Slashdot Mirror
Trojans and Popups and Slimeball Business
Selanit writes "Salon.com is reporting
on a company which exploited a vulnerability in an old but common version of Internet Explorer's Java engine to install spyware on the visitor's machine. " It's a pretty in depth story showing the lack of respect that
some companies have. My favorite part is that the guy who denies any knowledge
of the trojan popup is named 'Frank Bigott'.
Hello again! Kneel before Cyborg_monkey, master of first posts!
You are all worthless and weak!
w00t!
The pop-up ad campaign from hell
It's the latest in Web marketing innovation: Hijacked Web surfers, exploited Web browser vulnerabilities and malicious spyware all wrapped up together.
- - - - - - - - - - - -
By Brian McWilliams
May 7, 2002 | Looking for state-of-the-art Internet skulduggery? Try this: Thousands of unsuspecting visitors to a family entertainment site are discovering a cornucopia of unwanted, potentially malicious software on their computers -- the result of a pop-up ad campaign, a booby-trapped Web site, a compromised Web browser, and strange doings at a shadowy Los Angeles company.
The story starts at Flowgo, a site that prides itself as the leading family entertainment portal. According to officials at eUniverse, the California firm that operates Flowgo, a pop-up ad that ran at the heavily trafficked humor site for a couple of weeks until late April caused the trouble.
The ad, purchased by a Los Angeles Internet marketing firm named IntelliTech Web Solutions, was designed to automatically redirect visitors away from Flowgo (no mouse click required) and to dump them at a booby-trapped site called KoolKatalog.
Once at KoolKatalog, visitors were invited to feed an e-mail address into a digital slot machine created in the Shockwave animation format. Solve the puzzle faster than anyone else, and KoolKatalog would send you a swell prize!
Who's Next, in Salon's new feature, 'Masterpiece' presented by Lexus
In the nanosecond it took most people to recognize the obvious junk mail trap, the real damage was already nearly done. According to virus experts, code in the pages at KoolKatalog exploited a known flaw in an old version of the Java engine of Microsoft's Internet Explorer browser to covertly download the first of 10 files onto visitors' computers.
KoolKatalog is currently inacessible, but its domain name was registered by an IntelliTech employee and the phone number listed in the privacy statement at KoolKatalog is the number for IntelliTech Web Solutions. Phone messages left with the receptionist who answered at that number were not returned.
A contrite spokeswoman for eUniverse said IntelliTech's automatic redirects violated its ad policy, and eUniverse pulled the pop-ups as soon as it learned what was happening. Flowgo has achieved its success, she said -- and helped earn its publicly traded parent several quarters of profitability -- by taking great care to protect the safety of its visitors.
But according to virus experts, tens of thousands of Internet users have been back-doored by the KoolKatalog-distributed "malware," which they have added to their lists of malicious code for scanning.
"When you exploit a security bug to get your program onto someone's PC, you've crossed the boundary into what we consider malicious," said Craig Schmugar, a researcher with McAfee, which refers to the KoolKatalog-served payload as Downloader-W.
While researchers have not yet completely decoded all functions of the programs, they say two of the files, BVT.exe and ABSR.exe, attach themselves to victims' browsers and covertly monitor which sites they visit. Other components, including a file called AUSVC.exe, appear to enable the program's authors to secretly send updates or other files to the infected computer.
What's more, the install program, a file called CoolStuff.ocx, checks to see whether the victim is running a firewall, and terminates if it finds one. If no security software is monitoring outbound network connections, the installer grabs other files from one of two IntelliTech Web servers, online1net.com and wwws1.com.
"Somebody took a lot of time and attention to create this. There's a lot of error checking and careful programming in there," said Vincent Weafer, director of Symantec's virus research lab. Backdoor.Autoupder, as Symantec calls it, quietly made the software firm's list of the five most-prevalent viruses in April.
TWhile designed to be stealthy, the malicious code was revealed to many puzzled victims in recent weeks when it began causing instability in their PCs or crashed them.
Others discovered the program after updating their anti-virus signature files. Sam Evans, security analyst for a Midwestern semiconductor firm, said an anti-virus update in late April caused a sudden flood of reports from company employees. Cleaning the code off affected computers was complex and required editing the PC's system registry.
"We thought we disinfected all the computers, but our intrusion detection system is still reporting that internal machines are attempting to send information out," said Evans, who added that the company had "black-holed" (blocked access to) the range of Internet protocol addresses used by KoolKatalog and related sites.
Trend Microsystems, which since April 23 has received nearly 5,000 reports of infections by TROJ_SUA.A, as it calls the software, has released a free tool that automates the 49 steps required to remove IntelliTech's code from an infected PC.
The Giants' moody superstar in 'Masterpiece' presented by Lexus
IntelliTech itself has done little to clear up the mystery surrounding the surreptitious installation of its spyware.
Frank Bigott, a resident of Santa Monica, Calif., who holds the domain registration for KoolKatalog, said he had "zero knowledge" of the backdoor program prior to being contacted by Salon. Bigott referred all other questions to his attorney.
The lawyer, William W. Bloch of Beverly Hills, said Bigott resigned his position in sales and marketing at IntelliTech after learning of the incident from Salon. Bloch also gave Salon the cellphone numbers of three men whom he identified as IntelliTech management, but voice-mail messages left at those numbers were not returned.
Block says that Bigott determined that IntelliTech's management had placed the spyware programs on users' computers "to gain certain things that would result in increased revenue," such as commissions from affiliate marketing programs.
Susan Henrichsen, deputy attorney general for the state of California, declined to comment on specifics of the IntelliTech situation. But she noted that downloading software onto someone's computer without permission is tantamount to hacking.
"If, on top of that, you track people with spyware with the intent of selling the information, that goes way over into unfair and deceptive practices. It's really pretty appalling," she said.
The spyware tar pit that users encountered at KoolKatalog may have been connected to an earlier software development effort by a company called Volton Technologies, which also had ties to IntelliTech.
The agent of record for the incorporation of Beverly Hills-based Volton Technologies is Michael Osborn, one of the names provided by the lawyer Bloch as a member of IntelliTech management. Volton Technologies previously offered for download an apparently legitimate program that may have provided the technical foundation for KoolKatalog's twisted creation.
The program, which Volton termed a "browser toolbar enhancement," offered access to search engines and e-mail from a control panel at the bottom of Web browsers. According to the program's license, in exchange for the free software, users agreed to allow Volton to collect "anonymous" data on Web page views and responses to ads, as well as an inventory of the software on the user's PC.
The front door of Volton's search site, BestoftheWeb.com, invites users to download the toolbar. But the download page offers no link to the software and merely states, "Our new and improved toolbar is coming soon."
Similarly, a download link at Volton's BrowserToolbar.com site was disabled for weeks -- before suddenly reappearing May 3, when the site was relocated from an IntelliTech-owned hosting firm in Los Angeles, New Directions, to a new ISP in Canada.
Click the download link at Volton's new version of BrowserToolbar.com, hosted by Alberta-based Myrias Computer Technologies, and a message says a file called Coolstuff4.cab is being installed. But the toolbar installation fails because the server containing the file, online1net.com, is unreachable.
Online1net.com, along with wwws1.com and KoolKatalog, was summarily unplugged last week by Alchemy Communications, the Internet collocation facility that services New Directions.
When contacted by Salon on April 26 about reports of malicious code at the IntelliTech sites, Alchemy's vice president Jamie Daquino said his position was Shut down first, ask questions later.
"For someone to get written up as a virus, that's pretty serious. If they're doing what people are saying, it's illegal. We don't want to be associated with that," said Daquino.
Daquino noted that New Directions, which also goes by aliases including AlphaHostCo, Online Connect Group, Zones Now, Interhostland and Quik-Net, appears to be "companies within companies."
With its sites darkened by Alchemy, and its devious pop-up ads pulled by eUniverse, IntelliTech's misguided experiment in viral marketing appears to have been halted.
But Roger Thompson, malicious-code expert for TruSecure, said that spyware like that found at KoolKatalog.com remains a serious threat to the thousands of users who are infected and not aware of it.
"They are definitely still at risk. Only the original authors know exactly how compromised those PCs are. No one should want any uninvited back door on any PC," said Thompson
There are a few things about the article that don't seem to make sense, aside from the basic premise and the guy's name. Is this another internet rumour that slipped into the press? Anyone have real-live experience with this?
Moderation: Put your hand inside the puppet head!
First a virus uses a worm that exploits a vulnerability in Outlook and OE to spread.
Now this.
Ouch.
I love how the article is titled "The Pop-Up Ad Campaign from Hell"--and you get a pop-up when you first visit it. Also a nice Flash ad delay when you hit Back. Yep.
The coolest voice ever.
Isn't it odd that the only Java security exploit to be used in the wild is in the VM produced by Microsoft that didn't obey the Java spec.
Now a cynical person would say that this would enable Microsoft to point at Java and say "Java is insecure" but of course I'm not a cynical person and I'm sure it was purely an accident.
An Eye for an Eye will make the whole world blind - Gandhi
Mandi's voluptuous curves emphasised the singlemindedness of a Reaganite generation. Her wholesome rump, which would do a farmer proud in even the most competitive Texan meat markets, once again interrupted my field of vision to the birds perching nonchalantly on the roof of the opposite building. Two years, three months, four days and one hour into my job at dotcomrevolution.com, and the word on the seventh floor was that the VC's were about to cut off our air supply. These gulls were my only break from the monotony of BSD server administration, and Mandi had to be punished for her countless intrusive hours at the photocopier.
"Your ass is blocking my view," I mumbled.
"What did you say?" she roared. Well, it was more an angry squeak than a raw. I just had to block out the irritating, high-pitched whine that characterised all Mandi's replies, and my instincts caused my right hand to jump onto the air conditioning knob for the server room, turning it up to full blast.
"You -- that again -- I'll -- the manager!" she continued, her voice drowned out by the healthy whir of the most expensive fans in Christendom. I looked at her and grinned. "I can't think -- that -- noise! Turn -- off now!" She was trying to keep her cool (an act made all the easier by the now exceptional air conditioning), but even a blind man could have felt the heat from her cheeks as they began to turn a rosy red with rage.
"I'm afraid I can't do that, Mandy," I responded. I guess she looked like more of a Dave than a Mandy, her smooth but noticeably dark follicles of facial hair contrasting with her pasty skin under the lifeless fluorescence of office lighting, but she would not have understood the reference anyway.
With that, I turned back to my console and resumed my xtank session. But what was this? Out of the corner of my eye, I saw water begin to drip out of the corner of Mandy's eye, while she was sitting in my assistant's chair. (Well, I called it the assistant's chair, I had not actually had an assistant since late 1999, when I selected him to be the scapegoat for my rather poor backup schedule.)
"Why must you always make fun of me? I'm just trying to do my job," she blubbed. Sitting close to me now, not even $10,000 of Taiwanese ventilation could block out her piercing tone. "Ever since I got this job the guys here have made fun of me for my shape, why can't they just respect me for who I am."
A change of heart that would have made Montgomery Burns proud caused me to stand up and walk over to the wreck. I wanted to explain this rationally to her, in terms of the mating habits of the human male, and the desire for a woman fit for childbearing and housework, but there was no time for that (it was ten minutes to five). "I'm sorry," I uttered, and rested my hand on Mandy's shoulder, fearing a lawsuit.
Mandy stood up, and without hesitation put her arms round me, whispering, "Thank you." I reciprocated, grateful for a secure office lacking in inside windows. Instead of letting go, she squeezed me harder, and her tears began to stain the shoulder of my designer shirt. I motioned to back away, and in doing so my hand slipped downwards, brushing against her behind.
"I'm not so repulsive, am I?" she questioned.
I was racking my brain for a diplomatic response. "I guess there are advantages to looking at you over the gulls and the hypnotising router LEDs," I confessed. "And unlike with the routers, I'm not called out when you break down. And you don't leave a mess on the roof..."
"That's the nicest thing anyone's ever told me," she interrupted. "Do you have a girlfriend?"
(I'm a geek. Do you have a girlfriend? Exactly.)
"I'm, um, er.. I'm playing the field," was my closest attempt at honesty without offending my manhood. "I dont like to deprive others of my attention by focussing too much on one person."
"That's a shame," she said, and then her tone of voice changed completely. "Because I was so hoping to score before next week's lay-off."
"NEXT WEEK?" There was no chance that I would be able to return my home-brewed Beowulf cluster of 'borrowed' workstations so soon, and I had expected at least two week's warning from management. "Oh, and I know about your Beowulf cluster," she whispered, "but I'm sure I can use my special relationship with your boss to make it easier for you to return the equipment. The question is, what can you do for me?"
to be continued...
How is this type of cancerware distinguishable from a virus that spreads by exploiting security vunerabilities?
It seems that all the Klez and Chernobyl kiddies have gone and got themselves some venture capital, and are turning their malware into a business.
"Why did they cancel my favorite Sci-Fi show? I downloaded ALL the episodes!"
The interviewer calls him "Mr. Bigott" and then:
Frank Bigott: "Excuse me, but it's pronounced 'Bee-GOH'."
---
Remember when "Truth, Justice, & the American Way" wasn't contradictory?
that the pop-up from hell story has the biggest fucking ad i've ever seen before i can get to the story.
update comments set karma=-1, reason='offtopic' where sid=26315
Yield: 4 servings
2 lb Squid, cut into rings
1 c Coconut milk
2 Cloves garlic, chopped
6 tb Fish sauce
3 tb Peanuts, finely chopped
Juice of 1 lime
Cayenne to taste
1 ts Sugar
Coconut milk is easily made if you have a blender or food processor.
Boil 1 1/2 cups water. Pour it over 1 1/2 cups of fresh or dry grated
coconut. Beat it in the food processor or blender for at least 1
minute. Strain it through a sieve or through cheesecloth. Marinate
the squid for 1 hour in coconut milk to which you have added the
garlic. Prepare the coals and skewer the squid.
To make the dipping sauce which makes this dish so distinctive,
combine the fish sauce, peanuts, sugar, lime juice and the cayenne.
Grill the squid for about 3 minutes on one side. When brown, turn
over and barbecue 3 minutes more.
Serve accompanied by the dipping sauce.
This recipe will produce tasty grilled fish if you use firm varieties
such as swordfish, sea bass or halibut, cutting the steaks or fillets
into large squares.
This dish serves 4 to 6 as part of a larger meal.
It's so hard to keep track and the champaign has hardly had time to age.
Obligatory: I don't us IE and I disable Java whenever possible.
...a good reason to use an Applet.
"In a 32-bit world, you're a 2-bit user. You've got your own newsgroup, alt.total.loser." -Weird Al
...Call me naive, but why isnt that states attorney general investigating this company? This is nothing short of corporate sponsored hax0ring.
I didnt see any mention in the article of somebody lodging a criminal or even civil complaint.
I think a big reason these companies get away with this crap is that nobody takes them to task for what they are doing...
I lost my concept of community when my community lost all concept of me.
I take it this applies only to Microsoft's implementation and not to Sun's Virtual Machine? Not that Sun's is any more stable...(I run Win98 SE, and it dies on me all the time).
No statement is true, not even this one.
Do people like this sell thier soul to satan? I would like a Cray Computer Im considering selling my soul for it... but i guess satan is backed up with these Popup Companies
"All I can tell the "lesser of two evils" folks is that if they keep voting for evil, they'll keep getting evil."-Lp.org
Are you refering to the lack of respect Microsoft has for those who use their products?
"Try this: Thousands of unsuspecting visitors to a family entertainment site are discovering a cornucopia of unwanted, potentially malicious software on their computers--"
yeah, ok... i bet people running an old version of ie, visiting a family entertainment site, really figured this out on their own.
Not. Trollworthy.
Bring on the Katz! Bring on the Katz! Bring on the Katz!
fuck them
...or -1, flamebait
WHO THE FUCK ARE THESE PEOPLE?! Never heard of a single one of them - figures they'd be polluting the Internet.
Shouldn't these shitty companies have DIED last year?!
I'm a 2000 man.
all those lame server on wwws1.com entries in my log files. My girlfriend's computer got hit by this, and I cleared it out (eventually). Funny, guys who can write these programs to monitor everything you do on the 'net, but can't setup DNS properly.
Fortuyn, who believed immigrants were a threat to liberal Dutch life, and stated that Islam (but not Christianity or Judaism) was "backward", already had several seats in government.
A rich, overtly homosexual skinhead who campaigned that diversity causes intolerance and wanted a constitutional amendment to repeal the paragraph forbidding discrimination, Fortuyn was a hypocrite on a scale surpassed not even by Slashdot editors and karma whores.
Truly, therefore, a Slashdot icon, he will be sorely missed.
(Moderators, this is not a troll).
Maybe I'm just talking out of my ass, but, a web-site that just "installs" a program on my computer unbeknownst to me seems not too unlike me sending company X an email that "installs" a program on their computer unbeknownst to them. Yeah, IANAL and all that bull.
and it reminded me to go buy some more, cause I don't want to catch anything from Cowboy Neal tonight...
There has to be a solution to this sort of problem. About the only way I could get Flowgo to stop SPAMMING my mail server is to call up a buddy of Tony Soprano to break their knees because Flowgo doesn't care and I have never, ever, ever been able to get one of my elected officials or law enforcement agency to pay any interest in Unsolicited Commercial E-Mail. Its not like Flowgo is hiding its behavior either. It should be easy to get them but no one that matters or has the power, gives a damn about this huge waste of bandwidth.
Strange women lying in ponds distributing swords is no basis for a system of government.
It's John Big-Boo-TAY!!!
I have.
Many times: it's why I now use Mozilla (well, that and the tabbed browsing and...and...and...) and Ad Aware.
Mostly it seems to be dialler programs for offshore ISPs. Porn, basically.
Use IE unprotected for a while, then run AdAware - it's quite scary.
People first discovered the virus when they noticed crashing and instability in their systems. So THAT'S what causes it. And all this time I just thought it was crappy software.
Yes.. I know... this is Microsoft Bashing. Mod me down.
-Restil
Play with my webcams and lights here
404: This page not available.
I'm aware, that this doesn't necessarily sit well with a lot of people here, but wtf...
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.
It's about time someone got put away for this sort of crap.
California Penal Code, look for section 502
What would Lemmy do?
With that in mind, if the slimeballs knew that they can target one platform / browser (which is the case now as most normal people use IE anyway), they can devise things like this. Personally I use Mozilla, and tonight I'm converting to Linux, so this won't be much of an issue. I just wish more people knew there were other choices out there besides M$, and then they wouldn't fall victim to this.
"What kind of chip you got in there, a Dorito?" - Weird Al Yankovic
Companies appear to be using more and more dodgy ways to make money from us
Spyware for targetted ads... Scumware for stealing our resources... using exploits to do whatever they like
whats next?
deleting competitors software? (or even worse, dissabling it/making it give incorrect results in such a way that the user doesnt know its been tampered with)
Installing backdoors so they can verify that your not using their software illegaly?
I feel increasingly that we, the consumers, need to have some sort of protected from spyware, scumware, companies who exploit security problems and the next generation of click through "but you signed your kidneys over to microsoft when you bought office!"
I bet the guy who sold his soul for an 8088 screams a little louder than the rest when he dropd dead in about ten years.
although, I admit, all preceding days would have to be pretty bad.
you guys finally used the internet explorer icon!
i thought I would never see the day where you used it, for about the fifth time in the history of slashdot.
now what you should really do is get a google icon
I don't know what's scarier. This article or that a related article at the bottom of this one talks about our "friend" Fritz who wants to "protect" spyware by defining what's sensitive.
Quote
The second is "nonsensitive" information, and among that will include your name, address, and records of anything you buy or surf on the Internet. Under the act, business can't collect or divulge the sensitive bits without your express consent, but anything classified as nonsensitive can be freely collected and sold at will.
End Quote
The article can be found here
I am a lesbian, deeply involved with a woman of lusty beauty such as most men will never know. Her hair is short and blonde. Her face is bold, with a nice sexy square jaw. She has small breasts, and muscular arms and legs, and even a slight hint of a six-pack. Just the mere thought of her body gets my juices flowing.
She and I have been carpet munching for well over five years now. We love each other deeply, but it seems we've reached an impasse in our relationship. Every night, I lick and I lick and I lick. I finger, finger, finger. I also get the attention back with all sorts of creative ideas from my partner. Everything from dildos, to finger paints (when I am on my period), to meat tenderizer. However, no matter how much sexual gratification we exchange, it seems to be wearing down.
One day, while surfing on Slashdot, I learned about an interesting technique involving a turkey baster. The basic idea is that you fill a turkey baster with semen, then insert that tool into the vagina, and squeeze out its contents. With this in mind, I contemplated the idea of getting pregnant with this method, and having a baby with my partner.
I approached my beautiful mate and asked him if she wanted to have a baby. Her face lit up! She seemed to be excited; imbued with new life! However, the euphoria rapidly dissipated when she came to the realization that she did not possess the proper equipment to get me pregnant. I quickly responded that "indeed you do have the right equipment! It's in the kitchen, I'll show you." Promptly, we waltzed into the kitchen and out of a drawer, I produced the turkey baster that would bring a new life into world.
The next job was to find a source of sperm. Sperm is not hard to come by. Men ejaculate tens of thousands of gallons of it every day. We figured it'd be easy to acquire a nice hot, steaming load of cum from virtually any man. One day, I stood outside the door of our home, close to the sidewalk, top-less, and perking my lively breasts at any man who passed. Most simply gawked, but some actually tried to touch, but quickly walked away before doing so. Pretty soon, a nice young man came along who took such an interest in my tits that he seemed to forget about all else! Before long, I had him in our house and I was giving him a blowjob before he even knew what happened. As soon as he shot a big load into my mouth, I grabbed the baster and spit the load into it. He looked puzzled, but quickly realized the bizarre situation he was in and left immediately. I paid him no mind.
"Quickly," I shouted to my lover, "fuck me with this thing!" My lover grabbed the baster, thrust it into my eager beaver, and began to thrust like she was a man. I rubbed her clit and fingered her and she tweaked my boobs and fondled my own clit. When we were both about to climax, she squeezed the bulb of the turkey baster, squirting the whole load deep into my uterus. The warm, thick feeling of it drove me wild! When we were done, we rubbed oil all over each other's bodies, praying to the Lord Jesus that we would get pregnant.
Over the next few weeks, signs of something unusual began to show. As it turns out, I was not only pregnant, I had herpes too. Fucking Hemos! My life was turned upside down, but that story is for another day...
as ISP techsupport front line, I hear about this type of stuff all the time. Customers often think the ISP is the culprit and ask us to stop the pop ups. These are the same folks who can't get thier email after messing with firewall settings (not even knowing what a 'port' is). I'm amazed that novice users put up with all that winblows vrus crap. I guess they don't know there's another way to deal with it, until I tell them about Linux.
As a Linux user, my platform doesn't seem to be supported by any of these AdWare/SpyWare applications.
Sometimes it's good to be unsupported, and I think a lot of these novice users might do well on an unsupported platform.
Long live Tux, Defender of the free!
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
Don't forget that this happened via Flowgo, spammers extroadinaire, who have no scruples about using the September 11th disaster for their own ends.
Personally, I hope both IntelliTech (misnomer) and Flowgo are prosecuted for this.
It's just a statement with no supporting evidence.
" Coconut milk is easily made if you have a blender or food processor. Boil 1 1/2 cups water. Pour it over 1 1/2 cups of fresh or dry grated coconut. Beat it in the food processor or blender for at least 1 minute. Strain it through a sieve or through cheesecloth"
Mom,
I know that you all are from the midwest and such, but canned coconut milk is readily availible in most liqour stores and specialty food stores. In fact, here in Florida, the damn stuff grows on trees!
You should correct your recipe to reflect that, particulary since this simplifies the preparation by several steps.
What about the next? How trivial would it be to code up some cancerware that gathers addresses from the victim's address book, and sends itself out to them, hidden in some kind of novelty 'Purple Monkey'-type application?
This situation reminds me of a docu-drama they had on the UK's Channel 4 a few years back, set the requisite 20 minutes into the future, about the ultimate video multicasting 'killer-app' that spread itself across the Internet as a virus. When people wanted to view the video files, they found they automatically HAD the right software without needing to run a complicated install.
"Why did they cancel my favorite Sci-Fi show? I downloaded ALL the episodes!"
The article said the flaw exists in an old version of the Java Engine of Microsoft's Internet Explorer...
The M$ bulliten linked on the article and here shows that
The Microsoft VM is a virtual machine for the Win32® operating environment. It runs atop Microsoft® Windows 95, 98, Windows Me, Windows NT 4.0, or Windows 2000. It ships as part of each operating system, and also as part of Microsoft Internet Explorer. The version of the Microsoft VM that ships with Microsoft Internet Explorer 4.x and Internet Explorer 5.x contains a security vulnerability that could allow a Java applet, on a malicious web site to take any desired action on a visiting user?s machine.
Now, to me, Windows 2000 / IE 5.x isn't really OLD , considering that the majority of M$ users have IE 5.x. It may not be "new" like IE 6 or XP, but it doesn't mean 5.x is outdated.
$cat
Shit, this is like Microsoft writes bad code or something...
Can this be true or am I just living a nightmare?
Will we end up removing BOTH programs and installing two million candle-power lights to point up into the night sky to symbolize where these two mighty titans once stood?
Will Bush launch a strike against Redmond killing thousands (or putting them out of there misery)?
IANAL, but I've seen actors play them on TV
This is the first time I can remember seeing a I.E. icon (Mac-style) on a slashdot story. How appropriate that the story is about the most annoying feature of Microsoft's browsing apps: javascript pop-up hell. But seriously, times have never been better for non Internet Explorer browsers: Opera, Konquerer, iCab, Chimera, and Mozilla are all extremely usable at this point.
http://tinyurl.com/4ny52
IANAL but...
:)
If a piece of software *is* malicious spyware, it would be counterintuitive to ask the user to authorize its use and consent to a license agreement.
So -- let's assume that the software exploits the hole and, in the process, causes damage to your machine. Because you did not agree to the usual clickwrap, (software is AS IS, etc etc) could you hold the company liable for this?
Just a thought
Don't know about the other companies, but eUniverse's (EUNI) site says it is "the largest and fastest growing entertainment orientated network on the Internet. With over 19+ million unique visitors per month, it is consistently ranked as one of the Top 15 Most Visited Properties on the Internet by both Nielsen//NetRatings and Media Metrix"
You may remember that, immediately after Sept. 11, a very popular popup making the rounds was for a game called "Yo Mama, Osama". If you clicked the ad and played the game, of course, it installed a spyware app (don't recall which one).
While technically not any different from the way other spyware are distributed, it still tops the list in my book for the sleaziest thing I've yet seen in spyware, i.e., capitalizing on the emotional turmoil for 9/11.
...Oh my!
Trojans and Popups and Slimeball Business
oh MY!!
Trojans and Popups and Slimeball Business
OH MY!!!
*out pops the wicked digital witch of the west*
What bothers me the most, is that Federal Law Enforcement agencies have been going after individuals who crack corprate machines for years -- and hitting them with hard criminal charges (or in some cases, just throwing them in jail without clear or formal criminal charges).
Its clear that the federal government is zealous in its crusade to protect corporate America from "hackers". But who protects individuals from shady companies?
Its also clear that the company behind the trojan popups has engaged in criminal activity...but where the hell is the criminal investigation -- anyone being brought up on charges? At most -- we might see some fiducary damages awarded to someone (but not anyone here -- and not to anybody we know)...but if the feds can throw Kevin in jail -- I want the fuckers responsible for this kind of malicous marketing in jail too...(don't forget spammers either).
-Turkey
-Turkey
the hun It has a warning about exploit a site linked here used.
Investigate this! (warning: lot's of pink images, don't investigate at work).
The extensions MS made to their own version of Java Virtual Machine must be causing these hacks. Since these extensions of Microsoft is not called Java(remember the long lawsuit), it is lame to blame 'Java'.
Ad-aware is a Windows program from Lavasoft that will remove spyware from your computer. It is freeware. There is also a plus version available for a fee that will run in the background and prevent spyware from being installed.
IIRC, "we gotta get it out the door to do our part to help the economy, can't stop now to do the right thing, W.'s counting on us!" -- hmm soft stance of the DoJ... scratch my back, I'll scratch yours? Seems to fit in with the recent pattern of sucking up to industry.
Anyway, RealNetworks (love 'em, hate 'em) gripes are valid, if Microsoft rolls out a "tested and Q/A Approved (the MCSEs all playing solitaire never found any bugs) Final version" and mysteriously competitors products (which you know they've had a keen eye towards making sure all is well) malfunction and look shoddy.
Other than being rich and arrogant, I wouldn't want to be in their shoes.
A feeling of having made the same mistake before: Deja Foobar
Microsoft could do all manner of cock ups, illegal activities and no one would believe it.
It sickening to here how low some people will go to earn a few extra bucks, but such is the world we live in. The real problem is how to deal with it. Many people like to quote that 'all you need to do is run firewall x and anti-virus b' etc. which is fine for the tech savvy, but as we are all painfully aware, the majority is not tech savvy.
:).
I think using a computer should be though of more like using a car than a calculator - no one would dream of sitting in a car and going for a drive before taking some lessons and getting a license (apart from a joyrider perhaps), yet many people phone DELL-U-WANT, order their box and sit down thinking they will be able to browse away, most getting very irrate when it doesn't work out. People need to realise that to use a computer they need to put in time and effort to learn how to first, which is something not helped by all the AOL type adds saying how easy it is.
Another possible fix I like the idea of is to have a 'safe zone' - The WWW is a large and mostly free place, and I for one do not want to see ANY legislation changing that, whether apparently for the better or not. As anyone who lives in a large city nows, you don't go to the bad end of town unless you now how to handle yourself, people will learn to stay in the safe zone. It could work by having a controlling body which hands out domains (here.sfe etc.). Anyone using this site must sign a rigirous contract of use, forbidding any type of exploitation of the vunerable users. Thus, any company exploiting in the domain will be liable through breach of contract, and leaves the rest of the internet free for those of us who now what we are doing. Systems could come with 'IE-safe', which does not allow browsing outside the safe domain, so only someone who knows what they are doing will be able to download full browser and go to the big bad web.
These solutions are far from perfect, and do leave room for exploitation, but I think the're better than the 'I'm safe, I don't care' attitute, and a bit more constructive than 'lets melt the &"%$ in a vat of acid' solution
It's called "Windows Update."
coz Salon's going to get Slashdotted. I guess page widening has gotten boring for you, eh?
An example of this might be name brand T-shirts..
But this puts "viral marketing" in a whole new light...
I have no problem with your religion until you decide it's reason to deprive others of the truth.
Amusingly, the whois information (and hence top-level DNS servers) contain two completely different nameservers, NS1.QUIK-NET.NET and NS2.QUIK-NET.NET. Again only NS2 knows about the domain. This is common with badly configured DNS.
use constant PERL_IS_BROKEN => $] >= 5.006;
The main article doesn't seem to display unless your browser makes some effort to load it's ad.
a re/print.html
Here's a link to the printable version for those who don't want the page indirected flash ad.
http://www.salon.com/tech/feature/2002/05/07/malw
Selanit writes "Salon.com is reporting on a company which exploited a vulnerability in an old but common version of Internet Explorer's Java engine to install spyware on the visitor's machine. " It's a pretty in depth story showing the lack of respect that some companies have. My favorite part is that the guy who denies any knowledge of the trojan popup is named 'Frank Bigott'.
The only thing I did was look at the e-mail.
That was more than a year ago.
Fortunately they just replaced my homepage and search page in IE. No spyware.
Well, I don't use IE now anyways, but I use Outlook Express to read my Hotmail account.
Now I just turned off preview screen so I can delete spam and stuff without actualy rendering it.
I hope this company is held accoutable.
There's another company that's nearly as bad: Real Networks. Ever see how much crap they try to install if you're not paying attention?
Our company now has RealPlayer on its banned list, because we consider it a virus.
--
Ask the Ya-Hoot Oracle Anything!
I got a pop up "trojan" for ya right here!
Damn there goes my Karma.
it was only a matter of time before some unscrupulous ***hole took advantage of MS's unscrupulous coding to do something like this. The only surprise I got was that it took this long to happen, and is only now getting into the news. While I use IE for browsing, it's just because of things like this that I long ago disabled all active scripting, uninstalled flash, and never installed the MS virtual machine to begin with.
I also block any ad tracking site from setting cookies or sending popups through the nifty 'security' settings. Every time I find a cookie in my temp internet files that I don't recognize, the host automatically goes into 'ad tracking sites'.
Call me paranoid, but if it ain't plain HTML and static images, I don't wanna see it.
Moral indignation is jealousy with a halo - H. G. Wells
What makes you think the CA AG's office isn't investigating?
cuz right now thar too busy 'vestigatin the guvnuh and his IT boyz over that Oracle boondoggle
He was not a skinhead, nor a fascist.
You are small and fat, and we will write nothing of your death, your simple existance for which noone bothered to recognize.
Look! You breath now, and no one cares. What difference, then, comes from your death? Perhaps just another parking space at the local supermarket.
Your post, though a troll, is a joke, as is your life.
Long live Pim Fortyn, he will be missed.
Investigate your state laws here: http://law.spamcon.org/us-laws/index.shtml
Some of the states allow quite significant damages, for example, California law allows "damages of $50 per message, up to $25,000 per day, or its actual damages, whichever is greater."
If you are in a state with anti-spam laws you could really lay a hurtin' on them, and might even collect some dough in the process. (Although, given that we know they are unscrupulous, collecting will not be easy.)
Here are some other resources:
http://smallclaim.info/
http://www.spamcon.org/
http://www.aboutspam.com/
http://http://www.cauce.org/about/resources.shtml
"I don't know half of you half as well as I should like, and I like less than half of you half as well as you deserve."
Plus those pesky tabbed windows take too much getting used to. They look great and all, but like most people I accidentally close the "main" window, thinking I'm closing an opened pane. GRRR!
It's nice for the pop-ups, but PLEASE get java working so I won't have to rely on IE and Netscape for the java stuff on the net
Kevin Ealy, I want to give it to you in the butt.
butt butt butt butt butt butt butt oh!
Can I spray it over your hole?
Oh yeah, I am using lynx. :)
So what, exactly, gives you the right to deny them of funds like that? Now if you simply close the ad and don't click on it, thats one thing, but to never view it....
Good to see Jamie Kellner's got an account now.
Correction: the Microsoft VM is not a Java Virtual Machine. It is a Virtual Machine that supports Java. Lest we forget, Sun had to fight long and hard to have a court uphold this. Check out the Microsoft security bulletin about this flaw and note that it is the "Microsoft® virtual machine (Microsoft VM)". Let's not tar JVM's with the same brush.
If you were blocking sigs, you wouldn't have to read this.
What about Alchemy's response:
When contacted by Salon on April 26 about reports of malicious code at the IntelliTech sites, Alchemy's vice president Jamie Daquino said his position was Shut down first, ask questions later.
"For someone to get written up as a virus, that's pretty serious. If they're doing what people are saying, it's illegal. We don't want to be associated with that," said Daquino.
I hate to quote so much but this is scary. This is Alchemy's response based on some info from Salon? Without even checking with IntelliTech first they simply "pull the plug"? After reading the articles I formed my own opinion that IntelliTech is complete trash but what gives Alchemy the right to simply pull the plug? I assume they have an official step by step to deal with issues of this nature but they appear to not use them. Alchemy basically states that they don't know what IntelliTech is doing, did not bother to ask, but pulled the plug anyway.
Bad boys rape our young girls but Violet gives willingly.
Its despicable enough to install files onto a user's machine without their consent but to turn off the protection they're relying on is disgusting.
Burn the bastards.
The Microsoft virtual machine (Microsoft VM) contains functionality that allows ActiveX controls to be created and manipulated by Java applications or applets. This functionality is intended to only be available to stand-alone Java applications or digitally signed applets. However, this vulnerability allows ActiveX controls to be created and used from a web page, or from within a HTML based e-mail message, without requiring a signed applet.
But with all the fuss here and on a couple of other sites I am finding it hard not to scratch the itch to go over to flowgo and see what all the fuss is about. Somebody hold me back!....HTTP://www.flogo.c....
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
From reading the article, I got the impression this malware appears to take advantage of old exploits in Internet Explorer. IE with all the patches may not be not be affected by this.
Now excuse me...I feel like I need to take a shower.
Posted AC cause I don't want anyone to think that I would defend M$.
However, this did prompt me to do a few things at work, home, parents, in-laws, etc:
1. Check for the spyware
2. Remove all shortcuts to Internet Exploder
3. Install Opera 6.01
4. Install Mozilla RC1
5. Explain to less technologically inclined family that if a page doesn't render correctly in one, try the other, if it still doesn't render correctly, then email the webmaster of the site.
6. Despise Microsoft even more... even though I don't care who knows I visit Slashdot and Drudgereport.com... (though the principle of spyware pisses me off)
This comes from a joke, where you talk about
what you do with your finger (poke), and when
you sit in a nice hot bath you soak. In England a fellow is called a bloke. Now what is the white of an egg?
Flowgo/Funstun/Send4Fun use a very similar technique to get users to opt in to their spam lists. When you recieve a typical e-card (and not all of them but enough) there is a link in the first paragraph of the letter for ordinary pick up and a second link for AOL. You get a card from a friend and don't examine the links too closely. Besides the pattern is all the same.
Flowgo/Funstun/Send4Fun make their first link say something like "to see this card and recieve our great newsletter click here." The second link says "to see this card and recieve nothing," click here. Users who read carefully get no newsletter, but how many do?
Of course those who click the first link technically had a choice and are opting in. Opting in to receive a newsletter is not spam.
It's slimey and deceitful but since users technically opt in, I believe it's legal. I've gotten myself off Funstun/Flowgo's spam list twice. It's very easy to forget that the white of an egg is not a yolk.
For card education please visit Solla Sollew
http://nakedmolerat.org.uk/sollasollew It was my attempt at starting my own ladies' group.
Please visit ZOID CITY Community and Community Competition http://www.zc2zc3.st
http://www.revenews.com/archives/00000179.html#com mentsu svideos . tm
http://www.affiliatemarketing.co.uk/morphe
a) Morpheus enabled browsers automatically overwriting affiliate links with their own affiliate ID.
b) Morpheus enabled browsers writing their affiliate ID code even if the visitor arrived at a merchant's site via direct entry of the URL into the web browser.
c) Morpheus enabled browsers intercepting an Overture PPC click-thru and writing their own affiliate code.
The FDA has strict standards for listing nutrition information on food. A simple, consistant, easy to read, strictly formatted box shows you what's in it and how bad it is for you. IMHO, it works well (even for your average idiot at the grocery store), and is a Good Idea. Would it be so hard to do the same thing for software? Before installing, it presents the user a concise, consistantly formatted box that shows the user what the software does, what files it installs, what services/ports it uses over the internet, what information it collects, stores, uses and shares, and with whom it shares the information. Anybody who creates software that doesn't fit this policy gets heavily fined/jailed/deported/bludgeoned/etc.
... "Give me a woman who loves beer and I will conquer the w
That's all the farther I had to read. Anything beyond that is pointless. Flowgo is spam and nothing more. I block every single piece of flowgo netspace I can find. I also use the flowgoaway.com DNS blacklist. Block flowgo and you'll be a much happier mail admin.
How come no one noticed this:there was one a virus. Then that virus has met with anouther virus, they joined their "genes" and created a new one.
More simple they mutated. And I don't mean "mutated" like we usualy call a virus when someone changed it. I mean they did it on their one!!!!
Or, is you prefer it: they had sex...
Anyhow, these two viruses changed themselves on their own. I know that this was "probable" but so was evolution... Let's face it: we are witnessing a new life form being created here, or at least something like that....
THAT THING IS ALIVE!!!!!!!
Don't use FUCKING MSIE!!!
For crying out loud ... not another @#$%^&* hot fix! This MS Java patch is ancient. In Internet time, it's prehistoric.
./ just to stay informed.
With Red Hat, I can login to RHN or can run "up2date --list" and find out if there are errata.
Why isn't there an easier way for MS [insert product name here] [insert version number here] users to identify what hot-fixes, security patches, and other miscellany software updates they need? I'll be a hemorrhoidal geriatic if I have to read
Many people like to quote that 'all you need to do is run firewall x and anti-virus b' etc. which is fine for the tech savvy, but as we are all painfully aware, the majority is not tech savvy.
You know, it's precisely this attitude which pisses me off the most out of anything in the computer industry currently. For one thing, the above poster is right - the masses are NOT tech savvy. Nor should they have to be.
Hell, I'm tech savvy as far as that goes. But running a whole host of extra software and/or hardware just because we have weak laws/stupid people is NOT an acceptable answer. Think about it - if, instead of laws making it illegal to shoot people, we just said this:
"If you don't want to get shot, well, you shoulda worn a bullet proof vest and helmet when you went out."
I always shake my head when tech-related issues arise; it's as if people suddenly lose all common sense. I can freely walk down the street (for the most part) in the US without fear of being shot, sure it's a remote possibility, but everyone does and very few people get killed proportionally. Why oh WHY can't we use our computers freely also?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Patrick Stewert was not a skinhead
That's actually quite a hard one to argue, given any picture or news footage of him. Or will you put a toupe on his head for the funeral?
Henry Clay was not a fascist
There are those who believe all men should be judged equally in the eyes of the law ("justice"). These people wrote the constitution of the French Republic, the USA, etc. Then there are those who believe in removing laws which prohibit discrimination, so not all men are equal in the eyes of the law. This is one of the primary characteristics of a fascist.
You are small and fat, and we will write nothing of your death, your simple existance for which noone bothered to recognize.
The death of myself will never reach the media.
Look! You breath now, and no one cares. What difference, then, comes from your death? Perhaps just another parking space at the local supermarket.
Hm, you sound a lot like a great literary figure, how appropriate that you supported Telly Savalas.
Your post, though a troll, is a joke, as is your life.
My troll was successful. You even admit to being trolled, but you're so full of clever ideas-fuelled inspiration that you just had to reply, didn't you? Hehe.
Long live Samual Jackson, he will be missed.
His booty, like his body, will be bustin', and he will only be missed by everyone such as yourself.
Brown people, black people, they're all ok, baby.
It's the Islamic mother fuckers that fuck us.
Black made/inspired music is the best, really. Jazz, rock-n-roll, hip hop, blues.
And frankly, nothin' better than slappin' da black booty!
EUniverse's network is the #6 most traffic'd network on the internet, right behind MSN. They operate flowgo and a bunch of other entertainment sites and create all the flash games and things like killing Osama, etc. They make their money from 1) Collecting and selling e-mails, 2) selling replacement ink catridges, and 3) ads. They are and have been profitable for a long time and have their main office in downtown LA.
Not quite. It disables itself if there is a firewall program running. I assume so that it doesn't get detected. If there is no gatekeeper, then it goes ahead and downloads other programs and installs them. If that isn't malicious intent I don't know what is. It makes sure you aren't watching before it trys something.
Don't moderate flamebait as Troll. Know the difference or you will be Meta-moderated.
I use Mozilla and have it configured through the Advanced preferences not to pop things up. How do I block OnClose or other specific elements of JavaScript?
When I try to access the Salon article, Opera (NT4, which I have to run here at work) Dr. Watsons. Every time.
How long before one of these Malware authors sues McAffee for reverse engineering their virus/adware/trojan/spyware program.
I would love to see them get trounced by McAffee and see the DMCA get destroyed in the process.
then I'd like to see the author get punished under virus laws.
Internet Explorer running on Microsoft Windows
Systems not affected:
Internet Explorer running on Macintosh
Internet Explorer running on Solaris
Netscape running on Windows
Netscape running on Macintosh
Netscape running on Linux
Netscape running on Solaris
Netscape running on BSD
Mozilla running on Windows
Mozilla running on Macintosh
Mozilla running on Linux
Mozilla running on Solaris
Mozilla running on HP/UX
Mozilla running on BeOS
Mozilla running on AIX
Mozilla running on VMS
Opera running on Windows
Opera running on Macintosh
Opera running on Linux
etc.
(they forgot to mention this in the article. Not that any patterns are starting to appear...)
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
They all try the same thing. They simply start an installer and demand that you click next and that you agree to the EULA (which I don't think is shown, but they assume you've already read it). And Movie Networks tries to disconncet/dial into some CA-based server to download the rest of it. It doesn't even ask, it just says, "Disconnecting to call remote server" or something like that. Good thing I have DSL, or it would have made the call. Companies like that should be sued. It would be like watching a commercial, only to have a product arrive at your house, along with a bill demanding money.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
Keeping Up Appearances!
This crap with invasive software, opt-in by deception, and just plain garbage is going to go on forever until and unless users get more savvy or those in the know take the time to train them.
I tried some of this last summer with awful
results. I was in a group that is now defunct called the Secret Garden. I think it is now called http://rainbowofhope.tripod.com
I was head of the Support committee which meant we not only made web pages with graphic gifts but we also sent tons of cards.
I got up a good discussion on ecards and I showed my committee a spam trap and explained why it was bad. It was a card an actual member had sent.
The fireworks exploded. The woman who sent the card knew I meant what I said when I said it wasn't her fault.
Another member who had the ear of our Fearless Leader, Jules, did not. She feared she would be at the wrong end of the tirade I was directing at the spam pit, Flowgo.
I explained over and over to Jules the need to make spam traps a public issue and that providing good support means no spam. Jules worried about hurt feelings. I worried about screw ups.
I got through though when I said that the last thing any of us needed was to send a Flowgo/Funstun card to a sick or bereaved member and stick someone who has more than enough stress with the stress of spam.
We began to test card providers by sending cards amongst ourselves. Again, this does not take much skill. I think we would have gone much further if Jules hadn't pulled her cop de tat.
I think people can learn. Sometimes I wish they wouldn't. I'm currently head of RAOK's guestbook committee and lately there has been a huge drop off in the number of guestbook signings. The reason is that Bravenet is no longer as stable as it was precrash. I didn't pick RAOK's guestbook provider. It also throws two to three popups a signing. Signing a Bravenet guestbook just isn't much fun any more.
By the way, I feel about Bravenet the way a lot of you feel about Flowgo/Funstun/Send4Fun. At least the guestbook signers are avoiding garbage.
Please visit ZOID CITY Community and Community Competition http://www.zc2zc3.st
I love it -- the article quotes Jamie from Alchemy (which is owned by pr0n company Babenet) as saying their policy is shut down first, ask questions later, but witness an article at Wired which discusses the gohip virus Alchemy was installing on peoples computers two years ago!
Homer: "Can I have some money now?"
deus does not exist but if he does
My dad made the mistake of installing an "xp improvment" program that he was linked to off of a popup...i don't have any information off of what site it came from, but i do know that it preforms a function similar to norton's Clean Sweep, only doesn't do a very good job. I ended up losing half of the shortcuts on the computer. Had to re-install my virus prevention, and Photoshop's UserInterface font is now missing.
In his account, everytime there is a 404 not found, it routes you to Lop.com, which installed a "toolbar" that takes you to lop.com.
moral of the story is don't let other people use your computer. Also, if anyone knows how to restore the quicklaunch show desktop shortcut, i'd be much obliged.
ps. don't go to lop.com
You mean like selling our email addresses, Mr. Taco? Changed my address again 6 days ago, already getting spammed from ThinkGeek again. You can suck your caffeinated "Bawlz" back down your throat, thank you very much.
STOP ME BEFORE I POST AGAIN!
http://forums.justsaywow.com/
http://cexx.org/osama.htm
The wnad.exe program initiates connection to www.rankyou.com:80 and other sites, apparently for the purpose of transferring personal information and downloading targeted advertising for later display. According to reports, wnad.exe hijacks the Web browser to display pop-up ads every hour or so. While it is claimed that the purpose of the software is to raise money for the American Red Cross, the suspicious activities associated with
the software tend to cast distrust on these claims.
Caveat Emptor is not a business model.
However, advertisers won't pay (or at least not nearly as much) to advertise in something free. They take the number of paid subscribers--even if it's only a small amount--as a measure of how many people actually read it.
hawk
If you live in the UK (or EU) then this is already illegal under section 1 of the Computer misuse act. Since this act is a result of EU Treaty obligations similar legislation exist accross the EU.
This same legislation could theoretically be used against junk emailers.
'The Computer Misuse Act 1990'
Section 1;
1.--(1) A person is guilty of an offence if--
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b) the access he intends to secure is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that that is the case.
(2) The intent a person has to have to commit an offence under this section need not be directed at--
(a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.
(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.
http://www.hmso.gov.uk/acts/acts1990/Ukpga_1990
Hollings's proposed bill would require customers to be able to opt out of the "nonsensitive" information gathering as well. Salon, for some reason, has chosen to ignore this.