Slashdot Mirror
Buddylinks Stinks
Omie TheNull writes "After recieving several messages over AIM with the content:
"check this out... http://www.wgutv.com/osama_capture.php?HlvU", I went to the page and discovered that it is sponsored by a site called "BuddyLinks." Their website is at http://www.buddylinks.net
and they claim that they are NOT a virus. However, when you visit their links and install their "player" it seems that you are also installing software that takes control of your AIM buddy list and sends advertisments to those on your buddy list. The advertisements are obviously designed to look like innocent messages from your buddies asking you to check out certain links. Very scummy, indeed."
it says there very clearly that "soon your instant messaging software will start sending your friends funny news messages like this".
tell your friend that he is an asshole if he uses this.
"3. Open the prize - your friends will love the prize they receive in their funny news message. it might be a game or a funny flash cartoon"
yeah i'd really love that.
4. no need to send any new messages when everybodys ignoring you.
world was created 5 seconds before this post as it is.
The more this type of "attack" keeps happening, the more I wonder if there shouldn't be a license or minimum firewall requirement to get on the 'Net.
Maybe we have to start teaching "Safe Surfing" along with Safe Sex in the teen years.
GTRacer
- speechless
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
Why in the world does anybody still use AIM? It's a bloated, closed-source POS. Those using it should expect to get spammed.
Give me Trillian any day.....
CMDRTACO CHECK YOUR EMAIL!
However, when you visit their links and install their "player" it seems that you are also installing software that takes control of your AIM buddy list and sends advertisments to those on your buddy list. The advertisements are obviously designed to look like innocent messages from your buddies asking you to check out certain links. Very scummy, indeed.
What's worse, in an effort to drive traffic to their site, their software hijacks your Slashdot login, forges complaints about their software, and submits those complaints to Slashdot as articles and comments.
You can distinguish their forged posts because invariably the last three words of any forged post are "Very scummy, indeed".
Very scummy, indeed.
Opinions on the Twiddler2 hand-held keyboard?
My favorite part of this claptrap. To wit: No, our software doesn't PERSONALLY sell your information and the information of everyone on your buddy list. We're merely a conduit for third-parties to do so, and to give us bags of cash for facilitating it. Do you like my hat? It's made of MONEY.
El riesgo vive siempre!
Here's a copy of what the messages look like:
InfectedUser (12:30:45 AM): check this out... http://www.wgutv.com/osama_capture.php?hAsH
I'm wondering what that little hash code on the end is...
I haven't personally installed that crud, but I'm wondering if SpyBot (google for it) detects it. I clicked around the site, and, to be honest, it looks like they're setting themselves up for a huge "p2p" (I hate buzzwords) marketing push. I'm going to guess that this "jokes and pranks" business will come to an end when they have a sufficent install base, after which they'll start pushing the next new wave of spam for Viagra, Mortgages, Porn, or *checks his SpamNet folder* Internet gambling on you.
Here's a snippet from the license agreement with my emphasis:
Services; Modifications to Your Instant Messaging Client. The Software provides you the opportunity to access Content for no charge. In return for the right to access this Content, you acknowledge and agree that the Software contains additional software products provided to PSD Tools by its suppliers which will periodically deliver additional Content such as, but not limited to, advertisements and promotional messages to your Computer and programs that may alter your home page to offer you Content. In addition, the Software will interoperate with your current instant messaging client so as to permit the automatic sending of advertising messages originating from your Computer to your contact or "buddy" list regarding Content offered by PSD Tools or its suppliers. If you desire to stop this activity, you may elect to stop the messages by navigating to the "buddylinks.net" entry in your "Start Menu", selecting the "buddylinks.net Configuration" item, and unchecking the appropriate option. You may also refer to PSD Tools' website at http://www.psdtools.com for an uninstaller. (http://www.buddylinks.net/terms.html)
Michael C. Hollinger
Another example, which applies here, is to avoid certain software. The "A" in "AIM" stands for AOL; therefore, I've never installed AIM and thus I avoid this latest marketing ploy.
Similarly, the "Windows" in "Windows Messenger" stands for Microsoft Windows, so I disabled it. Yes, I run Windows (because I can't avoid it for a variety of reasons), but I only run it behind an OpenBSD firewall, and I also run ZoneAlarm and Norton Anti-Virus. As Gene Simmons says, if it's raining wear a raincoat.
Mod this "flamebait" if you must, but you know I'm right.
If all this should have a reason, we would be the last to know.
What, and you're surprised? That's expected of that type of scum. Hardly worth mentioning on Slashdot... there are probably a hundred other companies doing the same scummy thing all over the net. This one's not any more or less worthy of notice.
Daniel
Carpe Diem
That'll be up to the law to decide I guess.
It's one big disfunctional love-triangle.
This isn't actually violating anybody's rights, is it? Let's keep things in perspective. It isn't anything like this.
is this on here? So what?! People who don't know any better have been clicking "Yes" to install stuff they don't know anything about for years. Maybe you've heard of Gator. Its adware/spyware and I don't see how its newsworthy or relevant.
796F75617265616E65726400
Looks like we've shown them how "buddylinks" really work by having their /. "buddies" slashrape their server.
796F75617265616E65726400
Some one at work clicked one of those links (it throws a link in your profile) and her machine was infected. It altered her ie's homepage, and it made it constantly write the page it was viewing to some temp dir. It also installed about 5 other progs. We tried to remove it, first with windows... no good it reinstalled itself,. Then we tried the uninstaller, well that got some of it, but there were still a good few side affects.
MY DEAR LORD!! stay away from these sleezballs, they make bonzia buddy look like a good idea. If anyone is deserving of a serious slashdotting it is them.
http://monkeyserver.com --- weeeeee
It's a trojan!
The phone number on the WHOIS for wgutv.com will connect you to the guy who wrote the virus... Use this for good, not for evil.
Tim
Omnia vestra castrorum habetur nobis.
You mean, you downloaded a program being advertised by spam and it was crap?! My god, d'ya reckon it's a one off or should I cancel my penis enlarger and v1agra?
I got the message from a friend last night thru AIM on my laptop at work. I never got any sort of IE message about installing software - nothing, nil, notta. Looked like a dead link. Now, today, on a totally separate computer, I'm sending AIM messages to everyone in my list. I have NO IDEA how (1) it was installed on my laptop without the pop-up message / approval and (2) how it made it to my home machine (thru AIM?). Also note, contrary to other posts, that this is not removed by using control panel add/remove - it leaves shit all over the machine.
technically, would it be a worm?
..and you had to post the same scummy links on Slashdot. Perhaps 40% of the thousands of viewers will click the links just to see if they hold any information.
How much they're paying you per visits? Was it _you_ that authored the scummy-links?
Are all these sites down, or is my university blocking them on the router level?
-- I was raised on the command line, bitch
You can stress-test their system by running the following script:
/usr/share/dict/words| perl -pe 'system("curl http://www.buddylinks.net/support.php?sn=$_");' >/dev/null
cat
This will start removing everyone in their database, and will also eat cycles on their system.
May we never see th
...if you're a clever perlmaster, and can come up with a short way to synthesize usernames other than just using the entries in the system wordlist, feel free to post it.
May we never see th
why not use a decent shell like rc ?
/usr/share/dict/words}) /dev/null
for (w in `{cat
curl 'http://www.buddylinks.net/support.php?sn=' ^$w >
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
So basically Buddylinks is doing what real people have been doing for ages. Specifically, an aquaintance or friend decides to add your email to their address book, and forwards every piece of crap - virus hoaxes/jokes etc to everyone in their book. Yes, why, thank you vague aquaintance - I really did enjoy that list of hugely stupid jokes you sent me. The repeated quote arrows really made it work. At least with Buddylinks you have to actually install it...
Let's take a brief look at these folks:
$ host buddylinks.net
buddylinks.net has address 63.251.131.235
$ whois 63.251.131.235
[Querying whois.arin.net]
[whois.arin.net]
Internap Network Services NETBLK-PNAP-11-99 (NET-63-251-0-0-1)
63.251.0.0 - 63.251.255.255
ClickSpring LLC INAP-BSN-CLICKSPRING-0041 (NET-63-251-131-232-1)
63.251.131.232 - 63.251.131.239
# ARIN WHOIS database, last updated 2004-02-11 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
Googling for clickspring llc turns up a number of hits. Apparently, ClickSpring has been in the business of writing advertising worms and trojans commercially for some time now. They are responsible for PurityScan as well as some other nasties out there.
Normally I wouldn't care -- another Windows virus -- but now I'm getting masses of useless messages from infected friends.
Obviously, nobody has bothered to charge ClickSpring with computer crime charges, which is quite frusterating.
May we never see th
http://www.cnn.com/2004/TECH/internet/02/11/instan tmessenger.ad.ap/index.html
Looks like even the AV companies might be blocking it soon.
-Shadowkat
Anybody who has to make it clear that, whatever they are, they're not a virus, is somebody that I'm gonna be very worried about installing their software.
Free Software: Like love, it grows best when given away.
All of what you want more of I wouldn't be able to stand. This is why I stopped using Trillian earlier this year.
I prefer Miranda IM for AIM. As of right now it only connects via TOC, but I don't need the added features of OSCAR AIM. Being able to send and receive messages is most important to me.
To me Trillian is a little too big for what it does, and does too much more than it needs to initially. But that's just my opinion.