Storm Worm spreads YouTube spam

We've all certainly done something stupid that could've got caught on film or video.

It used to be that such footage could only be spread as many times as the photo or video tape could change hands or be copied.

Now, in the digital age, it's possible to do something silly and have it reach into all areas of your life. Video footage of the offending event can easily be posted to YouTube and seen by friends, family, employers and even potential lovers.

So when someone sends you an email with a link claiming to point to incriminating footage of yourself that's been posted to YouTube, you're almost certainly going to click on that link.

That's what the senders of the latest wave of spam utilizing the Storm Worm are counting on. It contains a link that appears to go to YouTube. However, links in email can easily be forged, and in this case they are.

The link really goes to an IP address that renders a site that looks like a bad imitation of YouTube. The video for some reason won't play. However, they offer a remedy for this situation. You just need to download "video.exe" to get things working. If you download and run that file, you'll quickly find your system infected with the worm. Soon, your system will also be sending out emails to others claiming they're featured in less-than-flattering videos.

Detecting these forged links is something that all anti-spam email programs really aught to be able to do. The code would simply have to recognize that the "anchor text" for the link contains the string "HTTP" however the following characters don't match with where the link really goes to. SpamButcher doesn't have this functionality yet, but we're working on it.

Back