Slashdot Mirror
How Much Harm Can One Web Site Do?
Ben Edelman has written extensively on issues including censorship and spyware. He's got a very interesting piece on his site now about who profits from spyware, and how much spyware can be installed on a Windows XP machine when the user simply visits a single Web site using Internet Explorer.
if you use another browser like Firefox?
Well, if it's Slashdot, it can leave your server a smoldering wreck.
Am I supposed to click that link? Finally, we've found the antidote to slashdotting!
how much spyware can be installed on a Windows XP machine when the user simply visits a single Web site using Internet Explorer.
Am I safe if I am on a win2k machine?
There is a spark in every single flame bait point.
I did (for once...) read the article, but didn't download the video my question might be answered in that (although if it is only answered in the video, that's pretty stupid - I'm sure many people can't view it, and it's WMV, so I wouldn't actually want to...) but does he actually say what the website visited was?
I mean, I'm guessing most people would visit a reputable search engine, or the default MSN page when they first installed Windows and opened up IE, instead of what I'm guessing must be a fairly dodgy site in order to install so much spyware.
That's not to discredit what he's done - I'm sure novice users would easily get onto these sort of spyware laden pages by mistake pretty quickly...I'm just interested, that's all.
And get no spyware at all.
Certain .cx sites are all the evidence needed. I rest my case.
The difference between spam and poop is that you don't have to dig through septic tanks looking for real food. -- Me
I LOVE the headline
Apparently we're forgetting the word "slashdot" as a verb.
None of this is a surprise to me. I've been dealing with this crap at work for years now. Spyware is teh single biggest headache the ITS department I work for has to deal with. We spend more time cleaning spyware out than viruses. XP Service Pack 2 has helped a lot, and so has encourgaing the use of FireFox, however, at least 55% of our systems still run Windows 2000 and a lot of the resources we need to access online only work in IE.
Boobies never hurt anyone. - Sherry Glaser.
From TFA:
... still there and could broke your life!" (s.i.c.)
"warning! you're in danger! all you do with computer is stored forever in your hard disk
Anyone else find the improper spelling of "sic" (used by an editor to mark improper spelling or usage in a quoted piece of text) to be humorous, or is it just me?
A site that willfully becomes a source of trojans, exploits, and malware deserves to have all it's packets blocked at a high level or black holed.
Why can't this be done?
Just cut them off entirely.
The big players need to get together on this.
Okay, let's see, this guy loads up an OS ("fresh", as he writes) that has been targeted by the net scum since it came out, so we know it's vulnerable to every exploit designed for it. Goes to a troll site for 180 and then complains about how awful it is when during installation/first net logon he should have gone straight into the patching process that would have prevented it (in other words, he had to cancel critical patching out intentionally).
This is akin to throwing matches at a tub of gasoline and writing an expose' when it catches fire. Either this guy had too little to write about, had too much time on his hands, or had to win a bet and is trying to slip this one by someone.
Even he admitted his lousy methodology in his last sentence.
This isn't news. It's just a bone thrown out to keep the resident "gotta flame microsofties" happy with a fix for the day.
It doesn't matter what you wrap your emotions around, Reality is a brick wall specifically designed to scramble eggs
Particularly amusing was that the article mentioned a proposal to bundle spyware into Gnome 2.0. I bet that went over like a strip club in the Vatican.
Unknown host pong.
How much harm can one website do? This is slashdot. We blow up poor people's servers for fun!
This is not a sig.
I RTFA, and hidden away deep in the article, we find this gem:
Note that the latest version of Internet Explorer, as patched by Windows XP Service Pack 2, is not vulnerable to the installations shown...
In other words, he's running all this on an unpatched XP machine.
Now, before the Slashdot horde stabs me repeatedly with a big sharp knife for being a Microsoft apologist, consider this situation. I've got an old version of Firefox with a few exploits in it. I report the exploit, and the response I get is that these exploits are already patched. Yet I decide to write a story about the horrific exploits, post it to Slashdot, and stir up a raucus about how bad FireFox's security is.
What I'm proposing is that Slashdot report it's stories with less sensationalism and more professionalism. Put in the story that all this was run on an unpatched machine, and that the said security holes have already been fixed.
Thank you.
Tech, life, family, faith: Give me a visit
...may I point out that it is NOT worksafe? Thanks, Ben! Appreciate that.
Glad I didn't have the boss watch it with me in an attempt to convince her of the need to take better anti-spyware measures.
- Part 1
- Part 2
- Part 3
Part 4 is coming Real Soon Now (tm). The ISC handler's diary is required daily reading; always a lot of good stuff to be found. (And every now and then, there's a tale that'll make your blood run cold...)Carousel is a lie!
I was not shown licenses or other installation prompts for any of these programs, and I certainly didn't consent to their installation on my PC.
I would love to see somebody slap some criminal charges against the site owner. Hiding behind an obfuscated EULA is bad enough, but installing software without any permission whatsoever has to be illegal, doesn't it?
Interesting to note that Windows XP SP2 is immune. Only old Windows versions are vulnerable. I think its pretty pointless to keep pointing out that OUTDATED products have bugs.
Comment removed based on user account deletion
Before you start whining about how the machine was unpatched, and going on about how we're picking on MS, realize that just maybe, Microsoft isn't the target here. If you would read the fucking article, you would see that Ben is attacking propagators of spyware; not MS.
Oh, probably the same reason I have to, all the corporate web sites that won't work with Firefox (still, yes, I have the updates). When Firefox gets plugins down we'll be able to nix IE, but till then we're stuck.
It doesn't matter what you wrap your emotions around, Reality is a brick wall specifically designed to scramble eggs
If I leave my door unlocked, I'm an idiot, but if you then walk in and steal my TV while I'm gone and sell it at the local pawnshop you're still just as much a criminal as if you smashed a steel door in with an APC: an unlocked door is not in itself an invitation to enter and make oneself at home. The same principle applies here: the sites and software authors are not the legitimate businesspeople they try to convince everyone they are.
-- Old Man Kensey
but then what is the internet for?
I was thinking, what if you could do something to simulate a spyware install on a computer to the point that they would be fooled in to paying out these per-install fees to websites. If they're paying out a lot of money for installs that will promptly be deleted, then it would hurt these companies financially and also hurt the revenue streams to the websites that use these exploits for financial gain.
-- Knowledge shared is power lost. -- Aleister Crowley
Twaintec is a spyware company, and upon viewing their website I read their privacy policy regarding their spyware, and they had an e-mail address to report any malicious sites (installing their spyware without customer consent) to...
My letter (to which I got no reply)
Hello there. As you can see, I have had to take steps to insure my identity remain secret.
Due possibly to an oversight on my part (leaving the security level in the internet zone in IE on Low, then going to an untrusted site), I have been infected with your adware. The uninstall procedure on your website does not work -- your software is not listed in add/remove programs. The twaintec.dll in my windows directory is currently being used, however I have removed all permissions to this file so it will not load after I reboot.
I was infected with this as well as a myriad of other spyware (toolbars, programs, browser hijackers... I didn't bother to make a list but you should see all the pornographic bookmarks I now have, it's very impressive) by simply going to an internet site. I didn't accept any requests, I didn't read any privacy policies, and now I have your program.
While your privacy policy attempts to divert responsibility by claiming not to allow this, your failure to insure in software that this actually happens makes your company morally, if not legally, complicit. In short, you could have written software that did this, but instead you put the onus on others to ensure that your software was installed on end-users' computers responsibly. Not surprisingly, many third parties do not do this, and privacy policy be damned, *you profit from it*. You acknowledge this by putting, in your privacy policy, instructions to contact your legal department if one should find examples of abuse of your software. I believe that a person of moral integrity would take steps to ensure that your software was not abused, and that by not doing so, you lack moral integrity.
But I'm not here to put you down. I would like you to stop distributing the software, shut down your servers, destroy the source, and find another job. A company that can produce this software could, instead, produce something like, say, PestPatrol, that would make peoples' lives better, not worse. But the purpose of this e-mail is not to request that.
What I want from you is simple. I want you to write me back with instructions on unregistering that DLL. I don't know who wrote this program, but this should be a simple task for someone with programming knowledge, such as must have been required to write the program. If you can do this for me, your moral obligation to me may be considered fulfilled. There is still the greater issue of this software, but one that I'll let you deal with on your own time. If you reply to help me fix what your software has broken, I will forgive you.
If you promise to take steps to ensure that your software is not abused or that you do not profit from it if it is (charitable donations?), I will applaud you.
But I will never trust you.
David
---
Protect yourself from spam,
use http://sneakemail.com
I reciently installed a new win2K system and installed the latest service pack 4.
e rn.iscx y.yoie xe
mirc.exen -Anon.Germ s32.llax e
zema
I also killed all the services. and it never ran a web browser. Just mysql. I didn't have any antivirus software on it.
So after placing it on an unfirewalled connection in a locked room, withing 2 hours there were over dozens of virus, worm and spyware installed on the system till it crashed and couldn't even boot. Coming up with 100's of DLL errors!
Again we never open a single web page.
Specificaly some of what was installed was:
alte.exe
beird.exe
c.bat
clonzips.ssc
clsob
cvqaikxt.apk
cult.exe
cygwin1.dll
dgss
dual.exp
emoti.bat
enotxa2.exe
explorx.
ger.exe
gt.x
hosts was altered
knlps.exe
knlps.sys
ksat.bat
medo.dl
nonzipsr.noz
ntcnsl.dll
orrl.exe
Odi
repcale.exe
riqa
scheduler.exe
sysm
svcshost.exe
titlex.exe
w.e
wshield.e
winguard.exe
ymnz.exe
unmt.exe
vnicmon.exe
a qsws directory
zippedsr.piz
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
All these people talking about how he's doing this on an unpatched windows install. Complaining he should update.
The story is not about a browser. The story is about the scum companies that make money using exploits to install their crap. If the money trail is followed and the companies profiting from this got their asses handed to them this wouldn't be near as much of a problem.
His example was exactly that, an example of how many nasty things are willing to exploit you, regardless if it succeeds or not.
superman runs linux
I spent about an hour trying to figure out all the hacks that website was doing but after all was said and done it was frightening the lengths people go to in order to hack your browser, set your home page then get ad impressions and make revenue.... embeded java code with encrypted javascript with encrypted java code which printed out encrypted HTML which when decrypted had the browser load java code that used a browse helper object to set your homepage.
2 years and no mod points. Join reddit. Because openness is good.
My mom doesn't understand why I make her click on the red globe icon instead of the blue E.
:)
You can resort to the old standby of car analogies.
Or you can just point the blue E to the red globe's exe file and she'll never know the difference
-matt
Before you go off half-cocked accusing other people of going off half-cocked, you might want to RTFA, including all you mods who upped this post to 5. The article is not about Windows or IE or what Microsoft shoulda or coulda or woulda done about any flaws.
The article is about the scumbags that exploit the flaws, and the lengths they'll go to to get their crap onto your PC. It's also about the money trail that can be followed to nail these suckers. The article was trying to demonstrate that there is a way to fight back against behind-your-back-ware, aside from securing the software and making sure your updates are current.
Just because the lock on the door to your house is an old design and can be easily jimmied doesn't mean someone can come in and take your Stuff and justify it by pointing out what a lamer you are for having such an old lock.
Edith Keeler Must Die
While so many are quick to point out that he used an unpatched machine, that he should know better, that he's just doing it to be difficult, that he can fix it. He know's he should install SP2, he knows he should have his firewall set up. He knows he should practice safe surfing....but my mom doesn't know this stuff.
For every computer whiz (like most of us that visit /.), there's a thousand users like my mom who know that you turn on the box, move the little mouse around, and she can type emails to the whole family every day. Then she surfs around on the internet, types something in wrong, clicks on the wrong site, and now can't send the emails to the family and can't order my Christmas presents from Amazon.
Spyware is a pain in the ass for us, but its a nightmare for the computer novices!
You know the Spyware companies are pritty dumb. What they should do when they make the program is remove all the other pieces of spyware so only you adds are beeing seen to the User. You know if they all did this then in Theory you should only have one piece of spyware on your system and most people wouldn't notice.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
It bothers me that some people still install windows while connected to the internet.
Nothing great was ever achieved without enthusiasm
The test is not particularly valid because in the video the person quite clearly clicks "Yes" to running scripts on the page even after there are errors. I have to ask myself what kind of person blindly clicks on yes and I come up with the answer "the person who gets software installed on their machine". Also the machine is not patched, which also makes the test less than meaningful.
The "test" is basically the same as saying "Hi I know that this lock is vulnerable to this method of being opened and I will now prove it is not secure by using an old lock with that vulnerability."
If I was in a really pedantic mood I could use a nice old copy of any other operating system with known and patched security problems and demonstrate how vulnerable they were in the past as well. Lets see, maybe I could make a website dedicated to the old known Irix user able to set root password to nothing exploit.
It's not scientific and it's not clever.
Martin Piper
Owner - ReplicaNet and RNLobby
Howdy folks. Sorry to take so long to respond -- was in airports and planes all afternoon. Day before Thanksgiving...
Browsing to the site I showed in my video is one way to get infected. But that's not the most typical infection method. Instead, other sites can and do point to this site (and other similar sites), typically via IFRAMES. I was recently looking at a post in a web-based threaded messaging site, which used a 1x1 pixel IFRAME (basically, hidden) to reference the site shown in my video. When a user loads the infected post in the threaded messaging site, the user's PC will be infected via the exploits shown (if the user's PC is vulnerable to such exploits), and the user will receive spyware like that shown in the video.
As to video format: I apologize for the WMV format. There's a lot to be said for this format, from the reliable free creator to the wide deployment of the player software (present in all W2K and WXP systems). But clearly it's an imperfect solution, and not great for viewers on other platforms. I'm working on finding a better alternative and/or offering the same content in other formats.