bill-swift - June 21, 2012
A lot of scammers use celebrity sex tapes as bait to get people to click on their links and visit their spammy websites--and for good measure, because they're pretty much effective at doing that.
For example, if you're looking for a Miley Cyrus sex tape, then you might probably fall victim to this latest scam that's currently spreading via a blog post on Tumblr. (And about the actual tape itself, well. You're not in luck--because no such tape exists. Not yet, anyway.)
Researchers from security firm GFI explain that the links in the post will redirect users through two URLs and on to a fashion website that's hosting the purported sex tape. When users try to play the video, a prompt appears saying that the server is currently overloaded. It will then ask to install a program called 'UTPlayer' so you can watch the video outside of your browser.
It doesn't matter whether you click "Ok" or "Cancel", the executable file will download onto the PC either way. If the end-user fires up the installer, they'll be given a series of install prompts and the choice of installing the Babylon toolbar (and a "2yourface" component").
While the end-user can opt out of the Babylon install, they're locked into the UTPlayer whatever they do – hitting "Decline", "Agree" or even the red X will still result in UTPlayer lurching into life on the system.
-- Chris Boyd, security researcher at GFI Labs
Once downloaded, the UTPlayer doesn't do much. It doesn't play any videos, it doesn't have the promised Miley Cyrus tape, and you've just effectively wasted ten minutes of your life dealing with a spammy piece of software. It will, however, bug you incessantly to install Adobe Flash on your system, even if you already have it.
A few words of advice: don't click on URLs promising sex tapes, don't try to play shady-looking videos, and make sure you've got a working anti-virus program on your machine to protect it.
Please log in again. The login page will open in a new tab. After logging in you can close it and return to this page.