FYI...
Spotify users attacked by drive-by malware...
-
http://news.netcraft...by-malware.html
25 March, 2011 - "Users of the Spotify Free music streaming software have been
attacked by drive-by malware. At least one attack used a Java exploit to drop malicious executable code on a victim's computer, with AVG software identifying one of the malicious payloads as Trojan horse Generic_r.FZ. Another threat blocked by AVG was a
Blackhole Exploit Kit hosted on the uev1 .co .cc domain. Several people have reported the problem to Spotify over the past 24 hours, and attacks are still being reported at the time of publication.
It is believed that the attacks are being launched through malicious third-party adverts which are displayed in ad-supported versions of the Spotify software. By exploiting local software vulnerabilities, the attacker can then install malware on unprotected computers."
-
http://community.web...icious-ads.aspx
25 Mar 2011 - "... The first report we have of a malicious ad being displayed is from around 11:30 GMT on March 24... In this case the malicious ad is actually displayed inside of the Spotify application... The application will render the ad code and run it as if it were run inside a browser. This means that the Blackhole Exploit Kit works perfectly fine and
it's enough that the ad is just displayed to you in Spotify to get infected, you don't even have to click on the ad itself. So if you had Spotify open but running in the background, listening to your favorite tunes, you could still get infected. Seems like free does come at a price after all.
Spotify removed all 3rd party ads in the free version while they did their investigation but the ads have now been turned back on again. Once the ad was displayed, the computer would connect to hxxp: //uev1 .co .cc where the exploit kit tries several vulnerabilities to infect the user. The IP address where the malicious content is hosted is well-known to us and we have seen it host the same exploit kit on several other domains... One of the vulnerabilities the exploit kit uses is a vulnerability in Adobe Reader/Acrobat. The kit uses a heavily obfuscated PDF file to make the infected computer download the fake AV software. Here are the VirusTotal reports for the PDF and the fake AV file*. Once the fake AV is launched it connects to the following domains to download additional content, including a rootkit** which is a packed version of TDSS:
• tuartma .in, rappour .in, findstiff .org, searchcruel .org, findclear .org, replity .in, searchgrubby .org, demivee .in, ripplig .in..."
(Screenshots and more detail available at the URL above.)
*
http://www.virustota...7acf-1301413767
File name:
L9FPB1.pdf
Submission date: 2011-03-29 15:49:27 (UTC)
Result:
12/43 (27.9%)
**
http://www.virustota...f261-1301086553
File name:
spotify_dropped.exe
Submission date: 2011-03-25 20:55:53 (UTC)
Result:
4/43 (9.3%)
There is a more up-to-date report...
-
http://www.virustota...f261-1301408014
File name:
f5dcd2415fa4b069c0b934baee109ea5
Submission date: 2011-03-29 14:13:34 (UTC)
Result:
21/41 (51.2%)
Edited by AplusWebMaster, 02 April 2011 - 05:28 AM.
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
