Brad Pitt named as top malware lure

Movie star Brad Pitt has shoved Paris Hilton off the top of a list neither will have coveted being on. A fan entering Pitt's name in a search engine now has a startling one in five chance of finding a malware-hosting site instead, says McAfee.

Pitt is top of the fake Web site malware league, just ahead of a collection of pop and film stars that reads (in descending order) Beyonce, Justin Timberlake, Heidi Montag, Mariah Carey, Jessica Alba, Lindsay Lohan, Cameron Diaz, George Clooney, and Angelina Jolie.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

Hilton no longer even makes the fake Web top ten, but can perhaps take some solace from her continued popularity with spammers.

If you're never heard of some of these people then it's a fair bet that you are not the intended target of a technique that has been for some years one of the commonest ways to infect a PC. But still it persists, driven by an apparently insatiable appetite among some Internet users for computer screensavers, wallpaper, ring tones and star pictures, at whatever risk to themselves.

"Cybercriminals employ numerous methods, yet one of the simplest but most effective way is to trick consumers into infecting themselves by capitalizing on Americans' interest in celebrity gossip," commented McAfee's Jeff Green. "Tapping into current events, pop culture or commonly browsed sites is an easy way to achieve this."

Reading the latest statistics, it's hard to avoid the conclusion that malware writers think that the celebrity-obsessed are as recklessly naive as they are star-struck. Most malware-infection techniques have shown some evolution over the last two years, but the fake Web sites ploy just goes on and on.

In fact, a deeper problem is the way users interact with search engines, as was pointed out by McAfee itself only a year ago. McAfee's motives for publicizing the issue aren't entirely neutral -- at least one search engine, Yahoo, recently took up using McAfee's SiteAdvisor tool to filter the Web sites it returns in search boxes.

And for those users who only visit legitimate Web sites they know about, there is also bad news. The biggest hack trend of the last year has been compromising perfectly legitimate Web sites to serve malware -- witness this week's large attack on the Web site of BusinessWeek magazine. For Internet users there is no easy escape, only the awareness of the growing number of pitfalls.

Techworld is an InfoWorld affiliate.