Finnish-language web pages suspected of modem hijacking

Familiar language and neat layout confuse local Internet users

print this

A number of Finnish-language web pages are believed to have been used in performing one of the latest Internet scams - modem hijacking, or dialer hijacking, or Internet dumping.
      When someone searches for certain popular Finnish web portals via well-known search engines, the answer given is often to links to addresses that are suspected of being modem hijacking pages.
      If an Internet user on a dial-up (modem or ISDN) connection opens one of these sites, the site uses a script to maliciously download - with or even without the user's knowledge - onto the connecting computer a piece of software that changes the PC's dial-up sequence. It then calls to a server located in Uruguay at a rate of EUR 1.99 a minute, according to Nicklas Koski, of the popular Suomi24 portal.
      Suomi24 is one of the net portals that have fallen victim to the scam, as would-be users seek the pages out using a search engine like Google. Two others with similar problems are the MTV3 and Jippii portals.
     
The suspected sites do not necessarily give any information whatsoever to the user of the cost of the connection, or alternatively it is in very, very small print at the bottom of the screen.
      What makes the pages particularly dangerous for local users is that they are in Finnish. Many users drop their guard and do not check the real address they are visiting. The address will be subtly different from that of the service they were originally seeking to get to.
      In most previous cases, modem hijacking pages have been in English. The Consumer Agency reported on one such scam, relating to IQ tests with a hidden sting, last July (see attached link). The Agency was made aware of this latest incident on Monday, and is investigating at present.
     
Protecting oneself against occurrences like this, which sound rather frightening, is in fact largely a matter of common sense.
      Maintaining virus and intrusion protection, keeping a firewall, and ensuring that programme updates are regularly checked are all ways of making sure that surfing remains largely safe.
      Caution with downloading unknown programmes should always be exercised.
      Spotting a hijack in progress may be more difficult, but if the user hears his or her modem re-dialling in the course of a connection to the Net, this is a strong warning that something is amiss. The connection should be terminated immediately.


Links:
  Modem Hijacking
  Consumer Agency press release 29.7.2004

Helsingin Sanomat