Habbo Hotel Trojan Downloader poses as social networking site tool

Websense is reporting that a tool is being offered to "Habbo" users, which contains malicious code. The loaded tool is being offered by a third party software developer.

From the Websense alert:

Websense® Security Labs™ has received reports of a Trojan keylogger aimed at the users of Habbo, a popular social networking site for teenagers. As of last month, Habbo’s entry on Wikipedia said that over 8 million unique visitors access Habbo’s Web sites around the world every month. The party involved in spreading this malicious code poses as a third-party software tool developer for Habbo.

There seems to be very little out there about this, but I was able to find a BBC article from November about a teenager stealing $4,000 euros worth of virtual furniture using real money?

Based on the article, this isn't the first time (or probably the last) that Habbo users have faced the murkier waters of the Internet.

The article states:

A spokesman for Sulake, the company that operates Habbo Hotel, said: "The accused lured victims into handing over their Habbo passwords by creating fake Habbo websites.

"In Habbo, as in many other virtual worlds, scamming for other people's personal information such as user names has been problematic for quite a while.

"We have had much of this scamming going on in many countries but this is the first case where the police have taken legal action."

According to the article, there are a lot of spoofed Habbo sites, asking for user name and password information. FSecure.com did another article with screenshots of some of these spoofed sites.

In case anyone besides me is having a hard time understanding how real money is used to buy virtual furniture, Wikipedia offers a explanation:

Credits, also known as Coins in other websites, are the currency used in Habbo. Credits can be purchased using a variety of different services, such as credit card, a telephone service and via SMS. Credits are often given out as prizes for competitions held in the community. The Credits are stored in the user's purse accessible in any public or private room as well as on the Hotel view and while logged in on the website. Credits can also be redeemed into Exchange, which displays the Credits as an item of virtual furniture, the furniture can then be traded among users, and redeemed back into Credits.

At least now I can understand why someone would want to break into a Habbo account - they do have real money in them.

This might not have been the first time Habbo users have been exposed to assorted forms of malicious code. I found a discussion on Habbohut, a Habbo bulletin board, where the matter was being discussed in 2005.

Going back to the current alert from Websense, it has some pretty wise advice, which can be applied to any software tool being touted from an unknown source:

Websense Security Labs recommends caution when trying out new third-party applications developed for Web 2.0 and social networking Web sites, especially those with APIs open for third-party developers.

In other words, just say no!

Websense alert with screenshots, here.

How to avoid getting your information stolen via wireless connections

Yesterday, I wrote about how the FBI is warning us that personal details can be stolen (i-jacked) when using public computers. This occurs using crimeware, previously installed on a public computer, logs the keys you are stroking and sends the information (electronically) to criminals.

It can be dangerous to look at any of your online financial information on these (public access) machines.

When writing about this phenomenon, I remembered that even using your personal computer at a public place with a wireless connection can expose a person's personal and sometimes, financial details.

Just the other day, Martin Bosworth, over at Consumer Affairs, wrote an excellent piece covering this danger, where he stated:

Sending unencrypted information over any unfamiliar network can turn your computer into an open book -- with pages full of your personal information.

Many of these connections are appear to be legitimate connections because they are spoofed (camouflaged to appear as if they are a trusted connection).

Spoofing a connection, or site isn't very hard to do. They simply copy and transpose pictures and statements (words) from legitimate sites to their own. The Artists Against website has a portal, where you can see fake websites that are up and running on the Internet, here.

Martin's article contains some excellent tips on how to navigate the murky waters of public hot spots, safely.

They can be viewed, here.

Interestingly enough, wireless technology, isn't only used to compromise individuals. In the recent TJX data breach, where some are saying 200 million records were stolen since 2003, reports are saying the data was stolen, using wireless technology.

It's being reported that this was accomplished from a car with a laptop. Driving around with a laptop, using other people's wireless connections, is sometimes referred to as "war-driving," which is my new word for the day.

Joseph Pereira (Wall Street Journal) wrote about this (courtesy of the Northwest Florida Daily News), here.