Slashdot Mirror
Trojans and Popups and Slimeball Business
Selanit writes "Salon.com is reporting
on a company which exploited a vulnerability in an old but common version of Internet Explorer's Java engine to install spyware on the visitor's machine. " It's a pretty in depth story showing the lack of respect that
some companies have. My favorite part is that the guy who denies any knowledge
of the trojan popup is named 'Frank Bigott'.
There are a few things about the article that don't seem to make sense, aside from the basic premise and the guy's name. Is this another internet rumour that slipped into the press? Anyone have real-live experience with this?
Moderation: Put your hand inside the puppet head!
I love how the article is titled "The Pop-Up Ad Campaign from Hell"--and you get a pop-up when you first visit it. Also a nice Flash ad delay when you hit Back. Yep.
The coolest voice ever.
Isn't it odd that the only Java security exploit to be used in the wild is in the VM produced by Microsoft that didn't obey the Java spec.
Now a cynical person would say that this would enable Microsoft to point at Java and say "Java is insecure" but of course I'm not a cynical person and I'm sure it was purely an accident.
An Eye for an Eye will make the whole world blind - Gandhi
How is this type of cancerware distinguishable from a virus that spreads by exploiting security vunerabilities?
It seems that all the Klez and Chernobyl kiddies have gone and got themselves some venture capital, and are turning their malware into a business.
"Why did they cancel my favorite Sci-Fi show? I downloaded ALL the episodes!"
...Call me naive, but why isnt that states attorney general investigating this company? This is nothing short of corporate sponsored hax0ring.
I didnt see any mention in the article of somebody lodging a criminal or even civil complaint.
I think a big reason these companies get away with this crap is that nobody takes them to task for what they are doing...
I lost my concept of community when my community lost all concept of me.
WHO THE FUCK ARE THESE PEOPLE?! Never heard of a single one of them - figures they'd be polluting the Internet.
Shouldn't these shitty companies have DIED last year?!
I'm a 2000 man.
all those lame server on wwws1.com entries in my log files. My girlfriend's computer got hit by this, and I cleared it out (eventually). Funny, guys who can write these programs to monitor everything you do on the 'net, but can't setup DNS properly.
Please define: A Good day for M$ on Slashdot.
Spencer Ogden
Sir,
With refrence to your order CR12345778092
We are sorry to tell you that your order is in a holding queue.
As you will be aware all transactions require the primaries signiture signed in triplicate in BLOOD.
Unfortunatly you seam to have taken this to mean the blood of any conviniant human near by.
We require the signature to be in your blood.
We are sorry for the delay this missunderstanding has caused and look forward to taking possession of your soul at the earlist.
Yours,
B. L. Z. Bub
Head of Customour Resources
Hell
Wouldn't it be nice if schools got all the money they wanted and the army had to hold jumble sales for guns
There has to be a solution to this sort of problem. About the only way I could get Flowgo to stop SPAMMING my mail server is to call up a buddy of Tony Soprano to break their knees because Flowgo doesn't care and I have never, ever, ever been able to get one of my elected officials or law enforcement agency to pay any interest in Unsolicited Commercial E-Mail. Its not like Flowgo is hiding its behavior either. It should be easy to get them but no one that matters or has the power, gives a damn about this huge waste of bandwidth.
Strange women lying in ponds distributing swords is no basis for a system of government.
It's John Big-Boo-TAY!!!
I have.
Many times: it's why I now use Mozilla (well, that and the tabbed browsing and...and...and...) and Ad Aware.
Mostly it seems to be dialler programs for offshore ISPs. Porn, basically.
Use IE unprotected for a while, then run AdAware - it's quite scary.
404: This page not available.
I'm aware, that this doesn't necessarily sit well with a lot of people here, but wtf...
ich bin der musikant
mit taschenrechner in der hand
kraftwerk
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.
It's about time someone got put away for this sort of crap.
California Penal Code, look for section 502
What would Lemmy do?
With that in mind, if the slimeballs knew that they can target one platform / browser (which is the case now as most normal people use IE anyway), they can devise things like this. Personally I use Mozilla, and tonight I'm converting to Linux, so this won't be much of an issue. I just wish more people knew there were other choices out there besides M$, and then they wouldn't fall victim to this.
"What kind of chip you got in there, a Dorito?" - Weird Al Yankovic
Companies appear to be using more and more dodgy ways to make money from us
Spyware for targetted ads... Scumware for stealing our resources... using exploits to do whatever they like
whats next?
deleting competitors software? (or even worse, dissabling it/making it give incorrect results in such a way that the user doesnt know its been tampered with)
Installing backdoors so they can verify that your not using their software illegaly?
I feel increasingly that we, the consumers, need to have some sort of protected from spyware, scumware, companies who exploit security problems and the next generation of click through "but you signed your kidneys over to microsoft when you bought office!"
although, I admit, all preceding days would have to be pretty bad.
I don't know what's scarier. This article or that a related article at the bottom of this one talks about our "friend" Fritz who wants to "protect" spyware by defining what's sensitive.
Quote
The second is "nonsensitive" information, and among that will include your name, address, and records of anything you buy or surf on the Internet. Under the act, business can't collect or divulge the sensitive bits without your express consent, but anything classified as nonsensitive can be freely collected and sold at will.
End Quote
The article can be found here
I think so. In fact, I'll be surprised if we do not see this going to court. If any of the affected PC's belong to a fortune 500 or larger company, I can nearly guarantee it. What I think should happen is that a class action suit be filed on behalf of all of the common people who were affected.
Heck, I'm sure if I the same exploits to upload even 1 teeny-tiny file to a PC, let's say, at a local bank. Guaran-damn-tee I'd be in lockup the next day.
The company behind this needs to be more than bitchslapped. They're going down.
It's just a statement with no supporting evidence.
I have to take issue with this. I really hate MS, believe me, but the fact is they (as well as a lot of bad things) make products that are user friendly and have lot's of features that, if not abused, could make a much nicer computing experience for everyone.
It is their problem that people are abusing it, but it's not their fault people are abusing it. I compare this to the luxery of having a convertable - it'd be really nice if it weren't so damned easy to break into, but it's not the car makers fault it happens - they just need to work on a way to help prevent it. And the fact is that people LIKE convertables - it's a feature.
The sad fact is that while MS is horrible about securing their products, it's the crackers and punks and phreaks that make it difficult for everybody. Sure, I'm approaching this from an existentialist point of view - not particularly realistic - but you have to blame the people that are maliciously taking advantage of a problem as well the company that fails to correct it.
It's crackers fault I have to spend my money and time protecting against break-ins. Even if you are well protected, these people steal my money and waste my time and that latter part is unforgivable. Yes, I feel the same way about the people who make it necessary for my house and car to need locks and an alarm system. I know it's reality, but those are the people I blame for making it reality.
Ok, now I'm venting, pardon the rant. I like dogging MS as much as the next guy, but the people who are violating your privacy are the ones that need your antagonism.
Stupid sexy Flanders.
This is the first time I can remember seeing a I.E. icon (Mac-style) on a slashdot story. How appropriate that the story is about the most annoying feature of Microsoft's browsing apps: javascript pop-up hell. But seriously, times have never been better for non Internet Explorer browsers: Opera, Konquerer, iCab, Chimera, and Mozilla are all extremely usable at this point.
http://tinyurl.com/4ny52
IANAL but...
:)
If a piece of software *is* malicious spyware, it would be counterintuitive to ask the user to authorize its use and consent to a license agreement.
So -- let's assume that the software exploits the hole and, in the process, causes damage to your machine. Because you did not agree to the usual clickwrap, (software is AS IS, etc etc) could you hold the company liable for this?
Just a thought
You may remember that, immediately after Sept. 11, a very popular popup making the rounds was for a game called "Yo Mama, Osama". If you clicked the ad and played the game, of course, it installed a spyware app (don't recall which one).
While technically not any different from the way other spyware are distributed, it still tops the list in my book for the sleaziest thing I've yet seen in spyware, i.e., capitalizing on the emotional turmoil for 9/11.
What bothers me the most, is that Federal Law Enforcement agencies have been going after individuals who crack corprate machines for years -- and hitting them with hard criminal charges (or in some cases, just throwing them in jail without clear or formal criminal charges).
Its clear that the federal government is zealous in its crusade to protect corporate America from "hackers". But who protects individuals from shady companies?
Its also clear that the company behind the trojan popups has engaged in criminal activity...but where the hell is the criminal investigation -- anyone being brought up on charges? At most -- we might see some fiducary damages awarded to someone (but not anyone here -- and not to anybody we know)...but if the feds can throw Kevin in jail -- I want the fuckers responsible for this kind of malicous marketing in jail too...(don't forget spammers either).
-Turkey
-Turkey
the hun It has a warning about exploit a site linked here used.
Investigate this! (warning: lot's of pink images, don't investigate at work).
Ad-aware is a Windows program from Lavasoft that will remove spyware from your computer. It is freeware. There is also a plus version available for a fee that will run in the background and prevent spyware from being installed.
Personally I blame both sides.. on one hand you have some idiot taking advantage but on the other MS should have considered the security implictions before a lot of those features were shown the light of day.
It sickening to here how low some people will go to earn a few extra bucks, but such is the world we live in. The real problem is how to deal with it. Many people like to quote that 'all you need to do is run firewall x and anti-virus b' etc. which is fine for the tech savvy, but as we are all painfully aware, the majority is not tech savvy.
:).
I think using a computer should be though of more like using a car than a calculator - no one would dream of sitting in a car and going for a drive before taking some lessons and getting a license (apart from a joyrider perhaps), yet many people phone DELL-U-WANT, order their box and sit down thinking they will be able to browse away, most getting very irrate when it doesn't work out. People need to realise that to use a computer they need to put in time and effort to learn how to first, which is something not helped by all the AOL type adds saying how easy it is.
Another possible fix I like the idea of is to have a 'safe zone' - The WWW is a large and mostly free place, and I for one do not want to see ANY legislation changing that, whether apparently for the better or not. As anyone who lives in a large city nows, you don't go to the bad end of town unless you now how to handle yourself, people will learn to stay in the safe zone. It could work by having a controlling body which hands out domains (here.sfe etc.). Anyone using this site must sign a rigirous contract of use, forbidding any type of exploitation of the vunerable users. Thus, any company exploiting in the domain will be liable through breach of contract, and leaves the rest of the internet free for those of us who now what we are doing. Systems could come with 'IE-safe', which does not allow browsing outside the safe domain, so only someone who knows what they are doing will be able to download full browser and go to the big bad web.
These solutions are far from perfect, and do leave room for exploitation, but I think the're better than the 'I'm safe, I don't care' attitute, and a bit more constructive than 'lets melt the &"%$ in a vat of acid' solution
An example of this might be name brand T-shirts..
But this puts "viral marketing" in a whole new light...
I have no problem with your religion until you decide it's reason to deprive others of the truth.
The only thing I did was look at the e-mail.
That was more than a year ago.
Fortunately they just replaced my homepage and search page in IE. No spyware.
Well, I don't use IE now anyways, but I use Outlook Express to read my Hotmail account.
Now I just turned off preview screen so I can delete spam and stuff without actualy rendering it.
I hope this company is held accoutable.
There's another company that's nearly as bad: Real Networks. Ever see how much crap they try to install if you're not paying attention?
Our company now has RealPlayer on its banned list, because we consider it a virus.
--
Ask the Ya-Hoot Oracle Anything!
it was only a matter of time before some unscrupulous ***hole took advantage of MS's unscrupulous coding to do something like this. The only surprise I got was that it took this long to happen, and is only now getting into the news. While I use IE for browsing, it's just because of things like this that I long ago disabled all active scripting, uninstalled flash, and never installed the MS virtual machine to begin with.
I also block any ad tracking site from setting cookies or sending popups through the nifty 'security' settings. Every time I find a cookie in my temp internet files that I don't recognize, the host automatically goes into 'ad tracking sites'.
Call me paranoid, but if it ain't plain HTML and static images, I don't wanna see it.
Moral indignation is jealousy with a halo - H. G. Wells
Investigate your state laws here: http://law.spamcon.org/us-laws/index.shtml
Some of the states allow quite significant damages, for example, California law allows "damages of $50 per message, up to $25,000 per day, or its actual damages, whichever is greater."
If you are in a state with anti-spam laws you could really lay a hurtin' on them, and might even collect some dough in the process. (Although, given that we know they are unscrupulous, collecting will not be easy.)
Here are some other resources:
http://smallclaim.info/
http://www.spamcon.org/
http://www.aboutspam.com/
http://http://www.cauce.org/about/resources.shtml
"I don't know half of you half as well as I should like, and I like less than half of you half as well as you deserve."
So what, exactly, gives you the right to deny them of funds like that? Now if you simply close the ad and don't click on it, thats one thing, but to never view it....
Good to see Jamie Kellner's got an account now.
Correction: the Microsoft VM is not a Java Virtual Machine. It is a Virtual Machine that supports Java. Lest we forget, Sun had to fight long and hard to have a court uphold this. Check out the Microsoft security bulletin about this flaw and note that it is the "Microsoft® virtual machine (Microsoft VM)". Let's not tar JVM's with the same brush.
If you were blocking sigs, you wouldn't have to read this.
What about Alchemy's response:
When contacted by Salon on April 26 about reports of malicious code at the IntelliTech sites, Alchemy's vice president Jamie Daquino said his position was Shut down first, ask questions later.
"For someone to get written up as a virus, that's pretty serious. If they're doing what people are saying, it's illegal. We don't want to be associated with that," said Daquino.
I hate to quote so much but this is scary. This is Alchemy's response based on some info from Salon? Without even checking with IntelliTech first they simply "pull the plug"? After reading the articles I formed my own opinion that IntelliTech is complete trash but what gives Alchemy the right to simply pull the plug? I assume they have an official step by step to deal with issues of this nature but they appear to not use them. Alchemy basically states that they don't know what IntelliTech is doing, did not bother to ask, but pulled the plug anyway.
Bad boys rape our young girls but Violet gives willingly.
The Microsoft virtual machine (Microsoft VM) contains functionality that allows ActiveX controls to be created and manipulated by Java applications or applets. This functionality is intended to only be available to stand-alone Java applications or digitally signed applets. However, this vulnerability allows ActiveX controls to be created and used from a web page, or from within a HTML based e-mail message, without requiring a signed applet.
Actually, to answer your question, it's not too hard to get java working on mozilla. It just takes an extra step. I have it working here and I'm using mozilla 0.9.9
.dll's to your mozilla plugins directory. Then close (if it's running) and restart mozilla. After that, java support should work for you.
First, go to Sun's Java page, and download their SDK for Java. Then run their installer and install that on your system. The next step is to go to the bin directory in the location where you just installed Java, and copy all the
-Through the server, over the router, off the firewall... Nothing but 'Net!
The FDA has strict standards for listing nutrition information on food. A simple, consistant, easy to read, strictly formatted box shows you what's in it and how bad it is for you. IMHO, it works well (even for your average idiot at the grocery store), and is a Good Idea. Would it be so hard to do the same thing for software? Before installing, it presents the user a concise, consistantly formatted box that shows the user what the software does, what files it installs, what services/ports it uses over the internet, what information it collects, stores, uses and shares, and with whom it shares the information. Anybody who creates software that doesn't fit this policy gets heavily fined/jailed/deported/bludgeoned/etc.
... "Give me a woman who loves beer and I will conquer the w
That's all the farther I had to read. Anything beyond that is pointless. Flowgo is spam and nothing more. I block every single piece of flowgo netspace I can find. I also use the flowgoaway.com DNS blacklist. Block flowgo and you'll be a much happier mail admin.
Well, considering how effective viruses and other exploits have been on the Windows platform, I'd think it'd be pronounced "Beeg-lawg-Oh".
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Many people like to quote that 'all you need to do is run firewall x and anti-virus b' etc. which is fine for the tech savvy, but as we are all painfully aware, the majority is not tech savvy.
You know, it's precisely this attitude which pisses me off the most out of anything in the computer industry currently. For one thing, the above poster is right - the masses are NOT tech savvy. Nor should they have to be.
Hell, I'm tech savvy as far as that goes. But running a whole host of extra software and/or hardware just because we have weak laws/stupid people is NOT an acceptable answer. Think about it - if, instead of laws making it illegal to shoot people, we just said this:
"If you don't want to get shot, well, you shoulda worn a bullet proof vest and helmet when you went out."
I always shake my head when tech-related issues arise; it's as if people suddenly lose all common sense. I can freely walk down the street (for the most part) in the US without fear of being shot, sure it's a remote possibility, but everyone does and very few people get killed proportionally. Why oh WHY can't we use our computers freely also?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Internet Explorer running on Microsoft Windows
Systems not affected:
Internet Explorer running on Macintosh
Internet Explorer running on Solaris
Netscape running on Windows
Netscape running on Macintosh
Netscape running on Linux
Netscape running on Solaris
Netscape running on BSD
Mozilla running on Windows
Mozilla running on Macintosh
Mozilla running on Linux
Mozilla running on Solaris
Mozilla running on HP/UX
Mozilla running on BeOS
Mozilla running on AIX
Mozilla running on VMS
Opera running on Windows
Opera running on Macintosh
Opera running on Linux
etc.
(they forgot to mention this in the article. Not that any patterns are starting to appear...)
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
The interviewer calls him "Mr. Bigott" and then:
Frank Bigott: "Excuse me, but it's pronounced 'Bee-GOH'."
Well, assuming that the sound of his name has anything to do with anything, the double 't' at the end prevents it from being silent. I assume that you are trying to apply French pronounciation rules here.
My question is why the apparent joke about this name. I rememberback in 7th grade, one of my friends found a picture of a truck or van with "Fucker" painted on the side. It was a German company, I believe, but we sure had a lot of laughs over that one. Ha! Ha! Boy, isn't that funny! I think we all got tired of it by the time we were in 8th grade, though. Maybe it was a part of growing up.
A dingo ate my sig...
They all try the same thing. They simply start an installer and demand that you click next and that you agree to the EULA (which I don't think is shown, but they assume you've already read it). And Movie Networks tries to disconncet/dial into some CA-based server to download the rest of it. It doesn't even ask, it just says, "Disconnecting to call remote server" or something like that. Good thing I have DSL, or it would have made the call. Companies like that should be sued. It would be like watching a commercial, only to have a product arrive at your house, along with a bill demanding money.
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
the usual disclaimer is: We don't support Linux, but there are sources of support elsewhere.
I don't know about you but I find Linux is WAY easier to use.
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
Yes, I am a TV Junkie. I find tvguide.com invaluable, but tvguide.com uses popups to show a closer look of each show:
closer = window.open("", "CloserLook", opts);
closer.focus();
On Mozilla 0.9.9 the only thing I allow JavaScript to do is to "Open a link in a new Window". This lets me use TV Guide, and keeps almost all other popups away. On Mozilla 1.0RC1, I have to enable "Open unrequested windows". Yikes, if I want my TV Guide popups, I also get all the other pop ups in the world.
So I am still not sure what I need to be doing to get TV Guide to work once more while keeping the junk popups away
However, advertisers won't pay (or at least not nearly as much) to advertise in something free. They take the number of paid subscribers--even if it's only a small amount--as a measure of how many people actually read it.
hawk
If you live in the UK (or EU) then this is already illegal under section 1 of the Computer misuse act. Since this act is a result of EU Treaty obligations similar legislation exist accross the EU.
This same legislation could theoretically be used against junk emailers.
'The Computer Misuse Act 1990'
Section 1;
1.--(1) A person is guilty of an offence if--
(a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;
(b) the access he intends to secure is unauthorised; and
(c) he knows at the time when he causes the computer to perform the function that that is the case.
(2) The intent a person has to have to commit an offence under this section need not be directed at--
(a) any particular program or data;
(b) a program or data of any particular kind; or
(c) a program or data held in any particular computer.
(3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.
http://www.hmso.gov.uk/acts/acts1990/Ukpga_1990