Slashdot Mirror
Faux-CNN Spam Blitz Delivers Malicious Flash
CWmike writes "More than a thousand hacked Web sites are serving up fake Flash Player software to users duped into clicking on links in mail that's part of a massive spam attack masquerading as CNN.com news notifications, security researchers said today. The bogus messages, which claim to be from the CNN.com news Web site, include links to what are supposedly the day's Top 10 news stories and Top 10 news video clips from the cable network. Clicking on any of those links, however, brings up a dialog that says an incorrect version of Flash Player has been detected and that tells users they needed to update to a fake newer edition, which delivers a Trojan horse — identified by multiple names, including Cbeplay.a — that 'phones home' to a malicious server to grab and install additional malware."
I was wondering why I being spammed with such a seemingly innocuous message, I thought perhaps it was just a filter poisoning attempt.
it took me quite a while to figure out why this would be effective spam.
Then I had a look a the HTML view. Quite insidious.
It provides what looks like a linkified http://www.cnn.com/xxxxxxx that actually referrs to a different url.
Instead of a nickel, how about giving that kid a CDR of a better OS?
If I have nothing to hide, don't search me
There is another similar one pushing 'IE 7 is now available for download' from 'Microsoft'.
ya.. right...
---- Booth was a patriot ----
But not invincible..
---- Booth was a patriot ----
Here's an excerpt from a message posted by a friend on EVERYONE's wall: (X's are mine, just to add some security) "HEY GUYS GET YOUR GAMING ON! ENTER AND WIN A PS3 Or Free PLASMA ITS EASY AND FREE SIGN UP AT THE URL BELOW http://xxxxx.imageshack.us/XXXXX/gameonit4.swf "
Too bad nobody is ever going to find the folks responsible for this. Pretty much any email that even has the letters "cnn" in it will go in the trash now. Do you think any email of a forwarded story from the CNN site would possibly get through today? Next week? It wouldn't surprise me if CNN.com ad rates took a nosedive because of this as well. Who wants to go to "the spammer" web site?
This is the sort of extremely bad PR that CNN would be well within their rights to sue the pants off of whoever started this nonsense. Unfortunately, it probably originated somewhere that doesn't care about US companies, US laws or what people think about spam. Also, how exactly would you prove where it came from?
Hope someone is getting paid real good for this. I don't think this can put CNN out of business, but it is certainly going to hurt real bad.
It's not a Windows problem, per se; the fact that it installs malware on Windows computers is functionally irrelevant.
PEBKAC- Problem Exists Between Keyboard and Chair.
There's absolutely no reason such a functionally identical attack would not work against any operating system you care to name, or even a theoretically perfect operating system were one to be invented.
Programs the user executes run in the user's security context. If you can trick the user, you can do whatever the user can do, or in this case, install malicious software.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
Here's a nickel, kid. Go get yourself a *real* operating system...
I enjoy playing around with Linux. I have a couple spare partitions on my desktop machine where I'll install an interesting new distro when I have some time (right now I have Kubuntu and WinXP set up as dual-boot), and maybe learn a little something about package management or do some cool things in bash ... whatever, doesn't matter to me ... it's the exploring that's the important thing.
You know what? Every time I read a post like the above, it turns me off Linux just a tiny bit.
If libertarians are so opposed to effective government, why don't they all move to Somalia?
Companies doing business on the web have curtailed the functionality of email correspondence, and often tell consumers the only safe method is to visit their site and log in. Acquiring software isn't much different, get it from the source. Personally, I find the incessant requirement of plug-ins to be breaking the web when no alternative (text) is offered. /Get off my lawn!
Of course you can also run Windows and avoid doing unsafe, stupid things. That usually works.
Since I'm on a 3270 terminal to an OS/390 box the size of your house right now, here's your nickel back, and a check for $50.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
It's hard to write a trojan that runs on multiple operating systems. They would need to write multiplatform trojans, and for now only Windows has the dominance to ensure profitability.
Not that it isn't possible; Adobe after all has Flash for both Mac and Windows PCs.
GPL Deconstructed
I can see the headline now: "We're not spamming you (really)"
A trojan-horse application is being delivered by email, masquerading as content from a major corporation.
This is news? We're supposed to be surprised?
Cross-posted from my journal.
And now we have the latest malware wave, where 1000+ legitimate sites have been hacked to serve a fake Flash player. This is going to seriously hurt CNN's reputation (and ad revenue), as a lot of folks are going to set their mail servers to delete stuff that even mentions CNN. Worse yet, it's going to put a serious hurting on the 1000+ hacked sites: CNN has enough goodwill and trust built up that it will survive the onslaught, but the "other victims" may end up blacklisted by a lot of folks.
Most malware authors have learned not to crap in their own bed: the days of a virus that wiped your files are fading; now we have malware that more-or-less uses your files alone, but uses your connection to send spam or do DoS attacks. If they make the attack less blatant, it's less likely to be discovered and cleaned up.
While the malware authors may be trying to stay quiet on the PC, they sure don't mind hurting companies ... and that hurts the internet as a whole. As much as some in the geek community may dislike it, the Internet is payed for by commerce--internet sales, services, and subscriptions indirectly pay for the infrastructure we all use. If these small companies are hurt by spammers and malware authors, then the small companies may be less willing to maintain an internet presence--which means there will be less people who pay the ISPs to maintain and improve the infrastructure.
There are a lot of contingent statements in the above paragraph, and maybe I'm getting more worried than I should be, but I have to wonder: how long will it be until spammers, scammers, and other low-grade shits ruin the Internet for everyone?
If you haven't been down-modded lately, you aren't trying.
Sacred cows make the best hamburger.
Of course that's true in general (Java, perhaps?) but that's not really the issue, although it is an argument for systems diversity in general as opposed to any kind of monoculture.
The issue is that users are stupid. They will remain stupid regardless of what kind of operating system you plunk them in front of, and for my money I'd much rather Microsoft (or antivirus vendors or whomever else) spend their time working to fix actual holes- security flaws that can be exploited without exploiting the vulnerability of the user's stupidity.
Because, to be honest, the security flaw that is the user's intelligence or lack thereof is not something that Microsoft can, or should, fix.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
Is it really? I've owned many Windows computers over the past 20 years and I've never had any problems with security. Well, there was that one floppy in the early 90s I accidentally booted off of...
There's 8 Windows boxes here on my den right now. Three servers, two laptops and three workstations. None of them are pwned, rooted, infected, trojaned or otherwise compromised. And they've never been. None of my Server 2003 colo boxes have ever been compromised either. I'm curious, what do you find difficult about securing Windows?
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
If someone saying something like that turns you off of Linux, you can expect to hear a lot more of that from people who don't want you to use Linux.
What in the world some jackass' trite comment has to do with your being "turned on" to Linux is beyond me. Either Linux is potentially valuable to you or it isn't. And the GP didn't even mention Linux.
Stop giving other people so much power over your behavior. You are responsible for your behavior, even if you let other people do your thinking for you.
"I wanted to use Linux but some jackass made a trite comment not even directed at me, so it's his fault I don't like Linux." What would you think about someone who made a statement like that?
This spam helped me find a bug in my procmail recipe - this was sent to my Sourceforge email address (never had spam there before), and was forwarded on to Google which bounced it as an illegal attachment. Kudos to Google for being on the ball.
The 1,200 recursive bounce messages that ensued were no-one's fault but my own. :)
Everyone knows that damage is done to the soul by bad motion pictures. -Pope Pius XI
Sure you could. Some of us do that right now- I have a VM running with a bare-bones Windows XP installation for IE and Firefox.
But this suffers problems. Namely, that if anything from the sandbox can't get out and harm the main system, you... can't get anything out of the sandbox.
The problem, as I said, is that programs run in the user's security context. It's perfectly possible to limit the capability of userland applications, but this does little good from a user's perspective; the user's data also resides in userland, and is the valuable part of the system. They don't really care if the kernel is still working if all their data is hosed.
Ultimately, as long as the user can access their data, so can a hostile program, so long as the user is willing to run it.
The only way to prevent this, essentially, is to prohibit anything from being deleted or modified- just write a new copy of whatever data you change, and write a transactional flag that stats that deleted data has had the 'deleted' attribute applied to it. Basically, an end-to-end journal of all file operations. And that'd be an enormous storage problem. Perhaps it is a solution in a handful of cases- if you can lock all the system files so they can't be written or modified and then ensure the user's data is never deleted or modified, only added to... maybe that's the solution. But it's not one I'd want to run at home, certainly.
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
Mac OS X.
Running on an iPhone.
A non-3G iPhone.
-- "In order to have power, I must be taken seriously." -Mojo Jojo
MyDoom, which holds the record for fastest-spreading worm ever, did so through email and required significant user action.
Statistically, there are about as many of those as there are normal desktop computer users for the platform, since most of these attacks rely on social engineering (as opposed to actual vulnerabilities) to succeed. So the lack of malware for your platform is not due to its inherent superiority, but to the size of its installed base. Windows may have more attack vectors than Linux or OS X, but that doesn't mean that they can be avoided with $0.05 worth of simple common sense.
No, that's why I asked you the question. It's not at all. If it were, those 100K machine botnets would have 100 million zombies instead, and that's not the case, is it? Or do you figure the malware vendors are just not interested in a potential pool of that size? By most measures there's about a billion computers in the planet running some version of Windows.
Oh, sure. But there's no need to be quippy about it. That happened almost 20 years ago, and it was the first and last time any of my systems were compromised. I guess I'm a good learner.
And by the way, "superior ability" is not needed at all. Just patch your boxes and don't download or run stuff from untrusted sources. That should take care of about 99.99% of all your problems. And that's true of any OS.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
But who sets the application's security context? The user, of course.
(You might argue the administrator sets the security context of the application, and that would be correct; but in this case, the administrator and the user are one and the same.
I realize there exists a separate paradigm where you have a competent administrator sitting on top of an incompetent user and basically 'screening' what happens- in that case, indeed, the 'user' we are referring to is competent and therefore able to provide the security context as appropriate.)
"It is possible to commit no errors and still lose. That is not a weakness. That is life." -Peak Performance
It's not a Windows problem nor is it a user problem. BTU (blame the user) is easy to toss around for us geeks, but it really masks the true issue here.
That is, user have be trained to install browser plugins by content providers. These so-called content providers only want to control their content, it's inconsequential to them that they're also exerting control over their viewers. It's also ironic that the mindless stride to control viewers has led that control into the hands of even more dishonest criminals.
In a sense most content provider plugins are trojans themselves. That is, they tell the user they'll provide the ability to view their content, but what they really do is take functionality out of the software and take control away from the user.
This trojan is possible because installing a trojan is an accepted Internet practice. Quick raise you hand if you have RealPlayer installed. Ideally a browser is all anyone needs to view the web, but at some point during commercialization of the Internet the community took a step in the wrong direction: Flash, RealPlayer. Barf. Don't you see, the problem is clearly not the users fault.
The problem, in fact, lies with the likes of Adobe, Real and Microsoft for creating stupid crap like Flash, RealPlayer, Silverlight then demanding users install these without thought to view content. If there were nice standards that provided the functionality of these plugins in the browser this would be a non-issue -- the trojan would never have been created.
Win a signed Stephen Carpenter ESP Guitar from the Deftones: http://def-tag.com/?r=0008781
Not even Apple users have the same problem. Users of other OS have been conditioned to get their software from a place they can trust. Free software users have learned not to trust non free software like Flash itself.
So where do Apple users get their Flash updates from then?
It's unfair. I clicked the link in the email, and it told me to update flash, but the flash updater I downloaded from their site doesn't work on my computer.
:(
How am I supposed to see the CNN videos if they don't make a linux version? Linux sux, I'm going back to windows.
RebateFX.com - Spread rebates for Forex traders
I cleaned up 8 or 9 PCs this July with XP Antivirus 2008 and 2009. Don't be fooled. That fucker is the causes all sorts of hell. It removes display window tabs such as screen savers and background. It does this to prevent you from rooting it out of the sytem. I've also seen it modify logon registry setting. Clear it out and the infected files, and you will send the machine into an endless log-on / log-off mode.
I found AVG to be very effective at removing the hidden crap. So far, this malware has slipped past Symantec, McAfee, and Trend Micro (all corporate editions).
Life is not for the lazy.
This is a REALLY aggressive spam campaign. I never received a message with the subject of "CNN.com Daily Top 10" until 2 days ago at 1:49 PM. Since then, I have received 1,799 of these messages and counting. Of course, I get spammed to death already -- my email address (deven@ties.org) has been public for many years, and I don't even hide it here on Slashdot, even though it really is my primary email address. Spam has grown to the point where I am receiving over 10,000 messages every single day. (Yes, that's about a million messages in 3 months.)
On a separate note, I received an email yesterday with the title "Action required to avoid account access interruption" -- and it was actually a legitimate email! I receive such emails daily from phishing attempts, but this one was actually sent to me by TD Ameritrade.
It's a sad state of affairs when it's the legitimate email that comes as a surprise.
Deven
"Simple things should be simple, and complex things should be possible." - Alan Kay
Why don't all mail readers which display html simply do what Slashdot does - show the real site linked to in brackets next to whatever text is in the link, like "cnn.com [http://somewhere.de]" - perhaps with highlighting when both look like urls, but they don't match? That would kill so many phishing attempts.
"with their freedom lost all virtue lose" - Milton
A while ago I had a regular email that would for whatever reason lock up Outlook when trying to download its HTML content.
So I set Outlook to always show plain text versions of all emails. This has provided two benefits:
1) Much faster message display
2) Malicious emails are easier to spot
In this case it was a while bunch of links where the text was http://x.cnn.com/ but the actual href was http://seomthing.de.
In Outlook 2007: Tools - Trust Center - E-Mail Security - Read all standard mail in plain text.
If you don't want to repeat the past, stop living in it.
Pleas God, no. Nobody wants Wolf flashing us.
/ \
\ / ASCII ribbon campaign for peace
x
/ \
Just to be clear, users are downloading malicious software that is posing as the Flash Player. "Malicious Flash", to me, means Flash content (a SWF) that uses a vulnerability in the Flash Player to compromise a user's system. While Flash hasn't had a spotless security record, I don't know of any instances where a vulnerability in the Flash Player has been exploited on a scale such as this. In the past few years, Adobe has really strived to make Flash Player much more secure. Were this to be an actual case of "malicious Flash", I think it would be a big PR problem for Adobe and make end users extra wary of Flash for some time to come.
The wording in the title seems to me like calling someone social engineering some passwords a "WIndows security vulnerability" - misleading and inaccurate, at best.
I read the title and I got and image of Bill O'Reilly and Anderson Cooper mooning everybody. Now I need to go scrub my brain with lye soap.