'Greasemonkey' Malware Targets Firefox

snydeq writes "Researchers have discovered a new type of malware that collects passwords for banking sites but targets only Firefox. The malware, dubbed 'Trojan.PWS.ChromeInject.A,' sits in Firefox's add-ons folder, registering itself as 'Greasemonkey,' the well-known collection of scripts that add functionality to Web pages rendered by Firefox. The malware uses JavaScript to identify more than 100 financial and money transfer Web sites, including PayPal, collecting logins and passwords, which it forwards to a server in Russia. Trojan infection can occur via drive-by download or download duping."

Comments

I wish

[gEvil (beta)]

I wish I could use this as an excuse for all the money disappearing from my PayPal and bank accounts, but sadly I can't....

Re:I wish

[maxwell demon]

I wish I could use this as an excuse for all the money disappearing from my PayPal and bank accounts, but sadly I can't....

See? With Firefox, you wouldn't have that problem! :-)

Re:I wish

[Hoi Polloi]

Now you can ask for a government bailout!

Re:I wish

[Lumpy]

I give out my paypal password all the time.

It's Fire98-myFun.

it will do you no good without my keyfob and it's current 6 digit number. My bank, paypal, ebay, and 2 of my credit cards use the same keyfob because they use verisign and it defeats every single one of these trojans, keyloggers, and scammers. Why they are not common place I'll never understand.

Re:I wish

[cayenne8]

"it will do you no good without my keyfob and it's current 6 digit number. My bank, paypal, ebay, and 2 of my credit cards use the same keyfob because they use verisign and it defeats every single one of these trojans, keyloggers, and scammers. Why they are not common place I'll never understand."

Interesting...I'd not heard of such and option being available for PP, eBay or banks.

What bank is that with?

Do you have links on how to set this up with PP and eB? Is it one fob that does it for them all or one for each?

Re:I wish

[Lumpy]

http://www.coolest-gadgets.com/20070118/paypal-security-key-fob/

covers paypal and ebay. It's been in place over a year now. You will need to go searching online in ebay and Paypal to find the real links. I had to be logged in to find them and they are internal links.

My bank is a michigan only bank, so it'll probably not be available to you, but the whole system is verisign based so if the company uses verisigns system the same keyfob works for all of them.

Re:I wish

[Lumpy]

https://www.paypal.com/cgi-bin/webscr?cmd=xpt/Marketing_CommandDriven/securitycenter/PayPalSecurityKey-outside

found a public paypal page with more info about it.

Re:I wish

[aonaran]

well, I've been trying for a year to get Paypal to send me one, I even offered to PAY them for it. Nno go. I'm in Canada, and despite the fact that I use the same PayPal.com as all the US customers and they are constantly advertising it to me they refuse to send me one.

Re:I wish

[Lord Ender]

You are so wrong it's not funny.

One-Time-Password devices do little to protect against man-in-the-middle, man-in-the-browser, session hijacking, or CSRF attacks.

They are useful against some sorts of attacks, but not when the attacker is already in your browser. He just has to wait for you to log in normally, then he does what he wants with your session.

Re:I wish

[aonaran]

I take back my complaint, I just tried it again and the charged me $5 CAD and said it'll be arriving in the mail shortly. I was logged in with my business account this time though, maybe that makes a difference.

Yay! I'm finally getting a PayPal RSA token. I can feel safer knowing my PayPal has equivalent security (on the authentication level anyway) as my Work VPN has had for years.

Re:I wish

[spammb]

This has to be one of the stupidest devices ever from the FAQ:

Can I still log in to my PayPal account if I lose or break my token, or if I don't have my mobile phone with me?
Yes. During login, we'll ask you questions to help confirm your identity. When you answer them correctly, you'll be able to log in.

Isn't the whole point of this device that you have to have it to log in? What extra security does asking some questions to confirm my identity do if I have a virus logging everything I type?

Re:I wish

[Baton Rogue]

A 6 digit number that changes every minute? Good luck with that.

This is a veiled blessing...

[mamono]

Yes, it is not good that there is malware targeting Firefox, but it shows that Firefox is on it's way to be a market leader/dominator. Much like the recommendation of using antivirus on Macs, this shows that there is enough of a market penetration for Firefox that it has garnered the attention of malware writers.

Re:This is a veiled blessing...

[Madball]

Yay! We're safe because mac/linux/firefox is secure by design. Oops. Yay! We're safe because no one bothers with attacks on us. Oops. Yay! We're being attacked and thus might finally be important?
----
Note: Actually a fanboy, but a realistic one.

Re:This is a veiled blessing...

[thtrgremlin]

I think an important thing to note here is that this is not using a Firefox exploit. It is using existing malware to manually install a plugin into Firefox. There is no proof of concept here at all, but point taken.

Re:PC ONLY?

[thtrgremlin]

Virus and Malware are registered trademarks of the Microsoft corporation, so yeah, business as usual.

DO-NOT "Remember Passwords"

[Hari Kant]

I would suggest that DO-NOT "Remember Passwords" and Login ids in any Browser where Sensitive Information will be sent ultimately.

Re:DO-NOT "Remember Passwords"

[maxwell demon]

I guess the malware remenmbered those passwords itself, so not storing them in the password manager wouldn't help.

IMHO the fact that you can use plugins with Firefox means that there should be an extra security barrier inside Firefox that disallows extensions to get passwords (e.g. when accessing the password lines, it would just get the stars which are also displayed on the screen).

Re:DO-NOT "Remember Passwords"

[girlintraining]

I would suggest that DO-NOT "Remember Passwords" and Login ids in any Browser where Sensitive Information will be sent ultimately.,/quote>

Well, that'll stop the really stupid malware authors that sit down at your PC and copy the file that stores your passwords. But it won't stop the one who left a key logger, the other who is doing control scrapes, the guy looking over your shoulder, the in-memory debugger that waits for a POST submission and copies everything in the data struct, or the FBI (who knows about those magazines under your bed too).

If you want to offer some advice to people that'll result in a real increase in security, tell them to install NoScript, or not to download executables and run them without scanning them. Tell them to install Spybot, or AdAware, or AVG Free. But don't ask them to turn off a convenient feature because it will stop the .1% of attackers too stupid to figure out a better way of getting that information.

Re:DO-NOT "Remember Passwords"

[clone53421]

Javascript is already capable of getting the value of a password field, and even if it wasn't they could just redirect the form action and get the password that way.

Try this: go to Paypal.com (any page with a password field, really), type in something arbitrary into the password field, and then paste this into the address bar:

javascript:for(var a=document.getElementsByTagName("input"),i=0;i<a.length;i++)if(a[i].type=="password"){alert(a[i].value);i=a.length;}void(0);

Re:DO-NOT "Remember Passwords"

[girlintraining]

How do I know that the latest update to Forecastfox isn't now ready my browsing history or passwords and uploading that information to a third party. Many addons do not need access to the web page being rendered, so I wonder why there isn't some additional layer of security there.

You don't. You are trusting solely that the developers are honest and/or that an interested third party reviews their code to ensure it does not do this. But this isn't any different than closed-source; When you install Windows, you're trusting that Microsoft hasn't trojaned their software either. Really, what people fail to understand is that all security is based on trust.

What's mind-blowing though, is that people overwhelmingly are honest.

Re:DO-NOT "Remember Passwords"

[moreati]

Given that javascript can be injected into a page in various ways, and as you show it can access the contents of input fields. Would there be any milage in blocking access to the contents of password fields from javascript. Would that break many sites?

IIRC the file upload element works this way, to avpid revealing the file path to the website.

Good on you!

[girlintraining]

Well, this just proves that it's easier to develop for Firefox than IE. ^_^ Of course, it's a very backhanded compliment.

also

[ODiV]

What happens if you already have Greasemonkey? Would it stop working or does the malware work fine alongside it?

Re:only firefox?

[scientus]

its javascript so the end code is probably cross-platform, weather the delivery takes place on multiple platforms i do not know but largely depends on the delivery mechanism, as a xpi it would probably be fully cross-platform.

mozila vs firefox, who friggen knows

someone should publish the javascript, the press report was totally bull

also java != javascript

Username/password combo for banks flawed.

[Vellmont]

It's just part of the mounting evidence that username/password combinations for banks is inherently flawed. "Somthing you know" can always easily be known by someone else. Bank security should (IMO) be also based on "something you have", like an ATM card.

If banks really wanted two-way authentication to work properly, they'd use a hardware device (USB-key) that had to be present in the machine to login to your account. The hardware device would be implemented in such a way to make it impossible to copy the functionality of it without physical access to it.

Re:Username/password combo for banks flawed.

[Elemental MrJohnson]

Some banks already do this (at least in the UK). They send out a card reader that you use for a challenge/response when you put your bank card and PIN in. It's only required for making payments to new people, so you can your view balance and make payments to people or organisations you've made at least one payment to before. It's not perfect but it goes some way towards improving security. More here

Re:Username/password combo for banks flawed.

[the 99th penguin]

Seems to vary from country to country, in some (like Sweden I believe, UK banks seem to have more of a PRNG device, at least that's what Barclays gave me) all banks provide a Challenge-Response system for logging into your account, similar to the RSA fob I am sure many here have used for secure logon.

Re:Username/password combo for banks flawed.

[Ed Avis]

And the banking site should be implemented in a such a way that hackers can't hack it.

That is already the case. AFAIK, almost no online banking fraud is done by attacking the bank's website. It is the user's PC that gets hacked.

What the other poster suggests is quite possible, and has been done for years. There are many smartcards and authentication devices made by companies like RSA that you use to log in with challenge-response. Because the secret key is held on the device and is never disclosed to the outside world, you cannot copy a device without physically disassembling it and getting out the key by probing the electronics.

Because you can't download free smileys or animated cursors to install on your smartcard, or indeed load any software onto it at all, it cannot be attacked with downloadable malware.

Re:Username/password combo for banks flawed.

[sexconker]

Because the secret key is held on the device and is never disclosed to the outside world, you cannot copy a device without physically disassembling it and getting out the key by probing the electronics.

1: Not yet. For some devices touted as "secure", you can. Easily.

2: The key is on the banking server as well, or at least the method to generate or validate it at any given time.

Your server will be compromised.
The end user will lose the dongle.
The dongle will be cracked.
The dongle will malfunction.
Malware to attack the dongle without physical access will be written.
Your encryption scheme has weaknesses.

Re:only firefox?

[miknix]

Mozilla needs your permission to install plugins from unverified sources.

But since windows standard practice is to click on everything that has an OK on it, I think it doesn't matter.

Re:only firefox?

[Brain-Fu]

from the article:
Users could be infected with the Trojan either from a drive-by download, which can infect a PC by exploiting a vulnerability in a browser, or by being duped into downloading it, Canja said.

This is utterly unacceptable. They should give instructions to users on how to avoid downloading this.

They listed two ways in which systems get infected. One is "by being duped into downloading it." The instructions to avoid this are easily enough translated as your standard Internet hygien guidelines: "When websites offer browser-enhancements to you, say no," and "don't execute email attachments even if they come from trusted friends."

However, I want more detail about this "drive-by download" bit. There is a hole in my browser that will make it automatically download this addon, without prompting me? Give me a link. Give me the details. What versions have the hole? Has it been patched? Is there something I can do (other than "browse nothing") that will prevent this hole from being exploited? People need these details.

Re:only firefox?

[Simon Brooke]

does it affect all platforms since it's Java?

anyone know?

It's not Java, it's JavaScript - two very different languages linked only by a common marketing fuckwit.

Re:only firefox?

[dedazo]

But since users' standard practice is to click on everything that has an OK on it, I think it doesn't matter.

There, fixed that for ya.

Re:only firefox?

[MrMr]

The problem has been diagnosed by BitDefender, and they can sell you all the peace of mind you ask for.

Re:only firefox?

[Ed Avis]

The cool thing about Firefox is that you can basically force users into installing malware by exploiting bug 59314. Just keep popping up a dialogue box (with no way to stop it or switch to another tab) until the user gives in and says yes.

Re:PC ONLY?

[thtrgremlin]

Since reading the article is for loosers anyway...

This [plugin] is intended to be delivered onto a compromised computer system by other malware for subsequent download into Mozilla Firefox's Plugin folder

Since the computer need already be compromised... sure you can draw your own conclusion on that one :)

Re:only firefox?

[clone53421]

someone should publish the javascript, the press report was totally bull

Meh, even without seeing the code it's pretty easy to figure out what they most likely did. All they'd have to do is create an onSubmit that sends an Ajax request to their server with the contents of the username and password fields on the form being submitted. Considering that add-ons (AdBlock, for example) can already inject and/or remove HTML from the dynamic page, it doesn't surprise me in the least.

Then all they have to do is figure out how to deploy it – obviously the Firefox plugin repository isn't going to host their malware, so distributing it in such a way that people are fooled into installing it is going to be tricky. 'Course, if you have control of a botnet, it might be possible to instruct the zombie machines to install it without the user's knowledge (not sure how FF's add-ons are managed, so it might or might not be possible, and it'd probably have to occur while FF wasn't running).

Re:only firefox?

[Rudisaurus]

More details here

Re:NoScript FTW

[kalirion]

Like you never "Temporarily allow myweirdpornvideos.com".

i've said this many times

[circletimessquare]

and i've always been derided as a microsoft fanboy. when i think its just common sense:

the amount of hacks and viruses and malware on an os/ browser has absolutely nothing to do with anything other than marketshare

you can try to make something as secure as possible, but if the incentive is high, hackers can always pay attention to security way more than you do, and find holes you did not anticipate, no matte rhow subtle

if something is full of security holes, it won't be hacked, if its market share is tiny

meanwhile if something is ironclad, it will still be hacked, if its maker share is huge. the incentive to find holes is so high, the most esoteric avenues of investigation are explored

Re:i've said this many times

[gad_zuki!]

Virii isnt a word.

Secondly, the GP is right, its all about marketshare. Look at all the rooted linux servers out there. Look at all the malware for windows. At the end of the day any computer controlled by someone with admin rights and who isnt paranoid about security is a risk.

Re:i've said this many times

[Sounder40]

The reason Windows is targeted is because it's model of sharing everything was so wide open to so many exploits. And don't forget the numerous buffer-overflow vulnerabilities. Top that off with the fact that it is so pervasive, and you have the deadly combination we have now.

Linux/Unix, on the other hand, was written with clear lines of delineation between the user and kernel spaces. And attention was paid to avoid buffer overflow vulnerabilities.

Not saying that there aren't exploits available in Linux and Unix... There are. It's just designed from the ground up to be more secure than Windows.

So part of what you said is correct: The pervasiveness of Windows is a major reason why it is targeted. But you can't avoid the poor security design of Windows as a cause as well.

that's it...

[xiao_haozi]

That's it....I'm switching to IE!

Re:Wait, I thought...

[Thelasko]

Here's the important part:

is intended to be delivered onto a compromised computer system by other malware for subsequent download into Mozilla Firefox's Plugin folder. Once installed it gets to work every time Firefox is started.

Apparently Firefox has protections so plugins can only be downloaded from addons.mozilla.org, but if they are downloaded by another program, and placed in the appropriate folder, Firefox will use them.

There are two things to know about this:
1) Another piece of malware has to be present on the machine for this to happen.
2) There is a "feature" in Firefox that allows it to run any program in the plugin folder.

Yeah, there's a bug in Firefox, but it's not the root cause.

FireFox matters.

[wvmarle]

Not sure whether this should be considered a compliment, but to me it indicates that FF matters. It has enough market share for criminals to target.

Unfortunately not many details on this exploit: is it really an exploit in FF (for the drive-by download)? Or is it more like a trojan (for the download duping)?

Only if you want to be in the IT business

[joeflies]

The problem with USB keys is that you have to install a client to handle the PKCS #11 with the browser. No bank wants to get in the business of telling customers to install software (and all the help desk problems that come with it).

OTP tokens have been the preferred method for consumer strong authentication, but only consumers in Europe have seem to taken to them. I don't really see people lining up to get the paypal OTP token.

Re:Only if you want to be in the IT business

[Mex]

Every bank in Mexico uses OTP authentication with a small physical device that generates a random key.

When will the US catch up with the rest of the world in terms of technology? ;)

Re:only firefox?

[The MAZZTer]

Nowhere does it say it is Java. In fact, I don't see any Java. I see JavaScript, but that is completely unrelated to Java (if the name confuses you, take it up with Sun, their marketing department wanted to leech off of Java's success). There is only a JavaScript file and a Windows Netscape Plugin. So it probably only affects Windows.

Re:NoScript FTW

[Anonymous Coward]

You should register that domain name. It appears to be free at the moment.

Re:Linux has less than 0.5% share, so does it matt

[dhasenan]

Linux has 0.8% market share!

Though that's counting me and my beard of unusual size, so take it as you wish.

malware targets Windows ..

[rs232]

"This latest e-threat - called Trojan.PWS.ChromeInject.A - is intended to be delivered onto a compromised computer system by other malware"

SYMPTOMS: Presence of the: "%ProgramFiles%\Mozilla Firefox\plugins\npbasic.dll"

TECHNICAL DESCRIPTION: It drops an executable file (which is a Firefox 3 plugin)

Does that mean it's Windows only ?

Fightback?

[Bazman]

Can we now blitz the collecting server with millions of bogus account records? Enough to make it not worthwhile trying them to find the good ones?

Re:To the smart people...

[Scuff]

you can detect it by looking for the following 2 files: "%ProgramFiles%\Mozilla Firefox\plugins\npbasic.dll" "%ProgramFiles%\Mozilla Firefox\chrome\chrome\content\browser.js" Theoretically closing Firefox and deleting those might remove it. The recommendations are to run anti-virus software, which is a good idea since the rest of the article indicates this is usually added to already compromised machines. Locations of the files may vary by OS, but should still be in Firefox plugins and chrome theme.

SITE-MODS: Please edit Subject Line -- W32 only

[gavron]

It doesn't "target Firefox", it targets "Firefox on Windows 32 systems" This does not affect Linux, Mac, or other systems. Ehud

Re:PC ONLY?

[Anonymous Coward]

spelling "losers" correctly is for losers too.

Re:only firefox?

[Anonymous Coward]

Newsflash, teenybopper: The world is not divided into "morons" and "people who know how to kill apps in Taskman".

Re:only firefox?

[Reece400]

I've had quite a few issues with Ubuntu because of my years of using windows. I'm used to hitting Enter rather than clicking for the default actions. Especially the overwrite file dialogs which default to 'no' in windows and 'yes' in ubuntu

Re:PC ONLY?

[Bourbonium]

Since I haven't yet RTFA, I can't comment with any authority (as if I ever do), but if it's a javascript exploit, then I suppose it could affect any platform. My credit union's online banking portal only allows me to use Internet Explorer, so I can't even get to my bank account through Firefox or Opera or SWIron (which I prefer to Chrome). Oh the irony! Here's one instance where IE is a safer alternative to FF!

Re:only firefox?

[Vancorps]

I ran into this when I visited a site that another admin got the Antivirus 2008 trojan from. Of course I'm on Ubuntu so I was pretty sure simply visiting the site wouldn't cause any problems. I kept getting prompted to install it so I just found out what link it kept calling and just modified my hosts file to point it to localhost and then I got out of it like I should.

Pretty devious exploit though.

Re:Linux has less than 0.5% share, so does it matt

[russlar]

Linux has 0.8% market share!

Though that's counting me and my beard of unusual size, so take it as you wish.

Stallman, is that you?

Re:PC ONLY?

[drachenstern]

But I thought the sequence usually went like this:

1. Install Firefox
2. Install noScript
3. ???
4. Don't get infected by js vector based viruses.
5. Get flamed on /. for pedantic usage of noScript to designate a particular add-on to Firefox, and for not using the general designation of either FX3 or FF3...

No, but really. If you have noScript, as most everyone I know using Fx does, then how do you get infected by a virus that uses js as an attack vector...

Guess I'll keep reading the thread and see if the answer arises.

Fix

[Frankie70]

You can download a fix for it here.

Wow, the summary is correct.

[argent]

This is not an exploit, this is a payload like a rootkit that targets Firefox... after your computer has already been compromised.

I would be surprised if there ISN'T a similar payload targeting IE delivered by the same malware.

Going back to IE

[GunDawg]

Who needs this headache; not me. I'm going back to IE.

As for the people who write these programs, they need to be PUT TO DEATH.

Seriously, if you want to steal from me, come to my house. I promise to make it a fair fight. ;)

Re:PC ONLY?

[thtrgremlin]

It is written in Java script, but the delivery system is windows only. This malware also does not use its own delivery system. (don't worry, you would have to read the article to know that and we all know reading the article is for losers)

Gah...

[msimm]

Read.article. Most of your 'insightful' comment applies to Windows and piggy-backing on a Windows exploit. The other OS's you mention (ie: not Windows) would be exploited by ignoring the FF warning dialog about installing untrusted add-ons and installing it anyway (not so much an exploit).

That said, if you're done being cheeky: software is complicated. Bugs are a simple reality and inevitably lead to some kind of exploitability. But Linux and Mac (along with FF and numerous other open tools) get a bit of credit for implementing basic controls (accounts with privilege separation in the OS's) and responding quickly and proactively.

Windows is only now trying it, but their implementation is so cumbersome it's defeating it's own purpose.

Any Vista user out there that haven't already tried it there are several open source sudo for Windows implementations that make using non-privileged accounts more viable. I think I use Sudowin which seemed to work the best for me, but I'm not on my home computer.

Re:only firefox?

[hairyfeet]

Bingo, I have seen malware in both Firefox and IE installed using the "endless loop" dialog box that the previous poster pointed out on Bugzilla(BTW, how freakin sad is it that the bug is from pre-1.0 and is still there?). Here is how I saw it work, by using a test box i keep for bug testing and removal practice. I found the bug by going through the users history and going where he went.

Here is how it works. You get Mr. Stupid Horny Guy to look at some topsites, you know the ones, a bunch of hot babe thumbnails that take them to yet more topsites. After a few minutes he will hit a site with a dialog box that says something like "You won a free hour in our hot babe video vault! Simply click yes to download the player and watch your hot videos full screen!" but thanks to the bug if he hits cancel it simply throws another dialog box in his face until he hits yes. If Mr Stupid Horny Guy even knows about ctrl/alt/del (which many don't) they will find the PC slow to a crawl whenever they try to launch it. So for Mr Stupid Horny Guy the choices come down to A=yank the plug out of the back, or B=click yes. So you can guess which of those 2 gets chosen more often.

I just wish Mozilla would put a cancel button automatically on all dialog boxes that would just kill all scripts on a page. It would probably cut way down on the drive by downloads, at least the ones I have come across.

Would have been nice

[The Cisco Kid]

if they had identified the server that it tried to contact, either by hostname or IP address, so that those with the capability to do so, could block connectivity to it from their network(s) and/or customers. ISP's could add a simple ACL to a router, home users might put a 127.0.0.1 entry in /etc/hosts, etc.

Of course one thing they completely left out was if this 'plugin' ran only on Windows Firefox or if other platforms were susceptible as well.

And quite frankly, if that host was providing some legitimate service that doing this ended up blocking, well, oh fucking well. Keep the thieves off your network and you can avoid that type of problem.

Another option of course, (for individuals and private/company networks, but probably not so for commercial ISP's) would be to just null-route the entirety of Russia (using blackholes.us), and then selective override individual address spaces as and if needed.

Re:Linux has less than 0.5% share, so does it matt

[DavidAlanChapman]

Yeah, but that 0.5% has crazy phat loot from not being ripped off by the windows only malware

Re:Linux has less than 0.5% share, so does it matt

[Whalou]

Linux has 0.8% market share!

Though that's counting me and my beard of unusual size, so take it as you wish.

Stallman, is that you?

No, he would have said GNU/Linux.

Re:malware targets Windows ..

[gabrieltss]

Oh good I'm safe then, it's firefox 3 plugin - won't work in my Firefox 1.5.x. Another good reason not to upgrade - securtiy is worse in the new version.

Re:Can I put on my 'told you so' t-shirt now?

[clone53421]

Can I put on my 'told you so' t-shirt now?

No, you can't. The trojan doesn't attack the password list file, it scrapes the login credentials from forms of sites when you visit them.

Anyway, are you aware of any way of obtaining username/password information from the "woefully unprotected" password list? I'm not saying a way doesn't exist, but I don't know of any.

Re:Mozilla?

[clone53421]

The malware calls itself "Greasemonkey" to avoid detection, but it's completely unrelated to the real Greasemonkey add-on.

Same as all the "spyware removal" or "antivirus" tools that are really adware/trojans... it's just to get it on your machine and prevent you from trying to delete it...

Re:PC ONLY?

[Intron]

It's javascript in firefox, so the malware writers could have made it platform-independent with a little bit more work. But did they? NO! Yet another example of ignoring the Linux platform.

virii should be a word

[circletimessquare]

1. it just sounds cool
2. sometimes in scrabble, you need to get rid of a lot of Is

language isn't a top down authoritarian function, its trickle up from the bottom

therefore, here in this thread, based on my authority of having none at all, i hereby announce "virii" to be a valid word in the english language

use it profusely, use it constantly, use it anywhere

and in such a way, make it a valid word

motion has passed

Re:virii should be a word

[dzfoo]

>> 1. it just sounds cool

True, it sounds more "technical" than the more mundane "viruses". But I also believe in using proper words.

>> language isn't a top down authoritarian function, its trickle up from the bottom

Yeah, I only hear that from people who can't spell. (just kidding!)

        Cheers!
        -dZ.

Re:what about us loosers?

[Fieryphoenix]

Ahem, I do indubitably believe that in that case it is referred to as the "more loose" in point of fact, quite, yes, what what.

LIST OF BANKS; seems to be windoze-only

[rickst29]

"Trojan.PWS.ChromeInject.B" is definitely only effective in Windows, because it installs and executes these files: "%ProgramFiles%\Mozilla Firefox\plugins\npbasic.dll" "%ProgramFiles%\Mozilla Firefox\chrome\chrome\content\browser.js" browser.js calls the The dll file, which can't run in Linux, etc. unless you're running a WINDOZE Firefox via crossover (which would be insanely stupid). Also, since it's installed into the program directory (rather than the user's profile), VISTA will almost certainly make you click for "administrator confirmation" before writing the files. (I don't know for sure, because I don't have VISTA.) - - - - - When I enter the URL for http://www.bitdefender.com/VIRUS-1000451-en--Trojan.PWS.ChromeInject.A.html#, the page content is identical the version for "Trojan.PWS.CHromeInject.B" (even the given name is "Trojan.PWS.ChromeInject.B", they even over-wrote the ChromeInject.A page by accident or, ChromeInject.A isn't spreading in the wild AND has nearly identical characteristcs, perhaps differing only in file sizes.) BitDefender provides the following list of banks their page for this version, http://www.bitdefender.com/VIRUS-1000451-en--Trojan.PWS.ChromeInject.B.html: It filters the URLs within the Mozilla Firefox browser and whenever encounter the following addresses opened in the Firefox browser it captures the login credentials. akbank.com caixasabadell.net credem.it areasegura.banif.es banca.cajaen.es openbank.es poste.it banesto.es carnet.cajarioja.es gruposantander.es intelvia.cajamurcia.es net.kutxa.net bancopastor.es bancamarch.es caixamanlleu.es elmonte.es ibercajadirecto.com bancopopular.es bancogallego.es bancajaproximaempresas.com caixa*.es caja*.es ccm.es bancoherrero.com bankoa.es bbvanetoffice.com bgnetplus.com bv-i.bancodevalencia.es clavenet.net fibancmediolanum.es sabadellatlantico.com arquia.es banking.*.de westpac.com.au adelaidebank.com.au pncs.com.au nationet.com online.hbs.net.au www.qccu.com.au boq.com.au banksa.com anz.com suncorpmetway.com.au quiubi.it cariparma.it bancaintesa.it popso.it fmbcc.bcc.it secservizi.it bancamediolanum.it csebanking.it fineco.it gbw2.it gruppocarige.it in-biz.it isideonline.it iwbank.it bancaeuro.it bancagenerali.it bcp.it unibanking.it uno-e.com unipolbanca.it carifvg.com cariparo.it carisbo.it islamic-bank.com banking.first-direct.com natwestibanking.com itibank.co.uk co-operativebank.co.uk lloydstsb.co.uk mybankoffshore.alil.co.im abbeynational.co.uk mybusinessbank.co.uk barclays.com online.co.uk my.if.com anbusiness.com hsbc.co anbusiness.com co-operativebankonline.co.uk halifax-online.co.uk ibank.cahoot.com smile.co.uk caterallenonline.co.uk tdcanadatrust.com schwab.com wachovia.com bankofamerica kfhonline.com wamu.com wellsfargo.com procreditbank.bg chase.com 53.com citizensbankonline.com e-gold.com paypal.com usbank.com suntrust.com banquepopulaire.fr onlinebanking.nationalcity.com

You've been wrong many times

[Chris Burke]

You might think it's common sense that marketshare is all that matters, but we hammered this out years ago when comparing attack rates on IIS vs Apache.

Obviously marketshare is a factor. Ease of infiltration is another factor. A more popular platform will be attacked less if the chance of success is lower, because at the end of the day going after the weaker but less popular platform can still net you more compromised systems. If you only look at desktop browsers and OSes, you might not think this is the case, but that's only because right now the most popular program and the most vulnerable program are the same, and that the up-and-coming browser can only claim to be better than the most popular one on security issues, not actually good.

In any case, common sense should not be telling you that the security of the program doesn't affect the number of hacks and viruses. Making the reasonable assumption that all code contains some number of bugs does not in any way imply that they are equally prevalent or equally easy to find in any given program, or that the time to discover the bugs is always the same and dependent only on desire. Exploring esoteric avenues of investigation because the incentive is so high does not guarantee a timely result. If it takes substantial time and effort to find an exploit, which is then fixed, requiring another substantial effort to find another exploit, then it may not be in the hackers interest to go after this target versus a lower profile one where exploits can be found faster and more frequently in spit of bug fixes.

Put succinctly: "the amount of hacks and viruses and malware on an os/ browser has absolutely nothing to do with anything other than marketshare" is trivially wrong, at its simplest you could say that the number of hacks and viruses is related to (marketshare * vulnerability).

Re:only firefox?

[hairyfeet]

I do use Noscript on all my machines, but for my customers it really is a "nuke it from orbit" solution which causes more problems than it solves. What we need for Noscript is a "average Windows user" setting which would whitelist Youtube and the other popular video sites, along with a "horny guy" setting that would add Porntube, Redporn,etc. Because I have tried to teach my Windows customers about whitelisting but sadly it turns into another Vista style "always click allow" which kills the whole point. Perhaps a simpler dialog box interface for Noscript than the current one? Maybe one that would detect .flv,.swf,rmb,etc and have a simple "click if you want to play the video" button?

Re:only firefox?

[bit01]

But since users' standard practice, as trained by M$ security theatre over many years, is to click on everything that has an OK on it, I think it doesn't matter.

There, fixed that for ya.

---

Don't be a programmer-bureaucrat; someone who substitutes marketing buzzwords and software bloat for verifiable improvements.