Facebook has removed a scam that was redirecting users to the Nuclear exploit kit, according to researchers with Symantec.
The scam relied on users getting drawn into clicking on a link promoting a work-from-home opportunity with the headline: ‘EXPOSED: Mom Makes $8,000/Month and You Won’t Believe How She Does It!’
“If people believe these jobs are legitimate and click on a Facebook link, they are redirected to a Facebook page,” blogged Symantec researcher Ankit Singh. “This page goes through a series of redirects and ultimately lands on a third-party website containing an iframe for the Nuclear exploit kit. This can allow the attacker to compromise the victim’s computer, but they do not have to infect the victim’s computer for the scam to be successful.”
As part of the scam, the victim could be made to ‘Like’ and share links, thereby earning money for the attacker in the process, he wrote. In particular, the attacker was able to make the victim to automatically share the following links:
- Tin[REMOVED]ew7.com
- Daily[REMOVED]alerts.com
“Previously, the Nuclear exploit kit was known for exploiting the Oracle Java SE Rhino Script Engine Remote Code Execution Vulnerability (CVE-2011-3544), the Oracle Java SE and Java for Business JRE Trusted Method Chaining Remote Code Execution Vulnerability (CVE-2010-0840), and the Adobe Acrobat and Reader Remote Code Execution Vulnerability (CVE-2010-0188),” Singh explained. “The current version of the Nuclear exploit kit exploits the Microsoft Internet Explorer Use-After-Free Remote Code Execution Vulnerability (CVE-2013-2551) and the Oracle Java SE Remote Code Execution Vulnerability (CVE-2012-1723).”
According to Websense, the Nuclear exploit kit was observed being sold for $900 in 2010.
“The average price for exploit kits is usually between $800-$1500 a month, depending on the features and add-ons,” said Jeff Debrosse, director of security research of Websense.
According to Symantec, the areas most affected by the Nuclear exploit kit have been North America and Europe.
More from Brian Prince
- U.S. Healthcare Companies Hardest Hit by ‘Stegoloader’ Malware
- CryptoWall Ransomware Cost Victims More Than $18 Million Since April 2014: FBI
- New Adobe Flash Player Flaw Shares Similarities With Previous Vulnerability: Trend Micro
- Visibility Challenges Industrial Control System Security: Survey
- Adobe Flash Player Zero-Day Exploited in Attack Campaign
- Researchers Demonstrate Stealing Encryption Keys Via Radio
- Researchers Uncover Critical RubyGems Vulnerabilities
- NSA, GCHQ Linked to Efforts to Compromise Antivirus Vendors: Report
Latest News
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- China Says It’s Looking Into Report of Spy Balloon Over US
- GoAnywhere MFT Users Warned of Zero-Day Exploit
