Slashdot Mirror
How Much Harm Can One Web Site Do?
Ben Edelman has written extensively on issues including censorship and spyware. He's got a very interesting piece on his site now about who profits from spyware, and how much spyware can be installed on a Windows XP machine when the user simply visits a single Web site using Internet Explorer.
if you use another browser like Firefox?
Well, if it's Slashdot, it can leave your server a smoldering wreck.
Am I supposed to click that link? Finally, we've found the antidote to slashdotting!
how much spyware can be installed on a Windows XP machine when the user simply visits a single Web site using Internet Explorer.
Am I safe if I am on a win2k machine?
There is a spark in every single flame bait point.
I did (for once...) read the article, but didn't download the video my question might be answered in that (although if it is only answered in the video, that's pretty stupid - I'm sure many people can't view it, and it's WMV, so I wouldn't actually want to...) but does he actually say what the website visited was?
I mean, I'm guessing most people would visit a reputable search engine, or the default MSN page when they first installed Windows and opened up IE, instead of what I'm guessing must be a fairly dodgy site in order to install so much spyware.
That's not to discredit what he's done - I'm sure novice users would easily get onto these sort of spyware laden pages by mistake pretty quickly...I'm just interested, that's all.
Certain .cx sites are all the evidence needed. I rest my case.
The difference between spam and poop is that you don't have to dig through septic tanks looking for real food. -- Me
I LOVE the headline
Apparently we're forgetting the word "slashdot" as a verb.
None of this is a surprise to me. I've been dealing with this crap at work for years now. Spyware is teh single biggest headache the ITS department I work for has to deal with. We spend more time cleaning spyware out than viruses. XP Service Pack 2 has helped a lot, and so has encourgaing the use of FireFox, however, at least 55% of our systems still run Windows 2000 and a lot of the resources we need to access online only work in IE.
Boobies never hurt anyone. - Sherry Glaser.
From TFA:
... still there and could broke your life!" (s.i.c.)
"warning! you're in danger! all you do with computer is stored forever in your hard disk
Anyone else find the improper spelling of "sic" (used by an editor to mark improper spelling or usage in a quoted piece of text) to be humorous, or is it just me?
Okay, let's see, this guy loads up an OS ("fresh", as he writes) that has been targeted by the net scum since it came out, so we know it's vulnerable to every exploit designed for it. Goes to a troll site for 180 and then complains about how awful it is when during installation/first net logon he should have gone straight into the patching process that would have prevented it (in other words, he had to cancel critical patching out intentionally).
This is akin to throwing matches at a tub of gasoline and writing an expose' when it catches fire. Either this guy had too little to write about, had too much time on his hands, or had to win a bet and is trying to slip this one by someone.
Even he admitted his lousy methodology in his last sentence.
This isn't news. It's just a bone thrown out to keep the resident "gotta flame microsofties" happy with a fix for the day.
It doesn't matter what you wrap your emotions around, Reality is a brick wall specifically designed to scramble eggs
Particularly amusing was that the article mentioned a proposal to bundle spyware into Gnome 2.0. I bet that went over like a strip club in the Vatican.
Unknown host pong.
Maybe that's why 6% of iPod users want to buy Macs. Nothing to do with iTunes, iPods and OSX, they just want to be free of pop-up ads.....
I have been a user for about 10 years. This ends Feb 2014. The site's been ruined. I'm off. Dice, FU
How much harm can one website do? This is slashdot. We blow up poor people's servers for fun!
This is not a sig.
I RTFA, and hidden away deep in the article, we find this gem:
Note that the latest version of Internet Explorer, as patched by Windows XP Service Pack 2, is not vulnerable to the installations shown...
In other words, he's running all this on an unpatched XP machine.
Now, before the Slashdot horde stabs me repeatedly with a big sharp knife for being a Microsoft apologist, consider this situation. I've got an old version of Firefox with a few exploits in it. I report the exploit, and the response I get is that these exploits are already patched. Yet I decide to write a story about the horrific exploits, post it to Slashdot, and stir up a raucus about how bad FireFox's security is.
What I'm proposing is that Slashdot report it's stories with less sensationalism and more professionalism. Put in the story that all this was run on an unpatched machine, and that the said security holes have already been fixed.
Thank you.
Tech, life, family, faith: Give me a visit
...may I point out that it is NOT worksafe? Thanks, Ben! Appreciate that.
Glad I didn't have the boss watch it with me in an attempt to convince her of the need to take better anti-spyware measures.
The main defense is their structural strenght, i.e. being thinked from the basis as multiuser, where you have very separated the system admin (the one that have some permission over i.e. what programs are installed) over the user that browses internet.
And dont forget that here the blame goes both for the operating system author (Microsoft) and the browser author (Microsoft again), both good examples of what happens when security is the least priority.
- Part 1
- Part 2
- Part 3
Part 4 is coming Real Soon Now (tm). The ISC handler's diary is required daily reading; always a lot of good stuff to be found. (And every now and then, there's a tale that'll make your blood run cold...)Carousel is a lie!
Interesting to note that Windows XP SP2 is immune. Only old Windows versions are vulnerable. I think its pretty pointless to keep pointing out that OUTDATED products have bugs.
If I leave my door unlocked, I'm an idiot, but if you then walk in and steal my TV while I'm gone and sell it at the local pawnshop you're still just as much a criminal as if you smashed a steel door in with an APC: an unlocked door is not in itself an invitation to enter and make oneself at home. The same principle applies here: the sites and software authors are not the legitimate businesspeople they try to convince everyone they are.
-- Old Man Kensey
I think we're actually talking about two different things. You seem to be referring to things a user is stupid enough to say yes to. RTFA. These are things that the user never even gets a prompt for.
IE runs under a user with administrator privileges (press ctrl-alt-delete and see who's running what) and has the ability to run active-x controls; there's your vector. IE lets the site run a control, and the system lets an administrator-level program write to the hard drive and the registry. It's not even a real hacker worthy exploit (buffer overflows, etc), just telling the computer to do something stupid and watching as it complies.
By contrast, Java (the only real code Firefox can excute) is much more paranoid than IE - that is, I've seen it throw security exceptions. You'd have to not only find a way to get root privs, but get past Java as well.
Absolutely correct. But that does not mean that not-windows users are not-targeted because of their not-dominent market share. That's a logical fallacy. Linux contributors should not become complacent, yes, but I am of the opinion that users have every right to be stupid, and that their computers should not make it easier for others to exploit that perfectly human condition - that is, that their computers should be well-designed. If XP needs all of these security patches just to keep going, where a mac or linux box could stand like a column of basalt for years, clearly something is deeply wrong with it; hell, that probably qualifies under the lemon law.
Twaintec is a spyware company, and upon viewing their website I read their privacy policy regarding their spyware, and they had an e-mail address to report any malicious sites (installing their spyware without customer consent) to...
My letter (to which I got no reply)
Hello there. As you can see, I have had to take steps to insure my identity remain secret.
Due possibly to an oversight on my part (leaving the security level in the internet zone in IE on Low, then going to an untrusted site), I have been infected with your adware. The uninstall procedure on your website does not work -- your software is not listed in add/remove programs. The twaintec.dll in my windows directory is currently being used, however I have removed all permissions to this file so it will not load after I reboot.
I was infected with this as well as a myriad of other spyware (toolbars, programs, browser hijackers... I didn't bother to make a list but you should see all the pornographic bookmarks I now have, it's very impressive) by simply going to an internet site. I didn't accept any requests, I didn't read any privacy policies, and now I have your program.
While your privacy policy attempts to divert responsibility by claiming not to allow this, your failure to insure in software that this actually happens makes your company morally, if not legally, complicit. In short, you could have written software that did this, but instead you put the onus on others to ensure that your software was installed on end-users' computers responsibly. Not surprisingly, many third parties do not do this, and privacy policy be damned, *you profit from it*. You acknowledge this by putting, in your privacy policy, instructions to contact your legal department if one should find examples of abuse of your software. I believe that a person of moral integrity would take steps to ensure that your software was not abused, and that by not doing so, you lack moral integrity.
But I'm not here to put you down. I would like you to stop distributing the software, shut down your servers, destroy the source, and find another job. A company that can produce this software could, instead, produce something like, say, PestPatrol, that would make peoples' lives better, not worse. But the purpose of this e-mail is not to request that.
What I want from you is simple. I want you to write me back with instructions on unregistering that DLL. I don't know who wrote this program, but this should be a simple task for someone with programming knowledge, such as must have been required to write the program. If you can do this for me, your moral obligation to me may be considered fulfilled. There is still the greater issue of this software, but one that I'll let you deal with on your own time. If you reply to help me fix what your software has broken, I will forgive you.
If you promise to take steps to ensure that your software is not abused or that you do not profit from it if it is (charitable donations?), I will applaud you.
But I will never trust you.
David
---
Protect yourself from spam,
use http://sneakemail.com
IE runs under a user with administrator privileges
No, IE runs under whatever user you are logged in as. One should definately learn to manage users. No argument there.
, but I am of the opinion that users have every right to be stupid,
Yet we all own cars... If you are too stupid to add oil to your car and you burn out your engine... It's not the manufacturers fault. There's a certain level of responsibility the users should bear as well. Users have a right to be stupid, but should pay up when they screw their computers up the same way car owners should pay if they don't maintain their vehicle or use it correctly.
. If XP needs all of these security patches just to keep going, where a mac or linux box could stand like a column of basalt for years
Again, Bullshit! There's security holes in Linux and FreeBSD. That's why we have utilities in Fedora like up2date, portupgrade, etc. So you can automate the patching of those security holes.
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
I reciently installed a new win2K system and installed the latest service pack 4.
e rn.iscx y.yoie xe
mirc.exen -Anon.Germ s32.llax e
zema
I also killed all the services. and it never ran a web browser. Just mysql. I didn't have any antivirus software on it.
So after placing it on an unfirewalled connection in a locked room, withing 2 hours there were over dozens of virus, worm and spyware installed on the system till it crashed and couldn't even boot. Coming up with 100's of DLL errors!
Again we never open a single web page.
Specificaly some of what was installed was:
alte.exe
beird.exe
c.bat
clonzips.ssc
clsob
cvqaikxt.apk
cult.exe
cygwin1.dll
dgss
dual.exp
emoti.bat
enotxa2.exe
explorx.
ger.exe
gt.x
hosts was altered
knlps.exe
knlps.sys
ksat.bat
medo.dl
nonzipsr.noz
ntcnsl.dll
orrl.exe
Odi
repcale.exe
riqa
scheduler.exe
sysm
svcshost.exe
titlex.exe
w.e
wshield.e
winguard.exe
ymnz.exe
unmt.exe
vnicmon.exe
a qsws directory
zippedsr.piz
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
While so many are quick to point out that he used an unpatched machine, that he should know better, that he's just doing it to be difficult, that he can fix it. He know's he should install SP2, he knows he should have his firewall set up. He knows he should practice safe surfing....but my mom doesn't know this stuff.
For every computer whiz (like most of us that visit /.), there's a thousand users like my mom who know that you turn on the box, move the little mouse around, and she can type emails to the whole family every day. Then she surfs around on the internet, types something in wrong, clicks on the wrong site, and now can't send the emails to the family and can't order my Christmas presents from Amazon.
Spyware is a pain in the ass for us, but its a nightmare for the computer novices!
It bothers me that some people still install windows while connected to the internet.
Nothing great was ever achieved without enthusiasm
Howdy folks. Sorry to take so long to respond -- was in airports and planes all afternoon. Day before Thanksgiving...
Browsing to the site I showed in my video is one way to get infected. But that's not the most typical infection method. Instead, other sites can and do point to this site (and other similar sites), typically via IFRAMES. I was recently looking at a post in a web-based threaded messaging site, which used a 1x1 pixel IFRAME (basically, hidden) to reference the site shown in my video. When a user loads the infected post in the threaded messaging site, the user's PC will be infected via the exploits shown (if the user's PC is vulnerable to such exploits), and the user will receive spyware like that shown in the video.
As to video format: I apologize for the WMV format. There's a lot to be said for this format, from the reliable free creator to the wide deployment of the player software (present in all W2K and WXP systems). But clearly it's an imperfect solution, and not great for viewers on other platforms. I'm working on finding a better alternative and/or offering the same content in other formats.