Banner Ad on Myspace Serves Adware to 1 Million

An anonymous reader writes "Washingtonpost.com's Security Fix blog reports that a banner ad running on MySpace.com and other Web sites used a Windows security flaw to push adware and spyware out to more than one million computer users this week. The attack leveraged the Windows Metafile (WMF) exploit to install programs in the PurityScan/ClickSpring family of adware, which bombards the user with pop-up ads and tracks their Web usage."

Comments

Excellent.

[Anonymous Coward]

Darwinism works!

Re:Excellent.

[Anonymous Coward]

did this effect kubuntu?

Re:Excellent.

[jZnat]

Well, it surely wasn't Intelligent Design that did it...

Re:Excellent.

[jkasmire]

Kudos. My first though on reading this was "Darwinism at its best" I'm happy to see that even at the first post, that's the general consensus.

Re:Excellent.

[Anonymous Coward]

...Which is pathetically ironic given that people here don't get laid.

Re:Excellent.

[ultranova]

...Which is pathetically ironic given that people here don't get laid.

Hah! A real master nerd is never unprepared. I'll watch the whole run of Nuku-Nuku for inspiration and build myself a catgirl android lover, and we'll make dozens of cyborg kittens together.

Take that, natural selection!

Re:Excellent.

[The Nordic Beast]

Actually wouldn't this be a case of "unintelligent design"...atleast on mircosoft's part.

Re:Excellent.

[slightcrazed]

Yeah, what a great quote. It might as well read: "I'm not good enough to take care of myself - I require government assistance."

Re:Excellent.

[Anonymous Coward]

Darwinism works!

The I should be dead and should have had no children, because I'm not smart enough to figure out what this guy's talking about. How is this Darwinism? If these machines caught fire or something you may have a point (somewhere other than the top of your head).

Re:Excellent.

[kabocox]

Well, it surely wasn't Intelligent Design that did it...

Are you sure Darwinism isn't the method for weeding out mistakes?

Re:Excellent.

[pfleming]

Or it could be read as "My government takes a combined 15.3% of my pay between my employer and I over my lifetime to offer me some kind of 'retirement', they should at least give it to me"

Re:Excellent.

[drinkypoo]

You can't convince these wannabe-libertarian assholes of anything rational, dude. They believe that every man is an island, but they wouldn't want to live on one. They want to be able to go to wal-mart to buy ammunition but they don't want to help provide for the health of the system that provides the opportunity.

Re:Excellent.

[SpryGuy]

I wish I could mod you up a dozen times.

Re:Excellent.

[Anonymous Coward]

Becase you had to be a complete moron to not have patched your system in the previous seven months after this highly publicized security problem was patched. In fact, in Windows, it's rather difficult to NOT patch your system. It happens automatically unless you specifically block it from doing so.

Anyone who got infected by this got what they were asking for and deserved. Darwinism in action.

Re:Excellent.

[achacha]

Yes it did, the users of Ubuntu had to waste time reading about the half-wits that got infected with adware.

I thought myspace had "gone through an effort" to remove all banners that may have exploits in them. MySpace is not making as much money as they hoped given such a high registration count, so maybe they are offering banner space to the shadier part of the net.

Sad part is that majority of the MySpace users do not fall into the intelligent bucket and thus are probably windowsxp/ie users and get trageted by adware writers.

Darwin, somewhere is smiling...

Re:Excellent.

[apotheon]

He says poe-tay-toe, you say poe-tah-toe.

Re:Excellent.

[apotheon]

You must REALLY LIKE wanton flamebaiting, then.

Re:Excellent.

[ultranova]

so, you want to steal my money, thanks a lot asshole.

No, I want that, if it gets to that, my life will be protected before your wallet. Maybe that makes me an asshole, I don't know... But please note that I also advocate putting your life before my wallet.

You are jumping into the conclusion that I currently need social security. I don't. I'm simply thinking ahead and considering the scenario where I might need it for my very survival. I'm quite happy to pay for it, in the form of taxes, in the meantime.

you will be the stain since you obviously can't take care of yourself.

No one can take care of themselves in every possible circumstances. That's why I want a safety net. It won't save me from every possible bad thing, but it substantially lessens the propability of a scenario where I starve to death. This actually benefits the society in the long run: since my basic sustenance is assured, I'm more likely to take risks like starting a company, instead of always considering everything just from the perspective of survival.

And I think that I'm taking care of myself quite well, by advocating social security; after all, the ability to think and plan ahead and prepare for possible trouble beforehand is the primary survival advantage of the human race. People who rely on their own strength to the point of being disdainfull of the very thought of needing help are the ones who need us planners around to keep them from getting killed, not the other way around. After all, the whole society is build around the idea of helping one another; arrogant pridefull fools depend on it every bit as much as everyone else, even if they don't admit it. Possibly they depend on it even more, since it's considerably harder to survive on your own if you have serious mental blind spots to hinder your judgement. And delusions of omnipotence and invincibility, as well as the need to prove your independence and worth as a human being by denying even the possibility of weakness and failure, are among the most destructive such blind spots.

Re:Excellent.

[SpryGuy]

No, I just really appreciate truth.

Prosecute virus creating companies.

[Facekhan]

And they wonder why consumers want to block all ads. Its because of illegal virus ads like this. If they prosecuted spyware companies the way they do with other virus creators we would not have as much of a problem with people setting up shop as if this is a legitimate business and then hijacking people's computers for profit and waiting for enough complaints to pile up that maybe the state attempts an enforcement action which at worst closes the company and more likely a few small fines and promises to behave in the future. Either way the owners of these companies never serve a day in prison for releasing their viruses.

Re:Prosecute virus creating companies.

[CRCulver]

And they wonder why consumers want to block all ads. Its because of illegal virus ads like this.

Not at all. I imagine that most of us around here who install AdBlock and FlashBlock do so because of the bandwidth and processor power that ad-laden pages take. People on non-Windows platforms hardly have to fear WMF exploits.

Re:Prosecute virus creating companies.

[alx.slashdot]

Amen!
However, M$ has addressed this vulnerability last year:
Microsoft Security Advisory (912840)
Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution.
Published: December 28, 2005 | Updated: January 5, 2006

Aside from reparing an old design flaw which had long been unexploited, I don't know how much more Microsoft could do.
Let the flamewar begin :)

Re:Prosecute virus creating companies.

[Ethan Allison]

People on non-Windows platforms are generally not the targets of ads, as indicated by XP-styled "message box" banners.

Re:Prosecute virus creating companies.

[Mr Tall]

I have ad + flashblock installed because adverts look like shit.

Re:Prosecute virus creating companies.

[Anonymous Coward]

> And they wonder why consumers want to block all ads. Its because of illegal virus ads like this.

Well, not *just* this. Personally I started blocking adds the moment they started making fscking noise at me. I also developed an irrational dislike of frogs at around the same time. Coincidence... I think not.

Re:Prosecute virus creating companies.

[Tim C]

I imagine that most of us around here who install AdBlock and FlashBlock do so because of the bandwidth and processor power that ad-laden pages take.

Speaking personally, I generally block ads that are misleading, flashy and/or distracting. I've lost count of the number of times an otherwise perfectly good webpage has been ruined (aesthetically) by an in your face ad.

Anything that attempts to look like a system dialogue, or to convince me that my PC is running slowly and needs to be fixed, etc, gets the entire advertiser's domain and sub-domains blocked. I hate that shit.

Re:Prosecute virus creating companies.

[DrXym]

People on non-Windows platforms hardly have to fear WMF exploits.

Exactly. The law of diminishing returns makes it considerably harder to target Linux (or even Firefox users) and expect a reasonable return from doing so. In short, the more heterogeneous your machine is, the more built-in immunity you have to any kind of exploit.

Some natural immunity is not a substitute for safe browsing practices, but it's hard to see how due diligence would have helped in this sort of case. We automatically assume that trusted sites deliver only trusted content, but this example makes clear that it is not always true. Ad blocker only works so far, since you have to see an advert to block it which obviously gives a window for infection.

Re:Prosecute virus creating companies.

[suffe]

I must confess, I've never been able to quite understand how companies are willing to show those adds on their space. Seemingly serious sites can be littered with them and in regard to professionalism it just seems like scraping the bottom of the barrel. Who can take a company/site serious when they are (through their ads) trying to outright scam their customers?

Re:Prosecute virus creating companies.

[panaceaa]

OMG WTF I THOUGHT THOSE WERE POP-UPS BY HACKERS!!! when i pressed the "X" it still went to there page!!!!! those are the ppl we should really be suing$@!one!!

Re:Prosecute virus creating companies.

[tehshen]

Who can take a company/site serious when they are (through their ads) trying to outright scam their customers?

This works for the same reason that spam works - it's cheap to do, and only a few stupid people need to click on the ads for them to be making money again.

Re:Prosecute virus creating companies.

[kylehase]

I personally block ads because they are distracting. I hate trying to read interesting content with bright colored or even flashing images all over the page. I'm not so concerned about bandwidth or processor since I'm not using much when reading an article or blog.

Re:Prosecute virus creating companies.

[jamar0303]

I remember that a couple of years or so back I got hit with a multiple Mac OS Classic-style dialog box ads from Japanese websites (mostly for dating sites with messages like "your love life is slowing down- need help?") but I have never gotten any Mac-style dialog box ads since then (only one OS X-style dialg box ad also from a Japanese website). I suppose that back before OS X the Mac was gaining more market share in Japan than PCs so those dialog box ads gained a Mac style rather than a PC style- that or Mac users there are more ...desperate for love... than PC users there.

Re:Prosecute virus creating companies.

[suffe]

I never doubted that it works, I doubted the rationale of selling out so easily.

Re:Prosecute virus creating companies.

[Bogtha]

I have to disagree with both of you. People block ads not because of risk, not because they take up too much bandwidth and processor power, but because they take up too much attention. People want to pay attention to the real content, not wade through fake distracting crap that wants to sell them something.

Re:Prosecute virus creating companies.

[Given M. Sur]

And they wonder why consumers want to block all ads. Its because of illegal virus ads like this.

Not at all. I imagine that most of us around here who install AdBlock and FlashBlock do so because of the bandwidth and processor power that ad-laden pages take. People on non-Windows platforms hardly have to fear WMF exploits.


While others, like me, just simply find ads annoying as hell and block them for that reason.

Re:Prosecute virus creating companies.

[bcmm]

The creation of this basically malicious content was wrong and should be punished by the Law, but please don't join the media and the less educated parts of our governments in refering to all computer security exploits as "viruses".

This attack is not a virus because it cannot spread to new hosts from infected machines. It is, more accuratly, a trojan, in that it is "executed" under the false pretence of being non-malicious code (I put "executed" in inverted commas because there is the additional issue of how it ended up actually executing native code on the infected machines).

Also, the people who recieve harsh sentances are normally writers of worms, rather than viruses. This is because the extremely rapid way in which some worms infect new machines can cause serious overload of the networks over which they spread, which tends to cause more $s of damage than the damage to the actual machines. Although these ads are wrong, they have not had that sort of global impact on networks.

So, while I agree that these people should be prosecuted and severely punished, I believe that it is misguided to say that they should be prosecuted under the same laws as virus and worm authors, as this would just muddy the water and add to the current situation where all computer users have to be worried about which laws they might be breaking.

Re:Prosecute virus creating companies.

[SamSim]

And they wonder why consumers want to block all ads. Its because of illegal virus ads like this.

Not at all. I imagine that most of us around here who install AdBlock and FlashBlock do so because of the bandwidth and processor power that ad-laden pages take.

I, for one, run Adblock because I don't want to look at ads. From what you two are saying, it's probably just me, though.

Re:Prosecute virus creating companies.

[zaajats]

Ad blocker only works so far, since you have to see an advert to block it which obviously gives a window for infection.

I believe most ad blockers don't load the ads at all and use url-based filtering (http://*.crappyadnetwork.com/*).

Re:Prosecute virus creating companies.

[Firehed]

You're entirely correct. But isn't the malware an extremely convenient cover when webmasters start getting pissed at their users for blocking their ads and thus their source(s) of revenue? I love free content as much as the next guy, but if the content is either crappy on its own or full of crap (ads), it's hardly worth my time. On the other hand, there's plenty of high-quality content out there that's currently free that I wouldn't mind paying a small amount for. I don't know what the average banner ad sells for on reasonably high-traffic sites, but some exclusive content (not unlike subscribing to slashdot) for paying members could quite reasonably make back a large amount of the operating costs, thus diminishing the need for advertising. Hypothetically, the lower ad content would attract a few more users and have a few of them become subscribers as well.

Just wishful thinking for the most part. I know an ad-free web isn't yet sustainable, but the effectiveness of ads is constantly dimishing, and sites that try to make up that loss by adding more ads tend to deter a lot of their users from coming back. Something's going to have to change soon, whether it's an onslaught of subscriber-only content or ISPs giving away free bandwidth (yeah, right).

Re:Prosecute virus creating companies.

[penix1]

"Aside from reparing an old design flaw which had long been unexploited, I don't know how much more Microsoft could do."

How about not using critical updates as a platform for making more money?!?!? Their WGA policy on updates causes people to NOT update especially when WGA itself is spyware.

B.

Re:Prosecute virus creating companies.

[jrumney]

Bandwidth, not really, that ceased being an issue for me about 5 years ago. Processor power, yes, but most Flash and animated gif ads don't really reach the limit where I'd get annoyed. I do use FlashBlock though, and set animated gifs to not loop, because I do get annoyed by ads that are distracting. I also block tribalfusion's ad servers at the DNS level, because they use tricks to get their Javascript around popup blockers.

I'm happy to accept that webpage authors need to pay the bills, and advertisers are willing to pay them. For that reason, I don't use AdBlock, or a DNS that blocks all advertisers, and am happy to accept ads that do not detract from the content I am trying to read. I usually ignore the ads, just as I ignore ads on television, radio, and in newspapers and magazines. That is a fact that advertisers have to live with, and stop trying to get in people's faces because it just pisses them off.

Re:Prosecute virus creating companies.

[DrXym]

Yes ad blockers do like that, but in general you have to train them. You have to tell them not to get ads from a certain IP address and to do that you generally have to see the add and then block it specifically or with a wildcard. Some blockers like JunkBuster / Privoxy might come with a general list but it's not going to catch everything.

Re:Prosecute virus creating companies.

[cdrudge]

You are underestimating the power that $.0000001 per ad can generate.

Re:Prosecute virus creating companies.

[Andrew Kismet]

Filterset.g allows a subscription system, effectively allowing someone else to 'train' your popup blocker. Of course, you can always add your own preferred blocks to it. I even occasionally block other, non-ad images in order to 'fix' webpage layouts, greasemonkey style :D

Re:Prosecute virus creating companies.

[Anonymous Coward]

"Speaking personally, I generally block ads that are misleading, flashy and/or distracting."

I'll agree with that. I don't mind ads that just sit there as they would in a magazine, regardless of how much space they take up. Web sites need to be funded somehow.

But I do mind ads that won't stop flashing and distracting me. Animated GIFs are OK because Esc stops them, but animated flash ads make me go to great lengths to find and block them, and I always just block the entire domain - I don't want my blacklist filled with individual items. I really am surprised that the ad men don't realise that all those blinking and flashing ads are an irritant and a turn-off. I really can't believe they encourage people to buy whatever they are trying to push.

I also block domains that cause the page loading to take noticably longer (for my regular haunts) - domain names you can see in the status bar, e.g. "Connecting to falkag.net". If it takes long enough for me to wonder what's taking so long and read iton the status bar, it's irritating me.

Re:Prosecute virus creating companies.

[Anonymous Coward]

Block Ads: Mike's Ad Blocking Hosts File
I use it, I love it.

Re:Prosecute virus creating companies.

[suffe]

If anything, I might overestimate the value of a returning customer. Or they might underestimate it. Who knows.

Re:Prosecute virus creating companies.

[hotdiggitydawg]

What's to stop them checking the user's platform before deciding which ad (XP, OS/X, or whatever style) to serve up?

Re:Prosecute virus creating companies.

[Anonymous Coward]

People want to pay attention to the real content, not wade through fake distracting crap that wants to sell them something.

Since when? What about sitcoms, commercials, "Modern Pop Music", almost any TV, Radio, most web pages???

Now if you'd said Intelligent People want to pay attention.... I might have believed you. The average person is just a consumer, they want mindless entertainment, flashing lights, and sound, and to spend their money on the hottest gadget of the day.

Re:Prosecute virus creating companies.

[ceejayoz]

A dollar per ten million impressions?

I think you're overestimating it.

Re:Prosecute virus creating companies.

[Marcos Eliziario]

how do you reproduce the Mac OS X drop shadow for a window? Is it possible with DHTML? maybe, that's the reason we see only XP-style ones.

Re:Prosecute virus creating companies.

[Anonymous Coward]

This attack is not a virus because it cannot spread to new hosts from infected machines. It is, more accuratly, a trojan, in that it is "executed" under the false pretence of being non-malicious code...

No, it isn't a trojan, it's a worm. You don't have to accept a download to get it, it comes in via the WMF vuln. All you have to do is visit the web page with less than up to dat e patches. The "your computer has spyware, click here to download the removal tool" is a trojan.

Re:Prosecute virus creating companies.

[Anonymous Coward]

I have NoScript and FlashBlock installed, but I still see some flash content on the myspace band pages. NoScript shows 'about:blank' being allowed to run scripts.

Re:Prosecute virus creating companies.

[NotFamous]

False Dilemma (Trilemma?). It is all of the above. Just for the record, my main reason IS performance, because I use a lot of older laptops. Flash can absolutely trash those machines. Blocking it provides a very snappy web on P-233's!

Re:Prosecute virus creating companies.

[creepynut]

Do you honestly thing most people would notice?

I've come pretty close to falling for the Luna-style XP ones, even though I use the Windows Classic theme.

Re:Prosecute virus creating companies.

[Dark_MadMax666]

"The creation of this basically malicious content was wrong and should be punished by the Law" -I cant believe it I am reading this on slashdot . What there is no people here who wrote viruses/worms as on of their first exercise in system programming? I mean everyone I know who was any good with computers wrote a few of those. It is challenging and interesting task (more so than writing yet another stupid business/reporting app ) .It gives you useful insights into what really program are and how computer systems really work. There are tons of very interesting code and techniques involved in writing good viruses ,worms ,malware, rootkits etc.

  Now distributing those with malicious intention is another thing .But for writing? It is akin to punishing for thought crime. - It is in the same boat as RIAA/MPAA/BSA vouching for crime penalty for reverse engineering and research in encryption . Sadly Brainwashing is so effective than it affects even the core community of hackers and computer geeks.

Re:Prosecute virus creating companies.

[saskboy]

"People on non-Windows platforms hardly have to fear WMF exploits."

You're technically right, but philosophically wrong. There were PNG and JPG exploits for Linux too remember? They didn't get in on the WMF goodness of course, but who knows what other bad code is just lurking? It's safer to assume that if you're connected to a network or introducing new code, you're introducing new bugs along with any new functionality.

Re:Prosecute virus creating companies.

[poot_rootbeer]

Seemingly serious sites can be littered with [malicious ads] and in regard to professionalism it just seems like scraping the bottom of the barrel.

MySpace is owned by Rupert Murdoch's News Corporation.

Re:Prosecute virus creating companies.

[Khyber]

I put "executed" in inverted commas

I think you misspelled Quotation Marks.

Re:Prosecute virus creating companies.

[Orp]

Exactly. I can't handle anything moving on my screen when I am trying to read text. I have yet to open a book or a magazine where crappy flashy animations cycled infintely (I'm sure the day will come however).

At a recent meteorology conference/workshop (on effective ways of using computer models in the classroom) one of my colleages said something to the effect that high school / college students today who grew up with the internet are used to things like animations on the screen and even suggested that they favor it over a static page. And went on to suggest that textbooks would be obsolete in 20 years.

So I ask all you young-uns out there, is this true? Am I the only one who permanantely has image.animation_mode set to never and has flashblock installed - and who wants to throw the monitor across the room after five minutes of using someone else's computer that doesn't have these settings?

Re:Prosecute virus creating companies.

[drinkypoo]

And they wonder why consumers want to block all ads. Its because of illegal virus ads like this.

Actually, no it isn't. It's because they don't want the shit flashing in their face and taking up valuable space in their browser window. Only a few people actually know that you can get owned by a banner ad.

Re:Prosecute virus creating companies.

[__aaxwdb6741]

I am very young. 19 years old.
And, you know what? I wholeheartedly agree with you. My style of computing is staring at a black terminal screen waiting for my input.
I've blocked *.swf from my browser, and I'm keeping it that way forever.

A text book, or a text document to be read in vi, is much more pleasant than reading content on a site with flash/gif ads.

Re:Prosecute virus creating companies.

[MickDownUnder]

I think you'll find most of these operators who create malware are ahead of the game and have structured their business such that it operates from a country where it is beyond litigation.

However in cases like this where the malware is being delivered on mass by a third party who happens to be a large very well respected operation there is definitely a chance for litigation of some sort. I think when you operate a domain you have a responsibility for the content that is delivered when a user browsers to your site. I don't think it should matter if your site has only relayed content from another domain, ultimately you should be responsible for the service you provide.

In a case like this where hundreds of thousands of people may have incurred damage to their systems, and lost time in cleaning up their systems, the damages could be quite large. You're talking about people's time and potential loss of valuable business data and/or personal items. In this circumstance people would be well entitled to compensation for their loss.

I don't think it'll be long before a mainstream operator runs into a class action suit as a result of negligence in assuring the content sent via their site is safe.

Re:Prosecute virus creating companies.

[Anonymous Coward]

I hope English isn't your first language.

And I've been a programmer all my life, and I've never ever written a virus or worm of any kind. Nor do I know anyone who has. If you know so many, that says something about the quality and type of people you hang out with, and if you have, then that says something about the quality and type of person YOU are. And none of what it says is good.

You're just flat out wrong on this one.

The creation of this malicious content SHOULD be punished by law. Your argument is akin to someone saying that it's okay to make small pox and anthrax in your basement, as it teaches you so much about biology. The point is, the stuff is inherently dangerous, and could too easily get out into the wild and cause serious damage.

Re:Prosecute virus creating companies.

[StarvingSE]

Exactly. I can't handle anything moving on my screen when I am trying to read text. I have yet to open a book or a magazine where crappy flashy animations cycled infintely (I'm sure the day will come however).

Print magazines present different kinds of annoyances. Firstly, I'll use wired as an example since I have been a subscriber for a while. I open up a new issue and immediately 5-6 subscription cards fall into my lap. Why the hell do they stuff these in the mag when i already have a subscription??

Next up are the 10 pages of ads before any real content in the magazine. And now we have ads that are thicker than the magazine pages so they stand out more. And lets not forget the ads that expand to poster-sized monstrosities because apparently and 8.5 x 11 page isn't enough space.

It gets old and really annoying after a while. I pay for a subscription, why must I also get bombarded with crappy ads in print magazines as well as online?

Re:Prosecute virus creating companies.

[Anonymous Coward]

Sorry, but anyone who didn't patch this in the previous 7 months, given how beyond-easy Microsoft makes it to patch things, and given all the wide-spread publicity about this vunerability and the availablity of the patch, deserves what they get. And if they're using a pirated version of Windows, when then, they definitely deserve what they get.

There's just no excuse to have not gotten this security update in the past seven months. There was plenty of warning, and Microsoft couldn't have made it easier to install. Heck, you have to take specific action to NOT install it. That's just stupid, if you do that. Whining about WGA isn't going to get you very far, as it's a really, really lame excuse.

If you refuse to patch your system, then you take your risks and you suffer the consequences and you don't get to whine about it.

Re:Prosecute virus creating companies.

[FLEB]

If it had to go over page content, you'd use a fuzzy black box on a layer undeneath the window, with an opacity value applied (a transparent PNG would work as well). For something over whitespace, just drop a shadow.

Re:Prosecute virus creating companies.

[penix1]

Horse shit. The only reason to update is to make sure your machine isn't a menace to others on a network. By using the update cycle to verify that a user has paid the Microsoft tax, Microsoft is making itself a menace to all networking. Add to that the fact that WGA is spyware in every sense of the word, and broken spyware at that, and it is a recipe for people not to update when WGA incorrectly identifes them as being "pirates".

As a Linux user I am offended by the attitude Microsoft takes to network security since everyone, including you and me, is affected by shit like this.

B.

Re:Prosecute virus creating companies.

[bcmm]

Thats way out of context. Read my post. I wasn't talking about writing proof-of-concept viruses or even about releasing real worms into the wild. I was talking about this banner ad, which was served to a million people with clear malicious intent. No one was learning anything. Yes, the first WMF exploit was needed to make the vunerability public and force MS to fix it, but this was just malicious use of a flaw for profit.

Re:Prosecute virus creating companies.

[bcmm]

We call them inverted commas, at least in en_GB. "Quotation marks" can mean a range of things including inverted commas and the marks that look a bit like double angle brackets which are used in French.

"Quotation marks, also called quotes or inverted commas, are punctuation marks used in pairs to set off speech, a quotation, or a phrase." (My italics).

Re:Prosecute virus creating companies.

[cdrudge]

Seriously though, what is the going rate for impressions? Do they even pay per impression anymore or is it all per click or some other measurable but less frequently occuring event?

I love how the submission links the comments

[Neoncow]

This way we don't even have to read the article if we want to! We can just comment about the comments of the article. =D

First time?

[Ninwa]

Makes me question myspace, you'd think they have people watching for these sorts of attacks. And who's to say this isn't the first time it's happened?

Re:First time?

[hendridm]

Makes me question myspace, you'd think they have people watching for these sorts of attacks.

Hah, that's like finding a loaded diaper in a garbage dump and then complaining about the level of sanitation.

Re:First time?

[tinkertim]

>> Makes me question myspace, you'd think they have people watching for these sorts of attacks.

Yes, and you're 100% right. Since they are syndicating it, showing 'due diligence' in making sure they aren't syndicating harmful code is their responsibility.

The question comes down to , reasonably, what is a good percentage to equate with 'due diligence' in checking what they syndicate. They have a few million pages, videos and photos to police, as well as watching what their advertisers are using their network to display.

So even if they go way above and beyond the 80% catch rate of abuse prior to it leaving their network, stuff like this is still going to happen. I'd imagine they only catch about 70% of illegal use involving their network, and considering its size and attractiveness to bad-doers, that's not bad.

Of course its an age old argument, who is most at fault. The person who shot the gun or the company that provided it?

I am also noting a rather old vulnerability was exploited, and people not updating their systems need to share some of the blame.

So I guess in essence .. 'shit happens.'

Re:First time?

[Anonymous Coward]

How about scanning everything that is uploaded for malware with ClamAV? While it wouldn't be perfect, it would be better than nothing. They could even contractually require their ad providers to do the same, with penalties for not doing so.

Re:First time?

[Vo0k]

The problem is that was not a user-provided content, one of millions of user pages, but advertizer content, something you directly get paid for, and certainly it appears in numbers much smaller than the user pages.

'Due dilligence' in schools, for example, may not be assuring no single kid ever smokes crack, but it certainly is making sure the school bus driver doesn't.

Re:First time?

[stridebird]

If you talking about content, about copyright or slander or something similar that comes about as a result of what users put up on their pages, then yes, there is an argument for them. But in terms of the web resources that come with the pages they serve, no. No way. That can be 100% screened, and should be.

Re:First time?

[Darkman, Walkin Dude]

Of course its an age old argument, who is most at fault. The person who shot the gun or the company that provided it?

More like the age old argument, is it illegal or not. Sadly the facts are that this event is not a criminal event, the police won't be getting involved, and no one really cares. Not the infected users, not myspace, and not the advertisers. This is just more roadkill on the information superhighway. Nothing to see here, please move along.

Re:First time?

[dave562]

I am also noting a rather old vulnerability was exploited, and people not updating their systems need to share some of the blame.

Exactly. The WMF exploit is old news. The people who got hit by this attack are the people who are too stupid to setup automatic update.

Re:First time?

[tinkertim]

Thats exactly right.

Installing Windows from a year and a half old install CD and jumping right to an old version of Internet Explorer (to sites like myspace) before running any updates is akin to a white dude walking naked through harlem with half of a racial slurr painted on each butt cheek... generally, a dangerous thing to do.

In a perfect world nobody makes bad code and we all sing kum-by-yah and watch the lights on the routers blink. But until then .. well, software licensing should be made to refer certifying the operators capability to not be a moron.

I love to put blame on people who make more money than I do off the Internet. But this time I really can't find much fault with myspace. If it was a zero day exploit, well , then .. still - its understandable that a million got infected as they get that many page views in 15 minutes.

You really have to look at it scaled. Myspace is huge, they have to watch thousands of servers. You (the home user) have one freaking PC to keep updated.

And people are saying myspace are the ones to blame? Cmon, whats the problem?

WMF Exploit Now Affects Mac Users!

[robotsrule]

There is a new variant of the WMF exploit that affects all Mac users running OS X. When a Mac user browses a web page that is displaying a banner ad with the WMF exploit, malicious code is run that silently installs Windows Vista on to the Mac users computer thereby completely replacing OS X with Vista.

Re:WMF Exploit Now Affects Mac Users!

[jZnat]

Sources indicate that OSX users only noticed because their computer started to "crash a lot". "I didn't even notice the change to be quite honest," an anonymous user explained. "Only that the buttons moved to the other side of the window."

Re:WMF Exploit Now Affects Mac Users!

[MobileTatsu-NJG]

Sources indicate that OSX users only noticed because their computer started to "crash a lot". "I didn't even notice the change to be quite honest," an anonymous user explained. "Only that the buttons moved to the other side of the window."

Users further complained that their productivity shot way down when a number of games mysteriously started working.

Re:WMF Exploit Now Affects Mac Users!

[Ilgaz]

Wow people think it is a joke.

It is not people!

Look what happened to my mac without antivirus
http://img153.imageshack.us/my.php?image=faketestp y5.png

(I know it is a shame graphic wise but I couldn't stand to XP theme anymore)

This comes right after a Flash hack

[ben there...]

Tom (the site's...er, spokesperson) left this message in everyone's Inbox on the 17th:

Latest Update: 05:15PM PST, Monday, July 17th.
hey folks - we are moving myspace music players and video players to flash 9.0. flash 9 has security fixes so that people can't mess with you on myspace. if your 'about me' got screwed up this weekend, you could have been safe if you had flash 9 installed. here's an easy way to install it, go watch this dashboard video i posted last week. if you don't like dashboard, just watch any video in our video section, and you'll be prompted to install flash 9.

His solution to the hack that destroys a section of your profile is not that he will fix the site, but that you should install Flash 9.

Re:This comes right after a Flash hack

[ozbird]

His solution to the hack that destroys a section of your profile is not that he will fix the site, but that you should install Flash 9.

So if you're not a Windows or Mac OS X (PowerPC) user, you're SOL.

Re:This comes right after a Flash hack

[zaliph]

Sounds like a not-so-subtle Dashboard Confessional endorsement. Why not tell everyone to watch the funny cat jump video instead?

Re:This comes right after a Flash hack

[KiloByte]

His solution to the hack that destroys a section of your profile is not that he will fix the site, but that you should install Flash 9. So if you're not a Windows or Mac OS X (PowerPC) user, you're SOL.

To the contrary.
If your kids use Windows or you're intelligence-challenged yourself, you're screwed. The rest of us are safe.

Re:This comes right after a Flash hack

[alphasubzero949]

His solution to the hack that destroys a section of your profile is not that he will fix the site, but that you should install Flash 9.

Unfortunately, it won't fix the crappy member pages that crash your browser.

Re:This comes right after a Flash hack

[Slow2Show]

Its because it is a bug in flash's understanding of DOM security. Not myspace's, so hence your attempt at insinuating that they don't know what they're doing is incorrect.

Sorry try again after you RTFM RE: security issues.

Re:This comes right after a Flash hack

[paganizer]

I make my kids use firefox when they go to myspace; I also only let them access it on a system that is firewalled from the rest of the network, which they have to keep running.
I figure it's good training for when they have to go off to college away from their MCSE/Linux Geek/Ex-BBS sysop dad.

Re:This comes right after a Flash hack

[phatmonkey]

AFAIK, there was a Flash worm a few days ago which was caused by a Myspace XSS exploit.

Re:This comes right after a Flash hack

[kkiller]

Ah, nice approach to security there... "Look, we're sorry these murderers, rapists and crack dealers keep moving into the apartment block. You would have been much safer from the multiple shooting if you had added an extra bolt to your door. Tst Tst."

Re:This comes right after a Flash hack

[advocate_one]

Ah, nice approach to security there... "Look, we're sorry these murderers, rapists and crack dealers keep moving into the apartment block. You would have been much safer from the multiple shooting if you had added an extra bolt to your door. Tst Tst."

hah... how very topical... we're sorry about all these muggers robbing you of your mp3 players and phones... it's your fault for having them in the first place...

Re:This comes right after a Flash hack

[KingEomer]

Augh. Did Tom come right out of the "blogsphere"? He's an official representative of Myspace; the least he could do is capitalize.

Re:This comes right after a Flash hack

[kabocox]

His solution to the hack that destroys a section of your profile is not that he will fix the site, but that you should install Flash 9.

You gotta love laziness! You know the weird thing is that is most likely the best thing that he could have done to "fix" his problem. I'm on several security mailing lists and get notices of all the holes in nearly everything. Do you want to know the real dirty secret? That process is worthless to me unless they happen to be announcing a patch to the product that fixes the problem. There is little to nothing he could have done if his problem was in a piece of software that he runs but doesn't write himself. About the only thing that, he could do to speed up develop of a patch is pray. Suggesting to users to update their flash players after a flash hack sounds like it should be a valid solution if the problem was in the vast majority of user's outdated flash players.

Re:This comes right after a Flash hack

[Leebert]

make my kids use firefox when they go to myspace; I also only let them access it on a system that is firewalled from the rest of the network, which they have to keep running.

You are aware that MySpace isn't the only potentially hostile site on the Internet, right?

Re:This comes right after a Flash hack

[NilObject]

I think the parent poster meant Tom and Co. wont fix MySpace by screening advertisements before they get posted.

Re:This comes right after a Flash hack

[mce]

Unfortunately, it won't fix the crappy member pages that crash your browser.

With all due respect, but if a crappy page crashes your browser it's your browser that needs fixing.

Heh, on Facebook too.

[betterthanducttape]

Heh, I posted about this having been on Facebook earlier today in the Slashback article. I'm rather amazed that these things could have been active for days without getting caught and pulled by the websites. I'd ban the advertising company from my site after a stunt like this, no matter how much money they bring in. They just exposed hundreds of thousands of high school and college students to a virus for a quick buck.

Re:Heh, on Facebook too.

[ucd_michael]

really? I have not heard of any Facebook attacks. I am not likely to click ads because I know they are a waste, but spyware? *sigh* I wish Facebook would have stayed UC wide..

Re:Heh, on Facebook too.

[Anonymous Coward]

Proposed: Td is inversely proportional to Ua

Td: Time to discover spyware exploit being deployed by a website.

Ua: Average intelligence level of a user of that website.

Re:Heh, on Facebook too.

[jZnat]

They just exposed hundreds of thousands of high school and college students to a virus for a quick buck.

We're talking about Myspace users here. What's the problem?

Re:Heh, on Facebook too.

[rhizome]

I'd ban the advertising company from my site after a stunt like this, no matter how much money they bring in.

Let me guess, you generally don't receive advertising money.

Re:Heh, on Facebook too.

[trezor]

So you want more botnets and spamzombies on the net, do you?

Re:Heh, on Facebook too.

[jZnat]

Since you put it that way, not really. :(

Re:Heh, on Facebook too.

[orielbean]

Let me guess, he generally doesn't receive money.

Oh the horror!!!

[gasmonso]

Doesn't anyone think of the pedaphiles!

http://religiousfreaks.com/

Re:Oh the horror!!!

[Eightyford]

Doesn't anyone think of the pedaphiles!

And emo kids.

Q: What's so great about emo bread? A: It cuts itself!

Re:Oh the horror!!!

[Anonymous Coward]

Doesn't anyone think of the people who have turned signature display off? You certainly don't.

Re:Oh the horror!!!

[Conanymous Award]

This is completely offtopic, but could someone explain me what the heck defines 'emo'? Having been teen in the 90's, what makes emo different from grunge? Or goth? Would those people who were into alternative bands like the Smashing Pumpkins (you know, gloomy darksy music) back then be called 'emo' now? Or is 'emo' just a subcategory or a new wave of punk? Please enlighten me.

Re:Oh the horror!!!

[k3vlar]

Read: http://en.wikipedia.org/wiki/Emo_(slang)

Re:Oh the horror!!!

[trezor]

Forget that silly wiki link. This article explains stuff in a much more amusing way.

Re:Oh the horror!!!

[Conanymous Award]

Yeah, I had previously read that Wikipedia article, and I still can't see the (possible) difference between the 90s angry angsty kids and the 2000s angry angsty kids. Oh well. But that Something Awful article was a good and funny read though.

My sister was bit...

[aniceyoungman]

...by this shite. Her: J, can you help me with this pop-up problem? Me: What did YOU INSTALL? Her: Nothing, I was fooling around with my myspace profile though... Me: God damn Zango... Her: Zang-wha? It did uninstall without giving me any bull-shite errors/hoops to jump through, but still...

The rise and fall of myspace

[QuantumFTL]

Myspace is a fad. It is a fad that may be here for a long time, but it too shall pass. This type of abuse, as well as the abuse by sexual predators and antagonistic peers will eat away at its usefulness until it is outlived and replaced by the new "cool" thing.

Re:The rise and fall of myspace

[Anonymous Coward]

The internet is a fad. It is a fad that may be here for a long time, but it too shall pass. This type of abuse, as well as the abuse by sexual predators and antagonistic peers will eat away at its usefulness until it is outlived and replaced by the new "cool" thing.

Re:The rise and fall of myspace

[nwbvt]

Perhaps, but this type of exploit is not specific to myspace. In fact, in case you didn't RTFA (or even the summary), this ad was featured on other websites as well. Don't make the mistake that because you don't visit 'fad' websites, you are safe from this type of thing.

Re:The rise and fall of myspace

[arivanov]

While I agree with you about myspace, the exploit is not by any means MySpace specific.

On previous occasions Falk AG has served exploits like this through websites like www.theregister.co.uk. In that case Falk had their ad delivery servers broken into.

This is not the first time and as the time goes we will see much more of this.

Re:The rise and fall of myspace

[McFadden]

Myspace is a double-edged sword.

On the positive side, it boosts your ego and makes you feel slightly superior, when it reminds you just how many fucking stupid people there are in the world.

On the negative side, it reminds you just how many fucking stupid people there are in the world.

Re:The rise and fall of myspace

[Vo0k]

Fuck.

Falk AG is the company that serves ads on slashdot.

One single reason why I have adblock installed on -all- of my machines - because it's so horribly slow for foreign ISPs like mine, that slashdot main page with adblock loads for me in 5 seconds, with ads in some 40. Good to know there's another reason. :)

Re:The rise and fall of myspace

[Anonymous Coward]

Ah, so you're the guy with no friends who complains about myspace!

Firefox with Adblock?

[Mayday]

I am sure myspace execs did not notice and they are all about the money anyways ($$$). Did you see the picture of the CEO on the front of Wired? Tell me he does not make millions off of that company. MySpace is a cancer on the internet (IMHO) and since we all must post about our drunken night of sex and debauchery at the age of 14, it continues on.

As for the users and the million of computers out there. Using Microsoft is a bad thing but a necessary evil because it is on every computer sold at Best Buy, Dell, and well everywhere. When Linux is easy, we will have the same exploits for libraries.

P.S. - Windows people should WindowsUpdate daily if you value your PC as well as your privacy.

Re:Firefox with Adblock?

[Library Spoff]

>>Did you see the picture of the CEO on the front of Wired?

err - he's Rupert Murdoch. If he wasn't going to "make millions off of that company" he wouldn't of bothered with it.

Re:Firefox with Adblock?

[Anonymous Coward]

MySpace is really only an accessory to Murdoch's already ginormous media empire. In the Wired article, he more or less says (I'm paraphrasing...forgive me) that he wanted MySpace as an outlet to promote the assets of his other companies (Movies, TV, Music....) to a demographic that's been very difficult to reach.

I may not be a fan of News Corp. in general, but this guy is an amazing businessman.

Re:Firefox with Adblock?

[Anonymous Coward]

As for the users and the million of computers out there. Using Microsoft is a bad thing but a necessary evil because it is on every computer sold at Best Buy, Dell, and well everywhere. When Linux is easy, we will have the same exploits for libraries.

The bad thing is not only can't you buy a PC there with Linux, you can't even buy a copy of Linux there anymore to replace Windows! I finally bought XP because I couldn't get any distro to run on my PC (video problems), I wanted to buy a copy just for support. I'm sute there's just a tweak in some configuration file somewhere but I couldn't find it.

Maybe I should try Ubantu, haven't given that one a shot yet.

PS- I don't put ANY sensitive info on my PC just because Windows is so God damned shitty.

Re:Firefox with Adblock?

[Politburo]

You today:

MySpace is a cancer on the internet (IMHO)

You 8 years ago:

GeoCities is a cancer on the internet (IMHO)

We're all still here. Any questions?

All your Myspace are belong to us?

[davidwr]

"It's called My Space not Your space for a reason."
    -MySpace Vice President In Charge Of Revenue Generation

Just update

[bigtimepie]

From the article:

Microsoft released a patch in January to fix a serious security flaw in the way Windows renders WMF
What is clear from this attack is that there are plenty of people who still haven't installed this security update from Microsoft.

If your OS puts out a security fix, it's probably for a reason. This could have been avoided for everyone just by keeping up-to-date.

Re:Just update

[SuperBanana]

If your OS puts out a security fix, it's probably for a reason. This could have been avoided for everyone just by keeping up-to-date.

"Sorry all your stuff was stolen, but it's your fault for not installing a better lock."

Maybe security updates wouldn't be so critical if the people that took advantage of them (and those that aided them, like Myspace) got bitch-slapped.

Re:Just update

[0racle]

Lots of exploits that have been released have been fixed before the exploit made the rounds. Its just that the type of moron MySpace caters to are also the type of moron that won't ever learn how to do things right.

MySpace knows its users are idiots, and that they aren't going anywhere until their 15 minutes of fame are up. What do they care that ads they carry also target those same idiots.

Re:Just update

[Zindagi]

There might be other reasons why your computer is not up to date. For instance, now that Microsoft insists I install WGA before I can get the updates -- I havent been getting the updates. So Lord knows what all critical fixes my computer is missing. Not that that excuses anybody for using IE :)

Re:Just update

[hyfe]

If your OS puts out a security fix, it's probably for a reason. This could have been avoided for everyone just by keeping up-to-date.

I'm a bit unsure if this is irony or not

If it's not. I just want to mention 'Windows Genuine Advantage', the oh-so-very critical security fix. Sure, it's there for a reason, but that reason ain't your computers well-being!

Re:Just update

[smash]

Upgrade from XP to 2000, which doesn't insist on installing WGA before you can install updates, runs faster, and generally pisses you off less by trying to do stuff behind your back.

Less security problems as well :D

Re:Just update

[cliffski]

not everyone who is not tech savvy is an idiot. Don't fall into the trap of assuming stupidity because someone has a differing skillset. Im sure most car mechanics think I'm an idiot because I have sod all idea how my car works, or for that matter, how to keep the engine in top condition. Like most drivers, if it starts , stops and gets me to work, I'm fine.

Re:Just update

[Vo0k]

Of COURSE WGA is a VERY essential security update!

While most hotfixes and patches protect you merely from losing your personal info, maybe some money from your account, maybe some time wasted closing popups, WGA protects you (not directly, but by warning you) from sad men in suits and black glasses that come knocking to your door and do some really bad things to you if your copy of Windows is not genuine.

Re:Just update

[webvictim]

Sorry, you said "upgrade"? I was under the impression that 2000 was somewhat older than XP and therefore would be a "downgrade". This also doesn't take account of the fact that 2000 is a nightmare when it comes to installing my Bluetooth software and various other things that clearly state I *MUST* have XP in order to install them. It is almost tempting to do just to get WGA to sod off, though.

Re:Just update

[Tim C]

While I agree with you, the argument can be made that although you have no real idea what needs to be done to keep your car in good condition, you do at least realise that it needs to be maintained, and that that requires regular services.

The computing equivalent - of regularly applying updates - really ought to be just as obvious. I think one of the major problems is that while most people realise that machines suffer from wear and tear and so will obviously fail in time if not maintained, the equivalent understanding - that almost no sufficiently-complex code is perfect first time - hasn't made it into the collective subconscious.

Re:Just update

[v1]

My bank got robbed last week, lax security. There went my $200 in savings. Bank says not our fault, but don't worry they have tightened security.

Yesterday it got robbed again. Lost another $50. Bank says not our fault we are trying. Claim to have better security now.

So I should put some more money in the bank today?

uhhhh... no!

Companies that do security work (be they physical security, software, whatever) are expected to provide a reasonable level of security for their customers. Yes, we realize no security is perfect, but there is a certain point where we have to stop and say , "Hey, this is not working". Windows passed that point years ago. If banks had security models like windows, my money would be in a sock under my mattress, and a lot safer there too.

Lets say your bank started a new online account access. They sent you a dongle (usb thingie) to plug into your computer so that only you can access your bank account. Two weeks later all your money is gone. You go to the bank and say hey what happened? Oh you didn't hear? There was a security problem with the dongle, here is your new dongle! Be sure to stop in here at least once a week to see if we have a new dongle for you! I don't know about you, but the first thing *I* would do is withdraw all my money and put it somewhere else. Second thing I'd do is call my lawyer.

So why does MS get off so easy? Because the windows users are used to it. It's unfortunate and sad, but they have dealt with it for so long that it's just another one of life's annoyances. They seriously need a wakeup call.

Re:Just update

[14CharUsername]

No he was right 2000 is a step up from XP. XP == 2000 + a bunch of crapware.

XP drivers will work on 2000 anyway. Only issue is that the XP drivers will sometimes complain about missing DRM dlls when installing them, but otherwise will work anyway.

Re:Just update

[Valdrax]

Look!
Up in the sky!
It's a bird!
No, it's a plane!
No, it's..! The Joke Flying Over Your Head!
Dummm dum-dum-dadum Daaa daa da Dummm dum-dum-dadum Dum dahdah!

Re:Just update

[fpp666]

You have to pass the windows genuine copy test be4 that... not all of us can :P Cheers! ^_RaMoN_^

Re:Just update

[Sax Maniac]

You don't need WGA to download critical updates. They will still automatically download. I haven't installed WGA yet and don't see any need to.

And, I do prefer Win2000, if it weren't for ClearType.

Re:Just update

[j79zlr]

I hate MS as much as the next /.'er but you do not have to install WGA for critical updates. You need it to basically download everything but critical updates from MS's site.

Re:Just update

[Rice-Pudding]

The computing equivalent - of regularly applying updates - really ought to be just as obvious.

Ummm... nope. Why should it be obvious? Most people have no idea what is involved in constructing a complex piece of software. This is essentially what you said in the very next sentence:

[...] the equivalent understanding - that almost no sufficiently-complex code is perfect first time - hasn't made it into the collective subconscious.

The car analogy is a good one. I expect things to stop working eventually on my car (needs oil, new tires, belts, etc.). Similarly, I expect things to eventually stop working on my computer (new hard disk, power supply, fans, etc). But I don't expect the software to stop working, or to need "regular maintenance". The fact that most software does, in fact, need regular updates only to fix security holes is not expected by the average net user.

Re:Just update

[Anonymous Coward]

If your OS puts out a security fix, it's probably for a reason. This could have been avoided for everyone just by keeping up-to-date.

Certainly, there is a reason. But the reasons aren't always in my best interest. The reason could be to create more revenue for the OS vendor. Or to create some lock-in that will lead to future revenues.

WGA is a "Critical Update" according to Microsoft. WGA-Notification is a critical update. Malicious Software Removal tool (which cripples Norton) is a critical update. An update to Windows Media Player that strengthens DRM is a critical update.

How do I know which updates are safe? Which ones are important, and which ones are actually hazardous? By abusing Windows Update, Microsoft has created a lot of FUD. That FUD works against Windows users. To be safe, they don't install any updates. They rely on Symantec, or Trend Micro, or that popup that told them they might be at risk.

I can't count the number of people who have called me after they paid $30-60 for a one week trial of some no-name product they thought they needed because they couldn't trust Windows. Or the people whose email doesn't work because they have Norton, McAfee, PCcillin, Avast, and AVG all installed and protecting their inboxes. They've paid hundreds of dollars of protection money, but they can't use their computers.

Which critical update are those people supposed to install? And can they get it without installing some "security fix" that they really don't want.

Re:Just update

[comp.sci]

Such as the one that installed Genuine advantage?

Re:Just update

[smash]

Funny? I was serious damn it. :D I went back to 2k for the reasons I listed above...

I think the new Nvidia drivers have some sort of cleartype-ish stuff in them too, because it certainly looks less ugly than before I upgraded to XP...

Woohoo!!

[TheDarkener]

Go corporate America!! Way to get your message heard in the most unobtrusive, sincere fashion. I'm sure you'll gain a lot of proud customers through dumb marketing ideas, just like "Let's spam a million people and get 10 suckers to give us money! Woohoo!"

Tips

[Anonymous Coward]

1. Use Mozilla Firefox.
2. Uninstall Flash, you don't need that proprietary junk, 99% of all flash animations are ads/banners anyways.
3. Maybe you want to "block loading of images from third-party sites".
4. Use the Adblock extension for Firefox, you can get it at http://adblock.mozdev.org/ and get some rules for it.
5. Use a more secure operating system.

I hate Myspace, it is a website that caters to retards, it is so dumb.

Re:Tips

[wordsnyc]

Or install Flashblock for Firefox, so you can choose what Flash to watch....

Re:Tips

[tacarat]

Actually, I'm wishing they'd update the flash player for Linux. Newgrounds has increasing amounts of games I can't play because of the old version. I'll be very sad if I miss a new RAB because of it...

Other than that, I agree with everything you put up.

Re:Tips

[inject_hotmail.com]

1. Use Mozilla Firefox.
2. Uninstall Flash, you don't need that proprietary junk, 99% of all flash animations are ads/banners anyways.
3. Maybe you want to "block loading of images from third-party sites".
4. Use the Adblock extension for Firefox, you can get it at http://adblock.mozdev.org/ and get some rules for it.
5. Use a more secure operating system

Another great way to block most (99% ??) ad sites is to go here and download this. It's a hosts file that directs your PC to essentially IGNORE ALL known ad servers.

Why forge a battle on your computer between your browser and an ad server, when one can ignore the war?

Re:Tips

[Shippinator Mandy]

"2. Uninstall Flash, you don't need that proprietary junk, 99% of all flash animations are ads/banners anyways." But what about the 1% that's entertaining or useful? I'm a huge webtoon fan, so if I uninstalled Flash, I'd be losing the use of some of my favorite websites. And I know I'm playing devil's advocate here, but most banner ads don't serve adware, spyware, or viruses. If they did, this wouldn't be news.

Re:Tips

[Fluffy_Kitten]

i have to diagree with 2 over there... flash is now actually used for productive stuff, like youtube or google video, very popular websites right now. flash is now a PLATFORM. it is a NECESSITY for 90% of joe five-pack computer users, just like windows...

Re:Tips

[Xiroth]

I ended up keeping Flash uninstalled in Firefox, my standard browser, and installing Flash into Internet Explorer for when I'm sure I want to watch something. Having to boot up IE whenever I want to watch watch/use something Flash-based is not totally convenient, but it does have the advantage that you miss a reasonable number of ads.

Re:Tips

[KiloByte]

In the rare case when you have found some useable flash site, you can install FlashBlock.

I'm personally too annoyed by the large flash marks it leaves to use it, but if you need flash, FlashBlock at least will let you survive.

Re:Tips

[alphasubzero949]

Or if you can't use AdBlock, at least get Privoxy.

Re:Tips

[Maelwryth]

Strangely enough, the last popup I got was at http://nvuext.mozdev.org/.

Re:Tips

[phayes]

Unless you're using a corporate web proxy. If an explicit (ie: non transparent) proxy is setup on your machine, no domain lookups are performed and all requests are sent to the proxy.

Re:Tips

[wc_paladin]

A good way to avoid flash-based ads and alot of other malicious stuff would be to install the No-script extension for Firefox. It blocks Javascript from all sites except for the ones you manually select and can also be configured to block Flash, Java, or other plugins.

Re:Tips

[pembo13]

Any idea how addign that many rules (for each host) to your iptables would affect lookup speed?

Re:Tips

[pembo13]

U-Tube....but they yse a version of Flash that doesn't exist on Linux. So one might as wekk not have flash. Why do they use flash to deliver video anyways?

Re:Tips

[Fred_A]

And while they're at it, if they stopped thinking that Linux == x86 Linux, it would be nice for lots of people as well... This goes for the Adobe Acrobat reader too (although that is supported on a few more platforms I think).

I expect there's lots of cruddy code leftover in that thing, but having a portable codebase isn't extremely hard nowadays, even GUI code, not when you have the same environment everywhere (X) (and you distribute a statically linked bin anyway).

Re:Tips

[dueyfinster]

I recommend AdBlock Filterset G, it does all the hard work of block lists for you, and it updates automagically: https://addons.mozilla.org/firefox/1136/

Re:Tips

[webvictim]

I used to use one of those files until I discovered that I actually couldn't visit some sites I wanted to. For example, I couldn't download any MSN Messenger-related programs from http://www.mess.be/ [mess.be] because they routed their download requests through an adserver before it served me the file. Now while I understand that's the site's fault for being money-grabbing fools and wanting everyone to view their rubbish adverts, it doesn't change the fact that I didn't get the software I wanted. Installing Adblock was just a better solution to the whole thing - at least the 1% of the time that you actually want to "see" an advert, you get to choose.

Re:Tips

[webvictim]

Using Flash means that the majority of layman Windows & IE users (ughh, IE) will be able to watch their videos because if they have Flash installed, it just works, and if they don't, it'll give them a popup to install it and then they can watch it 30 seconds later.

I'm sure Youtube are very sorry that they've catered for 85% of computer users rather than the odd 15% who insist on Linux and then whine that it doesn't work properly.

Re:Tips

[kkiller]

2. Uninstall Flash, you don't need that proprietary junk, 99% of all flash animations are ads/banners anyways.

Say goodbye to half of all mainstream media sites, then. It's bad enough without Flash 8 in linux - no flash at all leaves you with half a web experience.

Re:Tips

[imroy]

Just use the flashblock Firefox extension. Then flash files turn into a right-hand triangle "play" button. You get to decide when Flash files play and can just ignore the annoying ads or whatever.

Re:Tips

[Secrity]

It is taking all of my willpower not to say something snarky about MS Messenger, add-ons, adware, and adservers. Just as you can configure Adblock you can also edit the hosts file to remove the adservers that you wish to see. The hosts file and Adblock have overlapping uses and each has it's own advantages in certain cases. The hosts file can be used to block sites that Adblock does not care about, such as directly typed URLs (typos happen); the hosts file also works with ALL applications, not just Firefox. Assuming that the ads are not obnoxious, why do you insult the site for wanting to make money by serving ads in exchange for software that you consider to be useful?

Re:Tips

[Anonymous Coward]

You can also use Archive.org to access sites. Easier to go back to 1996 rather than carrying your suggestions. :)

Sites like Slashdot live with advertisements, I reject to block ads. Rather than blocking Flash, I choose sites using it in non lame ways of using it. There are good sites using it in a good manner.

Firefox with a user profile consisting of geeks like you won't help me either. Lets say you are a coder at Firefox scene, a user reports his favorite site can't display content because of Flash. Would you take your time to fix or mark it as "proprietary junk not working, it is not our problem"?

Re:Tips

[Tony Hoyle]

It doesn't work on Windows either. I hate when people send me utube links because their crapware simply doesn't work 90% of the time. OTOH google video never fails.

Re:Tips

[Anonymous Coward]

YouTube videos perfectly work for me on both IE and Firefox on Windows. You must have some other problem.

What did you think? YouTube is not working on Windows and they still don't fix it???

Re:Tips

[makomk]

The last time I used YouTube (not long ago) it worked fine with Flash 7 under Linux. Have they changed it since then?

Re:Tips

[laffer1]

At least linux gets flash. What about the BSDs? I would guess more people have x86 freebsd installed than linux with a different cpu. Lets hope they support all of the above.

On the up side, if someone follows these tips it might make flash not the number 1 plugin. That would mean a few people might think twice before using it.

Re:Tips

[Fred_A]

I would have thought the Linux plugin ran in BSD... (haven't used BSD as a desktop for ages). Valid point though.

Re:Tips

[Khyber]

Myspace may cater to retards, but there's also lots of neat and kick-ass bands that use Myspace to get their stuff out, like my mother's band or Memphis local group Egypt Central.

Re:Tips

[pembo13]

Wouldn't people on Windows have Windows Media Player installed? That always tends to work, like it or not.

Re:Tips

[pembo13]

Yes they have.

Re:Tips

[FrankNputer]

Problem with #2: Flash is also being used for content delivery, i.e. web radio, video, etc. If you remove Flash, you can't access any of that stuff either.

Better solution: Assuming you followed tip #1, get the Flashblock extension. At least this way, you have a choice as to whether or not to allow the Flash in question to run - so you can still go to youtube.com or homestarrunner.com, while avoiding annoying flash ads. ;)

Re:Tips

[failure-man]

String-matching algorithms are very fast, and on a modern system probably much faster than DNS. (Plus, the bandwidth you save from not downloading whatever hunk of flashing garbage is on the menu is probably worth more than a few cycles regardless.)

Re:Tips

[Shippinator Mandy]

I know I sound stupid for this, but can you link to that? I'd like to try it out.

Re:Tips

[inject_hotmail.com]

I'm on the same page as your re: MSN, add-ons, etc, etc. The issue I have is that active ad-blocking/anti-spyware software takes up CPU time. Not to mention administration, and general futzing.

I'm a no-nonsense type of guy -- HOSTS file = zero CPU (essentially).

There is an added side-effect to using a HOSTS file. If one DOES get any spyware on their machine, the HOSTS file prevents it from calling home (assuming it's listed, of course).

All this for the low low price of free (as in beer).

Re:Tips

[imroy]

It's pretty simple to search on Mozilla's site, but here is the add-ons page, and here's its mozdev site.

Prosecute the "sellers" too

[SuperBanana]

Prosecute virus creating companies.

How about Myspace as well? It is easily argued that Myspace controls the banner space and content added to the 'global' site (ie every page). This is akin to aiding and abetting.

The sad thing is that a million PCs were infected, and probably 500,000 of them will -stay- infected. And will this even remotely hurt Myspace's market share/traffic? I seriously doubt it.

Re:Prosecute the "sellers" too

[nwbvt]

"How about Myspace as well? It is easily argued that Myspace controls the banner space and content added to the 'global' site (ie every page). This is akin to aiding and abetting. "

Only if Myspace knew what was going on (which they almost certainly did not). Or do you think any business transaction with criminals is 'akin to aiding and abetting'? In which case, shouldn't you also prosecute

• banks, if one or more of their clients deposit money they got illegally?
• hotels, in whose rooms illegal transactions (prostitution, drug dealing, whatever) take place?
• computer manufacturers, whose customers use their computers to steal identities?
• camera manufacturers, whose products may be used to stalk people and invade their privacy?
• etc.

Ask yourself this, do you really want to go down that road? Do you really want companies to run extended background checks on you before they sell you anything to make sure you may not use it in some obscure way to harm others? Is such a police state really what you want? Or do you just not like Myspace (either because it is used by the same teenage girls who wouldn't date you in high school, or because it is owned by NewsCorp)?

Re:Prosecute the "sellers" too

[borderpatrol]

Hate to say it, but I predicted this back on January 1st http://it.slashdot.org/comments.pl?sid=172683&cid= 14375232

Re:Prosecute the "sellers" too

[arkhan_jg]

I agree with your examples, but not with your linking of them with the original problem. A bank or computer maker or hotel's CUSTOMERS are committing the illegal act. You're right, the business should not be held liable for what their clients do, i.e. myspace shouldn't be held liable for what their users hosting pages put on them.

This is different. This is the business putting up an advertising hoarding that is dangerous to visitors. The business already vets its adverts (so no porn), so it has the duty and capability to vet its adboards for viruses, just as if it was hosting auto-install viruses on the front page in their own webspace.

Just because it subcontracts the advertising out to a third party doesn't get myspace off the hook, any more than a bank with a beartrap inside the front door wouldn't be liable because their builders put it there.

Re:Prosecute the "sellers" too

[dfjghsk]

You're right, the business should not be held liable for what their clients do

So why do you then say MySpace should be held responsible?

Look.. the visitors are not MySpace's clients.. the visitors are the product (and if they aren't the product, then at best they are leaches.. they would never be considered a client, since they don't give MySpace a dime).

MySpaces clients are those who give it money.. ie: the advertisers.

Re:Prosecute the "sellers" too

[Dokterdok]

For your information, banks can be help responsible if they accept money from a source that has not been verified. A bank running "extended background checks" is not a matter of wanting it or not. It's in the law: they have to do it. MySpace are responsible of the ads they're hosting on their pages: they make contracts with those companies and they get money out of it, which implies that they know what they are dealing with (so they know they're getting money by rooting you.. it's a bit like Soviet Russia, you know?) By the way concerning your other "points": I'm pretty sure that closing your eyes on the illegal business that's happening under your roof *is* a crime.

Re:Prosecute the "sellers" too

[Macthorpe]

Hate to say it

No you didn't, you loved it :P

Re:Prosecute the "sellers" too

[Tony Hoyle]

"Knowing what was going on" isn't a criterion. If you are in a store and one of the people demoing goods decides to spray after shave in your eye the store doesn't know that was going to happen, but they are still liable.

Myspace should be more careful who they hire to serve their adverts. If they get burned, tough.

Re:Prosecute the "sellers" too

[Gothic_Walrus]

You know, I'd be willing to bet that the third party ad gropu vets the porn adverts, because there's a high demand for that service. How many major sites run ads but would be mortified to find porn on their front page?

I highly doubt that MySpace clears every ad that runs on their site, and anyone that says they do is an idiot. Sure, Murdoch has all the money in the world to hire a team of...say, five people to do just that, but why would you when the ad company is supposed to for you?

Re:Prosecute the "sellers" too

[nwbvt]

"This is different. This is the business putting up an advertising hoarding that is dangerous to visitors"

Actually, the business sold that advertising space to an advertiser and they put up an ad that is dangerous to visitors. So actually, it is the same thing.

Re:Prosecute the "sellers" too

[v1]

banks, if one or more of their clients deposit money they got illegally? You mean money laundering? Illegal? Check.

hotels, in whose rooms illegal transactions (prostitution, drug dealing, whatever) take place? Brothels? Illegal? Check.

computer manufacturers, whose customers use their computers to steal identities? DVD players that bypass CSS? Illegal? Check.

camera manufacturers, whose products may be used to stalk people and invade their privacy? Wiretapping hardware? Illegal? Check.

When the majority of the product or service use is confirmed to be illegal, the product or service is considerd illegal. It's always worked this way.

If a newspaper is irresponsible enough to publish something that is patently wrong as fact and is damaging to someone, (defamatory content) they are legally responsible. They have a choice of what to allow into their paper and what not to, and have a responsibility to verify the content.

Imagine an auto repair shop that pays Vinnie to "advertise" for them. They start getting an increase in repair business, lots of people it seems are getting their car windows smashed out late at night. It is brought to their attention by several of the customers that there is a gang of people breaking out the windows, and a very similar looking bunch is at the repair shop once a week walking out with envelopes. So you are saying the repair shop bears no responsibility for all of this, just because they are claiming ignorance of what's going on?

Examples of why this sort of behavior is illeagal abound. Spyware/adware is one of the few remaining places where such activity is NOT yet illegal.

Re:Prosecute the "sellers" too

[nwbvt]

"When the majority of the product or service use is confirmed to be illegal, the product or service is considerd illegal. It's always worked this way."

Well considering the vast majority of banner ads are legal and do not install spyware, then I guess Myspace is off the hook and we can stop this silly conversation. Finally.

Re:Prosecute the "sellers" too

[Sir Runcible Spoon]

It is a problem for a company to check the ads embedded on its pages when those ads are served by another company.

Only a general link is embedded in the page which causes the user's browser to makes a request to the ad companies server. Every time the link is used a different ad is served. The ad travels directly from the ad company to the user, nothing of it is seen by the company hosting the page.

The ad company likes this arrangement because they then know the ad they are paying for was really served. So the only control the hosting company has is by writing it into the contract, which as often they are the junior player, they probably don't have much control over. I know they could go to another ad company, but they will probably end up with similar terms there.

So I think you can try and hold the page owner responsible if you like, but I don't think this will have any practical impact. It's the ad company that has the opportunity to verify the ad is not anti-social, so it would be better sue them.

Re:Prosecute the "sellers" too

[cerebud]

This is more akin to a company building a hotel (for example) with materials and practices that don't meet standard building codes. If the hotel falls apart and someone gets hurt, the company is liable. It doesn't matter if MySpace knew what was going on, the fact is they had a responsibility to protect their customers. Your analogies are completely unrelated to the topic at hand.

Re:Prosecute the "sellers" too

[DakotaSmith]

The sad thing is that a million PCs were infected, and probably 500,000 of them will -stay- infected.

I think your estimate is grossly low. Of the million sluts and whores that frequent MySpace (and their natural counterparts, pedophiles and perverts), at least 900,000 will remain infected if not significantly more.

In my experience, very little (if any) of MySpace's target audience is using any form of anti-ad/spyware software. If they are, it's because their father is in IT and knows to install it.

Re:Prosecute the "sellers" too

[Anonymous Coward]

They do it all the time. Like when California sues a firearms manufacturer because somebody shot somebody else unlawfully (and there are plenty of cases where shooting someone is entirely within the law) with one of their products. We call it "blaming the tool" and not the criminal/idiot.

Re:Prosecute the "sellers" too

[recycledpork]

Thats not correct at all. A better analogy would be a hotel who accepts money from someone who runs into your room and night and kicks you in the dick a few times.

Re:Prosecute the "sellers" too

[Anonymous Coward]

It would be more appropriate to call the visitors employees instead of products.

As such, MySpace is abusing their employees by exposing them to an unsafe work environment.

They are clearly responsible now, right?

Re:Prosecute the "sellers" too

[wordsnyc]

If a hotel hires room-cleaning staff without checking their records and references, the hotel is responsible for the loss of what they steal. Myspace had a duty to monitor the ads on their site, and this is hardly an obscure exploit.

Re:Prosecute the "sellers" too

[drinkypoo]

They do it all the time. Like when California sues a firearms manufacturer because somebody shot somebody else unlawfully

These lawsuits have happened, but they've also been dismissed. Most recently, a lawsuit opened in 1997 (which tells you how frequently this shit actually happens - not as often as you would seem to imply) was shot down by California's Supremes. It was against Navetech, manufacturer of the TEC-DC9, which was used in a shooting some time ago.

California does have an amazingly fucked up legal landscape but let's not exaggerate, please.

Re:Prosecute the "sellers" too

[BarlowBrad]

"How about Myspace as well? It is easily argued that Myspace controls the banner space and content added to the 'global' site (ie every page). This is akin to aiding and abetting. " Only if Myspace knew what was going on (which they almost certainly did not). Or do you think any business transaction with criminals is 'akin to aiding and abetting'? In which case, shouldn't you also prosecute...

• etc...
• P2P companies for the "pirating" actions of their users?

No... wait...

Re:Prosecute the "sellers" too

[dangermouses]

That is in no way close to the statitory requierments for aiding and abetting, the argument would probobly get thrown out of court in a few min. -most dust is made up of human skin and mites.

Re:Prosecute the "sellers" too

[dfjghsk]

employees? So MySpace is paying these people for doing their job of visiting the MySpace website????? That doesn't make any sense.. so I would say they are definitely NOT employees.

Re:Prosecute the "sellers" too

[nwbvt]

"This is more akin to a company building a hotel (for example) with materials and practices that don't meet standard building codes. If the hotel falls apart and someone gets hurt, the company is liable."

Thats because we have standard building codes, and inspectors who go through buildings to make sure they meet them. Finding obscure hacker exploits is much more difficult.

Re:Prosecute the "sellers" too

[nwbvt]

Ok, you also would not be able to prosecute a hotel if one of their other guests breaks into your room (or perhaps walks in after you leave the door unlocked would be more appropriate, as a patch for this vulnerability is available) and kicks you in the dick, if that is somehow more relevent to you. I've personally never had that happen to me, so I didn't find it that helpful.

Re:Prosecute the "sellers" too

[nwbvt]

Oh, and with regard to the statement "the company is liable", there is a difference between civil liability and criminal liability. Since the call was to prosecute MySpace, not sue them, only the former is relevant to this discussion. Unless you can prove some sort of intent, it is very unlikely you will be able to prosecute the hotel owners just because they got ripped off by a contractor.

Re:Prosecute the "sellers" too

[Anonymous Coward]

MySpace can easily check their own site and see that one of their
featured adds is installing malware. They should have some responsibility
for the content of their site in the same way that banks have a duty to
try and detect money laundering. Checking the adds on your site is not
that difficult.
I hate the site because it is a Murdoch site and because it attracts
the sort of empty headed dumb girls I would never have wanted to date.

Re:Prosecute the "sellers" too

[nwbvt]

"For your information, banks can be help responsible if they accept money from a source that has not been verified. "

Yes, I am aware that there are certain scenarios in which someone can be charged for business dealings in which the other party committed the crime. However, the source of the money being obtained through illegal means in not itself sufficient for such a charge. If you are convicted for insider trading, the feds next stop isn't going to go take down your bank because you deposited some of your profits in your savings account.

"I'm pretty sure that closing your eyes on the illegal business that's happening under your roof *is* a crime."

Yes, but only if it should have been obvious what was going on. A hacker exploiting an obscure (at least to the perspective of the marketing guys selling advertising space) IE exploit cannot be considered obvious. Or do you really think myspace (along with a number of other websites) risked their reputation (along with the reputation of Internet advertising, from which they make their income) by knowingly selling advertising space to a hacker disguising himself as a legitimate businessman?

Re:Prosecute the "sellers" too

[v1]

Well you can whine and complain and moan about it, or you can take action. In this case the correct action to take is "ballot" (if you've heard of the three boxes of liberty, this is #1) Contact your congressmen and tell them you don't like spyware, you don't like adware, and you don't vote for politicians that either support it OR use it. (there are a few congressmen that use spam to drum up votes)

You can't stop the practice until you have made it illegal. Then the law stops it for you. That's how it works here. So either get busy or stop whining ;)

Re:Prosecute the "sellers" too

[nwbvt]

I'm sorry, are you saying you want to lobby politicians to make harmless non-spyware ads (which as I said, make up the vast majority of Internet ads) illegal? You really hate the Internet that much that you are willing to destroy one of its biggeste revenue sources? Or did you misread my previous post and think I was saying there were no laws against spyware?

Slashdot one-ups Washington Post moderators

[zaliph]

This is absolutely hilarious. I wonder if more people got AIDS or this from Myspace? Posted by: bvllets | July 19, 2006 05:20 PM

My jaw is open in disbelief.

Re:Slashdot one-ups Washington Post moderators

[walnutmon]

I don't get it? I don't see that post anywhere, did they take it down?

Re:Slashdot one-ups Washington Post moderators

[James_Duncan8181]

It's up there still.

When you go to the community pool...

[inject_hotmail.com]

expect to pick up something special for the ride home.

I'm not trolling, but I can't stand myspace-type blogs.

People need to understand that the net costs money. If you didn't pull out your credit card to pay for the resources you consumed, you'll be pulling in something into your PC...and when the intelligence quotient is double-digit...

I've visited myspace exactly once. By accident. I'd consider it to be a sesspool of the Internet if I saw more than one profile. My sister, too, has been affected by the WMF exploit in a myspace profile. Let me just say that telephone support for Win98 on an ancient laptop is less fun than most things, including elevator rides with those people that feel that the body cleanses itself.

My perspective -- if one goes to myspace, one deserves its effects.

The more reason for text based advertisements.

[Antony-Kyre]

At least that way, you're less likely to get infected. As safe as I can be, I simply don't trust banner advertisements, and adware/malware is one reason.

Heh

[agentdunken]

Another reason why not to use Windows and have a Myspace.

DNS Ad-blocking

[computergeek1200]

My solution to solve this problem is to block the domains of the servers that host these ads such as (pagead2.googlesyndication.com) by using a dns server. This is better than firefox ad-blocking or most other systems. This system prevents any connection to the advertising server. I have a dns server for ad-blocking that is publicly avaiable at 68.147.32.114.

Click here to see if you configured your dns properly.

Re:DNS Ad-blocking

[Anonymous Coward]

Please do not block Google ads. Otherwise they'll have to start charging for Gmail. My good friend forwarded a message saying so to my Gmail account yesterday.

Re:DNS Ad-blocking

[computergeek1200]

If that is true, I would like to see the email. Please send it to ads@calgarycomputerfix.com. I am also interested in advertising domains that are not blocked on my server.

Re:DNS Ad-blocking

[Anonymous Coward]

Using a public DNS server requires a fair amount of trust. I'd rather have just a list of hosts to block, which are widely available and much less of a security risk.

Re:DNS Ad-blocking

[computergeek1200]

I agree that public dns servers can be a security risk. Is is possible to get a blocklist and add it to the dns server automatically. (instead of manually creating new zones and host records)

Re:DNS Ad-blocking

[MullerMn]

Click here to see how to make an html link properly.

Re:DNS Ad-blocking

[Anonymous Coward]

I am also interested in advertising domains that are not blocked on my server.

http://hostsfile.mine.nu/hosts.zip

Re:DNS Ad-blocking

[joost]

Good for you computergeek, but do you realise AdSense actually provides small publishers with valuable income? I'm with you on the annoying push-the-monkey crap, but AdSense, at least to me, is a different manner.

Re:why?

[kjart]

Anyone who protests tracking of their web usage obviously hates america.

Exactly - every time you delete a cookie an american flag bursts into flame.

Virus/adware-spreading ads

[john_prog]

Ads can be a growing security risk in the future. I'd like to ban all ads at work, but I can't do that since IE6 is the only allowed browser here and no extra software is allowed to be installed. Once I surfed to Dilbert website for comics that I thought would be safe, but Errorsafe malware tried to install itself to my machine (by ActiveX component in an ad). See http://koti.mbnet.fi/jnyman/dilbert.html screen capture here (the dialogue text is in Finnish, but the bottom line asks "Do you want to install Errorsafe program to your computer to check your computer for free (recommended)?". I complained about this to Dilbert website's webmaster and to Scott Adams and they replied that they're looking at the problem, but after that nothing. Haven't visited Dilbert website since at work. Hope this is not a growing trend.

Re:Virus/adware-spreading ads

[SCPRedMage]

In your case, the problem wasn't with the Dilbert website, and in the parent article, it wasn't a problem with myspace, either.

The problem is with the ad-serving companies that these websites use. Either they're less-than-trustworthy, and are directly responsible for the exploits being used, or they sub-contract out, and don't care enough to keep an eye on their "partners". Usually, notifying the webmaster of the offending site is enough to get them to have a "talk" with their advertisers to resolve the situation.

Of course, you probably already know this, but it bears repeating as it's something that can be missed by people not familar with the subject.

Please, won't someone think of the n00bs?

Re:Virus/adware-spreading ads

[Anonymous Coward]

I had dilbert.com as my home-page for years, but recently gave up on it in disgust. 9 times out of 10 Firefox would block anything upto 3 popups, and then they started to carry an extremly obnoxious popup that even Firefox couldn't block. I figure anyone being that anti-social doesn't want me around, so I left. If I were Scott Adams I'd be outraged by United Medias total dimwitedness, but I guess his Clue departed many years ago.

Re:Virus/adware-spreading ads

[Ohreally_factor]

MySpace was a pretty sleazy company before Murdoch bought it. Tom is the public face, but the original investors are a mysterious and well hidden group that has links to spyware and adware.

Can I substantiate this? Yes. Will I substantiate it? No.

I don't care if anyone believes me. Just remember, you heard it here first.

But to address your assertion: A website might want to pass the buck to whoever was doing the ad-serving, but it was their site that was spreading the disease. They have ultimate responsibility.

Re:Virus/adware-spreading ads

[Curien]

Quit spreading FUD and set up ad blocking on the proxy server. Doing it at all the clients is the wrong approach for an internal network.

Re:Virus/adware-spreading ads

[Macthorpe]

If you're unwilling to substantiate, and you don't care whether people believe you or not, then why did you bother posting it?

Also, if I had the flu but didn't realise because I wasn't showing symptoms, how does it make me ultimately responsible for spreading it? I couldn't have known I had it until people who I was in contact with got it too.

Even big sleazy companies do things accidentally sometimes.

Re:Virus/adware-spreading ads

[FlyingCheese]

The Government is spying on you and killing off people who speak bad about the government. The whole "Freedom" thing is a public face, the original writers of the Constitution are a mysterious and well hidden group that has links to The Masons and Illuminati.

Can I substantiate this? Yes. Will I substantiate it? No.

I don't care if anyone believes me. Just remember, you heard it here first.


Oh and pass the bong, dude. Thanks.

Re:Virus/adware-spreading ads

[Sarisar]

Never had a problem, using Privoxy to stop shit like that. I even have turned OFF the popup blocker in opera / firefox / swiftfox / whatever else I'm using because privoxy gets 99% of them. Any it doesn't I just amend the rules to add it in.

Then again I set it to block almost everything by default.

Re:Virus/adware-spreading ads

[elwin_windleaf]

It's a shame there's no "-1 Loony" moderation...

Re:Virus/adware-spreading ads

[v1]

One of my favorites is a screencapture I have a printout of by my desk at work. Imagine the poor presentation of Registry Cleaner's trick box trying to scam me... on my Mac OS box... running firefox.

They try so hard to make the dialog box look like a system message, and fail so very miserably.. heh.

You'd think they would be smart enough to at least detect my OS type and determine that (A) I'm not running windows and (B) I'm not running explorer, so those carefully crafted borderless dialog boxes they are opening (the "the whole window is a giant 'install' button" variety) just give me a good laugh. Ya, riiiiight.

But then again they probably don't care. In that case they can't infect my machine with thier crapware anyway, so there's no point in trying to trick me into clicking it.

Re:Virus/adware-spreading ads

[westlake]

Can I substantiate this? Yes. Will I substantiate it? No. Just remember, you heard it here first .

I won't forget that a touch of libel gets a mod up to +4.

Slashdot. News for Nerds, indeed.

Re:Virus/adware-spreading ads

[v1]

might ?

I've never known them not to

What I get a kick out of is how they like to tell you they have no way to contact them and there's nowhere you can complain to.

Um... you're getting a CHECK from them every month, remember? (we know you're not allowing that crapware on your site for free!)

Re:Virus/adware-spreading ads

[funfail]

You don't have to stop reading Dilbert. Subscribe to the RSS feed instead:

http://www.tapestrycomics.com/dilbert.xml

Re:Virus/adware-spreading ads

[Anonymous Coward]

Why are you assuming that the parent poster is the system admin? He/she is most probably an end user.

Re:Virus/adware-spreading ads

[Anonymous Coward]

You sir are my hero. A valiant knight, standing proud.

Re:Virus/adware-spreading ads

[dsgitl]

Well, I wish I hadn't. This is the message I got:

  http://koti.mbnet.fi/jnyman/dilbert.html has been categorized as Pornography. It has been blocked per your organization's Internet Usage Policy for group Public.

So, you know, thanks for that.

Re:Virus/adware-spreading ads

[sklib]

If you use the hosts file provided at http://someonewhocares.org/hosts/, the dilbert page won't have any ads at all. Pretty sweet.

Re:Virus/adware-spreading ads

[Dare nMc]

> extremly obnoxious popup that even Firefox couldn't block.
it's in the javascript, http=http://www.noscript.net/whats
took care of it.

Re:Virus/adware-spreading ads

[Marcos Eliziario]

Typical teenager-myspace-user dialog I've heard one of these days while commuting: "Oh, the computers on my school suck, they don't have windows, only word and mozilla" Under the light of this comment, I believe your suggestion is not going to be widely adopted.

Re:Virus/adware-spreading ads

[lochinvarr]

I guess his clue and relevance to the office environment left about the same time.

Re:Virus/adware-spreading ads

[tb3]

Or buy a newspaper.

Re:Virus/adware-spreading ads

[Kirlian]

You may want to add the unofficial Dilbert RSS feed to your feed reader, so you don't have to go to Dilbert.com again, it's clean and simple, I like it.

Re:Virus/adware-spreading ads

[paultyngnet]

To block ads in IE with no plugins you can use your host file to map ad domains to your loopback address or something similar.

ads.myspace.com 127.0.0.1

etc...

Re:Virus/adware-spreading ads

[drinkypoo]

Newspaper? Oh yes, I believe that is the vaguely rectangular paper thingy I've seen homeless people sleeping under in the park. You say it contains Dilbert?

Re:Virus/adware-spreading ads

[F_Scentura]

"In your case, the problem wasn't with the Dilbert website, and in the parent article, it wasn't a problem with myspace, either.

The problem is with the ad-serving companies that these websites use."

The Dilbert website serves ads from these companies, therefore the problem's resolution is ultimately the responsibility of the Dilbert website.

I don't blame the ad-servers just as I don't blame wild animals for mauling tourists. It's in their nature ;)

Re:Virus/adware-spreading ads

[Anonymous Coward]

google "portable firefox" much?

Re:Virus/adware-spreading ads

[Anonymous Coward]

I don't blame the ad-servers just as I don't blame wild animals for mauling tourists. It's in their nature ;)

We usually send out department of wildlife agents to shoot such wild animals. I think we should be carrying out the analogy in full here.

Re:Virus/adware-spreading ads

[VisceralLogic]

I've never had any problems with Safari...

Re:Virus/adware-spreading ads

[jp10558]

What about proxy filtering at the edge of the network?

Re:Virus/adware-spreading ads

[niteice]

Please, won't someone think of the n00bs?

No.

Re:Virus/adware-spreading ads

[abirdman]

if I had the flu but didn't realise because I wasn't showing symptoms, how does it make me ultimately responsible for spreading it? I couldn't have known I had it until people who I was in contact with got it too.

Bad metaphor. It's one of the problems I have with calling malware a "virus," because that implies that some more-or-less random thing happened to the computer which caused some inconvenience and problem with your computer.

It's not random or an unfortunate accident! Someone had to write the program, package it in such a way that it would infect the computers of unsuspecting users, often using poorly understood or undocumented vulnerabilities of popular software or backdoors installed by earlier malware, and someone had to engineer a distribution scheme to make that happen. Few of these programs are the products of script kiddies with attitude problems anymore. This isn't like catching a sniffle from a doorknob or an airborne virus! And worse, the really bad malware out there now was created commercially, paid for by some company who believes that the investment in paying programmers and engineers to come up with it will be handsomely rewarded, by delivering the keystroke logs and the spam forwarding zombies and the inadvertant hits on the websites of their clients caused by popups.

We have to stop thinking of this as some random "virus" that's like the common cold, and realize these are commercial ventures that have a commercial interest in fscking with your computer and software against your will, and will even fight with the anti-adware and anti-virus companies in court to avoid being called what they are (scum-sucking criminal dregs of the lowest sort), and it's all done for profit.

No one can hold you responsible for spreading a flu, but people can and should be held responsible for spreading computer malware, adware, and viruses for profit. If someone is making money from it, it's not a "virus", it's a crime.

Re:Virus/adware-spreading ads

[SCPRedMage]

Yeah, let's not forget that, again, this kind of stuff can happen without a webmaster's knowledge. A lot of the time they WILL lay down the law up front, and tell the ad-servers that they don't want that kind of crap on their site. But then, a lot of the time the ad-servers sub-contract out, and don't pay much attention to the practices of their minions.

90% of the time, if you bring this up to the webmaster, he'll either talk to his ad-servers and get it straightened out, or go elsewhere. Just because it pops up on their site, doesn't mean they're a bunch of scum-sucking a$$holes; give them a chance to fix it without judging them first.

Re:Virus/adware-spreading ads

[F_Scentura]

"Yeah, let's not forget that, again, this kind of stuff can happen without a webmaster's knowledge. A lot of the time they WILL lay down the law up front, and tell the ad-servers that they don't want that kind of crap on their site. But then, a lot of the time the ad-servers sub-contract out, and don't pay much attention to the practices of their minions."

Yeah, I'm not saying that they willfully knew this was happening, just that they're responsible on some level for it, and for fixing it.

"Just because it pops up on their site, doesn't mean they're a bunch of scum-sucking a$$holes; give them a chance to fix it without judging them first."

Nah, I'm not judging. I know sleazeballs slip through, but the site admin is still responsible for fixing things and ripping into the ad server.

Re:Virus/adware-spreading ads

[Macthorpe]

I take it you're not into intelligent design then!

Your point is a valid one, but doesn't explain how MySpace is culpable for it.

Re:Virus/adware-spreading ads

[abirdman]

Hahaha... yes, you're right. I'm not into intelligent design.

I don't guess MySpace is criminally culpable in this case, since we're still trying to figure out the good guys from the bad guys. It seems if I subcontract some service to another company (as MySpace does for their advertising), and the other company messes up-- or does something despicable-- in the process of supplying the service, it's not my fault. And if the MySpace advertising agency subcontracts the actual ads to others, then it's not the ad agency's fault either. Ditto with the advertisers-- if I advertise my widget through an agency, and the ad my widget appears on infects a zillion computers, it's not my fault either-- paper trail, signed contracts, NDA's, good faith, non-compete, hold harmless, legal team-- the cufflink-popping, tassel-loafer crowd makes sure of that. If there were liability, they would do it differently.

But let's face it, corporations are making the decision that it's OK to infect computers for profit, and other corporations are making the decision to look away (even if they have to hold their nose-- or double check their contracts-- while doing so) while their sub-contractors do bad things. The laws against the practices are vague and ineffective. Money is the only object-- it's America's new "free market," and frankly it disgusts me. Naming names, and calling things bad which actually are wrong is perhaps a start.

Disclaimer-- I have a MySpace account, and my Windows Media Player has been patched for this particular vulnerability for months. And the video stuff is among the most annoying thing on MySpace.

adzapper Squid redirector

[Baloo Ursidae]

I'm not sure what a better argument in favor of encouraging ISPs to set up web proxies for customers running adzapper than this (unless we're talking dialup, in which *not* downloading ads really saves on time).

Re:why?

[GodOfCode]

> Exactly - every time you delete a cookie an american flag bursts into flame. So what happens when you clear all cookies from you machine?

The shocking part is....

[Rapier]

The shocking part is that there are still people using Windows. I've got a laptop sitting around here with Windows on it that I use as a novelty once in a while, but it's not like it can really do anything useful. The package management system is horribly antiquainted, the dependancy checking leaves a lot to be desired, and then there are the security holes in the stock applications that come with the OS. Maybe some day it will mature enough to be useful, but for now it's just a novelty that still isn't up to being used in a production environment.

Re:The shocking part is....

[Danga]

The shocking part is that there are still people using Windows

Why is this shocking? Windows has the highest market share and comes pre-installed on way more than the majority of pre-built computers. It is what people are used to using since it is the OS that most people started out on, so the majority of people are more comfortable using Windows since they don't have to learn something new. A lot of people also just don't know any better. They don't realize or care that there are other OS's available, as long as they can surf the web, check their e-mail, use MS Office applications, and play their games what incentive do they have to move to anything else?

The package management system is horribly antiquainted, the dependancy checking leaves a lot to be desired, and then there are the security holes in the stock applications that come with the OS.

Oh, sounds a lot like linux (although it has gotten better recently). I am not a fan of how Windows goes about these things either, but I must say that I have had much more frustrating times with dependency and package management problems on linux than on any Windows machine. On Windows it usually goes like this:

1) Try and install upgrade to software.
2) It doesn't work.
3) Uninstall software package completely.
4) Reinstall software.
5) It magically works.

Yes, it is horrible that a lot of upgrades work that way but at least that is usually all that is needed. With linux on the otherhand I have literally had to spend days sometimes trying to get packages upgraded/working properly, even with Yum and other package handlers. One pain in the ass that I remember off the top of my head was when I was trying to upgrade some Perl MySQL module after upgrading the MySQL server, it literally took me 3 hair pulling days to finally get everything working right and the whole problem was caused by an error with CPAN (I can't remember exactly right now what the error was).

If I had to direct my 91 year old grandmother over the phone how to install some software I would much prefer she be running Windows than linux. It would be great if everyone ran linux but I think you are getting ahead of yourself if you honestly believe that it is easier to use than Windows. Now if you are a Mac guy then you could be right, but I have very limited Mac experience.

Linux is also not immune to having stock applications that have security holes and need to be patched right away, Windows is not alone at all in that regard either. After freshly installing either Windows or linux I have to go through the process of applying the needed patches on both.

Maybe some day it will mature enough to be useful, but for now it's just a novelty that still isn't up to being used in a production environment.

If you play games then Windows is very useful since the majority of games are developed for the Windows platform. It also can be made pretty damn secure as long as you lock it down reasonably well, I have not had any problems at all for the last 4 years on my Windows XP Pro boxes at work or home. My work box also is very useful for Windows development, so it is not just a "novelty" and actually is up to being used in a "production environment".

I don't know what OS you use but you really need to get over your zealotry, you just sound like all of the other zealot sheep who love to rip Windows to pieces even though it does have some useful purposes that they always fail to acknowledge. Windows has its quirks (and quite a few) but so does every other OS that I have used.

Re:The shocking part is....

[earthbound kid]

I would prefer to just SSH into granny's computer, start an X-windows session and do it myself, but hey, if you like telling your granny, "no gran, don't click the X button," over the phone while you try to guess what she's actually doing, more power to you, I guess.

Re:The shocking part is....

[the_xaqster]

....You did not realise that the loud Whoooshing noise was the joke going over your head.

Re:The shocking part is....

[Danga]

Granny doesn't have an always on connection and X-windows over a non stable dial up connection could be a pain too. Her computer is also an old Pentium 75MHz which might make running X-windows slow as hell (I don't know for sure though). It might be possible to do it that way but after getting disconnected a few times I probably would go back to just explaining it to her over the phone.

I will mention that this does work nicely over a decent connection that is always on. It was how I did all of my assignments while I was in college, I just setup an X-server on my Unix account and did almost everything from my own room instead of being forced to go to the computer labs (WAY across campus) and sit at a Sparc workstation.

Re:The shocking part is....

[nanio]

Is a joke still funny on the 100,000th telling?

Re:The shocking part is....

[Anonymous Coward]

Only in Soviet Russia.

Re:The shocking part is....

[Rapier]

Oh, sounds a lot like linux (although it has gotten better recently). I am not a fan of how Windows goes about these things either, but I must say that I have had much more frustrating times with dependency and package management problems on linux than on any Windows machine.

Linux is just the kernel. What OS were you using? I've been using Debian for about 6 years now (other various Linux based systems for over 10), and I havn't had the problems that you have had. I even track SID (still in developement) and very rarely do I run into a package upgrade that shuts me down for any significant length of time. If there is a conflict, I am notified before the package is installed.

Linux is also not immune to having stock applications that have security holes and need to be patched right away, Windows is not alone at all in that regard either. After freshly installing either Windows or linux I have to go through the process of applying the needed patches on both.

Every OS is going to need to upgrade programs as problems are found. I find it much easier to upgrade packages on my Debian system than it is on a Windows system. I also find the fixes are released much faster for the open source/free software that comes with most Linux based systems than the proprietary software that comes with Windows. I also don't need to reboot my systems every time there is a small upgrade. The only time the system should need a reboot is when the kernel or possibly modules (device drivers) get upgraded.

If you play games then Windows is very useful since the majority of games are developed for the Windows platform.

I put playing games under the novelty category. Definitly not a production activity.

It also can be made pretty damn secure as long as you lock it down reasonably well, I have not had any problems at all for the last 4 years on my Windows XP Pro boxes at work or home. My work box also is very useful for Windows development, so it is not just a "novelty" and actually is up to being used in a "production environment".

If Windows were so secure, I wouldn't be hearing the same questions from people all the time about how to get rid of viruses and trojans. I always respond with "If you don't like it, then don't run Windows." I'm not saying that Windows can't be made fairly secure. If someone makes a living by developing Windows software, then using a Windows system makes sense. That's the one thing that I don't disagree with anyone.

I don't know what OS you use but you really need to get over your zealotry, you just sound like all of the other zealot sheep who love to rip Windows to pieces even though it does have some useful purposes that they always fail to acknowledge. Windows has its quirks (and quite a few) but so does every other OS that I have used.

Thank you! I think that's the first time I've been called a zealot. My original message was going for a "funny" tag by using sarcasm, but your response was better than anything I could have ever dreamed. I use Debian for my everyday work, but I do have one laptop with Windows XP installed. It's main purpose for existance is QuickBooks for our company. We would normally find another solution, but when dealing with a CPA is almost as difficult as dealing with Windows zealots.

Re:The shocking part is....

[ultranova]

They don't realize or care that there are other OS's available, as long as they can surf the web, check their e-mail, use MS Office applications, and play their games what incentive do they have to move to anything else?

Isn't this whole story about how they can't surf the net on Windows, since they'll pick up malfare which turns their machines into advertizing bazookas ?

Oh, sounds a lot like linux (although it has gotten better recently). I am not a fan of how Windows goes about these things either, but I must say that I have had much more frustrating times with dependency and package management problems on linux than on any Windows machine. On Windows it usually goes like this:

1) Try and install upgrade to software. 2) It doesn't work.
3) Uninstall software package completely.
4) Reinstall software.
5) It magically works.

Yes, it is horrible that a lot of upgrades work that way but at least that is usually all that is needed.

In Debian Linux it goes like this:

1. Write "su" and press enter. Give the root password when asked.
2. Write "apt-get install programname" and press enter. If you don't know the program name, you can write "apt-cache search keyword" to get a list of potential candidates.
3. Apt-get makes a list of everything that needs to be installed in order for the program to work. If there's any such requisites, it shows you the list and total install size and asks you for confirmation. Simply press "y" and press enter.
4. Wait while apt-get downloads and installs the program and all the libraries and possible other things it requires.
5. Write "exit" and press enter. You're done.

Now, there are all kind of wrappers, both text-based and graphical, that can be used to do this instead, but I prefer to work with apt-get rather than play around with them.

Oh, but you said update, not install. My bad.

1. Write "su", press enter, and give the root password when asked.
2. Write "apt-get update && apt-get upgrade" and press enter.
3. Apt-get gets the list of newest program versions, and if there's anything newer than you have installed, gives you a list and asks for confirmation. Simply press enter to give the default answer ("y").
4. Write "exit" and press enter. You're done; all programs have been updated.

5. With linux on the otherhand I have literally had to spend days sometimes trying to get packages upgraded/working properly, even with Yum and other package handlers.

   Was that more or less painfull than trying to clean the remains of a failed install from Windows registry with regedit so that the install program lets you try again ?

   If I had to direct my 91 year old grandmother over the phone how to install some software I would much prefer she be running Windows than linux.

   If she used Linux, I wouldn't need to direct her over the phone, I could simply use ssh or vnc to do it myself remotely. I would also likely have to do maintenance a lot less often than in Windows...

   It would be great if everyone ran linux but I think you are getting ahead of yourself if you honestly believe that it is easier to use than Windows.

   As both Windows and Linux are used in the same way - point and click, and occasionally type text with the keyboard - I fail to see how this could be the case.

   Linux is also not immune to having stock applications that have security holes and need to be patched right away, Windows is not alone at all in that regard either. After freshly installing either Windows or linux I have to go through the process of applying the needed patches on both.

   Actually, since I install Debian as a network install, it simply downloads the latest program ve

Re:The shocking part is....

[ultranova]

Her computer is also an old Pentium 75MHz which might make running X-windows slow as hell (I don't know for sure though).

It won't. Yust avoid running Gnome or other fancy "desktop environments", and you'll be fine.

Windows, on the other hand, will be slow as a turtle.

It might be possible to do it that way but after getting disconnected a few times I probably would go back to just explaining it to her over the phone.

VNC doesn't care about disconnections, just connect back and continue what you were doing, and with SSH you can use "screen" for a similar effect.

And if her phone line is bad enough to constantly disconnect the modem, you propably don't want to try to explain technical procedures to a 90-year old (propably half-deaf) grandmother over it :).

Re:The shocking part is....

[Danga]

Linux is just the kernel. What OS were you using?

A few, mainly Red Hat, Debian, Xandros, Mandrake (before Mandriva), Damn Small Linux, and a few others, that was why I just said linux as a general term.

I find it much easier to upgrade packages on my Debian system than it is on a Windows system.

I find both relatively easy, I just have had more problems along with harder to find solutions on linux systems. Windows is made for the dummy user, linux really is not. I do not understand how a person who is proficient at installing/upgrading software on linux has a harder time doing the same thing for Windows.

I also don't need to reboot my systems every time there is a small upgrade. The only time the system should need a reboot is when the kernel or possibly modules (device drivers) get upgraded.

I rarely have to reboot anymore on my Windows boxes for small upgrades. A lot of times a prompt will come up saying to reboot but most of the time I have found it is not necessary to do so. The last time I was forced to reboot was about a month or so ago when I installed the newest nVidia video card drivers, before that was a couple of months when I put some more RAM in my machine. I do admit that a Windows box must be restarted more often than linux boxes but the amount of times a reboot is really needed for Windows has been so low in my experience that it does not matter.

I put playing games under the novelty category. Definitly not a production activity.

While not a "production activity" it does give Windows a big advantage over other OS's for people who do enjoy games. Talking about games I was responding more to when you said "Maybe some day it will mature enough to be useful", this is a very useful feature to a game player, I was just stating that Windows can serve some useful purposes.

If Windows were so secure, I wouldn't be hearing the same questions from people all the time about how to get rid of viruses and trojans.

I bet if you left an unpatched linux box open to the world it would get owned as well. The reason you don't see the virus/trojan problems so often on linux machines is not only because it is relatively more secure, but mainly because virus/trojan writers don't target it since they go after the most used OS world wide instead. They can get more results that way, especially malware/adaware folks.

Thank you! I think that's the first time I've been called a zealot. My original message was going for a "funny" tag by using sarcasm, but your response was better than anything I could have ever dreamed.

I responded late at night when I was tired and did not sense any sarcasm at all (which is easy to do on the internet). I have come across many posts such as yours that were not meant to be sarcastic and I just figured yours was another one. How you worded things did come across with a zealot tone by saying Windows is a novelty, unuseful OS.

Re:The shocking part is....

[Rapier]

I find both relatively easy, I just have had more problems along with harder to find solutions on linux systems. Windows is made for the dummy user, linux really is not. I do not understand how a person who is proficient at installing/upgrading software on linux has a harder time doing the same thing for Windows.

I think this statement really gets to the heart of why I have problems with Windows. It is geared toward dummies. Even as they work on improving the underlying OS, the interface looks more and more like it is designed for pre-school children. I'm an administrator/developer, and I really hate when an OS tries to hold my hand and tell me what to do. There are quite a few GNU/Linux based distributions that also drive me nuts, and I do what I can to avoid them as well.

I do admit that a Windows box must be restarted more often than linux boxes but the amount of times a reboot is really needed for Windows has been so low in my experience that it does not matter.

Another good point. For many people, Windows needs to be rebooted after almost every little upgrade because Windows tells you that it needs to be rebooted. Things are getting better in that area, but not from the normal user point of view.

While not a "production activity" it does give Windows a big advantage over other OS's for people who do enjoy games. Talking about games I was responding more to when you said "Maybe some day it will mature enough to be useful", this is a very useful feature to a game player, I was just stating that Windows can serve some useful purposes.

This is a part of OS discussion that I prefer not to spend too much time. I'm not a gamer, and feel that playing computer games is a waste of time. If I have enough time to sit and play a game, I have enough time to go outside and see the real world. If I want to pick up a sword and go attack someone, I grab my gear and go find someone to spar with. If I want to walk around a city and talk to random people, I go outside and walk around while talking to people. The best part is that the real world has better graphics and doesn't charge me for sitting on my rear. To me, the game arguement goes along with Windows being designed for dummies with an interface for the pre-school crowd.

I bet if you left an unpatched linux box open to the world it would get owned as well.

I have to disagree with this statement as a general principle. Unless I install some type of daemon that responds to external queries, it would be almost impossible to "own" the system. A clean base install should have nothing more than a console login and all the drivers needed to work with the hardware in the system.

I responded late at night when I was tired and did not sense any sarcasm at all (which is easy to do on the internet).

How strange.. I normally have this problem when I wake up first thing in the morning. I fully understand the issue with typing while tired. I've had to appologize many times for things I've written while half asleep and didn't have the sense to hit cancel.

Re:why?

[Stormwatch]

Exactly - every time you delete a cookie an american flag bursts into flame.

So what happens when you clear all cookies from you machine?

The USA will become an islamic republic.

Really??

[Gorimek]

And they wonder why consumers want to block all ads. Its because of illegal virus ads like this

I thought I followed the field fairly well, but I have never heard of any previous virus ads like this.

Re:Really??

[babbling]

It happens all the time. It happened on LiveJournal only a month or two ago.

Re:Really??

[Vo0k]

Not on "reputable sites". The problem is you don't have to try hard to get to the "less reputable sites". All you need is to type "com" instead of "org" or "net", make a typo or misspell the domain name, click a result that on first sight looks genuine in Google Search, visit a site from your bookmark which is two years old, enter any phpbb-based forum or any site running on older, unpatched IIS. Minor sites get hijacked all the time.

Re:Really??

[v1]

True, you never see any major sites hacked. (that's an ardchive from microsoft.fr btw)

Unfortunately, the elevator riders are right...

[patio11]

... they DO end up with less stench on them at the top of the ride than at the bottom, since convervation of mass means that the stuff suffocating me had to come from somewhere...

Re:Unfortunately, the elevator riders are right...

[inject_hotmail.com]

well, there'll definitely be some molecule swapping going on. Your atoms on the other people probably means they smell better though.

The real problem is that the stench atoms are generated at a feverish pace.

:)

Another Reason to Block ALL Ads

[Anonymous Coward]

Just another reason to block all ads no matter where they are serverd from. The ads are bad enough much of the time, but with this kind of activity going on, why take any risk?

Re:Another Reason to Block ALL Ads

[webvictim]

I agree with blocking everything except Google ads. They're very small, unobtrusive and above all they're text, so virtually no extra overhead for dialup or fussy broadband users. I don't object to things that don't get in my face - it's just when I get three popups telling me to click the ant to win a prize or join the Jamster ringtone club that steam begins to emerge from my ears.

Re:why?

[max99ted]

Exactly - every time you delete a cookie an american flag bursts into flame. So what happens when you clear all cookies from you machine?

God kills an American kitten.

umm there has been a patch since jan

[atarione]

wow... ok so not to interupt and windows hate fest.

but the WMF exploit has been patched since jan of this year

anyone that got hit by this only has themselve to blame.

Adblock, Spybot and hosts file

[basotl]

It's amazing the lengths we have to go through to keep a windows pc secure.
On my Windows XP box I run Firefox with Adblock installed and Spybot and I edit my host file to block sites that get past any of those. That's not even counting my virus utilities and a firewall.

The amount of computer knowledge that is needed to keep a windows pc secure is much more advanced than what it takes to run an install of just about any Linux distro out there.

At least with the popularity of MySpace and this exploit, I'll finally convince my less tech savy co-workers to update windows and run a spyware detector. It will freak them out when I tell them their beloved MySpace installed that adware/trojan.

Firefox and Spybot for them all! The thought makes me smile!

Re:Adblock, Spybot and hosts file

[Anonymous Coward]

Actually by you own admission you NEED linux boxes to run windows boxes.

So if you NEED windows.
You NEED linux.

So THIS is how we got it...

[Anonymous Coward]

Several of the computers here at work ended up with this somehow - at least now I know how it got it. Our particular problem broke Adaware and made it reboot as it started scanning, I spent two days fixing the fallout... what a wonderful pain in the ass this was. This explains it, all right. Glad to see people at least weren't doing this crap intentionally. Spysweeper, incidentally, does a good job of disinfection - it kept reinfecting after each reboot when we tried with other things.

(Fortunately IT still doesn't know it happened - we don't need ALL access revoked.)

Re:So THIS is how we got it...

[Runesabre]

I tried Ad-aware a couple years ago on a computer that was just completely dogged with spyware. I encountered the same problem; spyware kept reinfecting the system repeatedly even after a full scan, reboot, full scan, reboot, repeat ad nauseum.

I switched to Spyware Doctor which cleaned it all up in one pass. I've since used nothing but Spyware Doctor for all my spyware issues.

Does Windows Defender Catch This?

[fragMasterFlash]

Anyone know if Windows Defender will catch the spyware component of this exploit? I suppose its a moot point since people who run IE unpatched aren't going to run Defender anyway.

Prosecute MySpace

[Yez70]

Do you really want companies to run extended background checks on you before they sell you anything to make sure you may not use it in some obscure way to harm others?
 

You mean like the government wants our ISPs to track and monitor our web usage and keep copies of all our IM's, searches and emails? Or how about our libraries revealing what books we check out? Maybe AT&T could provide a log of all your phone calls. How about the banks reveal all your financial transactions?

Oops, I forgot - the Patriot Act, among other obscure laws, already allow this.

Innocent until proven guilty no longer applies in the land of the free - why should it apply to corporate America any different? Oh yea, I forgot, they own the politicians.

Why can't Microsoft patch the holes in it's software? Why can't MySpace screen it's advertisers? They aren't showing porn site ads, because they 'screened' the ads, correct? So, how come they are serving adware?

If it's ok for the government to be constantly running background checks (illegally I might add) on it's own citizens in a 'FREE' country, then MySpace should also be responsible for spreading viruses and spyware. Of course, they won't ever have to answer for it. News Corp may as well be owned by the GOP...

Re:Prosecute MySpace

[kwark]

"Why can't MySpace screen it's advertisers?"

I don't know about myspace but a company I worked for years ago got hit by a similar problem. At that time they were letting Falk serve ads, a machine there got compromised and was used to spread images using some IE exploit:
http://news.com.com/Attackers+strike+using+Web+ads /2100-7349_3-5463323.html

Re:Prosecute MySpace

[nwbvt]

"You mean like the government wants our ISPs to track and monitor our web usage and keep copies of all our IM's, searches and emails? Or how about our libraries revealing what books we check out? Maybe AT&T could provide a log of all your phone calls. How about the banks reveal all your financial transactions?"

No, not really...

I'm scared to ask, but how does your conspiracy theory reason why the government would want ISPs to monitor all that information, when the government itself really wouldn't have any trouble doing it themselves?

"Why can't Microsoft patch the holes in it's software?"

They do. Users just don't always install the patches.

"Why can't MySpace screen it's advertisers? They aren't showing porn site ads, because they 'screened' the ads, correct? So, how come they are serving adware?"

What part of 'hidden in the ad' did you not get?

Re:Prosecute MySpace

[Dread_ed]

So your answer to insane govenmnet policies and laws that circumvent our freedom and eviscerate the constitution is more of the same restrictive interference that you are already upset about?

That is what you are saying, right? Since the government changed the laws and now can do all these bad things then we should make it compulsory for other companies to do bad things as well. Sure, making companies responsible for their advertising space sounds like a good way to cut down on obnoxious ads. However, if that level and type of corporate accountability is mandated then you sould have no problem with constant monitoring of your hotel room by video and audio just to make sure that you don't do anything illegal in there, right?

Re:Prosecute MySpace

[RatBastard]

Or how about our libraries revealing what books we check out?

Actually, most libraries go out of their way to destroy your checkout history. One common library checkout systems only keeps track of the person who has that particular copy at that moment. The only way to look up the book is by its inventory number. Searching by patron name returns no result. Once the book is checked in the record is modified saying that the library has it. The result is that there is no history of who had what books or what books you have read.

Libraries are notorously at odds with the PATRIOT Act and have risked loss of federal funds to do what they can to protect patron privacy.

Disclosure: My wife works for a local public library.

Re:Prosecute MySpace

[Anonymous Coward]

Wow.. lots of psycho mods today... parent post is troll or flamebait.. not insightful

is myspace responsible for their site or not?

[SuperBanana]

Only if Myspace knew what was going on (which they almost certainly did not).

I'll make this very simple for you: Is myspace responsible for the content they put on their site, or not?

When you are a website the size of myspace, failing to vett your advertising borders on gross negligence and incompetence.

Furthermore, if you study how 'responsibility' plays out in the business world, particularly with lawsuits- the first party on the food chain is responsible. If that company wants to take action against its employees, suppliers, etc- so be it. But the buck, figuratively, stops at "round one".

Re:is myspace responsible for their site or not?

[MrSquirrel]

I may be wrong, but myspace doesn't operate their own ad agency -- it's all outsourced to a company that specializes in online advertising. I only had to block one domain (I'm at work, so I can't look it up right now) to stop 99% of the flash ads on myspace. I blame the ad agency -- based on the other ads they have (way back in the day before I had Firefox with flash block, every other ad on myspace was "your system is infected, click here to infect your computer. ...I mean clean it. yes... clean it with viruses!") the ad agency is a bunch of greedy, soulless bastards.

Re:is myspace responsible for their site or not?

[Athanasius]

And how is anyone, myspace included, meant to vet the contents of URLs that they don't control?

Anyone intending malicious conduct can easily *change* the code that produces the URL's content so that at the initial checking stage it all looks harmless, but sometime after that once it's live they make it start exploiting security holes.

I guess you could insist that anyone running ads on the web has to be directly responsible for their generation, and thus there'll be no more general ad serving companies, but the likes of myspace, and certainly smaller sites, likely don't want to do that.

Re:is myspace responsible for their site or not?

[nwbvt]

"I'll make this very simple for you: Is myspace responsible for the content they put on their site, or not? "

Well, yeah, but they didn't put that content on their site, the advertiser did.

"Furthermore, if you study how 'responsibility' plays out in the business world, particularly with lawsuits-"

Yes, lawsuits are funny. You can sue a restaurant for serving you with hot coffee. However, you cannot prosecute them for it.

Well.....

[Anonymous Coward]

Well,that's what happens when you use windows.

Re:Well.....

[webvictim]

Get over yourself, for goodness sake. It's fools like you who make all Linux users look like haughty Windows-hating snobs.

Re:Well.....

[Anonymous Coward]

What exactly makes you think he's a Linux user?

Prejudism?

Re:Well.....

[webvictim]

Well, I don't think a Windows user would sit there and make a comment exactly saying that, do you?

Finally a use for small tubes

[bblboy54]

I have no fear of this type of internets. Until betting on horse races becomes a common place in every American's house, the tubes will be entirely too clogged to deliver this to me.

Axis of Evil

[Anne Thwacks]

When is President GW Bush going to realise that America is part of the Axis of Evil, and carpet bomb these Adware people back to the stone age?

Its the Ad, not Myspace

[Fr3d]

Before we go on with all the Myspace and Windows bashing it's important to note who is at fault here.

Myspace isn't at fault and neither is Microsoft

Sure they make shitty products for the below average user, but that isn't the problem. Myspace administrator's don't choose exactly which ads are dissplayed on their pages, they sell their ad space to an ad company with a few constraints on what types of ads are allowed to appear. The company who provides the ads then chooses specifically which ads it wishes to display on each of Myspace's, and for that matter, hundreds of other web site's web pages. And the users who didn't update their Windows OS arn't any more at fault either. Is it my fault if I leave my window unlocked and I get robbed because of it? No.
Another important note:
Myspace users were not the only one affected by this banner ad

So enough with the flame wars, go fuck the adware companies that are fucking everyone over.

Re:Its the Ad, not Myspace

[Anonymous Coward]

ok, myspace not being at fault I'll give you, but if I write shit code, I'm to blame. This vulnerability is there because someone at microsoft wrote shit code. Sure, there was an update available so the user is also partly to blame, but still, microsoft have been around long enough to know that they needed to clean up their act. I just installed XP Pro under vmware here for an app and IE is touted as "The most secure browser" or something along those lines. The marketing fluff needs to stop and the software needs to be the proof.

Re:Its the Ad, not Myspace

[Krojack]

IF myspace knew about this then they are at fult but I doubt they will say they knew about it if thats the case. Could you imagine what would happen to microsoft if they came out and said "Oh yeah.. we knew about ALL the exploits and holes in our OS but choose not to tell anyone" =)

Re:Tips:LUA?

[giorgosts]

You can add that when we browse on Windows its imperative to use a user account that does not have any rights to install software. If we place this on top of your list, the others are an overkill..

I use a similar Ad Blocking Hosts file

[Rick17JJ]

I use a similar ad blocking hosts file on both my Linux computer and on the Windows XP computer. I have been using "Mike's Ad Blocking Hosts file" for several years now on both computers. Like the modified hosts file you mentioned, Mike's modified hosts file also diverts the URLs for most ad servers to the 127.0.0.1 loop-back address that all computers have. His webpage has instructions for using his modified hosts file in either Windows, MAC, Linux and Unix. He regularly comes out with updated versions of his hosts file.

You also mention using a more secure operating system, I use Linux instead of Windows most of the time at home. Of course I don't use Internet Explorer on the Linux computer since it isn't even avilable for Linux and would not want to anyway. I use the Linux version of Firefox instead. Spyware, viruses and worms are almost unheard of under non-Microsoft operating systems such as Linux or Mac OS X.

Re:I use a similar Ad Blocking Hosts file

[Lillesvin]

Of course I don't use Internet Explorer on the Linux computer since it isn't even avilable for Linux [...]

Not entirely true. IEs 4 Linux. I installed it, just because I could... Besides, it can run Flash 8-9 and stuff (so I can watch the Weebl & Bob episodes that require Flash 8), but it's highly unstable --- think (stability of Wine) * (stability of IE)...

I wonder if this WMF-exploit will work in IE on Linux... And - if so - what will it do?

Re:I use a similar Ad Blocking Hosts file

[14CharUsername]

Well its hit and miss whether malware would work under wine, just like any app is hit and miss with wine. If it did work it would do the same things it does on windows, but would only effect wine, so only apps you run with wine would be affected. When not running wine the malware wouldn't run at all. Most wine setups put your home directory as a drive (J: maybe?), so the malware could look through your files, and maybe infect them with windows viruses or whatever. If you delete the wine directory the malware would be deleted too, but some files in your home directory would still be messed up, though you wouldn't know because its unlikely it would have any effect under linux. But if you email a file to a windows user... you might give them a virus.

This is all theoretical, of course. since linux users are pretty careful, I don't think this would happen often.

Re:I use a similar Ad Blocking Hosts file

[Rick17JJ]

You're right about it being possible to run Internet Explorer under wine. I had not heard of Es4Linux, but I had heard of running Internet Explorer under Linux with the help of "CrossOver Office". It is a slightly enhanced version of Wine made by CodeWeavers. The Codeweavers website mentions running Internet Explorer 6.0 under Linux. Will that allow me to run Windows spyware just like Windows users do? Probably not, but for the last few years I have used the "CodeWeavers CrossOver Office" version of Wine to run MS Office 2000 under Linux although I mostly use the Linux version of Open Office instead of MS Office.

So?

[WhatDoIKnow]

If this was news the Washington Post would have had it in the paper instead of some security fix blog.

MySpace Hate

[IClavdivs]

omg. wow. who would've thought that so many nerds would have such hate for a SOCIAL networking website.

Re:MySpace Hate

[Anonymous Coward]

Who would've thought that someone incapable of capitalizing the beginnings of their sentences and of using proper punctuation would be such a fan of the place?

I'll bet you've got a great song and some really bitching animated GIFs on your site, though.

Re:MySpace Hate

[Anonymous Coward]

It's not that it's a social network site - I'm sure many nerds have profiles on them. It's the fact that it is an absolutely terribly designed website in the first place, and then was bought by media mogul Rupert Murdoch's company, which also owns Fox News. Personally, I don't want this person having access to my information, nor controlling the indirect form of communication for many people.

After all, lets look at his take on media:

"My ventures in media are not as important to me as spreading my personal political beliefs" (in "The Hollywood Reporter" November 23, 2005)

Social Networking is not something dislike, but Myspace is. The fact that they use shady advertisers who take advantage of users is just another straw on the camel's back.

MySpace's Response Was To..

[Absentminded-Artist]

...quickly upgrade all flash ads and video to Flash9 this morning. I was just prompted to upgrade to Flash9 (I don't really keep on top of Flash updates) an hour or so ago.

Although I'd like to see MySpace increase its response time, a week response time is fairly fast for corporations. Apple took two weeks to patch the vulnerabilities discovered last February and they were applauded for having a fast response. The shame is that Microsoft's glacier-like response to security vulnerabilities makes two weeks look speedy, and one week look positively instantaneous.

I realize that it will be popular to bash MySpace around here over this but the real culprits are, in order from least to greatest responsibility, the users who hadn't patched their OS with the latest updates, Microsoft for pushing such crappy code in the first place, and greatest of all, the ad agency that didn't catch this little beauty. They should lose their contract at the least over this, IMO. I use a Mac, Safari, and an adblocker style sheet, but I want to see an end to this. Kids shouldn't be used to propagate malwarez and if I was a band over at MySpace I'd be plenty ticked off about this, too.

Re:MySpace's Response Was To..

[Anonymous Coward]

...quickly upgrade all flash ads and video to Flash9 this morning. I was just prompted to upgrade to Flash9 (I don't really keep on top of Flash updates) an hour or so ago.

Actually, that's been going on since last week, to resolve another issue where people were getting their pages overwritten by a different exploit.

I hesitate to call it a malicious exploit, considering the shit it's overwriting.

Re:MySpace's Response Was To..

[assassinator42]

What exactly did it do? And I did think it was pretty stupid for them to make people upgrade to Flash 9 to stop a WMF exploit.

Viral marketing

[Opportunist]

So that's what's meant by that term?

(You know I've been waiting to say that for weeks now)

Only when a Domokun masterbates! NT

[Anonymous Coward]

I hear kittens taste like chicken, but I prefer mine raw.

agrhh..

[stachu trawki]

What pisses me off is that the company which created this ad is not being punished (at least it seems so). Ordinary people are raided, have their property literalily stolen for breaking into servers (which is right) or sharing hashes of some copyrighted material (which, at least in the cast of The Pirates Bay, *wasn't* illegal).
Now some company breaks into a million computers (using whatever means) and even though they make a lot more damage pretty much nothing happens to is. [Hint: you may also try substituting "Sony" for "some company".]
In Poland we have a law that states something like (IANAL) "accessing or modifying information stored on a computer system without authorization is illegal". I bet it's similar in most highly developed countries.
IMO, if anyone, the company who created this ad and Sony (for their rootkit) should have their servers raided and execs(?) arrested/prisoned.*)

On the other hand, it's amazing how powerful some governments are when a small company (often only allegedly!) doesn't pay all the taxes it "should" - often leading them to bankrupcy..**)

*) I know I'm talking about different countries, different jurisdictions, there's that damned "lobby", etc.. But from a common sense point of view that's exactly how things are.
**) There have been a couple of well known cases of this kind in Poland. But I'm guessing that althougt this country is a WTF on it's own, it's not alone when it comes to this sort of things.

That's nothing.

[Ivan Matveitch]

I clicked one and it installed Windows XP on my computer.

Same thing on OKCupid...

[Max Threshold]

I encountered an ad which prompted me to download a file called 'exp.wmf'.

Yes, it's an online dating site. No, I haven't met anyone on there yet. Shut up.

Re:Same thing on OKCupid...

[tritonic]

But if you do, offering to disinfect their PC could be a great pick-up line...

Troll me, but I only have one thing to say..

[Anonymous Coward]

Troll me, but I only have one thing to say.. MoHaHaHaHaHaHaHaHaHaHA!

Aren't there antihacking laws that apply?

[TheLink]

Y'know unauthorized modification of a computer system and all that stuff?

Tampering with 1 million computers without permission and AFAIK without good reason. Isn't that a serious criminal offense?

That's what annoys me the most about all those "antihacker" crusades. Don't the same laws apply to spyware, unauthorized adware etc? Even Sony's DRM crap.

But no, the FBI and other authorities round the world seem to prefer trying to jail people who are pretty harmless (like that brit looking for UFOs).

If directors/owners of companies doing such stuff were sent to jail (or even seriously threatened with jail), you'd see a lot less spyware or nasty adware around.

Instead there's one law for the small stupid amateur and another law for the incorporated pros.

And that is the real reason why there's so much spyware around. Not because users are clueless (even though they are) or click on attachments without thinking.

slashdot

[stachu trawki]

When this happens on slashdot?

Re:slashdot

[onebuttonmouse]

This happen when they set us up the bomb?

Doesn't matter

[Frightening]

Most people on MySpace have so much spyware to begin with that no change was noticed in their daily activity.

A Test Run

[conn3x]

Rupurt is just letting his evil scientists have a little fun. At the bargain price of $500 per computer he can infect, he now controls the largest DDOS IRC network in the world. All This and More From the Internet's Largest Topological Superstore!

Myspace ad-servers to block

[Anonymous Coward]

I have the following filters in the Firefox's Adblock extension:

http://delb.myspace.com/*
http://debr.myspace.com/*
http://dehp.myspace.com/*
http://demr.myspace.com/*
http://desk.myspace.com/*
http://defp.myspace.com/*
http://uhpfp.myspace.com/*
http://defg.myspace.com/*
http://desb.myspace.com/*
http://defb.myspace.com/*
http://desb.myspace.com/*
http://dewb.myspace.com/*
http://deeb.myspace.com/*
http://defv.myspace.com/*

This filters pretty much all advertisements from myspace. Would it have protected me from this exploit, I wonder?

All the more reason...

[jagossel]

Just another reason for me to boy-cott MySpace. I cancelled my account there and now, it seems like I have very good reason to say, "For Security reasons." For all I know, my current employer could have been reading my blogs there. It doesn't matter anymore, no longer a member at MySpace.

Re:All the more reason...

[The Cisco Kid]

I've never even glanced at MySpace, I'm sure its horridly cliche teenagers and wannabees posting drivel on the net, and a complete and utter waste of time.

However, I would suggest rather than 'another reason to boycott Myspace', that this is 'another reason' (in a list that surely numbers in the millions for anyone rational) to boycott SOFTWARE THAT IS VULNERABLE TO STUPID CRAP LIKE THIS (eg, anything with Microsofts brand name on it).

I say that anyone who is STILL stupid enough to be running MSIE and Windows deserves all the adware, spyware, trojans, and whatever else can ram its way onto their system. And the world would be a better place if the next virulent outbreak in that sewer actually destroyed the systems, but that is unlikely, becuase only the amateurs are out to wreak havoc - the pros do it for the money that the spammers pay them to get fresh hijacked boxes to relay their crap through.

MySpace Invaders

[digitaldc]

MySpace: A place to go and get spyware, adware, stalkers and moral police supervision.
Sounds GREAT! Where do I sign up???

MySpace is definitely responsible

[ericlondaits]

I don't care that MySpace didn't know that an exploitive ad was being served, they're still responsible for choosing that certain ad serving company. MySpace certainly must expect a number of things from this company, such as not serving ads for pr0n (at least in pages viewed by minors), among others. I can assume they're not happy about having served adware since they don't specifically profit from it and it ruins their image.

So, should they have ran an extensive background check on the ad serving company? That's entirely up to them and the risks they're willing to take. Detecting sleazeballs is not a precise science, but it's standard procedure when looking for a business partner (and if your revenue model is somewhat based around banner ads, then the company providing those ads certainly is a business partner).

What I do expect from MySpace is to give a damn about this and sue the sleazeballs for whatever they're worth on the grounds of breaching the expected quality of service, messing with their users' computers and ultimately ruining their image (an intangible asset) and reducing their number of users. They don't need anti-adware laws for this, I guess.

Re:MySpace is definitely responsible

[geomark]

The MySpace guys are big spyware guys. That's what this article by a guy named Trent Lapinski says. The founders use to run big spam and spyware companies. So yes, MySpace is responsible, and they probably fully endorse it.

Good Job

[krelian]

I liked the fact that the writer avoided linking to the site so they won't get any boost on google from being mentioned on the Washington Post.

Tips don't work for kids

[cyclocommuter]

I myself use these tips except #2 (I have Flashblock for that) and #5 (I use Visual Studio). However, I cannot force my kids to abandon IE... they need it to install and run "free" games like MapleStory which appears to run only in IE (Kids love playing games such as this with their friends online). The result is I have to reformat their PC every couple of months because of Spyware like those from Zango (thanks 180 Solutions). Soon I will instruct them how to reformat and re-install the OS and software themselves and later on administer their own PCs. I figure this is the new way to make kids "online smart"... let them experience pain and then they will learn.

Re:Tips don't work for kids

[westlake]

The result is I have to reformat their PC every couple of months because of Spyware Soon I will instruct them how to reformat and re-install the OS and software themselves and later on administer their own PCs. I figure this is the new way to make kids "online smart"... let them experience pain and then they wil learn.

Not when the pain is self-inflicted: Langa Letter: XP's No-Reformat, Nondestructive Total-Rebuild Option

What your kids should be learning is how to setup and live with parental controls, a limited user account, how to install and use anti-virus, Ad-Aware, Windows Defender, McAfee SiteAdvisor, etc.

Excuses, excuses

[metamatic]

The problem is with the ad-serving companies that these websites use. Either they're less-than-trustworthy, and are directly responsible for the exploits being used, or they sub-contract out, and don't care enough to keep an eye on their "partners".

Funny, that's the same kind of excuse spammers use. "Oh, I'm not a spammer... I purchased this list of e-mail addresses in good faith, how was I to know they weren't all 100% verified opt in like the seller said?"

It's also the same excuse The Pirate Bay use. "Oh, no, we're not responsible... we just provide a service which other people use to serve up illegal content."

Re:Excuses, excuses

[YAN3D]

The pirate bay is offering you a service, if you use it to serve up illegal content, that's on you, not pirate bay.

Re:Excuses, excuses

[rubycodez]

riiight, and the "pirate" part of pirate bay has nothing to do with piracy or evil pirates, just the happy, romanticized, andventurous movie-star type of pirates, like Johnny Depp

Re:Excuses, excuses

[RxScram]

no, the "pirate" part is just TPB's way of trying to fight global warming. Long live the FSM!

Modified .hosts file can help

[mclaincausey]

If an ad is hosted on a known ad-serving commercial, mapping ad servers to 127.0.0.1 can help defeat attacks like this. On my Linux and OS X machines I have a cron script automatically curl http://everythingisnt.com/hosts to my /etc/hosts file (after first archiving it) every so often, appending past entries I want to preserve and overwriting the previous list entries. The site has a Windows installer too, so I manually install on my Windows machines whenever an update comes out. I use this list on all my machines and it is pretty effective. My motivation isn't defense so much as it is not wanting to see advertisements at all or waste time loading them.

Spyware common on MySpace

[geomark]

Seems pretty common for MySpace to be serving up spyware ads. Another recent case was reported here of spyware from Starware being advertised with a banner they made by sticking Osama's face on the body of an Asian model in a bikini. Given the background of the founders of MySpace it shouldn't be surprising (they came from the spyware business according to references sited in that spyware report).

Hate Myspace?

[Anonymous Coward]

I hate Myspace, it is a website that caters to retards, it is so dumb.

As opposed to say, slashdot?

No way! You're kidding me!

[Valdrax]

So if you're not a Windows or Mac OS X (PowerPC) user, you're SOL.

You mean to tell us that a site that is pratically a shrine to petty teenage popularity contests, cliquishness, and ad-whoring for the biggest businesses in the world only supports the two OSes used by more than 2% of the market!?

Holy crap! What is the world coming to?

OMG! Thanks for...

[Anonymous Coward]

Thanks for the Add(ware)! Check out my profile! {lame animated GIF file here}

FlashBlock

[Valdrax]

2) Alternatively, you could install FlashBlock and have the option of seeing the Flash you do want, like homestarrunner.com.

Not affecting me!

[wonkobeeblebrox]

>a banner ad running on Myspace.com and other Web sites >used a Windows security flaw to push adware and spyware >out to more than one million computer users this week. >The attack leveraged the Windows Metafile (WMF) exploit want to be immune from crap like this? get a Mac.

Re:Not affecting me!

[dslozak]

Aye. Same here. I love not having these headaches when I just want to surf the internet.

Re:Not affecting me!

[Anonymous Coward]

Thanks for the suggestion, but I think I'll stick with a platform that allows me to put newlines in my Slashdot posts.

Like this.

Plutocracy

[Anonymous Coward]

Adrian Lamos cracks The New York Times and gets busted, that whistle guy whats-his-name cracks the phone company and spends years in prison, some sleazy asshole cracks millions of home machines and even though there's a clear and easy trail, no law enforcement agency in the world seems to care.

If you install software on my computer without my permission you have broken several laws in most countries, but nobody will give two shits.

Deploying images for later malcious use

[blast3r]

Another thing to think about with this type of exploit is what the future will hold for us. Since we already know that in the future there will be new vulnerabilities discovered in image viewers, media players, flash players, etc, evil people will begin to distribute embedded links to files in advance where they can then come back later if an exploit is released and replace the file with a malicious one. For instance, if you create all those cute flashy images that myspacers seem to use in comments and host them on a site later you can come back and simply replace the image with an evil one. Same goes for shockwave or other media files as well. Just something to think about!

umm....

[1800maxim]

Yup! The virus evolved by itself from random bits and used WMF as a host, and then became active on users' PCs.... ;)

Re:umm....

[jZnat]

With some of the weird quirks of Microsoft software, I wouldn't be surprised if that were true.

HEY STFU

[WileyK]

Quit with the MySpace hating you tools. Myspace itself is a great system. It allows users to put as much time and effort into it as they want. It doesn't matter if you're a n00blet or a 1337 master coder, you can still use it. Sure, the average MySpace user thinks less than old people fuck, but that doesn't mean MySpace itself is to blame. In reality, MySpace may be inspiring more people to learn to code. Look at all those "pimp my myspace"(God that's so redundant.) sites out there. Sure, the average layout may blow ass, but alot of the codes I've seen are rather well-written. Hell, one of my best friends learned HTML just so she could code her space. Now she's interested in learning C++, Perl, and all sorts of other programming languages. Don't write off MySpace as a cesspit just yet. I bet it's simply going through its "Me too!" phase. When the next big thing comes out all the tards will migrate to that and the only people left on MySpace will be the intelligent minority.

It just gets funnier

[xeno-cat]

Although the hecklers are getting tired.

Kind Regards

United Media could be liable for damages

[MickDownUnder]

I'll second that, I ran into this almost a year ago, I too wrote an email to complain and received no reply.

After a long holiday from Dilbert coincidently I visited Dilbert again just last night and to my shock got an even more agreesive form of attack which left me scanning my hard disk for a good two hours afterwards just to make sure that they hadn't used a browser exploit to infect my machine.

I emailed United Media again last night here's a copy...

I think you should know that one of the banner ads that is occasionally appearing when you visit the Dilbert comic website redirects you from the Dilbert site to another domain - www.errorsafe.com. Where upon you are continuously assaulted with popups attempting to get you to install Errorsafe's spyware software. This software poses as an antivirus application but in actual fact deliberately installs malware on to your machine, and then attempts to get you to pay money to remove it. This is basically outright fraud and blackmail, I have no doubt you'll find this company operates in a country beyond reach of litigation.

Errorsafe is notorious and well documented by numerous anti-spyware companies such as symnatec http://www.symantec.com/security_response/writeup. jsp?docid=2006-012017-0346-99. I think it's a very serious matter to allow Errorsafe to inject malcious script into your sites exposing visitors to your domain to such a deceptive incidious organisation whose business is to cause damage and monetary loss to those unwary enough to fall pray to it. I could go so far to say that whilst Errorsafe may be beyond the law, you may actually be in part (or fully) liable for any damages caused by Errorsafe to those visiting your domain.

This has been going on for quite some time now (at least a year). I'm really quite shocked that such a high profile site such as United Media would be linked to such criminal activity.

In short, I really think it would be in your best interest to make sure that Errorsafe is not permitted to "advertise" on any of your websites.

Michael

I've since added this domain (www.errorsafe.com) to the list of no go domains for my browser to ensure that my computer never attempts to load content from that domain again. Can anyone suggest a reliable site that you might find a list of domains that a security conscious user should put in their ban list ?

Having some sort of service that updates a list of banned domains on your system would be a great way to nullify these sorts of attacks. However I guess this could become an extremely dangerous tool for an authority wanting to censor the web.

Re:United Media could be liable for damages

[Anonymous Coward]

you mean this list?

Re:why?

[Eradicator2k3]

The dog is on fire.

hypocrites/flash 9

[Xtravar]

And they're alienating (or saving, depending how you look at it) Linux users by porting their media players to Flash 9...

Their reason for doing so is that Flash 7 has too many vulnerabilities and they are trying to help users get prompted to upgrade. What in the world?

Re:why?

[TubeSteak]

Then the few remaining 'true' Patriots turn the newly formed Islamic Republic into a large glass parking lot.

owned

[Magnj]

Thats what you get for using myspace as your personal slut homepage.

the proxy problem

[inject_hotmail.com]

True enough. I wish I could mod you up -- informative.

I'd hazard a rough guess and say that 90% of the typical user susceptable to ads would not be using a proxy. The other 10%? Bug your proxy admin like a fiend!

Beyond that, I've got nothin'.

Re:the proxy problem

[phayes]

It's ironic that I get more unwanted popups and ads when I'm at work than I do at home. At home, there's no proxy so the hosts entries that point to localhost block them, yet at work the websense proxy that is supposed to block all the non-work related sites lets all that junk through...

Re:the proxy problem

[inject_hotmail.com]

It's ironic that I get more unwanted popups and ads when I'm at work than I do at home.

Quite. And I bet your admin would never use such a HOSTS file on the proxy because "it might break something". Either that, or the response would be "what's a HOST file?".

Think of the bandwidth an ISP could actually ~save~! If an ISP threw this on their DNS server, it'd be hectic.

Re:the proxy problem

[phayes]

Nah, I sometimes work with/for the people that manage the proxies. It's mostly a matter of "if it works don't fix it" as they have more than enough to do elsewhere. From their point of view, we pay good money to Websense to determine what should be filtered out (once we have selected the content categories which sould be blocked).

I don't normally believe in hidden conspiracies but did you ever wonder why Websense doesn't have an easy to select category to filter out all the ads & popups? Porn, Entertainment, etc, yeah, real easy to filter out. But not the flashing red text on a yellow background that pushes buying MS's latest bugware...

Fortunately we now use a transparent proxy so the explicit proxy conf is no longer needed and my hosts file works once more.

Re:the proxy problem

[inject_hotmail.com]

Gah! Just do it and get it over with, I say. If there's anything I've learned, it's that there's no sense (ha ha, sorry) in only using one method for X management...be it spyware, virus, ads, site blocking, network mgmt etc.

It's just like those commercials for anti-bacterial whatever -- "Kills 99.9% of all germs!"....well, ok, that's great, but the 0.1% that survive will ALWAYS A) continue to MULTIPLY, and B) be the really strong type, that can't be killed later by the same level of anti-germ stuffs we buy in the store (superbug anyone?). Yes. You heard me right. That 0.1% of all germs on your hands are growing. All the weak germs are now dead, leaving heaps and gobs of (1000 times as much!) food for the 0.1% of the bacteria (that you don't want, believe me or not, most of bacteria on you is GOOD for you) to their devices to infest you as they see fit.

What was I talking about again?...so...use anti-bacterial hand soap AND bleach. That'll do the trick.

DNS vs HOSTS speed

[inject_hotmail.com]

I'd suggest that it's MUCH faster than using DNS.

Technical Nazis look away for a moment.

Imagine for a moment, to convert a friendly-name to unfriendly-name your computer needs to send a few packets out to your local DNS server for resolution, that server looks up its own tables, and if it doesn't exist it gets forwarded (subdomains?) to another DNS server. Yes yes, all this is cached etc etc, but the point is that the packets have to go all the way out, and all the way back. And this takes HUNDREDS of MILLISECONDS!!!!

Using a HOSTS file reduces the path to relatively zero (only a few milliseconds). In computer land, local is FAR better than remote...this includes heaps and gobs of porn.

Technical Nazis can look again.

I LOVE MYSPACE

[Anonymous Coward]

Myspace Rocks!

Quit bitching and patch your boxes or get off my web!
Where else are you going to get free music, videos, straight from the bands themselves?

Myspace Rocks!

If you don't like the ad's then block em.
Be smarter than the ad's.

Myspace Rocks!

Fsck speed, I want effectiveness

[ShaunC]

The disadvantage to relying on a hosts file is that it won't, and can't by design, filter out entire domains. One of my pet peeves is 2o7.net; they host ads for all sorts of places and they're more pervasive than DoubleClick ever was. Check your machines and see how many cookies you have from various subdomains of 2o7.net. You can sit there playing whack-a-mole, and wind up with hundreds of these in your hosts file...

127.0.0.1 autobytel.112.2o7.net
127.0.0.1 autoweb.112.2o7.net
127.0.0.1 canwest.112.2o7.net
127.0.0.1 careers.112.2o7.net
127.0.0.1 employ22.112.2o7.net
127.0.0.1 employ26.112.2o7.net

..and still get ads from the servers you haven't identified yet. Or you can really take charge of the situation, set up your own local nameserver, declare it authoritative for 2o7.net, and resolve every last one of their subdomains to dead IP space, forever, no matter how many they add in the future.

What sent me over the edge was when I found a cookie from 192.168.112.2o7.net (which resolves to a couple of IPs in 216.52.17.0/24). As far as I'm concerned, trying to masquerade like that is just plain malicious... They aren't trying to fool users, they're trying to fool admins. Now they and all of their fellow scummy advertisers that I come across are permanently blocked from purveying their wares to anyone here.

Re:Fsck speed, I want effectiveness

[inject_hotmail.com]

Yeah, I tried the whole wildcard thing ages ago and to my dismay learned quickly that it didn't work. And I'd say 90% of the intarweeb adverts are ALL about the masq. It's just like the fools that call my house phone every night...always start off with the quick line to make me think they don't want to sell me something. First line out of my mouth (IF they let me speak that is) is always "what are you selling?" (I'm a straight-forward kind of guy). That usually gets a direct response.

Next line is "please take me off your list".

My point is, net ads used to be overt and obvious (who the hell thought that adding cycling banners was a good idea?). People began to learn how to ignore. Now, it's more subvertive.

There's a national "do not call list". We need a national "do not spam/infest my COMPUTER list. COM-PU-TER. Not email address. COMPUTER."

Or you can really take charge of the situation, set up your own local nameserver, declare it authoritative for 2o7.net

That is a wicked idea! I think I'll implement it somehow. Does anyone here know of a way to import huge lists into a DNS server?