Warning about Java drive-by (keylogger) !

sl0ta · Dec 13, 2011

Today somebody with name "SKIDDERS" added me on skype and wanted to show me his most sucsessful deal. He sent me link ,which looks like link to imageshack.us ,but it was not real imageshack.us. I happily have very good AV with firewall and it showed me that some java software wants to run.

But why this phish page is different then others?

Well at first look at her address:

http://imgXYZ-imageshack.us/imgXYZ/4057/IMG_30112011_030625.png/

instead of XYZ there were some numbers (same for each part of address) , i removed them in case anyone would click on this link, so it looks like real imageshack.us adress ,but it is not, notice imgXYZ-, which is part of domain.

Once you click on it ,it opens page that looks totally same as imageshack.us

However instead of picture there is error picture in corner and most of people who use imageshack.us would click on this error picture to open image in bigger resolution and go over this error. However one you click on it ,you successfully installed keylogger into your computer!

So be careful about click on any image hosting link.

X4NRSA · Dec 13, 2011

Thanks for the heads up

Toshext · Dec 13, 2011

JDB's have been around for a while you should of know about these by now, and there not just for keyloggers they can be rats and many other things. Just remember to run security scans daily, and be cautious.

sl0ta · Dec 13, 2011

Toshext said:
JDB's have been around for a while you should of know about these by now, and there not just for keyloggers they can be rats and many other things. Just remember to run security scans daily, and be cautious.

Yes ,but this one is very good made ,so if you are carefull about links you click on ,you still may click on this link, because it is not suspicious as much as others ,it looks pretty legit.

TheLuckyNub · Dec 13, 2011

I once got accused of trying to use one of these when telling my mate to vote on a RSPS and tell me the code, I have no idea what he meant, because if it did have a JDB then it was harmless, due to the fact the RSPS is large and popular.