BBC Site Used as IE Attack Lure

capt turnpike writes "The hits just keep coming... according to eWEEK.com, someone is using actual excerpts of BBC news stories to 'launch drive-by downloads of bots, spyware, back doors and other Trojan downloaders.' One example is a story blurb masking the download and installation of a keylogger -- with no user interaction. And it doesn't even tell you it loves you."

Comments

How is this news?

[Anonymous Coward]

So... they used BBC news as bait... WOW! It's not like they took over the BBC site and used it.

Re:How is this news?

[TommyBlack]

WOW! It's not like they took over the BBC site and used it.

No, of course not. I'm the one who did that.

Click here to read an interesting BBC story about it

eWeek is retarded...

[ninja_assault_kitten]

"The hits keep coming in..." Yeah, 1 every hour. The media wants to make this the most critical vulnerability that ever existed. What a joke.

Erm, why is this a story?

[baldass_newbie]

I mean, a known bug is exploited and it's using quoted text from the BBC site.
If they do it again tomorrow with text from nytimes.com would that be another story?

Re:Erm, why is this a story?

[i_should_be_working]

Maybe slashdot will be spoofed next. That will be a story. That could be the story. Emails that read:

"Tech website Slashdot article links to vulnerability exploiting websites. Read more here"

And whoever submits it to /. won't even have to rephrase it.

Re: Erm, why is this a story?

[Black Parrot]

> If they do it again tomorrow with text from nytimes.com would that be another story?

And will it be safe to read about it at BBC?

Re:Erm, why is this a story?

[Firehed]

Wouldn't this end up creating some sort of infinate dupe-loop and tear the fabric of space-time?

Re:Erm, why is this a story?

[richdun]

Possibly. It'd be the first exploit that required soul-sucking registration to activate it.

Now I'm worried....

[Black Copter Control]

From TFA:

Click here to read more about drive-by attacks on the Internet Explorer vulnerability.

And if I click there, just what do I get?

(Times like this I'm glad that I use linux ... Until, of course, the next zero-day firefox hole, at which point I'll switch to konqueror or..).

Re:Now I'm worried....

[the-amazing-blob]

And if I click there, just what do I get?

I don't understand why everyone is so afraid of these things. They monitor us, keep track of us. The kind of thing a girlfriend would do if we had one. Think of keyloggers and the like as your new Girlfriend (beta 0.2, results may vary)

Re:Now I'm worried....

[Mal-2]

> Think of keyloggers and the like as your new Girlfriend (beta 0.2, results may vary)

I'm worried about the child processes that will be spawned...

Mal-2

WOW!

[jav1231]

An IE vulnerability! That's news!

Fake URLS Suck!

[Giant Ape Skeleton]

According to This article, using bogus URL's to trick people is still the most effective social engineering trick in the book. Of course, that may not apply to those in the Slashdot community :p

Re:Fake URLS Suck!

[MBCook]

I clicked your link.

It's an apache configuration page!
I'M BEING HACKED!

AAAAAAaaaaahhhhhh......

I'd better call the FBI!

Re:Fake URLS Suck!

[Anonymous Coward]

woah, whoever maintains that site is one sick f*cker.

Re:Fake URLS Suck!

[jftitan]

Tech Support : I'm sorry sir, but Apache is the name for the webserver software used to run your webpage.

you:..... AHHHHHHHHHH

Tech Support: You go right ahead and call the FBI and Police, I'll be sure to let them know about everything, right after I shoot off our transcribed converation to your local news agency.

you: (what you say, next will make an interesting conversation)

My SITE HAS BEEN HIJACKED

[Billly Gates]

MY name is James Taylor and I clicked on your link and then the web went down all by itself!

It was taking over by a hostile native american terrorist organization called apache running on Gentoo gnu/linux. Damit hacker! I need to call the FBI over and sue you for this.

Newsworthy?

[Yomer333]

Not really sure why this is even news. After a computer security competition last weekend, I had the chance to talk to professional security auditors, i.e. hackers. The reason I bring it up is that at one point, one of them said that "he had a web page he would like everyone to visit...with firefox." Needless to say, this scared the shit out of me. After pressing for more info of browser related exploits, he said that IE7 is suprisingly solid security-wise. Same goes for Vista, at least the parts of it that are finished (no more ldap). I shudder at the thought of IE pushers trying to convince people to switch away from firefox because it's not secure enough. I don't know, food for thought.

Re:Newsworthy?

[bunratty]

Gosh. I'm glad you told me this. Now I'll know better and ignore all those warnings about extremely critical vulnerabilities in Internet Explorer from Secunia I keep seeing.

Re:Newsworthy?

[zcat_NZ]

What's the URL?

I can name plenty of URL's that install drive-by spyware on MSIE (astalavista.box.sk, serials.ws). Go ahead and give me even one solitary URL that installs drive-by spyware through firefox. Just one! I promise I will visit it with firefox, and let you know the results.

What harm in bundling the browser?

[chill]

So, what harm is there in bundling the browser with the OS shipped on 90% of the retail PCs in the world? What harm is there in integrating the browser into the core of the operating system?

Apparently, if you bundle a half-ass product where only lip service was paid to security, the cost is greater than anyone realizes. IE was crammed in there with the sole purpose of crushing Netscape and dominating the Internet market. It was rushed, with slipshod quality and security only as an afterthough -- and that only by the PR department.

"Where do you want to go today?" seems to have found an answer... ...let's stop by your bank and credit card accounts on the way to an organized crime hangout and/or third-world country! Fun!

  -Charles