Hijack Alert: talian pensioner dies hoisting flag for final game

Here's another instance of "sensational news" being used as bait to lure people to a website armed and loaded with Web-Attacker, a piece of software designed to compromise computers and place them under the control of another party. The spam itself looks like so.

World-Soccer News

"World-Cup'2006 Germany" scandals and afterparty news!

July 9-10:

• Italy lift Cup, bitter end for Zidane

Italy lifted the World Cup for the fourth time on Sunday, beating France on penalties in a match that will be remembered for Zinedine Zidane's sending off for butting an opponent..

• Italian pensioner dies hoisting flag for final

A 77-year-old Italian pensioner fell off a ladder and died as he tried to attach Italy's flag to a pole ahead of Sunday's World Cup final against France...

• Italy welcomes diversion of Azzurri glory

Hundreds of thousands of Italians gathered on Monday in Circus Maximus, one of ancient Rome's most famous stadiums, to fete their...

• Wor ld-Cup reaches climax with Italy-France final

The world's most-watched sporting event reaches its climax on Sunday when Italy take on France in the World Cup final in Berlin.

Fresh news and more - on World-Soccer News!

Send
This link to your friends!

© 2006 World-Soccer

Note the invitation to mail the link to your friends. Spread the disease, if you please, except that the link there is "world-of-soccer.org" for some reason. Anyhow, the trail is fairly typical for this sort of thing. The "world-of-soccer.biz" (and ".org") website uses frame-wrapping to hold "http://soccer-2006germany.com/". That site in turn starts with a tremendously obfuscated piece of Javascript which ultimately produces a page of soccer-related information.

Unbeknownst to the casual viewer, however, it also loads two invisible frames which incorporate Web-Attacker. One is at http://www.soccer-2006germany.com/go.php, and the other is at http://www.extechweb.com/go.php. These ultimately redirect to Web-Attacker's attack-mode script. The statistics screen for the Web-Attacker instances can be found at http://www.soccer-2006germany.com/cgi-bin/ie0606.cgi and http://www.extechweb.com/cgi-bin/ie0606.cgi, respectively. You'll have to guess the password to do anything useful beyond that point, however.