warnings encourage users to download scareware

Scammers are spoofing the anti-malware warnings of popular browsers to dupe Windows users into downloading fake security software, says Symantec.

Several malicious websites are displaying phony versions of the alerts that Google's Chrome and Mozilla's Firefox present when users encounter pages suspected of hosting attack code, said Symantec researcher Parveen Vashishtha in a blog .

Rather than simply warn users that the page they're about to visit may be dangerous - as do the legitimate alerts - the sham versions also include a prominent message that suggests downloading a browser security update.

In reality, no browser offers its users security updates from its anti-malware warning screen.

Anyone who accepts the update actually downloads bogus software, often called 'scareware' because it bombards users with endless fictitious infection warnings until people pay around £30 to buy the useless program.

Even the cautious can be nailed by these sites. Users who refuse the mock updates are assaulted by a multi-exploit toolkit that includes attack code for 10 different vulnerabilities in Windows, Adobe Reader, Internet Explorer and Java. Windows PCs that have been kept up-to-date with bug patches will be immune from the exploit kit, however.

"Malware authors are employing innovative social engineering tricks to fool users - it's as simple as that," said Vashishtha.

The strategy that Symantec pointed out isn't new. A month ago, Microsoft 's malware protection center warned that fake antivirus scammers were putting up bogus alerts in Internet Explorer, Firefox and Chrome.

"The similarity between the fake warning pages [and the real things] is so accurate that it can trick even highly trained eyes," Microsoft said in early September .

It's no surprise that scareware dealers are constantly looking for new ways to con users into downloading their good-for-nothing software: It's a serious business.

According to the FBI, rogue security makers have made at least $150million by duping the public.

Little wonder, then, that the fake security software industry is huge. During the 12 months from July 1, 2008, to June 30, 2009, more than 250 different phony programs tried to get on more than 43 million machines worldwide, Symantec said in a report issued last October.

See also: The 17 most dangerous places on the internet

IDG UK Sites

Apple WWDC 2015 rumours: iOS 9, OS X 10.11, Apple TV & more

IDG UK Sites

Why I think the Apple Watch sucks and you'd be mad to buy it

IDG UK Sites

Kung Fury VFX behind-the-scenes: how Fido blew up everything for this year's most over-the-top film

IDG UK Sites

What will Apple launch at WWDC 2015, with one week to go? Apple TV, Macs, Beats Music, iOS 9, OS X 1......