Slashdot Mirror
10,000-website Strong Malware Maze Created by Criminals
Stony Stevenson passed us an ITnews article about the newest scam in online crime. Some 10,000 web pages have been rigged by IT-minded criminals, with the aim of hijacking unsuspecting PCs. The site reports that the users are redirected through a maze of malware, all with the goal of gaining access to personal user information. "The reprogrammed web pages are probably victims of an automated attack that included scanning the internet for unsecured servers and planting a piece of JavaScript code that redirects to a site in China to serve up the malware. The malware cocktail attempts to exploit vulnerabilities in Windows, RealPlayer and other applications to break into the PC. A back door also allows the subsequent installation of additional malicious programs. McAfee Avert Labs first spotted the attack on 12 March. 'Of the 10,000 pages that were compromised a number have already been cleaned up,' the firm stated."
Maybe not today, but tomorrow?
Seriously, it's time to seriously sandbox web browsers and have "no extensions" by default with overrides on a per-page, per-session basis allowed.
In addition to sandboxing, browsers should ship with NoScript or equivalent functionality built-in.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
...how do we check our sites to ensure that this code has not been planted. The article gives no clue at all. It doesn't even identify if is platform or technology specific, etc. Just that someone else has set up a huge botnet.
Even sysadmins and webmasters that use best practices and diligently patch, etc. can be gotten because there are always undisclosed holes that are utilized. In fact, were I in that game and I figured out something to defeat security, it would keep it under my ragged black hat and never share that info.
"Often you hear warnings about not going to untrusted sites," said Craig Schmugar, threat researcher at McAfee Avert Labs... That is good advice, but it is not enough. Even sites you know and trust can become compromised."
In the old days it was easy to avoid malicious sites. Now even your neighbor could be the terrorist... err..I mean.. even sites you know and trust can become compromised.
At least this threat researcher offered a calm analysis with plenty of advice about how to avoid such attacks without recoiling from the web in fear.
MUST BUY MCAFEE...
Why not just disallow redirection and loading of off-domain/off-host data from scripts?
Disabling scripts entirely disables dangerous behavior, sure... But is also disables lots of desirable functionality that most people want.
First, people figured out that in order to hijack people's PCs for "bot net" purposes, they could try to trick them into installing a program that would slip it in, along with the desired program being loaded. But along came all the "spyware cleaner" packages, that could identify and remove the malware, leaving the originally desired software installed and running.
... the "evil doers" had to escalate things further.
So the next trick was to try to make removal difficult or impossible by infecting a PC with a "downloader virus". That way, the virus itself would try to avoid detection, but silently download and install spyware from various sites around the world. The user might figure out he/she was infected with the spyware and try to clean it with a remover, but it would keep coming right back, as the original virus kept re-downloading the stuff.
This led to popular anti-virus packages starting to blur the lines between spyware and virii (in cases where the company in question didn't have a specific anti-spyware product ready to sell you). They'd just attempt to clean ALL of the stuff up. Others wanted you to run 2 distinct programs together to protect against both types of threats. In any case, all of this confused a lot of people -- but also made them catch on that a lot of this stuff appeared to be impossible to clean ONLY because of that "downloader trojan horse" trick.
After they started "wising up" and unplugged their Inet connections while doing all the virus and spyware removal
The current ploy of injecting the stuff from normally benign web sites is pretty much the "next logical step" for them. Doesn't surprise me a bit. I think we'll continue to see more and more of this, too. After all, this attack has several vectors. DNS server entries could be spoofed, redirecting people to fake sites. Web servers with security flaws could be compromised, and modified code loaded directly onto them. Or maybe, legitimate sites will unwittingly host infected ad banners down their pages, paid for by "advertisers" with motives other than really caring if you view the ad's visible content?
It makes you wonder what the next logical step after this one is, doesn't it?
Personally, I suspect that we will start seeing DNS cache and Route poisoning attempts become much more commonplace. Particularly after the whole "YouTube gets 'knocked offline' because of an improper route broadcast by a piss-ant totalitarian country" issue we had in recent weeks.
I would bet good money that there were criminals rubbing their hands together with glee over the idea of dumping MILLIONS of users to a malware server simultaneously. Or using that type of exploit as a blackmail tool.
What do you think the next logical step is?
Official Heretic from the "Church of Global Warming". Proven right thanks to whistle blowers. AGW = Flat Earth Theory
I've been saying (and doing) this for years. China, South Korea, Malaysia, some parts of Russia... It sucks for them, but until their Governments/ISPs clean up the network, banning entire IP blocks is one of the better defenses against these malware floods. I figured it out while studying IDS logs a while ago, and noticed 98-99% of all exploit scans were coming from those countries. I do feel sorry for the good people who are getting blacklisted on behalf of their shit-flinging neighbours, but part of me wants them to get pissed off and do something about it, whether it's complaining to their ISP / political figure, or even just spontaneously beating the shit out of that sketchy kid selling burnt movies on the corner.
Raising awareness is the first step toward solving a social problem like this. I used to drop packets at the router, but now I redirect them to an informational page explaining precisely why they're being blocked, with links to virus and spyware cleaners. That's if they weren't trying to find phpMyAdmin vulnerabilities, those guys I give a big colorful F.U. page, and if they ever invent the remote boxing glove, I'll add a trigger for that too!
-Billco, Fnarg.com
If McAfee (and others) really wanted to solve this "problem", then they would have to do little more than TELL US what the domain name, IP address, etc. of the offending server was!
If we knew that, we could reject any requests from there at the application OR server level, or even both.
And when they move to a new server, same thing. Of course, it would be helpful to have signature(s) of the code as well, but let's STAMP OUT the immediate problem, then worry about potential problems.
I know the "security" companies are commercial interests. But there are times when responsibility toward your community trumps making an enormous profit.