Slashdot Mirror
New Malware Overwrites Software Updaters
itwbennett writes "Researchers at Bach Khoa Internetwork Security (BKIS), a Vietnamese security company, have found a new type of malware that 'masks itself as an updater for Adobe Systems' products and other software such as Java,' wrote BKIS analyst Nguyen Cong Cuong in a post on the company's blog. BKIS showed screenshots of a variant of the malware that imitates Adobe Reader version 9 and overwrites the AdobeUpdater.exe, which regularly checks in with Adobe to see if a new version of the software is available."
I've always filed the original forms of both these aggressive updaters under malware anyway...
Everybody I know would click through that bad boy without a moment's hesitation.
On the one hand, it's malware, on the other hand it replaces software from Adobe.
I can't decide if it's an enhancement or not.
Malware that poses as an updater or installer for applications such as Adobe's Acrobat or Flash are nothing new, said Rik Ferguson, senior security advisor for Trend Micro.
If your copy of AdobeUpdater.exe runs reliably without unexplained crashing, you are probably running the malware version.
On the strength of this, looks like Java will be following it.
What difference will that make to my general new-fangled-interweb experience?
Enquiring minds need to know...
If I had an Ass, I'd call it Fanny Bottom, then I could slap my Ass; Fanny Bottom, on the Arse.
about a month ago, while going through the motions of updating java one day (clicking on all those security warnings, running the little interface), i thought: to hack a system, why not just copy this stupid little interface and have the user gleefully click through all of the little security warnings?
and now my fleeting paranoia is reality: you can't trust the updaters anymore
which makes this news from two days ago all the more prescient:
http://it.slashdot.org/article.pl?sid=10/03/24/189248
"Microsoft To Distribute Third-Party Patches"
furthermore, i despise the fact that just because i have quicktime and adobe and java installed, i have to always have these useless potentially bogus processes constantly running in the background doing nothing but waiting for their once monthly updates
it makes much better sense to have ALL software updated through one repository which, obviously, has to be microsoft
now microsoft is responsible for a secure update process, you don't have to worry about 9 different third party update mechanisms and have them constantly running, and finally, the big fat shiny nail in the coffin: you don't have to worry about this malware posing as an updater
a negative being: now you're pretty much sending microsoft a manifest of all of your installed software every time you get an update, but i see no way around that without this new hack entering the picture
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
They have stolen my idea! Can I patent malware?
I used to sit there and think, "well, if I were a criminal, I'd do this, that and the other" (this that and the other being stuff like replacing updaters, faking out security software so it couldn't update, having multiple processes that "watchdogged" each other, yada yada). Nowadays, they're doing that shit and a whole lot more I never thought of.
Once your system is comprised, it's pretty much never a good idea to trust it until its been completely rebuilt from the ground up.
I'm currently in the middle of doing this for a friend. Whatever the heck he had was so dug in that I had him replace the hard drive, reinstall a fresh OS, patch up, reinstall apps from disk, and now I'm restoring his user data from the original drive (carefully with auto-run disabled) mounted from a USB enclosure.
The Digital Sorceress
I don't get it. If your system has had Administrator-owned files replaced with malicious versions, then your system has already been compromised! Game over. It's already too late.
there's a difference between a pop up in a browser frame and a modal dialog box from an application
and, get this, you can actually see the difference
and, i hope i'm not getting too far ahead of you here, it matters in terms of what kind of attack vector you are dealing with
have i totally blown your mind yet? ;-P
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Seeing as how 'a black fly in your chardonnay' is classified as 'pretty darn ironic' on the Morrisette Scale, I think her scale might be broken.
Now if that's not an excuse to get away from Adobe Reader, what is? This?
Why are these Windows malware problems constantly cropping up?
If only there were a less malware-prone OS to use . . .
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
Me neither, and sometimes I even fall prey to it.
# sudo apt-get install malware
Password:
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
cool-benign-app-1.1
After this operation, 1.6MB of additional disk space will be used.
Do you want to continue? [Y/n]? y
I did that and got infected. WTF?! I'll never use cool-benign-app again!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
See while most only go to 10, ours goes to 11.
That's one more ironic.
furthermore, i despise the fact that just because i have quicktime and adobe and java installed, i have to always have these useless potentially bogus processes constantly running in the background doing nothing but waiting for their once monthly updates
All Intuit products do this to and it annoys the piss out of me - annoyed the piss, I mean, since I ripped every goddamn Intuit app off of my system.
One central updater.. for everything! Plus its Linux, so its not like there's malware there anyway.
I did notice one time though that the Ubuntu updater did update Firefox and a bunch of things stopped working. I had to reboot to clear it. I tracked it down to a library that had been updated, that apparently was confusing ld or something. Would have been nice to have been warned...
Anyway, the fact that there is only one updater is a win for Linux.
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
That is a really good strategy as lots corporate device control polices will have exceptions for those sorts of things. Now admins should be using hashes to check those but we all know they just trust the name because its a pain to update their policy evertime an updater gets updated.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
When Microsoft introduced Windows Update there was a lot of speculation that it would be compromised and used as an infection vector. That threat never seemed to materialize. I always thought that the 3rd party apps like Adobe, Java, etc would be more vulnerable due to the fact that they run on the local machine.
At the rate it takes Microsoft to adjust, we should have a centralized patch management system by 2020.
I'm tired of malware being differentiated just because it comes from a commercial entity. When you're replacing things that are practically system components (assuming most people have adobe pdf reader installed) then as far as I'm concerned this is a trojan, not some innocent advertising software.
Companies that make this software are getting too easy a ride on this and should be taken to court the same way someone who writes an Internet Worm would.
I completely neutered my copy of Adobe.
Just curious, instead of going to all that trouble, why wouldn't something like Foxit be simpler and easier with similar results?
Queens of the Stone Age - they rule
Next time you "del GoogleUpdate.exe", try "mkdir GoogleUpdate.exe" That should stop it from being reinstalled for a while, unless it really is malware.