# MA-410.072014: MyCERT Alert - Suspicious Links Related to Flight MH17

**Date:** 20 Jul 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-410.072014  
**Advisory ID:** MA-410.072014

---

**1. Introduction**
In regards to the recent media news 
The suspicious tweets that points to malicious links are written in Indonesian language, using the trending #MH17 hashtag in order to entice Internet users who are looking for news 
The fake Facebook pages, some of it were created using the MH17 Flight victims’ names, contains link that points to pop-up ads.
**2. Methods of Spreading**
2.1 The malicious links are spread through Twitter using #MH17 hashtag. This method is also called hashjacking.
2.2 Fake Facebook pages that purportedly contains link to detailed information about the MH17 plane crash. When clicked on the links, users will be directed to pop-up ads of online gambling sites and other unwanted services. The fake pages have since been shut down by Facebook.
Attached is a screenshot of the fake Facebook page:
**3. Recommendations**
Internet users are advised to be precautious of any suspicious activities and threats that takes advantage of current incidents and news.
MyCERT would like to recommend and advise Internet users:
- Not to believe and pass around any untrusted links 
- Users are also advised not to simply click or open any links that they receive through social networking sites or emails, as they may contain malware.
- MyCERT also advises users to install the latest security update/patches for their computers and update virus definition.
- Make sure Internet users always refer to trusted channels when looking for news 
- Internet users are advised to report to Cyber999 if they receive or come across any suspicious links or attachments on the social networking sites or emails.
In case the public receives or come across any suspicious URLs and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**4. References**
- <http://www.eyeopening.info/2014/07/20/cyber-criminals-use-malaysia-airlines-flight-mh17-plane-crash-news-to-bait-users/#.U8tR-aisYWg>
- <http://blog.trendmicro.com/trendlabs-security-intelligence/cybercriminals-hitchhike-on-the-news-of-mh17-crash/>
- <http://amanz.my/2014/07/trend-micro-berhati-hati-dengan-pautan-berkaitan-mh17-di-twitter/>
- <http://www.csoonline.com/article/2455098/cyber-attacks-espionage/criminals-target-flight-17-mh17-discussions-on-twitter.html>