Slashdot Mirror
Malware Spreading Via ... Windshield Fliers?
wiedzmin writes "Another interesting article published by the SANS ISC Handler's Diary is describing a very unusual vector for malware distribution — windshield fliers and fake parking tickets. A website URL provided for "disputing a ticket" actually leads to a malicious website, and a "toolbar" required to find the photo of your violation is, you guessed it, a trojan posing as a fake antivirus. The best part is — according to the VirusTotal report, it doesn't look like most antiviruses have signatures for this one yet."
As clever as this is it seems like catching the person or persons putting these on wind shields would be simple enough.
but I can't seriously imagine this being a widespread problem.
Maybe a few people in a town would end up affected, but the cost in time/effort required to trap victims is impractical considering what a simple email can do.
while(1) attack(People.Sandy);
What scares me most is that this style of distribution is something I'd actually fall for. I mean, pop ups and stuff are easy enough to ignore, but what about local flies for bands, business cards, and these tickets? Just goes to show that no matter how much protection you have on the tech side, there's always a social engineering way around it.
After all, do you know what a parking ticket looks like in your city, to be able to distinguish between a real one and a fake? I would suspect that most people who recognize the real thing either wouldn't bother to try to contest one, or don't do anything about them anyways. But for the larger portion of a city's population who has not been ticketed, they could well have a hard time telling a fake from the real thing.
And then you add in people who are from out of town, who would much rather not have to go back to your city to deal with a ticket...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I can't imagine there are a large number of people who are not only going to read the flyer, but take it home and remember to get on their computer and type in a URL from it. The "parking ticket" gambit seems pretty weak too if you look around and notice two things:
1. You are parked legally
2. Everybody else has these "tickets"
And that's before you notice that your local government is using a website like: http://qlmbix.ch/parkingticets.html
I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.
I read the internet for the articles.
Some should rip in to the fake person giving out the tickets like people do to the real meter maids as you see do on A&E parking wars. And if they are not real say I'm calling the cops as I don't think they will like to have people giving out fake tickets.
There is also a neck we can hang them from... someone police can pursue and arrest, more direct money to follow... leads.
I really want to see some terrible, nearly unimaginable things happen to these people. Some people feel this way about drug pushers. Others feel this way about child molesters. For me, it is malware. Oh I think of the children too, but frankly, a lot can be done in the way of prevention if only most parents paid attention to their own children that would address a good portion of the child molestation thing and as drugs go... well, once again, people don't get hooked on drugs unless they had some other problems that precipitated it first. If they were raised well, odds are better that they'd not be a drug addict.
If the flier says "go to evilticketcontesting.com", you just need to find who that domain is registered to, and contact the registrar and ISP to have it shut down. This is quick and straightforward, since internet registrars all keep good records of who they sell domains to, and all ISPs respond quickly to requests that are written in plain English. We should have this problem licked in time for dinner.
Oh, wait. Registrar accreditation is handled by these bumbling idiots. And how many ISPs that offer hosting services respond to much of anything?
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Genius!
Now you can get viruses by looking at anything with text on it!
WARNING This virus requires:
-A Computer running Windows
-Human stupidity, but not that much (i would fall for that maybe)
By reading this you agree to give me (Noxn) 1 dollar.
I went out to my car to go to lunch and there was this Nigerian Prince and his entourage standing there and he said he needed my helpto move some cash out of his country for his dead uncle or someone.
Sig Follows: "Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." -- Mark Twain
You don't even need a Virus or Malware to pull this off all you is a pay on link that takes your CC # and that likely will work even on super locked systems.
What makes it slightly scary is that it claims to be a parking violation.
However, I would likely make a very loud noise about being required to not only have Internet, but also a specific browser and a specific operating system, and having to download their software.
For unemployment, at least here, the entire thing is done over the Internet. However, the website pretty much works in any browser (though the layout was slightly off in Konqueror), and if you don't have Internet (or a computer), you walk to the unemployment office, they sit you down at one of their computers, and you do it there.
For a parking violation to be so unaccessible has got to be violating some regulation somewhere.
Just goes to show that no matter how much protection you have on the tech side, there's always a social engineering way around it.
Also goes to show how a little paranoia goes a long way.
Don't thank God, thank a doctor!
I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.
We have an abundance of uneducated people in the US, specifically those who don't know or understand the dangers of the internet. Also, a low infection rate is all it takes to get some return on investment.
To top it all off, Americans are first and foremost a scared people, especially of our own government and of forces outside our borders. Heaven forbid you piss off the government by not paying a parking ticket! You might lose your constitutional rights! Maybe they'll stop protecting you?!?!?! Maybe your a teenager who doesn't want your parents to find out?
Somehow these scams pay off and they only need a few suckers. And a new sucker is born every minute. Why do you think the "three cards, find the ace" scam still works in the alleyways and slums? It's one of the oldest scams in the book and those who are not educated don't know how it works and are easily manipulated.
"All great wisdom is contained in .signature files"
Holy lack of punctuation, batman!
Ninnle Linux has enhanced security for this sort of thing.
Ok, this article dredges up the old thread of "If Microsoft made cars" and the barbs cast back and forth about it. Makes me wonder, if the car was made by Microsoft, would the car get the virus directly from the malware flyer?
Don't fear the penguins
It would be a clever method of pen-testing a local client.
Only works locally, a parking cam can catch the real culprit (think in catching the originator of most of the spam/malware that goes thru email), and is somewhat shortlived (by the time most of the ones that got the ticket went to internet the site could have been taking down).
To make it much worse, YOU can catch him and take revenge of every spam/malware/spyware/virus you received ever. We can get an updated version of witch burning for the XXI century.
Some should rip in to the fake person giving out the tickets
How do you catch a fake person? Fake traps?
Aren't those the little pieces of paper that go under my wipers and always make it rain/snow?
Disclaimer: The opinions and actions of the US Gov't are in no way representative of those held by this author or its ci
Most people have by now been taught to no click willy-nilly on the screen, but people get fliers and other handouts with URLS on them all the time. We've been conditioned that to be sure you are going to the sight you really intend to go to, you have to manually enter the full URL.
Ok, for a car analogy:
Let's say my car was a Linux,
then I'd have nothing to worry about.
cheers,
Phase 4: Get assaulted in prison
Phase 5: Sue
Phase 6: Profit!
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
Ingenious! Simple and novel, there's a beauty to this scam just in its form. I wonder how effective it is. The workings of outlaw minds can sometimes be very interesting indeed.
... because the domain probably didn't end in .gov
It's supposed to be a parking ticket, right? But http://www.some.plausible.domain.name.com/ should be a red flag, just because of the .com
Use a Mac. I never have to worry about new and directed attacks like this with OS X. The only way this could affect a Mac user is if they go to a website, and run a downloaded executable as root... something no legit parking ticket site would do.
I don't have a car, you insensitive clod!
Isn't this awesome new moderation system such a great part of this fantastic new layout?
That is exactly the reason I turned it off. Slashdot's interface is becoming all flash and no function.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
The victim gets all pissed and wants to see the evidence and yell at someone. Their rational thinking (what little they have) goes out the window.
Engineering is the art of compromise.
... right away because they get their earliest warnings from honeypot machines and this one uses an offline vector.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I would like to make 100 copies for myself and stick them on any car I see parked like that SUV in the picture.
Jeeze, all you /.'ers and no one figured out that the ticket might be from someone like me that wants to get even with dweebs too rude to park in their own spot?
I bet the actual malware and whatnot was already out there. Some OTHER smart guy made the fake ticket with a link just to get even.
I need a pair of latex gloves then I can print my own at my colleague's computer. I have 20 cars in my office parking lot parked like that right now. I want to hit them before COB today.
Well first off, that is not the only method of acquiring samples. Second, the VirusTotal report uses default settings right? So it uses limited heuristics, therefore providing an inaccurate representation of real world AV results for those of us who properly configured our scanners. Am I right?
I bet the antivirus companies didn't have it right away because they get their earliest warnings from honeypot machines and this one uses an offline vector.
Well, they also monitor network traffic looking for network usage signatures that are likely to be worms or viruses and do not match known malware. I suspect the limited range of this malware causes little traffic, since it is only machines from a tiny number of people who obtained a flyer. It is likely just not big enough to have shown up yet.
Urgent! Bogus Parking Tickets Found on Campus Refer Recipients to Virus-laden Web site
Do Not Go To This Web Site!!!
A message concerning bogus parking tickets being distributed on campus that was sent out late Monday contained the URL of a Web site that carries a computer virus. We are resending that message below with the problem URL removed:
Here is the message:
UPD received a call on Jan. 31, 2009 pertaining to someone issuing bogus parking tickets in the parking lot directly east of the ramp. The ticket is yellow in color and states the following: "PARKING VIOLATION This vehicle is in violation of standard parking regulations. To view pictures with information about your parking preferences, go to XXXXXXX.COM" (URL not used for computer safety reasons)
DO NOT GO TO THIS WEBSITE!! IT CONTAINS A VIRUS!
If you visit the Web site and click on the link to view pictures of horrible parking, you will download a virus onto your computer.
Should anyone have any information pertaining to this, please contact UND Police at 777-3491.
Lt. Dan Lund
Night Shift Supervisor
UND Police Dept.
forget it.
malware is, and always will be, a stupid user issue. You can't solve stupid user issues with technology. Antivirus software is a sham, and a virus itself.
And we informed slashdotters will use FireFox with NoSript extension and laugh at them.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
You guys are missing the root of the problem. If the cars didn't have windows, then the users wouldn't have gotten infected.
I suggest a car like this.
http://www.m38a1.com/images/Archives/jeep%20_105%20gun%20jpg.jpg :p
Slashdotter, ID #101. UIDs are in binary, right?
Besides, not all virus scanners can search the contents of all installer types, and the installer is what was passed to the site. The results of the installation will probably trigger more virus scanners.
Stylish sheet to fix many problems in Slashdot's D3: https://gist.github.com/801524
These creative attempts at taking control of my computer won't fly on my beloved Mac Pro, I'm going to enjoy my low marketshare while it lasts...
...to not use Microsoft Windshields and the stuff it comes bundled with.
(love the fuzzy dice, though. why do people always say they cause crashes? strange.)
I was kind of intrigued at the title of this story, as I've never heard of malware being spread in this fashion. I was even more surprised that this happened in Grand Forks, the city (most of you would call it a town, but everything seems to be called a city here in North Dakota) where I live. The last time I remember Grand Forks being in the news was the flood of '97.
Some antivirus software programs use heuristic methods, the heuristic scanner could detect the malware, if it _really_ is unique (and not just reuse or a new variant of existing malware).
Heuristic AV software can collect and forward samples to AV makers who will then have it available.
There is so much malware out there though, that AV makers may not consider it a priority to fully id the new bad code, and design robust patterns to detect its variants, if there are only isolated infections.
Nah, you've gotta know their habits.
The best place to bag a few is down at local clothing stores. Just watch out 'cause they camouflage amongst the real ones, and you can't even do catch-and-release with those.
Repton.
They say that only an experienced wizard can do the tengu shuffle.
They should put some of those parking tickets on cop cars. See how many cops fall for it!
Technically, they probably carefully avoided a tech savvy Slashdot crowd.
/. poll. How often do you visit shopping malls.
By targetting parking lots outside large shopping malls outside the city centers I am sure they attack people listening to Britney Spears rather those rolling their own kernels. The chance of duping someone there seems more likely to me.
Hmmm. Next
1. Every day.
2. Several times a week
3. Several times a month
4. A few times every year
5. Grok you?
yes, but nice to see that Avira (the free for personal use AV which I have recommended to all and sundry for many years) was one of 7% of the AV vendors who did detect it.
Who needs a signature to fight this nonsense when those fliers are likely covered in fingerprints that most likely belong to some criminals.
The bread crumb trail you'll discover after you find the distributors will likely lead you to the author.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.