Normally, we expect malware to disable older versions of key applications in order to steal information or take over a victim’s computer, but the latest in a string of problems involving Adobe Flash Player has cybercriminals offering a free update to the browser plugin instead.
As first revealed in a blog post by an independent security researcher known only as Kafeine on Malware don’t need Coffee, the latest version of the Kovter malware has been updating Flash as a sort of competitive tactic against other cybercriminals. The Kovter Trojan typically works by taking over a victim’s machine and clicking on online ads to generate revenue through crooked pay-per-click (PPC) affiliate programs.
In some respects, the real victims here may be advertisers, who don’t realize they’re getting impressions obtained by hijacking computers. As Naked Security noted, click-fraud malware can’t really work if it can’t see online ads properly, which is probably one of the reasons this variant of Kovter proactively updates Flash on the user’s behalf.
On the other hand, ensuring that a machine is using the latest version of the browser plugin could also be a way of guaranteeing rival click-fraud malware authors have a tougher time targeting the same computer later. Komando suggested this isn’t entirely a new tactic; earlier viruses could clean up a machine with their own antivirus tools before stealing information or taking control.
Perhaps the best defense strategy is beating Kovter to the punch by updating Flash first. There are certainly enough reasons by now: Just last week, The Guardian reported that a flaw in the plugin was allowing attackers to embed malware in a video file to take over victims’ computers. Around the same time, cybercriminals were taking advantage of the same flaw in drive-by download attacks using the Magnitude exploit kit.
Computerworld suggested malicious actors are getting much faster at seizing such opportunities, so users need to patch as quickly as possible. And as this latest incident involving Kovter proves, cybercriminals are becoming as interested in one-upping each other as they are using malware to steal data or make money.