Slashdot Mirror
Blogs Latest Source of PC Infection
smooth wombat writes "The BBC has a story which indicates that filtering firm Websense believes at least 200 fake blogs are in existence which have malicious code that could infect your pc. Websense said it had seen examples of some computer criminals creating a legitimate looking weblog, loading it with keylogging software or viral code, and then sending out the address of it through instant messenger or spam e-mail. Websense warned that viruses hosted on weblogs might be a danger because they get round the filtering systems many firms have created to ensure malicious programs do not reach employees." From the article: "In separate cases some blogs were being used as storage lockers holding chunks of malicious code that the controller of a network of zombie machines wants those remotely-controlled computers to use."
WEBSENSE filters legit sites!
I'm a virgo and on Slashdot. Coincidence? Yes.
How could a blog site - or whatever kind of site for that matter - host and run keylogging software?
Articulos para gente geek: Poleras, linux, libros y mas
So basically they're saying there are now webpages that exist to infect your computer with malicious code through various browser security holes? Huh. Imagine that. I never would have thought that to be possible.
Dot dot dot.
... as if the fact they're largely written by self-important bores wasn't reason enough to avoid blogs and bloggers.
Is this really the case, are is it yet another attempt by corporations to subtly supress their employee's reading habits???
This doesn't seem to be a great deal of sites, after RTFA I now know there are around 8 million blogs and only 200 are infected.
Personally I'll take my chances........
Only they use a fake webpage to install shit, rather then using a fake webpage to take your info. The ideas the same though, most people on the web (or at least those just on it for the blogs) don't really know the difference between what looks like a professional page, and what IS a professional page. More wide spread education about the dangers of what can be found on the internet really needs to happen.
If the blog you are reading says... ... you probably shouldn't download the code.
"Today, I went with Billy and Johnny, and we went to the farm and saw a cow. It was a big cow! Download this program and it will show you how big the cow was!"
If the blog purports to be from some p0rnster, and the blog says "download this cool active X control, it will let you see all these hot pix I took at the club last night"... you probably shouldn't install the control.
Ok, I think I got it.
So there are 200 fake blogs among 8,000,000 that were drawn up with malicious code and this is a story? I'm sure there are far more websites out there that aren't blogs with malicious code. All it comes down is protecting your computer the way you prevent anything bad from happening, by not being stupid about it. 200 is a drop in the bucket when it comes to the blogging community.
The brighter criminals seem to understand that this well and more and more scams are less about clicking on something than it is about convincing someone to provide their SS#, banking info, etc.
http://www.busyweather.com/
Maybe the problem isn't that the fake blogs are carrying malicious code; rather that the browsers (coughIEcough) being used to surf the fake sites aren't secure enough.
Malicious websites will always be around; however, if we try and educate the public about security, they'll be rendered useless.
IGB: More fun than eating oatmeal!
Let see... The mainstream news is reporting "Don't go read the blogs or your PC will crash and burn." Does anyone else find it curious that blogs are one of the more potent competitors the the mainstream news in recent time?
They couldn't be trying to discredit the competition?
I do have a blog, or at least people call it a blog.
What I'm asking myself right now, reading this article is...
"What's the difference between a blog and a website?"
I mean, how could a proxy know it's a blog?
It can't, unless you talk about blogs hosted on big blogger networks.
But I'm not the only one having a blog on another hosting service, with my own domain and so on.
The same could happen with "personal home pages", the problem is, as usual, people click on anything that seems interesting, without checking the website where they'll end.
It's always a matter of Social Engineering, users have to be educated I think...
-- Personal Blog: http://www.delymyth.net/ (italian)
how do these blogs get outside the browser sandbox?
publishing this sort of rubbish should be punished.
Lacking the broad compatibility of Windows to run any executable at any time without pestering the user, Linux will slowly fall out of favor as the more "user friendly" Windows proves yet again that everthing "just works".
Developers must get their act together to make Firefox compatible with these soon -to-be mainstream methods of allowing users to update their PCs without worrying their little heads over such arcane details as "what does this application do?"
Until Linux can match Windows in this kind of ease of use, I'll have to stop using FC3 and Firefox and upgrade to XP and IE.
Note to mods: This post contains sarcasm. Do not eat.
yeah, I know, I read this site because it's written by humble yet well-informed and interesting people, who are careful not to make generalisations.
QUICK!! Ban blogs!!
Oh wait, the majority of the US public already want to :-).
I am a bit baffled why this is news. How is this any different than any other attack via a web page? And how is a weblog any different than a vanilla web page? (That was meant an ironic, rhetorical question for those itching to answer that.) The techniques used to phish and to infiltrate a target machine via web pages are identical for weblogs ... since weblogs == web pages. (And yes, I do appreciate there are persons in the world who do not understand the two are the same.)
How on earth can one conclude that blocking people from all weblogs will protect them? Unless you also block them from all web pages to boot, ie the entire world wide web.
Can someone confirm this? Are you telling me companies actively track if a site is a weblog ... and if so lower the security precautions for it?
I am a bit disappointed that BBC reported this article. Talk about FUD.
You might be a dumbarse!
According to the emails *I* get, bored housewives are not looking at blogs at all. They'd much rather meet with me when their husbands are out of town. (this internet thing is *really* something)
Yeah? Well I think you're overrated too.
According to the emails *I* get, bored housewives are not looking at blogs at all. They'd much rather meet with me when their husbands are out of town.
What? You get those too?
I though it was just my hot cock they were after.
I'm feeling rather depressed all of a sudden.
Websebse making a big deal about blog bugs should be taken about as seriously as Symantec making a big deal about cell phone or Macintosh viruses. At best it's self-serving.
But there's something bigger that really bugs me: Websense is part of that big conglomeration known as "them" or "they". Sometimes it's hard to tell where the government stops and "they" start. The American media is another big member of "them" and blogs are a threat. So "they" have to do whatever they can to steer people away from them--make it unclear what exactly a blog is, tell people their computers will get viruses if they read blogs, censor their content--we'll hear more in the next few months I'm sure.
Those in control are just trying to draw devil horns on blogs so that they can stay in control.