Last year it was Paris Hilton. Today, it’s Brad Pitt. They both earned the dubious distinction of “most dangerous celebrity search term,” according to researchers at McAfee®. If you’re hooked on celebrity gossip and want to find out the latest dirt on your favorite stars, you’ll want to exercise caution in your hunger for the latest news. Our global team of threat experts found that approximately 18 percent of searches for Brad Pitt lead to web sites that harbor malware or lead to spam, breach browser security, or generate popup traps. Some of the riskiest search behaviors include trying to find screensavers, wallpapers, downloads, and ringtones from favorite celebrities.

In McAfee’s second annual report, based on data from McAfee SiteAdvisor® technology, you’ll find Beyoncé, Justin Timberlake, Heidi Montag, and Mariah Carey are among the top five. (By the way, Paris Hilton and Britney Spears are notably absent from the list this year, so this is an obvious indication that cyber crooks are staying on top of trends.)

Online Villains Ride the Wave of Celebrity Mystique
According to Jeff Green, Senior Vice-president of McAfee’s Product Development at McAfee® Avert® Labs, cybercriminals employ a variety of methods to lead unsuspecting individuals to malicious and risky web sites, and one of the simplest, most effective lures is to capitalize on Americans’ interest in the rich and famous. “Tapping into current events, pop culture, or commonly browsed sites is an easy way to achieve this,” say Green. “And because of Americans’ obsession with following celebrities’ lifestyles, they are an obvious target.”

What are some of the threats associated with targeted Hollywood performers? Here’s a sampling, listed according to position in McAfee’s report:

1. Brad Pitt: Be especially careful when you search for “Brad Pitt screensavers.” More than half of the search results were identified as containing malicious downloads with spyware, adware, and potential viruses.
2. Beyoncé: Typing “Beyoncé ringtones” into a search engine yields risky phishing sites that promote misleading offers as a way of collecting visitors’ personal information.
3. Justin Timberlake: Fans’ high level of interest in this man-about-town’s relationships makes him the perfect target for cyber crooks. When we searched for downloads associated with his name, we found one web site with free music downloads that led to spam, spyware, adware, and other undesirable and possibly malicious content.
4. Heidi Montag: Stay away from wallpaper web sites that feature this star from pseudo-reality television show “The Hills.” The wallpaper is often laden with malware.
5. Mariah Carey: If you’re looking for Mariah Carey screensavers, take precautions, as cyber villains are using these web sites to link to other sites that contain known spyware, adware, and other threats embedded in downloads.
6. Jessica Alba: When you input her name, you get a list of hundred of sites with malicious downloads, links to bad sites, misleading offers that attempt to snag your personal information, and a fair amount of spam emails when you register.
7. Lindsay Lohan: Searching for downloads (“Lindsay Lohan downloads”) associated with this popular actress results in several dangerous web sites replete with concealed adware.
8. Cameron Diaz: Cybercriminals have infiltrated download web sites related to Cameron Diaz’s photos and other images as a way of linking to other malicious sites.

• Email tests: How much email is received after a one-time use email address is registered with a site? And how commercial or spammy is that email?
  
• Download tests: Do files downloaded from the site contain viruses, adware, spyware, or other unwanted programs?
  
• Exploits: Does the site attempt to breach browser security?
  
• Online affiliations: Do a preponderance of the site’s outbound links go to other sites rated as risky?
  
• Annoyances: Does the site generate a high number of popups?
  
• Phishing: Is the site a fraudulent phishing site?

Using Celebrity SEO to Snare Victims
McAfee isn’t the only one to examine this disturbing trend. Independent security consultant and blogger Dancho Danchev says we’re seeing only the tip of the iceberg. Danchev believes there is growing network of search engine optimization campaigns and vast portfolios of domains serving fake celebrity video sites that are propagated via spam. (Source: http://blogs.zdnet.com/security/?p=1926)

According to Danchev, it’s not just particular celebrities that are favored over others by these cyber crooks. They target all of them. Rather than pulling in unsuspecting visitors through search engines, this more proactive and less detectable technique uses spam to push victims to sites that use SQL injection to execute malware. SQL injection is a security exploit that takes advantage of vulnerabilities in a web site, allowing hackers to insert their code, such as fake registration forms that appear legitimate.

These exploits are difficult to detect because hackers are leveraging legitimate sites to serve up undesirable and dangerous content. Cybercriminals often piggyback off of services that thousands of people flock to like Blogspot, Google Groups, or MSN Groups, instead of registering separate domains. For Internet surfers, that means you may be just as likely to encounter malware while browsing your favorite site—which you assume is safe—as you would be when searching for your favorite celebrity. And to top it all off, malware writers also use spam to lure you into these enticing traps.

If You’re Hooked on Hollywood …
We certainly can’t expect you to give up your addiction to movie star gossip, but we do recommend that you enjoy your obsession prudently. Exercise a healthy degree of suspicion and caution when you approach celebrity sites, and use McAfee SiteAdvisor to help you navigate this potentially dangerous turf.

For your free copy of McAfee SiteAdvisor, click on http://www.siteadvisor.com/.