New Malware Imitates Browser Warning Pages 143
Jake writes with this excerpt from Ars:
"Microsoft is warning about a new piece of malware, Rogue:MSIL/Zeven, that auto-detects a user's browser and then imitates the relevant malware warning pages from Internet Explorer, Firefox, or Chrome. The fake warning pages are very similar to the real thing; you have to look closely to realize they aren't the real thing. The ploy is a basic social engineering scheme, but in this case the malware authors are relying on the user's trust in their browser, a tactic that hasn't been seen before. Beyond the warning pages, the actual malware looks like the real deal: it allows you to scan files, tells you when you're behind on your updates, and enables you to change your security and privacy settings. Performing a scan results in the product finding malicious files, but of course it cannot delete them unless you update, which requires paying for the full version. Attempting to buy the product will open an HTML window that provides a useless 'Safe Browsing Mode' with high-strength encryption. To top it all off, the rogue antivirus webpage looks awfully similar to the Microsoft Security Essentials webpage; even the awards received by MSE and a link to the Microsoft Malware Protection Center have been copied."
Not new... (Score:3, Informative)
Re: (Score:2)
This is also old news in regards to the actual topic. Malware has been imitating error pages and injecting code into pages (like "Google detects you're infected, use software to fix!" on Google") for the longest time..
Re:Not new... (Score:4, Funny)
How could you even think of browsing the internet without Internet Explorer 8 on Microsoft Windows 7? Do you realize that using knock-off "operating systems" and programs like Foxfire and Chrum and Oprah is intellectual property theft? Why do you think you fools are getting viruses? It's not cool. You're not slick and getting one over on "the man". It's fucking bullshit. Microsoft Internet Explorer 8 was designed and engineered to exacting standards to mesh flawlessly with the intricate security in Microsoft Windows 7. Your knock-off crap is not. Why do you freetards insist on removing your noses to spite your faces? Do you just tire of smelling your own bullshit? Microsoft Windows 7 and Microsoft Internet Explorer 8 are superior to this freetard shit in every possible way. Microsoft have invested billions of dollars in blood sweat and tears to deliver an exceptionally secure system and you people just take it for granted. What would you do if Microsoft were driven out of business because you thought you could steal from them and use Lumix and frebsd? You people disgust me with your Lunix and Crabble puke. Do you think you're special? Guess what... You're not! You can't think you can honestly get away with continually stealing the fruits of the billions of dollars Microsoft Research has invested in producing the intellectual property that you dorks so cavalierly pilfer to inject into your Gnom and KED and Quark shit. You all disgust me. You people need to look into the mirror and reevaluate your lives.
Re:Not new... (Score:4, Funny)
How could you even think of browsing the internet without Internet Explorer 8 on Microsoft Windows 7?
2/10: for using it's and your correctly.
Re: (Score:3, Insightful)
Actually, it's a very, very good troll that brings up some interesting points, so I'll bite.
The thrust of your argument is that older and/or non-company vended net software is dangerous when it comes to picking up viruses. There's an element of truth in that, a regularly patched system, be it *nix based or Windows is generally a good idea. This is, however, a different thing to having every possible update just for the sake of it. If I installe
Re: (Score:2)
Ah, but many aren't satisfied with that -- they want the ladies to move too, which requires a codec.
But far from always. Less clothes (to continue using the naughty ladies example) isn't more in -40 degree weather, trust me. No more than needed for the purpose is a better rule of thumb. If your need is to play HDMI video
Re: (Score:2)
The thrust of your argument is that older and/or non-company vended net software is dangerous when it comes to picking up viruses.
It is? I thought it was that Linux (and free software in general) was claimed to be a rip-off of commercial software developments' IP. Which, while definitely not true in the broadest sense, you could make a case for. A lot of free software intentionally duplicates functionality found in popular commercial software as a way to get around paying for said commercial software. The problem is that the initial design of software is far harder to get right than the implementation, and I can easily see how a comme
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
removing your noses to spite your faces
I think that's supposed to be "removing your noses despite your faces". (Although I personally prefer "to spit in your faces".) :)
Re: (Score:2)
Yes, and it's also "cutting off", not "removing". Sorry, I guess my attempt at humor fell a bit flat there.
Re: (Score:2)
Re: (Score:2)
What I see as an attack vector are third party add-ons. You can have a secure browser, but if an add-on gets compromised, it is all for naught.
What it really will take is hooks to OS level protection for the Web browser. Microsoft got something right with the low security mode of IE7/IE8 in Vista/W7, but it would be good to be able to isolate add-ons completely from each other on the OS basis so they don't even share the same memory space as the browser, and absolutely no filesystem space, unless the user
Your Post is at Virus Risk!1! Scan? (Score:4, Funny)
The biggest security hole is Microsoft's version of the javascript interpreter. They should collaborate with Google and adopt the rewrite for Chrome, it would solve half the problems right there.
BTW, I found a virius in yor post - clikc this link to free triel of PostScan 2010!
IE 9 won't share WSH's JS interpreter (Score:4, Interesting)
The biggest security hole is Microsoft's version of the javascript interpreter.
IE 9 will not use Windows Script Host's JavaScript interpreter. I predict that this change will make it easier for Microsoft to maintain the integrity of the sandbox.
Re: (Score:1)
But then how can they claim that IE is an "integrated part of the OS" and not removable?
MSHTML (Score:2)
But then how can they claim that IE is an "integrated part of the OS" and not removable?
By continuing to use MSHTML for the help system. "Internet Explorer" itself is an insignificant piece of code, acting as a wrapper around an MSHTML browser control.
Re: (Score:2)
Re: (Score:2)
Why wait for IE 9 to not use WSH when I have a choice of great browsers that I can use right now that also don't use WSH?
Because you still need to use IE 8 even if only to download one of those great browsers. This reduces but does not eliminate your window of vulnerability.
Re: (Score:2, Interesting)
Amazingly, most people still click on the damned things.
Re: (Score:3, Insightful)
Imitating warning pages or other elements of the UI is not a new tactic.
Perhaps browsers could be developed to use some feature that 3rd party pages couldn't easily duplicate? It might not be practical to use colors/effects etc not supported by standard browser features, but maybe a browser could be designed to display some preset USER SPECIFIC DATA or graphic that javascript and other net-driven browser code does NOT have access to?
Re: (Score:2)
My bank has a user-selected image when logging in, just to prove that it is the real site. Unfortunately you can only select from a limited number of images (can't upload your own) but it does let you set two secret words that are displayed along with it.
Re: (Score:2)
Didn't say it was a new technique or tactic, just a new piece of malware.
Would you prefer they don't say it was new in the headline (makes it rather awkward: "Malware imitates warning pages"), don't report it at all, or what?
Themes (Score:5, Insightful)
All the more reason to theme your window manager - it makes this stuff obvious.
Re: (Score:2)
Re: (Score:2)
It's actually kind of hilarious sometimes to see windows-style fake error messages when browsing in Opera on FreeBSD.
Yeah, love 'em. Opera/Ubuntu
Re: (Score:2)
Re: (Score:2)
WTF is that, privilege unescalling? If you can already replace the HOSTS file, why would you change a page to get the user clicking on something?
Re: (Score:2)
WTF is that, privilege unescalling? If you can already replace the HOSTS file, why would you change a page to get the user clicking on something?
Because you don't want them downloading and running a cleanup tool that would remove you from their system.
A few recent viruses/adbots/spambots/systemfuckers will do this. They'll do a few different tricks (patching I.E., changing hosts file, sabotaging downloads) to try and stop you from getting to any antivirus or recovery sites. It makes it virtually impossible to recover your system without a system cleanup live CD, which basically guarantees that your average non-technical user won't be able to fix t
Re: (Score:2)
On two occasions since then, I have also been diverted to websites that claimed to have detected spyware and viruses on my
Re: (Score:1)
My understanding is also that there has not yet been any problem with Linux viruses circulating in the wild.
Not as much, but that doesn't make it impossible. Most Linux distro managers maintain ClamAV in their repositories. You might want to consider installing it.
Re: (Score:2)
There are have been a few over the years, just like for macs. Contrast that with 10s of thousands for windows.
Re:Themes (Score:5, Funny)
Re: (Score:2)
Uh thank you very much.
Practical and immediately useful advice from a Slashdot comment. What will they think of next?
Firefox personas (Score:2)
I thought it was weird of Mozilla to push the personas idea since it seems tacky. But it's true that the window frame represents the security context for an application like a web browser, and a uniform customization of the frame would make the browser more secure against window imitation threats.
Re:Themes (Score:4, Interesting)
I don't understand; how does theming your window manager help against this? [microsoft.com] I'm assuming the malware bit is *inside* the Google Chrome window, so even if you themed your windows with say a Pikachu theme, the *insides* of the Chrome window would still contain the rogue site, imitating Chrome's red and white-colored malware block UI.
The only way out of this is if crucial error pages are protected with some sort of "sign-in seal", like Yahoo uses for its login screens.
Re: (Score:2)
I don't understand; how does theming your window manager help against this?
Theming probably doesn't, but assuming Google checks its dialogs for proper grammar probably does.
Re: (Score:2)
"I don't understand; how does theming your window manager help against this? "
It doesn't.
If Windows users cared about avoiding these things, they'd browse using a virtual browser appliance, or browse using a second OS in a VM.
Portable VirtualBox allows fun things like .rar'ing a backup copy of a complete VM plus the software to run it, so if your VM is compromised you can simply delete it and extract a fresh copy.
http://www.dedoimedo.com/computers/portable-virtualbox.html [dedoimedo.com]
Re: (Score:2)
Re: (Score:2)
Unless, of course, the malware reads your theme configuration file.
Re: (Score:1)
Actually, even that isn't required. People just need to stop running random executable files that they find on the internet. Seriously, I don't even have anti-virus software and I don't even get viruses because I avoid stupid shit that's obviously a virus. Also, using IE doesn't help, either.
Re: (Score:1)
Re: (Score:1)
"you are bad at computer security, full stop."
Odd because I've *never* gotten a virus, and I don't use shitty browsers such as IE. The solution really *is* to not be an idiot, and you will avoid 99% of malware. Exploits are possible, yes, but they happen rarely, and certainly never happen to me. Seriously, the only reason that poorly made malware gets so many people is because 99% of the people who own computers barely know how to work a television remote.
Re: (Score:1)
Re: (Score:1)
Well, I do have anti-virus software, it's just not the kind that constantly looks out for viruses. I do scans every once in a while to get rid of spyware and such, but never really find any bad malware. I was mainly talking about the lack of need for that kind of anti-virus software.
Re: (Score:2)
The solution really *is* to not be an idiot, and you will avoid 99% of malware.
Ah, but you see, I want to avoid all of it.
Re: (Score:1)
"then you are as at fault as anyone"
At fault of what? That would be true if I had ever gotten a virus, but I haven't. In fact, no one I know that has any decent knowledge of computers has got a virus. Not because of some anti-virus software, but because they aren't complete idiots.
Re: (Score:2)
These days all you have to do is see an infected add that slipped through, open a malicious PDF, put in an infected flash drive, etc. It's really sad to see Slashdot users - people who are supposed to be the cream of the nerd crop - spouting this decade old stuff as if Conficker never existed. If you run Windows and do not run an antivirus solution, you are bad at computer security, full stop.
In my years of running Windows, I never used a resident AV program (although I did periodic online scans) and I got a virus exactly *once*, when someone emailed me an executable asking "hay is this a viruz??" and I (not being used to the trackpad on my new laptop) accidentally double-clicked instead of click-and-dragged.
Then again I haven't run Windows at home for a few years now, so maybe it's rougher out there than it was. Back when I did run XP it was sufficient to just use a combination of Firefox, Ad
Re: (Score:1)
Of course not. BTW, for your security, you should install KnowScript. You surely have heard about it. Get it at www.evilmalware.com :-)
Re: (Score:2)
Keep suggesting switching, help people switch if necessary. But for crying out loud, stop doing free technical support for Microsoft.
Re: (Score:2)
Why is this new? (Score:4, Insightful)
There's plenty of rogue/fake AntiVirus programs [wikipedia.org] out there. Is the new part that they imitate your browser rather than looking like a real anti virus program?
Re: (Score:2)
Well, let's see now; from RTFS:
"auto-detects a user's browser and then imitates the relevant malware warning pages from Internet Explorer, Firefox, or Chrome...relying on the user's trust in their browser, a tactic that hasn't been seen before".
So, mebbe?
Re: (Score:1)
All of the ones I have seen so far have no idea what I am running, so that sound like a new trick.
Possible solution (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
"Proven antivirus protection fin one click!"
Whether it's shark fin, mahi fin, or tuna fin is user-selectable...
Re: (Score:2)
"Proven antivirus protection fin one click!"
Whether it's shark fin, mahi fin, or tuna fin is user-selectable...
They are french mal-ware writers.
What they really mean is "Proven antivirus protection ends in one click!"
Re: (Score:2)
There's a study out there [computerworld.com] that has proven that those security images don't work.
The new part of this (Score:5, Informative)
Get all the details at the conference. (Score:2)
Is this just an advance posting of a presentation at MalCon [slashdot.org]?
These guys really need a conference to hone their skills, and take advantage of everyone who doesn't read /. daily (because those of us who do read /. daily are too smart to be conned by these losers). Right?
Re: (Score:2)
(because those of us who do read /. daily are too smart to be conned by these losers). Right?
I see that you are new here.
Bit of Advice (Score:3, Insightful)
You spend all this time writing this creative software (malware)...
Try fracking finding someone who can proofread your english; it's abysmal and frankly embarrassing. I realize it is not your native language but this lack of attention to detail is exactly the reason you find yourself writing malware in the first place ... oh and why the only people you manage to trick into this are on the bottom side of the intelligence bell curve.
Re: (Score:2)
I would say let those idiots get scammed if they're stupid enough to fall for this sort of obvious fake.
Unfortunately it'll only get worse until some politicians get paid to propose a bill that will
require IPSs to filter bad traffic to protect Joe Public. ISPs will of course use that as an excuse to
get around any net neutrality rules that get proposed. Eventually all traffic not pre-approved will get
filtered/blocked/downgraded.
Re: (Score:1)
"Get me our of here and upgrade"
So what, you're getting me one more 'our of browsing on this site before I have to upgrade? Allright, I'll upgrade in an hour.
Re: (Score:2, Insightful)
"oh and why the only people you manage to trick into this are on the bottom side of the intelligence bell curve."
So... 99% of the people that own computers?
Re: (Score:2, Interesting)
I was going to post exactly this. The sample Google Chrome image in the article is immediately obvious as a fake because real Chrome warning pages have proper subject-verb agreement and don't have character encoding images. I imagine Firefox warning pages don't have the two buttons overlapping.
I'm really forced to wonder this about a lot of malware and phishing scams - I somewhat frequently get e-mails telling me I won an "iPhone-4G" on "Facebooks", how hard it is to get those right?
At the same time, I thin
Re: (Score:2)
When people who actually sell the damn phones can't get it right (one major phone company sells "iPhone 4GS" here), I think most people aren't even sure how to spell most products they own. I've seen Toyota-owners misspell the brand of their car in creative ways too. Don't expect too much.
Re: (Score:3, Insightful)
oh and why the only people you manage to trick into this are on the bottom side of the intelligence bell curve.
I disagree with this line entirely.
Sure, those of us at Slashdot may realize the obvious attempts at breaching our computers safety, but not everyone realizes they need to distrust and scrutinize every little thing they come across, especially when it looks like a very legitimate message from the browser itself (English errors notwithstanding). Even still, that doesn't make the completely stupid, just naive.
Re: (Score:2)
not everyone realizes they need to distrust and scrutinize every little thing they come across, especially when it looks like a very legitimate message from the browser itself (English errors notwithstanding).
Experience keeps a dear school, but fools will learn in no other.
-- Ben Franklin
Re: (Score:2)
Naivety is a special branch of stupidity.
If you default to trusting, you are stupid, but far from alone. There's one born every minute.
Re: (Score:2)
oh and why the only people you manage to trick into this are on the bottom side of the intelligence bell curve.
Why would they want to compromise your computer? You're smart enough to notice and take action, it'll be out of their botnet in hours. That's just more accounting and command-and-control overhead for little benefit.
Re: (Score:2)
Thanks you for a advice. Are you available profread for me? Pay $1000 day, work at home. Send name and bank number to malgod@malgot.org an will advance you paymet for first work.
Corrction: malgod@malgod.org
You owe me $1000, send me your bank account number and I will collect the fee directly.
Re:Bit of Advice (Score:4, Funny)
Corrction: malgod@malgod.org
Correction: "Correction"
You owe me $10,000, as I'm charging my standard rates for proofreading for proofreaders.
Security Fix Schedule (Score:3, Interesting)
Firefox will have it fixed within hours.
Chrome will have it fixed within days.
Microsoft will issue a patch with in months.
Re: (Score:1)
If that wasn't so true it'd be hilarious. Sadly, too, you can be assured that if/when MS does release a patch, they will wait until a Tuesday to do so.
Re: (Score:3, Insightful)
> Firefox will have it fixed within hours.
> Chrome will have it fixed within days.
> Microsoft will issue a patch with in months.
Apple will ignore it.
Re:Security Fix Schedule (Score:5, Insightful)
That'd be the day - when a browser developer can issue a patch for human stupidity.
But that web site was SECURE! (Score:5, Funny)
The .gif image of a shield SAID SO!
Re: (Score:2)
This part never fails to amuse me. An arbitrary image that happens to say "it's safe because I said so, and look; I even know what day it is today!" makes me feel GREAT about the web site. It needs to say "go find the lock icon in your browser. does it look locked? good. on your way."
Linux users (Score:2)
Bastards, I use Elinks. Couldn't they at least humor me and do background=#00000000 and set the font to courier 10 in neon green?
Malware? (Score:2, Funny)
Re: (Score:2)
What's funny is all those fake warning boxes trying to trick me.
"Windows XP has detected a problem!" ...really? I thought my Mac mini was running Snow Leopard!? I guess I was wrong!
Just Hurting Kids and Old People (Score:5, Interesting)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
The fucked up thing about the whole thing is most of these malware writers are kids and/or people with kids in shitty environments. They do work like this because Bob down the street bought a new bike with the money he made selling spam bots, and my kids are fucking starving, so fuck those rich people I'm infecting their computers to send spam to pay my bills.
You want to get rid of spam and malware?
Fix the global economy so nobody is poor.
What about us? (Score:3, Insightful)
What about Safari and Opera users?
Re: (Score:1)
Re: (Score:2)
I know both use Webkit, but I think they use different Javascript engines.
Re: (Score:2)
Safari is available on Mac OS X, Windows, iPhone, iPod touch and iPad.
Opera is avaiable on Mac OS X, Windows, Linux, Nintendo Wii and Nintendo DSi, and a shitload of smartphones.
Still think there's only three Safari or Opera users?
Re: (Score:2)
It's not Opera, it's Opera mini. Almost the same name, huge difference.
Seen it (Score:2, Interesting)
Re: (Score:2, Informative)
Re: (Score:2)
Disabling task manager means nothing.
%windir%\system32\perfmon.exe /res - resource monitor. All the information you can get from Taskmgr, and a whole lot more. For bonus point,s it allows you to suspend (without killing) processes. There's a lot of malware that won't auto-resume a suspended process but will auto-restart a killed one.
tasklist/taskkill - ps and kill for Windows. Not as powerful as either, but perfectly valid tools for killing problematic processes.
Powershell (included with recent Windows vers
Grammar (Score:2)
This is why i still use lynx (Score:2)
God I love lynx. Can't infect my shit.
Of course, i have to borrow my neighbors computer to post here, lynx don't do web 2.0.
But I'm sure there's be a lynxweb2.0 fork anytime now...
Users must pass the Turing test - no exceptions (Score:2)
The solution to this problem is to teach users to think for themselves, and to understand what's being asked of them. You sure as hell wouldn't trust a brand new doctor if he put you in for major surgery/medications after simply taking your weight ("Ooh, you're heavy, let's put a staple in your stomach"), why would you trust some inane browser message to do the same to your computer?
Any user must know what their level of aptitude is, know their limitations, and think for themselves (which is not the same as