UAB Computer Forensics Links Fake Online Postcards to Most Prevalent U.S. Computer Virus

Fake Internet postcards circulating through e-mail inboxes worldwide are carrying links to the virus known as Zeus Bot, said Gary Warner, director of computer forensics at the University of Alabama at Birmingham (UAB). Zeus Bot has been named America’s most pervasive computer Botnet virus by Network World magazine, reportedly infecting 3.6 million U.S. computers.

    July 24, 2009

Screenshot of Fake E-Postcard. Download image.

• Fake e-postcards carry password-stealing virus

• Virus considered the country's most pervasive

BIRMINGHAM, Ala. - Fake Internet postcards circulating through e-mail inboxes worldwide are carrying links to the virus known as Zeus Bot, said Gary Warner, director of computer forensics at the University of Alabama at Birmingham (UAB). Zeus Bot has been named America's most pervasive computer Botnet virus by Network World magazine, reportedly infecting 3.6 million U.S. computers.

"These fake postcards ask users to click and download to view the contents, and as soon as that click is made the Zeus Bot malware has infected their computers," Warner said. "Once on a user's computer, Zeus Bot will give cyber criminals access to passwords and account numbers for bank, e-mail and other sensitive online accounts."

Screenshot of Email. Download image.

A Botnet is a collection of compromised or infected computers that runs specific software that usually has been installed on computers without the user's knowledge.

Warner said cyber criminals who are employing the Russian-language Zeus Bot software are using the fake Internet postcards as the latest mechanism to download the virus software onto unwitting users' computers. Once the virus is on a computer it becomes a part of the Zeus Botnet and is able to steal Web site data from victims. The malware uses a graphical user interface to keep track of infected machines throughout the world and is equipped with tools that allow the criminals to prioritize the banks and related stolen accounts they want to strike, Warner said.

"These messages are standard in their design and carry a subject line that indicates they come from the Web site 1001 Postcards," Warner said.

"In this case and when it comes to messages that are supposedly from your bank, eBay or any other site, don't click on the links in an e-mail," Warner said. "Instead, type the address for the site that the message is coming from into your Web browser and log in as you normally would.  If the site has an important message for you, you'll be able to find it."

Read more at Warner's blog at http://garwarner.blogspot.com/. Learn more about Warner at www.uab.edu/news/resources/experts/item/1114-warner-gary.

About UAB

UAB Computer Forensics Research is on the front lines of cyber crime and takes a three-part approach in its response to the problem: academic training to prepare the next generation cyber-crime investigators, increased public awareness of cyber crime and research to develop cutting-edge options for battling cyber criminals.