Slashdot Mirror
Faux-CNN Spam Blitz Delivers Malicious Flash
CWmike writes "More than a thousand hacked Web sites are serving up fake Flash Player software to users duped into clicking on links in mail that's part of a massive spam attack masquerading as CNN.com news notifications, security researchers said today. The bogus messages, which claim to be from the CNN.com news Web site, include links to what are supposedly the day's Top 10 news stories and Top 10 news video clips from the cable network. Clicking on any of those links, however, brings up a dialog that says an incorrect version of Flash Player has been detected and that tells users they needed to update to a fake newer edition, which delivers a Trojan horse — identified by multiple names, including Cbeplay.a — that 'phones home' to a malicious server to grab and install additional malware."
I was wondering why I being spammed with such a seemingly innocuous message, I thought perhaps it was just a filter poisoning attempt.
it took me quite a while to figure out why this would be effective spam.
Then I had a look a the HTML view. Quite insidious.
It provides what looks like a linkified http://www.cnn.com/xxxxxxx that actually referrs to a different url.
I thought I was on crack! I thought my mailserver got hacked. I have been receiving 20+ of these messages for the past 3 days...
Update exchange's filter rules, with no affect.
Lets get this filtered!
It is windows only.
A relief, kinda..
... it takes a lot to get the kosher flashplayer to work, let alone a hooky one.
More like "Faux-CNN Spam Wolf Blitzer Delivers Malicious Flash"!
"He who can destroy a thing, controls a thing." --Paul Atreides, Dune
Instead of a nickel, how about giving that kid a CDR of a better OS?
If I have nothing to hide, don't search me
Botnets for sale!
There is another similar one pushing 'IE 7 is now available for download' from 'Microsoft'.
ya.. right...
---- Booth was a patriot ----
But not invincible..
---- Booth was a patriot ----
But is Cbeplay easy to develop for?
Here's an excerpt from a message posted by a friend on EVERYONE's wall: (X's are mine, just to add some security) "HEY GUYS GET YOUR GAMING ON! ENTER AND WIN A PS3 Or Free PLASMA ITS EASY AND FREE SIGN UP AT THE URL BELOW http://xxxxx.imageshack.us/XXXXX/gameonit4.swf "
Too bad nobody is ever going to find the folks responsible for this. Pretty much any email that even has the letters "cnn" in it will go in the trash now. Do you think any email of a forwarded story from the CNN site would possibly get through today? Next week? It wouldn't surprise me if CNN.com ad rates took a nosedive because of this as well. Who wants to go to "the spammer" web site?
This is the sort of extremely bad PR that CNN would be well within their rights to sue the pants off of whoever started this nonsense. Unfortunately, it probably originated somewhere that doesn't care about US companies, US laws or what people think about spam. Also, how exactly would you prove where it came from?
Hope someone is getting paid real good for this. I don't think this can put CNN out of business, but it is certainly going to hurt real bad.
I've received nine of these (in just a few hours) on my usual (university) email address. But google mail keeps telling me about them, instead of marking them as spam or phishing and just moving them out of the way. Worse yet it leaves them on my (university) mail server which has an absurdly low quota - so I'll have to remove them manually. This means I need to deal with this crap twice - once when google mail tells me it won't give it to me and once when I need to login to the server and manually delete them. It would be so much nicer if google mail would flag these as spam or phishing, take them off the server and just make them invisible.
Of course (and yes, I'm contradicting myself) I'd also like (since I'm interested in viruses and the like) to be able to set a flag where I could say, "Let me download this. Yes, I do know what I'm doing" and give it to me in some nice packed format.
It's not a Windows problem, per se; the fact that it installs malware on Windows computers is functionally irrelevant.
PEBKAC- Problem Exists Between Keyboard and Chair.
There's absolutely no reason such a functionally identical attack would not work against any operating system you care to name, or even a theoretically perfect operating system were one to be invented.
Programs the user executes run in the user's security context. If you can trick the user, you can do whatever the user can do, or in this case, install malicious software.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
This attack shows a complete disregard for fellow humans by the 100s of millions. The only fair punishment is the death penalty. There may even be some deterrent effect from that, but even without it should still be DEATH!
Here's a nickel, kid. Go get yourself a *real* operating system...
I enjoy playing around with Linux. I have a couple spare partitions on my desktop machine where I'll install an interesting new distro when I have some time (right now I have Kubuntu and WinXP set up as dual-boot), and maybe learn a little something about package management or do some cool things in bash ... whatever, doesn't matter to me ... it's the exploring that's the important thing.
You know what? Every time I read a post like the above, it turns me off Linux just a tiny bit.
If libertarians are so opposed to effective government, why don't they all move to Somalia?
Companies doing business on the web have curtailed the functionality of email correspondence, and often tell consumers the only safe method is to visit their site and log in. Acquiring software isn't much different, get it from the source. Personally, I find the incessant requirement of plug-ins to be breaking the web when no alternative (text) is offered. /Get off my lawn!
Of course you can also run Windows and avoid doing unsafe, stupid things. That usually works.
Since I'm on a 3270 terminal to an OS/390 box the size of your house right now, here's your nickel back, and a check for $50.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Damn their oily hides!
Sig this!
It's hard to write a trojan that runs on multiple operating systems. They would need to write multiplatform trojans, and for now only Windows has the dominance to ensure profitability.
Not that it isn't possible; Adobe after all has Flash for both Mac and Windows PCs.
GPL Deconstructed
I can see the headline now: "We're not spamming you (really)"
A trojan-horse application is being delivered by email, masquerading as content from a major corporation.
This is news? We're supposed to be surprised?
Cross-posted from my journal.
And now we have the latest malware wave, where 1000+ legitimate sites have been hacked to serve a fake Flash player. This is going to seriously hurt CNN's reputation (and ad revenue), as a lot of folks are going to set their mail servers to delete stuff that even mentions CNN. Worse yet, it's going to put a serious hurting on the 1000+ hacked sites: CNN has enough goodwill and trust built up that it will survive the onslaught, but the "other victims" may end up blacklisted by a lot of folks.
Most malware authors have learned not to crap in their own bed: the days of a virus that wiped your files are fading; now we have malware that more-or-less uses your files alone, but uses your connection to send spam or do DoS attacks. If they make the attack less blatant, it's less likely to be discovered and cleaned up.
While the malware authors may be trying to stay quiet on the PC, they sure don't mind hurting companies ... and that hurts the internet as a whole. As much as some in the geek community may dislike it, the Internet is payed for by commerce--internet sales, services, and subscriptions indirectly pay for the infrastructure we all use. If these small companies are hurt by spammers and malware authors, then the small companies may be less willing to maintain an internet presence--which means there will be less people who pay the ISPs to maintain and improve the infrastructure.
There are a lot of contingent statements in the above paragraph, and maybe I'm getting more worried than I should be, but I have to wonder: how long will it be until spammers, scammers, and other low-grade shits ruin the Internet for everyone?
If you haven't been down-modded lately, you aren't trying.
Sacred cows make the best hamburger.
Of course that's true in general (Java, perhaps?) but that's not really the issue, although it is an argument for systems diversity in general as opposed to any kind of monoculture.
The issue is that users are stupid. They will remain stupid regardless of what kind of operating system you plunk them in front of, and for my money I'd much rather Microsoft (or antivirus vendors or whomever else) spend their time working to fix actual holes- security flaws that can be exploited without exploiting the vulnerability of the user's stupidity.
Because, to be honest, the security flaw that is the user's intelligence or lack thereof is not something that Microsoft can, or should, fix.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
Is it really? I've owned many Windows computers over the past 20 years and I've never had any problems with security. Well, there was that one floppy in the early 90s I accidentally booted off of...
There's 8 Windows boxes here on my den right now. Three servers, two laptops and three workstations. None of them are pwned, rooted, infected, trojaned or otherwise compromised. And they've never been. None of my Server 2003 colo boxes have ever been compromised either. I'm curious, what do you find difficult about securing Windows?
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Don't forget they also have a Linux version of flash. My simple C++ programs required little modifcation to the system calls for command line to work between linux and windows.
In its DEFAULT setup, especially regarding security? Maybe... but, NOT if you do this:
HOW TO SECURE Windows 2000/XP/Server 2003 & VISTA, + make it "fun to do", via CIS Tool Guidance:
http://www.tcmagazine.com/forums/index.php?s=69e3a8383c24ab823ef36b246b66ce88&showtopic=2662
Then again, IF you look there? Linux doesn't do ANY BETTER "outta-the-box/oem-stock" (yes, even SeLinux bearing distros) either, as both OS' stock only score into the mid-40's of 100 possible ranges, initially (until you 'security-harden' them).
Both reach 90's++ ranges, IF you take the time to do the work required, per CIS Tool guidance and the other points that guide notes to look out for, & shore up.
absolutely right! mod UP UP UP!
My ISP-provided spam filter caught this one and tossed it into the e-carp can and so did Gmail's spam filter. In the ISP-provided spam e-box, I've been noticing quite a bit of faux news email headers, including thousands dead in a stampede at a soccer game?? Dumbass spammers.
I suspect it should be possible to create a sandbox within a system that limits the capabilities of userland apps.
In other words instead of a UAC system you have a sandbox where user installed apps live and cannot get out of and the system can monitor these apps and their behaviors for maliciousness.
GPL Deconstructed
How many Windows viruses, trojans, and other malware programs are there successfully spreading in the wild? Thousands? TENS of thousands?
OK, now how many Linux, BSD, or OS X viruses, trojans, other malware programs are successfully spreading in the wild? ZERO, ZILCH, NADA, ZIP.
So you tell me: How difficult is it to secure Windows? Must be damn near impossible.
You even admit that despite your self-proclaimed superior ability to secure Windows, you were still a victim of a trojan.
If someone saying something like that turns you off of Linux, you can expect to hear a lot more of that from people who don't want you to use Linux.
What in the world some jackass' trite comment has to do with your being "turned on" to Linux is beyond me. Either Linux is potentially valuable to you or it isn't. And the GP didn't even mention Linux.
Stop giving other people so much power over your behavior. You are responsible for your behavior, even if you let other people do your thinking for you.
"I wanted to use Linux but some jackass made a trite comment not even directed at me, so it's his fault I don't like Linux." What would you think about someone who made a statement like that?
This spam helped me find a bug in my procmail recipe - this was sent to my Sourceforge email address (never had spam there before), and was forwarded on to Google which bounced it as an illegal attachment. Kudos to Google for being on the ball.
The 1,200 recursive bounce messages that ensued were no-one's fault but my own. :)
Everyone knows that damage is done to the soul by bad motion pictures. -Pope Pius XI
Sure you could. Some of us do that right now- I have a VM running with a bare-bones Windows XP installation for IE and Firefox.
But this suffers problems. Namely, that if anything from the sandbox can't get out and harm the main system, you... can't get anything out of the sandbox.
The problem, as I said, is that programs run in the user's security context. It's perfectly possible to limit the capability of userland applications, but this does little good from a user's perspective; the user's data also resides in userland, and is the valuable part of the system. They don't really care if the kernel is still working if all their data is hosed.
Ultimately, as long as the user can access their data, so can a hostile program, so long as the user is willing to run it.
The only way to prevent this, essentially, is to prohibit anything from being deleted or modified- just write a new copy of whatever data you change, and write a transactional flag that stats that deleted data has had the 'deleted' attribute applied to it. Basically, an end-to-end journal of all file operations. And that'd be an enormous storage problem. Perhaps it is a solution in a handful of cases- if you can lock all the system files so they can't be written or modified and then ensure the user's data is never deleted or modified, only added to... maybe that's the solution. But it's not one I'd want to run at home, certainly.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
How many Windows users are there successfully spreading in the wild? Millions? TENS of millions? OK, now how many LINUX, BSD, or OS X users are successfully spreading in the wild? 500k? 2-3million at the most? Just admit it. Most people use windows. Therefore, it will have the most problems. Not enough people to matter use other systems. They don't matter.
ZoneAlarm has a product called ForceField, that does it within Windows. I haven't tried it, but I think it sandboxes most of the browser, creates a dummy file system, etc. It seems like a good idea that should cover most exploits, at least until it gets popular.
OK, now how many Linux, BSD, or OS X viruses, trojans, other malware programs are successfully spreading in the wild? ZERO, ZILCH, NADA, ZIP.
That's because no one bothers to write malware for these systems. The majority of computer users use Windows, so that's the target audience.
It's very easy to secure Windows. Just be careful what you do with your computer, especially if it has an Internet connection. If you want to download some $exCashMoneyV!@gRa_UltimateSearchBar toolbar, that's your fault.
I'm no fan of Microsoft, but I don't bash them for things they didn't do.
Attacks like this don't work outside of Winblows. The problem is that users have been conditioned to needing a never ending series of non free "upgrades" from untrusted sites to do what they want. I can download Gnash all day from Ubuntu and never find a trojan. Not even Apple users have the same problem. Users of other OS have been conditioned to get their software from a place they can trust. Free software users have learned not to trust non free software like Flash itself.
M$, because life is too short to type icrosoft frequently.
Mac OS X.
Running on an iPhone.
A non-3G iPhone.
-- "In order to have power, I must be taken seriously." -Mojo Jojo
MyDoom, which holds the record for fastest-spreading worm ever, did so through email and required significant user action.
Statistically, there are about as many of those as there are normal desktop computer users for the platform, since most of these attacks rely on social engineering (as opposed to actual vulnerabilities) to succeed. So the lack of malware for your platform is not due to its inherent superiority, but to the size of its installed base. Windows may have more attack vectors than Linux or OS X, but that doesn't mean that they can be avoided with $0.05 worth of simple common sense.
No, that's why I asked you the question. It's not at all. If it were, those 100K machine botnets would have 100 million zombies instead, and that's not the case, is it? Or do you figure the malware vendors are just not interested in a potential pool of that size? By most measures there's about a billion computers in the planet running some version of Windows.
Oh, sure. But there's no need to be quippy about it. That happened almost 20 years ago, and it was the first and last time any of my systems were compromised. I guess I'm a good learner.
And by the way, "superior ability" is not needed at all. Just patch your boxes and don't download or run stuff from untrusted sources. That should take care of about 99.99% of all your problems. And that's true of any OS.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Solution to unintelligent users was to block all downloads of "get_flash_update.exe" on our proxy server.
Removal process was fairly trivial; All processes/files were > 10 chars randomized like a362b462da6.exe/scr. Processes were easily killable and removable without having to do anything fancy like boot off a Linux CD.
The only things we found that it installed was XP AntiVirus 2008 under C:\program files\[random > 10 digit name]. Again, fairly easy to remove.
Another day, another spam mail getting through our crappy anti-spam service.
Wake me up when the rest of us need to worry.
Yea, because hundreds and thousands (or hundreds-of-thousands) of compromised Windows boxes on the internet couldn't possibly have an untoward effect on anyone else...
dumbass
No way am I clicking a link on an article with a headline of "Malicious Flash". goatse is not an experience i wish to repeat.
Not if you are using SELinux that is properly configured, in which case the access controls are set at the level of the applications security context.
Not saying that it's perfect, but it would help and I'm sure that is where most OS's are going to head in the future.
I haven't received a single one. This is why I run my own mail server. I don't trust other people to do a good job.
Without looking at the logs, my guess is the Zen list from Spamhaus.org is doing the good work here.
-- Will program for bandwidth
I might just be on a hobbyhorse here, but it seems like a proper HTML5 standard with a -video- tag and a recommended codec would put a stop to all this "Download the latest executable thingamajig to view the media on this site"
(if you hadn't heard, this was tried, and any DRM-incompatible codec was called a "non-starter" by the "content industry")
My turnips listen for the soft cry of your love
I love free software, but I am sick and tired of you retarded linux zealots.
It's not a Windows problem nor is it a user problem. BTU (blame the user) is easy to toss around for us geeks, but it really masks the true issue here.
That is, user have be trained to install browser plugins by content providers. These so-called content providers only want to control their content, it's inconsequential to them that they're also exerting control over their viewers. It's also ironic that the mindless stride to control viewers has led that control into the hands of even more dishonest criminals.
In a sense most content provider plugins are trojans themselves. That is, they tell the user they'll provide the ability to view their content, but what they really do is take functionality out of the software and take control away from the user.
This trojan is possible because installing a trojan is an accepted Internet practice. Quick raise you hand if you have RealPlayer installed. Ideally a browser is all anyone needs to view the web, but at some point during commercialization of the Internet the community took a step in the wrong direction: Flash, RealPlayer. Barf. Don't you see, the problem is clearly not the users fault.
The problem, in fact, lies with the likes of Adobe, Real and Microsoft for creating stupid crap like Flash, RealPlayer, Silverlight then demanding users install these without thought to view content. If there were nice standards that provided the functionality of these plugins in the browser this would be a non-issue -- the trojan would never have been created.
Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
Where does the OP say they run Linux?
Your own bias is showing through.
I'm not sure how you can blame the content providers. I'm trying to come up with an analogy, but I can't- I think your model is that flawed.
The user has a choice. The user is not forced to install browser plugins. Moreover, not all those plugins are harmful; are you arguing that a monopoly is better for users than diversity? Because that appears to be what you're claiming.
Really, I think you've mixed your own ideological struggles with content providers with the technical issue- and the technical issue is that the security flaw here is not software. It's the user.
Even if you're right about the cause of the flaw, which I strongly disagree with, that doesn't change the flaw.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
Here is a nice little freeware sandbox I use for bad ID10T Windows problems.Works well and is easy to use.Enjoy! P.S. It'll work on FF and anything else you want to sandbox,not just browsers.
ACs don't waste your time replying, your posts are never seen by me.
Three servers, two laptops and three workstations. None of them are pwned, rooted, infected, trojaned or otherwise compromised. And they've never been.
Prove it.
(Not that I don't believe you...but that's a pretty heavy statement to make.)
There's absolutely no reason such a functionally identical attack would not work against any operating system you care to name,
Well, the enormous hassle involved in getting software outside of a repository installed on a Linux system would leave it quite hardened against this kind of attack.
And here's the original Dilbert comic for that line
http://ozguru.mu.nu/Photos/2005-11-11--Dilbert_Unix.jpg
I'm not sure how you can blame the content providers.
It's not hard to understand, let me spell it out for you in user-friendly terms. Content providers often require users to install additional software thus the user is not suspicious when a website wants them to install additional software. Simple isn't it.
There is even terminology in psychology for this, it's called: positive reinforcement. That is the user is used to installing additional software without negative consequence thus they are likely to install more additional software without thought. After all the last time they installed additional software they were rewarded with cool content.
This has nothing to do with choice. It doesn't have anything to do with some plugins not being harmful. I'm not arguing for a monopoly at all, that is a very distorted interpretation of my post. I am talking about behavior, namely reinforced behavior. I'm not say it was intentional and/or malicious on the parts of content providers or Adobe or Microsoft and Real. What I am saying is the trojan was possible indirectly because of them.
Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
Like clicking on a .deb package, [entering password,] and letting gdebi install it?
Blame implies they are guilty of some misdeed. They are not.
They have no responsibility for the user's lack of competence, and positive reinforcement is no excuse.
That would be appropriate if, in fact, they were reinforcing the fact that the user should do something wrong, but that is not the case.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
Not even Apple users have the same problem. Users of other OS have been conditioned to get their software from a place they can trust. Free software users have learned not to trust non free software like Flash itself.
So where do Apple users get their Flash updates from then?
I doubt that. My house is pretty small. Do you have a Kaypro?
Now I understand. dedazo appears to be a well-know Micro$oft shill.
It's not a Windows problem, per se; the fact that it installs malware on Windows computers is functionally irrelevant.
I don't use Windows, thus I couldn't be affected by this particular crap at all. It is a Windows problem. Now, the issue of ignorant users is also a problem; but don't let Windows off the hook.
It's unfair. I clicked the link in the email, and it told me to update flash, but the flash updater I downloaded from their site doesn't work on my computer.
:(
How am I supposed to see the CNN videos if they don't make a linux version? Linux sux, I'm going back to windows.
RebateFX.com - Spread rebates for Forex traders
If that is the case, then how do you change Windows to defend the user?
If, in fact, the problem is with Windows, then obviously there is something Microsoft can fix to-
Oh, wait, no. They can't. The operating system is not doing anything wrong.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
You got +5 way to go, you must be right. *in caveman voice* User dumb, me omniscient. *end caveman voice* Enjoy the bliss.
Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
This is a REALLY aggressive spam campaign. I never received a message with the subject of "CNN.com Daily Top 10" until 2 days ago at 1:49 PM. Since then, I have received 1,799 of these messages and counting. Of course, I get spammed to death already -- my email address (deven@ties.org) has been public for many years, and I don't even hide it here on Slashdot, even though it really is my primary email address. Spam has grown to the point where I am receiving over 10,000 messages every single day. (Yes, that's about a million messages in 3 months.)
On a separate note, I received an email yesterday with the title "Action required to avoid account access interruption" -- and it was actually a legitimate email! I receive such emails daily from phishing attempts, but this one was actually sent to me by TD Ameritrade.
It's a sad state of affairs when it's the legitimate email that comes as a surprise.
Deven
"Simple things should be simple, and complex things should be possible." - Alan Kay
Bwah, that's a laugh & 1/2: This is SLASHDOT - home of the "Pro-Linux/Pro-*NIX variant", & that's just common-knowledge to anybody who visits here regularly. Lord knows, if you post nearly anything favorable about Microsoft, Bill Gates, or Windows itself (or conversely, anything negative (though it may be true) about *NIX in general) here? You get "modded down" here, 9/10 times! I've been "hanging around" here, posting as A/C (because registered users are RIDICULOUSLY EASY to "track" here, & that to myself is a "no-no" in & OF itself) for around 5 yrs. now, & this is something I've noted here myself, & see that I am not alone in that.
Security is not a binary thing, and no one in their right mind has never claimed it is - beyond misinterpretation of unqualified comments.
50,000:1 in my books means that the 1 is damn nigh invincible. Anything else is academic.
PS: I just got pointed out today how stupid the UAC in Vista is. "A program is attempting to access your computer - cancel/allow?" Um, what kind of program exists that DOESN'T "access my computer"? This question was posed by a complete computer novice, so I'm not even speaking on a technical level here. By any definition of "access", technical or n00b, that's what programs do - access the computer. Who would ever say no, unless they maybe accidentally clicked on the wrong program entirely. If I clicked on something, of course I want it to access my computer.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Why don't all mail readers which display html simply do what Slashdot does - show the real site linked to in brackets next to whatever text is in the link, like "cnn.com [http://somewhere.de]" - perhaps with highlighting when both look like urls, but they don't match? That would kill so many phishing attempts.
"with their freedom lost all virtue lose" - Milton
A while ago I had a regular email that would for whatever reason lock up Outlook when trying to download its HTML content.
So I set Outlook to always show plain text versions of all emails. This has provided two benefits:
1) Much faster message display
2) Malicious emails are easier to spot
In this case it was a while bunch of links where the text was http://x.cnn.com/ but the actual href was http://seomthing.de.
In Outlook 2007: Tools - Trust Center - E-Mail Security - Read all standard mail in plain text.
If you don't want to repeat the past, stop living in it.
Just to be clear, users are downloading malicious software that is posing as the Flash Player. "Malicious Flash", to me, means Flash content (a SWF) that uses a vulnerability in the Flash Player to compromise a user's system. While Flash hasn't had a spotless security record, I don't know of any instances where a vulnerability in the Flash Player has been exploited on a scale such as this. In the past few years, Adobe has really strived to make Flash Player much more secure. Were this to be an actual case of "malicious Flash", I think it would be a big PR problem for Adobe and make end users extra wary of Flash for some time to come.
The wording in the title seems to me like calling someone social engineering some passwords a "WIndows security vulnerability" - misleading and inaccurate, at best.
Prove it.
Prove that his boxen have never been Pwned. Logical fallacy much?
No mod points, no meta-moderating/Firehose/all the other free work Slashdot wants me to do.
Saw it.
Figured it out in 12 seconds.
Deleted it.
Blacklisted it.
As if CNN got me subscribed somehow, and is using some podunk server in East Gish.
pity da fools that got sucked in.
deleting the extra space after periods so i can stay relevant, yeah.
So where do Apple users get their Flash updates from then?
I think they're bundled with Safari, thus the updates would come from the Mac OS X "Software Update" tool.
Call me when they ported it to mac so we can have the same user experience ...
Any project maintainers?
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
I use OS X, and although Flash does ship with the system, I have downloaded newer versions direct from Adobe. I've also downloaded third party codecs such as Windows Media/Flip4Mac from Microsoft, and the open source Perian. Granted, I do trust all of those as much as one can trust Adobe and Microsoft, but third party plugins are not unheard of on the Mac, just rarer.
Oh, and don't forget all of the people who have jailbroken their Apple iPhones with software obtained from the shadiest places possible (such as RapidShare)! People have no problems installing random binaries on their systems.
The problem is that 'places people can trust' often don't release the software and media that people want to run or view.
Microsoft is not going to release today's latest screener movies via BitTorrent, and Debian is not going to add "Asian Teen Whores IV" to its download repositories.
Your solution is great for OS upgrades, and some applications and their updates, but it certainly doesn't work everywhere.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
14th account?
I read the title and I got and image of Bill O'Reilly and Anderson Cooper mooning everybody. Now I need to go scrub my brain with lye soap.
Twitter, you do know you're a stupid cunt, right? Just checkin...
Is that CNN's "Crack Team of Reporters" can't discover the responsible parties.
Technology -- No Place For Wimps! Grateful Dead and Jerry Garcia Chatroom -- http://www.wemissjerry.org
How would installing a different OS help in any way?
I now, some memes are popular here, but it's getting tiresome.
Short version of the story: users are tricked into installing malicious software.
No vulnerability is exploited; the fact that it's Windows and not Linux-distro-of-the-month is irrelevant (remember, once installed, if the software can read your home directory and send passwords and CC details, it achieved its goal - it may not need full system access). The fact that Flash is involved is irrelevant too - it could be a "special" video codec, or java or whatever.
That is true, although now that I think about it, most of the third-party Mac OS X applications I use (including Perian but not Flip4Mac) are very good about checking for updates automatically, thus there's at least a tiny shred of hope that the user of such an application wouldn't be suckered in by this "plug-in is out of date; download this new one" trick.
That being said, I am fully aware that Apple users are just as vulnerable to social engineering as their PC counterparts.
And as long as we're on the subject, thus far I haven't had any problems accessing any website on my Mac due to having a possibly dated version of Flash (your own mileage may vary, of course). I have occasionally run into problems due to Adobe's failure to port other plug-ins to the Intel Mac (such as Shockwave), but that seems more like a case of either incompetence or laziness on Adobe's part--not much any of us can do about that unless there's an open-source alternative that runs natively on Intel (and the few incidents I had weren't serious enough that I was compelled to go looking).
"Winblows"?
We need to change the odds of the spammers' game to make them the losers. My suggestion to make Gmail a very hostile environment for spammers.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.
That's also nearly irrelevant, because what scammers want these days is either your user data (either by reading files or just getting you to type it in) or to use your bandwidth for spamming. Damaging user data is a rare and minor concern these days.
Of course they do need to be able to write exes (etc) to the system. But it doesnt help that a correct copy is still archived away - the new bad one is already running.
For every expert, there is an equal and opposite expert. - Arthur C. Clarke
Good point. This article needs at least microsoft windows tag. But on /. you get -1 Flamebait, sigh.
RPM is much better!
... if malicious software was starting up when you log in - something having modified your .profile, .bashrc , whatever. Also it would be dead easy to remove. Not so with windows which generally takes an age to log in anyway so you probably wouldn't even notice a few extra seconds, and the places where a user space trojan initiator script can hide are so varied.
Yes under unix a user space process could fork off a daemon which remains running after you log out but once discovered running its easily killed and the binary easily found.
So, I assume a completely unpatched version of Debian from 8 years ago won't have any security flaws either?
Wait... did someone just say "SSL"? Hm, must be the wind.
Duh, read the emails.
I got mine updated from cnn.com.1234567.compromised-servers.net/trojan.app
This is /.. Windows is evil. Period. On a logical note, it is less the OS and more the user. Granted, certain things should never happen (email client -> install, browser -> install, at least outside a sandbox)... but a user willing to click on ANYTHING is the underlying issue.
Like me, you play smart. I haven't used antivirus software for many years and rarely have issues (none attributed to a virus). Boot times on all my boxes are all less than 40 seconds and they have been up for max 3 years (excluding power outages). Uh, and yes, I do use them frequently/daily! :D
Unfortunately, it probably originated somewhere that doesn't care about US companies, US laws....
Well, that covers most of the world then.
....or what people think about spam.
True, but it is probably an accurate statement to say that spammers don't care what people think about spam.
Have a look at soylentnews.org for a different view
Also know as "A Layer 8 Issue"
UTF-8: There and Back Again
Thereby installing it into the local repository, where you can still find it and fully remove it?
freeflux-powered open-source blog
I got 7 of these in my Google Spam folder on August 5th. None of them look remotely like spam. You can VERY EASILY see that the links don't point to cnn.com by OnMouseOvering the links when reading them in Google's client.
That being said, I am not sure if legit CNN.com e-mails are going to start getting flagged (not that I think many people would let CNN.com deliver them "news" in the first place) but CNN.com itself is a disaster-pot of obnoxious Flash ads with Dancing Mortgage rates and Spinning Whirlwinds.
If they really want goodwill, they should make it possible for their site to load reliably with No-Script turned on. As it stands, I only use them for a very limited amount of content that they provide (sports stories and the politic stories not picked up on Slashdot).
Support the 30 Hour Work Week!!!
It would be easy to blame Windoze (mainly because MS security has always been a band-aid retrofit), but this is a social engineering problem that targets Windoze users because they are (proportionally speaking) more naive and arguably dumber. I know, as I have to clean up after them. For some reason, typing grammatically incorrect upper-case sentences into Outlook Express makes people think they are computer whiz.
That's not always true.
I work for a law firm and there are many government and court related web sites that require some sort of plug-in to view their content. The Medicaid manuals in my state require MS word or a Word viewer AND Adobe Acrobat, court reporter services require e-transcript viewers such as RealLegal and/or specialty audio-visual players instead of Windows Media Player, multiple county courts require DjVu and/or Acrobat, and our Secretary of State's website is entirely done in Flash. Without these plug-ins, these sites are technically useless, so the user is required to install the plug-in.
I'm not tense. I'm just terribly, terribly, alert.
I followed one of these a few days ago inside VirtualPC to see if AVG would spot it (it did).
It put Firefox inside an endless loop of popups telling me to download a new flash player (I don't have noscript on that copy) so it's pretty mean in that respect - you can't press cancel to make it go away you have to kill the browser with the task manager.
No sig today...
PEBKAC- Problem Exists Between Keyboard and Chair.
I've also heard this referred to as an "error 60" (60 centimeters from the monitor), or an ID-10-t error...
There is also a flash-plugin for Linux
New things are always on the horizon
That's why you give stupid users a linux or unix computer or laptop and no rights and set noexec on /home and /tmp (and make sure they can only write there).
New things are always on the horizon
Adobe after all has Flash for both Mac and Windows PCs.
Adobe has Flash for Linux PCs too.
Linux on a PPC would be immune, since Adobe has no Flash for Linux on PPC.
Bring back Sirius Punk!
Just because you see no symptoms doesn't mean your box hasn't been pwned... I've seen plenty of boxen that have been compromised and sending out data over the network yet the console seems fine.
I do. If I had seen one of these I would have avoided it because it has "CNN" somewhere in it.
More 'Windows users spreading in the wild' than 'Linux users spreading in the wild' ...well yeah that's common knowledge!
--- Mercutio was right.
OK... how?
I frankly don't understand why. This is not black magic, a trojan cannot enter a computer via osmosis or a teleporter, and it cannot function without being detected, unless it does absolutely nothing of value. The attack vectors and the symptoms are known. It follows that it's relatively simple to know if you have been compromised in any way. Unless you know something about the way Windows works that I don't?
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
Doubtless, but he only claimed it was hard to install non-repos software ... which I find so absurd that I must have misunderstood.
There's 0install and autopackage too. Though I forget the details I think 0install counts as repos but not autopackage.
Kerio Personal Firewall (with app behaviour blocking set to paranoid levels), ClamWIN/avg/NOD32/other good antivirus (not norton/mcaffe/etc), and Anti Hook do a good job of securing windows. iptables, clamav, and maybe a graphical frontend for iptables like KMyFirewall do a good job securing linux... But iptables is built in. And in the Windows case, Antivirus really isn't needed with a good firewall/behavior blocker (Kerio+Anti Hook, for example.) Any system, when placed behind secure enough walls, can be secure from threats outside the walls. Some systems are more secure against internal threats than others. In Linux, most of what you can easily screw up is your own home directory. In Windows XP, you can screw anything except other user's home directories, and often even them, and in Vista you can't screw much up if UAC is on, but it often gets turned off. Linux and Vista both have security. Linux just has usable security. Security alone is worthless if the user removes it to do work, it must not interfere with the normal operation of a computer.
Not a sentence!
You have a point, but the thing is, there's no reason anyone would be using an 8-year old Debian CD to install. OTOH, most XP installs by home users are done with old discs.
You and I may know how to slipstream, but the average person installing XP sure as hell doesn't.
OTOH, more and more users now are setting up their PCs behind routers that block most of the ports by default. That has helped a lot.
MyDoom, which holds the record for fastest-spreading worm ever, did so through email and required significant user action.
And, do tell, what is the only operating system MyDoom runs under?
A "theoretically perfect" operating system would be immune to these attacks. Even an operating system that's just a little better designed would be. You nailed the problem: programs users execute receive all the user's powers. Designs for systems that don't do this are fairly well understood (look up 'capability security'), and can be as sophisticated as needed -- you could design rules for browser-launched stuff along the lines of "only allow access to an app-specific portion of the filesystem", "don't allow direct socket connections to other internet sites" (while perhaps still allowing requests through a system-provided resource API), or even "don't allow direct socket access _after_ anything has been read from the local filesystem". It's quite feasible to come up with a system that's as flexible as legitimate application authors would need while having an interface to security controls that's comprehensible to non-technical users. Discussion of that here: http://www.skyhunter.com/marcs/granmaRulesPola.html
I can't see how those rules would have prevented this attack.
Firstly, again, the user would define the security context of the application- not necessarily a problem if you have users who can define 'security context'. Most can't, and as a result, telling them to do so is worse than useless (as the Vista UAC program demonstrates).
Your average user does not know what permissions a specific application requires to execute its function correctly.
For example, a piece of software that bases its security apparatus around public-key infrastructure would need to be able to check the Certificate Revocation List. However, the CRL is not necessarily stored at the same place as the application generally operates. To an untested user, it would appear that the application is behaving improperly, when in fact, the application is behaving exactly as designed and exactly as it should.
It was Albert Einstein who coined the truism that "...problems cannot be solved at the same level of consciousness at which they are created."
In this case, I think, the problem with security (of any kind, to be honest, from electronic warfare to physical security to computer security) is that you can only 'solve' the problem when the user understands the problem to the same level as the solution. You can't create a solution that requires less knowledge than the problem.
For a perhaps clearer example, locks: The answer to someone turning the handle and opening your door and walking in is a lock. But that doesn't stop a variety of other attacks, like say kicking down the door or picking the lock. There are, of course, solutions to those problems as well, but they require knowledge of the problem in order to sufficiently utilize and apply a solution (reinforced doors, multi-factor identification, etc).
I don't see computer security as being any different. You can't dumb it down because to do so doesn't solve the problem- it only solves a specific subset of problems, those that are created at the same complexity as the level to which you have dumbed down the solution.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
Perhaps it is safe. When I installed Windows XP with Service Pack 2, my machine was not auto-rooted at all. In fact, I have been free of malware for quite some time. I simply stay away from questionable sites and email. Then I also have Mozilla Firefox installed as well.
No matter how secure an Operating System is, there will always be someone who could be so ignorant enough to get malware. All it would take for any GNU/Linux install to get malware is for someone to be dumb enough to get access to the Root account and install software that has the malware linked to it. Not that I am condemning GNU/Linux as it is a great operating system as well. What I am pointing out is the user is generally the root of the problem.