Web Fraud 2.0: Fake YouTube Page Maker Helps Spread Malware

A new Web Fraud 2.0 tool makes it a cakewalk for criminals to create fake YouTube pages in a bid to trick people into installing malicious software.

The YTFakeCreator tool, pictured at right, is a point-and-click program that automates the creation of authentic-looking YouTube pages, minus the familiar video window. This is the version of YouTube visitors see if their browser is configured to block Javascript or Adobe Flash videos (as the Firefox "noscript" add-on does by default) or if the visitor does not have those programs installed.

Even if visitors have both of those programs installed and is not blocking either file format, they will be prompted to install Flash when visiting one of these fake YouTube pages. And, of course, the tool allows the page creator to substitute any nasty file they want for the supposed Flash download.

According to Panda Security, crooks can use YTFakeCreator to manipulate the error message displayed by the Web page; define how long it takes the message to appear; enter the link to the infected file to be downloaded onto the victim's PC; and create a false profile similar to those one would see on the actual Youtube.com Web site, to add to the illusion that the video has been uploaded by a real user.

In all likelihood, these same fake page creators exist for other major video- and image-heavy Web sites, such as Facebook and MySpace.

Remember this rule of thumb: If you didn't set out looking for a program, don't install it just because a site prompts you to do so. If you want or need a particular program or plug-in, download it from the maker of said program (i.e., for Flash, get it straight from Adobe's Flash download page). Also, be extremely wary of clicking on links that arrive in e-mail, particularly those inviting you to view video or image files