{"id":35782,"date":"2014-06-02T14:40:09","date_gmt":"2014-06-02T21:40:09","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=35782"},"modified":"2025-08-17T22:51:00","modified_gmt":"2025-08-18T05:51:00","slug":"heartbleed-phishing-scam","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/heartbleed-phishing-scam\/","title":{"rendered":"How Hackers are Using Heartbleed to Trick You into Infecting Your Computer"},"content":{"rendered":"

Heartbleed, a vulnerability affecting nearly 70% of websites on the Internet, was discovered two months ago. It was big<\/a>. It still is big. Heartbleed affects nearly every person using the Internet (especially if you haven\u2019t changed your passwords since the bug was discovered) because the vulnerability deals with how servers interpret information, such as usernames and passwords, that is sent online. That means users cannot protect themselves from the vulnerability until the bug is fixed on the server\u2019s side\u2014meaning a company\u2019s IT administrator has to fix it.<\/p>\n

But it appears some hackers are trying to convince potential victims that Heartbleed can be \u201cuninstalled\u201d from their computers. They\u2019re doing this by sending out emails loaded with a \u201cHeartbleed remover\u201d tool attachment, which is really just a cleverly disguised package of malicious software<\/a>. This form of attack\u2014where a hacker or a group of hackers try to trick victims into compromising their devices\u2014is called a phishing attack<\/a>. And phishing attacks, even this one, usually have a few telltale signs.<\/p>\n

1. A link or attachment.<\/strong><\/h2>\n

This phishing attack is as dangerous as it is clever. It tries to trick you into downloading a \u201ccleaner\u201d for the Heartbleed bug, as if it was something that could be fixed on the user-side (once again, it\u2019s not). In reality, what you are downloading is a keylogger. Keyloggers are programs that record your keystrokes and send them back to the controlling hacker. With information from the keylogger, the hacker in question can login to your accounts and get access to your personal and financial information.<\/p>\n

A strong rule of thumb to live by online is to never open an attachment or click on a link that you weren\u2019t expecting, or one that comes from an unknown source.<\/p>\n

2. A sense of urgency.<\/strong><\/h2>\n

In this case, the phishing email contained a subject line pertaining to investments in Syria. The body of the phishing attack, however, was a warning telling the victim that they needed to run a program to make sure the Heartbleed \u201cvirus\u201d was removed from their computer. The email contained a plausible threat to those who aren\u2019t informed about Heartbleed, as well as a strong sense of urgency.<\/p>\n

3. Signs of mischief.<\/strong><\/h2>\n

But a closer look at the email gives us the evidence we need to dismiss it as a phishing attack. Take the subject line \u201cLooking for Investment Opportunities from Syria\u201d for example. The subject line had nothing to do with the body of the email. So there are two indicators right off of the bat: a peculiar subject line (sometimes referred to as the \u201cNigerian Prince\u201d subject line\u2014a reference to another phishing attack which promises the victim riches for a small fee) and an email body unrelated to the subject line. Other signs of mischief can include typos, English syntax errors, and the sender\u2019s email addresses containing odd characters.<\/p>\n

4. Dead giveaways.<\/strong><\/h2>\n

There\u2019s a line in the email that ought to give the scam away to anybody: \u201cIf you get a warning from windows or your Anti-Virus that this file might harm your computer, please ignore this warning \u2026 as it will be an attempt by the virus program to stop you from running the tool.\u201d It\u2019s a sentence explicitly telling you to ignore your own security programs. It\u2019s a subtle order, but it\u2019s one that\u2019s necessary for the attack to work. The same goes for other phishing attacks: a line telling you to click on this link; a single sentence saying you need to reset your password even though you never requested to reset your password; an invitation for you to donate money to a foreign beneficiary.<\/p>\n

All of these attacks follow similar patterns, but those patterns are getting harder to detect as hacking tools become both more common and more complex. So what can you do to defend yourself from such an attack? There\u2019re a few options available:<\/p>\n