History and stories
Koobface: the fake video update that spread through friends
A friend sends you a link to a video of yourself. The video needs a software update to play. That update was Koobface.
1 min readStory
The short version
Koobface sent messages from infected social media accounts to their friends, with a link to a video that needed a “player update.”
The story
Koobface, its name a rearrangement of “Facebook,” was first spotted in December 2008. It spread through social networks and messaging services.
Infected accounts sent messages to their friends with a link to a video, often suggesting the friend appeared in it. The link led to a page that said a Flash player update was needed to watch. The “update” was the malware.
Once installed, Koobface stole logins for social media and other sites, used the computer to send the same messages to more friends, pushed advertising and redirected web searches. Infected computers joined a botnet that its operators used to make money.
Why it mattered
Koobface showed how attackers could use the trust between friends on social networks to spread, and how a fake update for something familiar could be the way in. The “you need to update to watch this” trick is still used today, now usually as a fake browser update.
The lesson today
Koobface combined two tricks that still work: a message from someone you know, and a prompt to install an update to see something. Real updates come through your computer’s own update system. They do not appear as pop-ups on web pages. A message from a friend that feels a little odd is worth checking with them another way.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.