Virus promises Paris Hilton porn

Adult footage used as social engineering hook

Robert Jaques, vnunet.com 21 Feb 2005

Security experts have warned users to be wary of emails containing references to Paris Hilton after two different worms were discovered claiming to contain adult footage of the society heiress.

The new Sober-K and Ahker-C worms masquerade as X-rated videos of the popular celebrity, IT security firm Sophos warned.

Sober-K, which is spreading in the wild, mails itself using a variety of subject lines including 'Paris Hilton, pure!' and 'Paris Hilton SexVideos'.

The worm can send itself in either German or English, depending on whether it believes the recipient's email address to be owned by a German or English speaker.

The second infection, Ahker-C, sends itself using the subject line 'Paris Hilton...download it!' and an attached file called 'ParisXXX.zip'.

This worm attempts to disable antivirus and firewall software running on the computer, potentially opening the PC to further attack by hackers and malware. It also tries to block access to a number of websites.

"It's an old trick but sadly it still works: disguise your worm as something saucy and there are likely to be some computer users who will throw common sense out of the window and launch the dangerous file," said Graham Cluley, senior technology consultant at Sophos.

"Those looking for the simple life, without the trouble of viruses and worms, would be wise to be wary of unsolicited email attachments."

Sophos discovered the worms on the same day that it was reported that hackers broke into Miss Hilton's mobile phone address book and published the private telephone numbers of celebrities such as Anna Kournikova, Lindsay Lohan and Vin Diesel.

"Paris Hilton is, according to some search engine companies, the most commonly searched for female celebrity on the internet. Interest in her is huge, so it's no surprise that virus writers have tried to use her as bait," added Cluley.

See also: