Brad Pitt tops list of Internet malware lures

Movie star Brad Pitt has shovedParis Hilton off the top of a list neither wanted to be on. A fan entering Pitt's name in a search engine now has a startling one in five chance of finding a malware-hosting site instead, says security products companyMcAfee Inc.

Pitt is on top of the fake Web site malware league, just ahead of a collection of pop and film stars that reads (in descending order) Beyonce, Justin Timberlake, Heidi Montag, Mariah Carey, Jessica Alba, Lindsay Lohan, Cameron Diaz, George Clooney and Angelina Jolie.

Hilton no longer even makes the fake Web site top 10, but can perhaps take some solace from her continued popularity with spammers.

If you've never heard of some of these people, then it's a fair bet that you are not the intended target of a technique that for some years has been one of the most common ways to infect a PC. But still it persists, driven by an apparently insatiable appetite among some Internet users for computer screensavers, wallpaper and ringtones that feature their favorite stars, at whatever risk to themselves.

"Cybercriminals employ numerous methods, yet one of the simplest but most effective ways is to trick consumers into infecting themselves by capitalizing on Americans' interest in celebrity gossip," said McAfee spokesman Jeff Green. "Tapping into current events, pop culture or commonly browsed sites is an easy way to achieve this."

Reading the latest statistics, it's hard to avoid the conclusion that malware writers think that the celebrity-obsessed are as recklessly naive as they are star-struck. Most malware-infection techniques have shown some evolution over the past two years, but the fake Web site ploy just goes on and on.

In fact, a deeper problem is the way users interact with search engines, as was pointed out by McAfee itself only a year ago. McAfee's motives for publicizing the issue may not be entirely neutral; at least one search engine,Yahoo, recently began using McAfee's SiteAdvisor tool to filter the Web sites it returns in search boxes.

And for those users who visit only Web sites they know are legitimate, there is also bad news. The biggest hack trend of the last year has been compromising perfectly legitimate Web sites to serve malware -- witness this week's large attack on the Web site of BusinessWeek magazine.

For Internet users, there is no easy escape, only the awareness of the growing number of pitfalls.

source: John E. Dunn