They’re wrong, and malware authors have begun preying on users of

alternative browsers to push dangerous software, including Trojans and

scareware. The problem is that most malware attacks aren’t triggered by

exploits that target vulnerabilities in code. Instead, according to one recent study,

“users are four times more likely to come into contact with social

engineering tactics as opposed to a site serving up an exploit.”

Follow-up: Malware attempts that use Apple-focused social

engineering are now in the wild. I just found one via Google Image

search. See for yourself: What a Mac malware attack looks like.

I found a perfect example yesterday, thanks to an alert from

Silverlight developer Kevin Dente. He had typed in a simple set of

search terms—Silverlight datagrid reorder columns—at Google.com, using the Google Chrome browser on Windows. You can follow along with what happened next in the screenshot gallery that accompanies this post.

The first page of Google search results included several perfectly

good links, but the sixth result was booby trapped. Clicking that link

in Google Chrome popped up this dialog box:

That led to a basic social engineering attack, but this one has a

twist. It  was customized for Chrome. If you’ve ever seen a Google

Chrome security warning, you’ll recognize the distinctive, blood-red

background, which this malware author has duplicated very effectively.

After the fake scan is complete, another dialog box comes up, warning

that “Google Chrome recommends you to install proper software.”

That’s terrible grammar, and this social-engineering attack is likely

to fail with an English-speaking victim, who should be suspicious of

the odd wording. But a user whose primary language is something other

than English might well be fooled. And the malware author has

anticipated the possibility that you might click Cancel in the dialog

box. If you do, it still tries to download the malicious software.

Each time I visited this page, the download I was offered was

slightly different. My installed antivirus software (Microsoft Security

Essentials) didn’t flag it as dangerous. When I submitted it to VirusTotal.com,

only five of the 42 engines correctly identified it as a suspicious

file. Less than 8 hours later, a second scan at VirusTotal was a little

better. This time, eight engines confirmed that the file was suspicious.

Microsoft’s virus definitions had been updated and a scan identified

the rogue file as Win32/Defmid.

Panda and Prevx identified the file as “Suspicious” and “Medium risk

malware,” respectively. BitDefender, F-Secure, and GData flagged it as

“Gen:Trojan.Heur.FU.quX@am@e97ci.” AntiVir detected it as

“TR/Crypt.XPACK.Gen.” Kaspersky says it is

“Trojan-Downloader.Win32.FraudLoad.zdul.” Every other antivirus engine,

as of a few minutes ago, waved this suspicious executable right through.

Meanwhile, back in the browser, Google Chrome’s warnings are

completely generic. If you download the software it shows up in the

Downloads folder looking perfectly innocent.

Interestingly, this set of “poisoned” search terms also affected

Bing, although the dangerous search result was on a different site,

which didn’t show up until the fifth page of search results. And the

download that it offered was, apparently, a completely different

Trojan/scareware product. But the end result would have been the same,

regardless of which browser I was using.

This case study shows that malware authors are beginning to adapt to

changing habits of PC users. There’s nothing inherently safer about

alternative browsers—or even alternative operating systems, for that

matter—and as users adapt, so do the bad guys.

Be careful out there.