Facebook has removed a scam that was redirecting users to the Nuclear exploit kit, according to researchers with Symantec.
The scam relied on users getting drawn into clicking on a link promoting a work-from-home opportunity with the headline: ‘EXPOSED: Mom Makes $8,000/Month and You Won’t Believe How She Does It!’
“If people believe these jobs are legitimate and click on a Facebook link, they are redirected to a Facebook page,” blogged Symantec researcher Ankit Singh. “This page goes through a series of redirects and ultimately lands on a third-party website containing an iframe for the Nuclear exploit kit. This can allow the attacker to compromise the victim’s computer, but they do not have to infect the victim’s computer for the scam to be successful.”
As part of the scam, the victim could be made to ‘Like’ and share links, thereby earning money for the attacker in the process, he wrote. In particular, the attacker was able to make the victim to automatically share the following links:
- Tin[REMOVED]ew7.com
- Daily[REMOVED]alerts.com
“Previously, the Nuclear exploit kit was known for exploiting the Oracle Java SE Rhino Script Engine Remote Code Execution Vulnerability (CVE-2011-3544), the Oracle Java SE and Java for Business JRE Trusted Method Chaining Remote Code Execution Vulnerability (CVE-2010-0840), and the Adobe Acrobat and Reader Remote Code Execution Vulnerability (CVE-2010-0188),” Singh explained. “The current version of the Nuclear exploit kit exploits the Microsoft Internet Explorer Use-After-Free Remote Code Execution Vulnerability (CVE-2013-2551) and the Oracle Java SE Remote Code Execution Vulnerability (CVE-2012-1723).”
According to Websense, the Nuclear exploit kit was observed being sold for $900 in 2010.
“The average price for exploit kits is usually between $800-$1500 a month, depending on the features and add-ons,” said Jeff Debrosse, director of security research of Websense.
According to Symantec, the areas most affected by the Nuclear exploit kit have been North America and Europe.
