Slashdot Mirror
New Malware Imitates Browser Warning Pages
Jake writes with this excerpt from Ars:
"Microsoft is warning about a new piece of malware, Rogue:MSIL/Zeven, that auto-detects a user's browser and then imitates the relevant malware warning pages from Internet Explorer, Firefox, or Chrome. The fake warning pages are very similar to the real thing; you have to look closely to realize they aren't the real thing. The ploy is a basic social engineering scheme, but in this case the malware authors are relying on the user's trust in their browser, a tactic that hasn't been seen before. Beyond the warning pages, the actual malware looks like the real deal: it allows you to scan files, tells you when you're behind on your updates, and enables you to change your security and privacy settings. Performing a scan results in the product finding malicious files, but of course it cannot delete them unless you update, which requires paying for the full version. Attempting to buy the product will open an HTML window that provides a useless 'Safe Browsing Mode' with high-strength encryption. To top it all off, the rogue antivirus webpage looks awfully similar to the Microsoft Security Essentials webpage; even the awards received by MSE and a link to the Microsoft Malware Protection Center have been copied."
Imitating warning pages or other elements of the UI is not a new tactic. Back in the 90s and 2000s there were lots of "You are the 223423424th person to view this page" banners that were deliberately trying to imitate Windows 9X or XP.
Taxation is legalized theft, no more, no less.
All the more reason to theme your window manager - it makes this stuff obvious.
Go green: turn off your refrigerator.
There's plenty of rogue/fake AntiVirus programs out there. Is the new part that they imitate your browser rather than looking like a real anti virus program?
The first time the browser is used, create a security image like bank websites use. Store that image or the word used to generate it someplace where the malware will presumably not be able to access it.
One part is old - imitating the web browser error page, specifically the IE error page. I've had many a chuckle when running Galleon or some other Linux browser and seeing it pop up a well-imitated IE error page. The new part on this one is that they're checking which browser it is and making sure the error page matches the browser.
Is this just an advance posting of a presentation at MalCon?
These guys really need a conference to hone their skills, and take advantage of everyone who doesn't read /. daily (because those of us who do read /. daily are too smart to be conned by these losers). Right?
I need trepanation like I need a hole in the head.
You spend all this time writing this creative software (malware)...
Try fracking finding someone who can proofread your english; it's abysmal and frankly embarrassing. I realize it is not your native language but this lack of attention to detail is exactly the reason you find yourself writing malware in the first place ... oh and why the only people you manage to trick into this are on the bottom side of the intelligence bell curve.
"Oh, you hate your job? There's a support group for that, it's called everyone, they meet at the bar."
Firefox will have it fixed within hours.
Chrome will have it fixed within days.
Microsoft will issue a patch with in months.
A feeling of having made the same mistake before: Deja Foobar
The .gif image of a shield SAID SO!
You see? You see? Your stupid minds! Stupid! Stupid!
Write anti-malware that looks like malware, or their most common sources? The Public certainly has a knack for finding it.
Disguise your anti-malware as: New Torrent Software, Cracked Versions of Popular games/key generators, Latest nude pic of the current fad celebrity, or hooked into some flash/pdf vulnerability
Malware would be driven to an all time low in a couple of years.
Bastards, I use Elinks. Couldn't they at least humor me and do background=#00000000 and set the font to courier 10 in neon green?
The biggest security hole is Microsoft's version of the javascript interpreter. They should collaborate with Google and adopt the rewrite for Chrome, it would solve half the problems right there.
BTW, I found a virius in yor post - clikc this link to free triel of PostScan 2010!
A feeling of having made the same mistake before: Deja Foobar
The biggest security hole is Microsoft's version of the javascript interpreter.
IE 9 will not use Windows Script Host's JavaScript interpreter. I predict that this change will make it easier for Microsoft to maintain the integrity of the sandbox.
Is there a Linux port? I'd love some malware. I miss having people trying to install software on my computer without permission! Maybe I should go get a Mac.
Always has been. Always will be. I'm educated. I don't punch the monkey. The two times I can think of where I got compromised, it was because I was on one of "those" sites. Yes, I admit it. The other time was Nimda, one of the rare email attacks that actually worked without the user being tricked.
Given the frequency with which I've been affected, it doesn't make sense to pay continuously, either with money or lost CPU cycles.
Responding to the Nimda attack by purchasing and installing A/V would have been like launching wars against two whole nations in response to an attack by rogue elements from one nation...
What offends me most about these malware tactics is that I'm savvy enough to recognize the spoof, but the low income kids and old people in my neighborhood aren't. I know not to click on anything that pops up in my browser when I'm surfing, but every week I get people on my porch needing help cleaning out their infected systems, which I do and they get infected again within a week. How can these malware authors take pride in preventing little kids and old people access to the Internet or their software? Where's the sport? What pathetic losers.
i ~ Celebrating Science, Cyberspace, Speculation
What about Safari and Opera users?
I've actually seen this malware in action. If you're infected and it decides to start running, there's not really much you can do. Disables the task manager as well. Library computers are most at risk.
I thought it was weird of Mozilla to push the personas idea since it seems tacky. But it's true that the window frame represents the security context for an application like a web browser, and a uniform customization of the frame would make the browser more secure against window imitation threats.
Looking at these new screenshots, they STILL have fucking grammar issues. If I'm going to fall for something, it's not going to be an error page with spelling errors and unnecessary exclamation points. How hard would it be for these fuckers to find a native English speaker to proofread their shit for them? Jeez.
WHO NEEDS SHIFT WHEN YOU HAVE CAPSLOCK/ DAMN1
I became infected by a similar virus about a week or so ago. I do not remember doing anything out of the ordinary that made me susceptible to intrusion, but I will say that I was on a website that uploads the latest raw scans of just-released japanese manga chapters. There are a lot of worries going to these sites, such as pop ups and redirects, but I have never had any problem in the past. You can usually close out these pop ups and redirects before they are aloud to load. Anyways, that is the only questionable activity I can think of that would have caused my computer to catch this virus.
I was surfing the internet, submitting homework via internet portals, and just basic operations when I noticed that I wasn't connected to the internet anymore. I looked at my connections to confirm that I was connected, which I was, but I still couldn't access any sites. Then, in my minimized icon list in the bottom right of my desktop, a warning message popped up that looked very similar to a Microsoft Windows warning box/message. (I wish I printscreened these messages, they would help reinforce my experience). The message said something like, "34 malicious viruses were found on your computer. Upgrade antivirus software to delete them." (I'm paraphrasing because I do not remember word-for-word what the message said). I was hesitant to click on the message, but I wanted to investigate further. So, I click on it and a program pops up on my screen, similar to any antivirus pop up menu, and begins to do a scan of my computer. It gets to about 12% when I stop it and cut my connections, physically and electronically. The name of this "anti-virus" program was "AV Security Suite." During the 12% of scanning it was able to do before I turned off my network connections, it stated that it found 34 viruses, spyware, etc. and that if I wanted to delete these malicious software I would have to upgrade by logging on to a website that AV Security Suite directs you to, and this upgrade will cost money.
(I want to state that I was skeptical the very second I saw the "Microsoft Windows warning message." This message, the AV Security Suite template, and the various other pop ups looked distinctly different than anything similar in nature that I have seen in windows, that's legitimate. These were different in that their font and placement of text and headers on the templates were different and inferior to that of legitimate Windows warnings. To the naked eye and merely glancing at the messages, it is still relatively easy to overlook their inadequacies.)
At this point I try to open my task manager, I try to scan my computer, I tried to do a lot of diagnostic stuff but to no avail. Every time I tried to open one of these applications a pop-up would come up saying, "[blank] is infected and cannot be opened." I wasn't even allowed to restore my computer to a previous point. I was stuck. This was the only computer that I had access to at 2 in the morning and I didn't want to reconnect to the internet with an infected computer, so I had to wait until the next day to find another computer to search the internet for information on this AV Security Suite and how to fix my computer.
Upon, searching for suggestions, I found that this Security Suite was indeed a virus and a very annoying one at that. It is installed from a trojan, which was downloaded from searching the internet. AV Security Suite blocks all applications unless the file name of the executable is for a web browser. This explains why I couldn't pull up my task manager or run diagnostic tests. I found out that in order to temporarily disable this virus is to restart the computer and bring up the task manager before AV loads up. Once you bring up the task manager, search through your processes until you find something that you do not recognize. I say, "...not recognized," because apparently the virus has variations of its name and it could be named something different on other people's computer. The process on my computer was called, "wtimhmishdw.e
After having supposedly detected viruses and spyware on my computer they offered to scan my hard drive. When I tried to say "No" or close the tab or close the pop-up or whatever, the advertisement reappeared and pretended to begin scanning my drive "C."
Closing the tab/window might be okay, but by clicking inside the fake window the of the fake antivirus you may have been giving the malware access it did not already have. There's no reason a "No" or "Cancel" button can't be fake too.
Steve will tell you why you should upgrade to the latest Sabre Tiger to get a fix, and why you should be thankful for this feature in the first place..
God I love lynx. Can't infect my shit.
Of course, i have to borrow my neighbors computer to post here, lynx don't do web 2.0.
But I'm sure there's be a lynxweb2.0 fork anytime now...
Be seeing you...
The solution to this problem is to teach users to think for themselves, and to understand what's being asked of them. You sure as hell wouldn't trust a brand new doctor if he put you in for major surgery/medications after simply taking your weight ("Ooh, you're heavy, let's put a staple in your stomach"), why would you trust some inane browser message to do the same to your computer?
Any user must know what their level of aptitude is, know their limitations, and think for themselves (which is not the same as DIY or "trust no one"), to arrive at a solution that is circumspect of the user's knowledge level, perhaps supplemented by a trusted friend or paid professional. Any real pain can generally be avoided. But the defense must be human based, and must pass a Turing test, as this cannot be automated.
Software tools work for a thinking user, they don't think for the user.
Any company who claims their product makes security simple is full of it. The idea of a computer "so simple a child can use it" is a myth, or at least an unattained aspiration. So is easy security, for the foreseeable future. It takes at least one thinking adult human being to design, operate and maintain any machine.
Specifically, users also need to know the level of severity of "privilege escalation," and what constitutes such escalation in their environment. It's like signing a contract. You don't sign one without reading it. Sometimes all it takes is a single mouse click, and that's ridiculous. At a bare minimum, a user should know why they're escalating, what process is getting the escalation, and that it is warranted. They have to read the contract.
UAC leans too far toward "one click" casualness/simplicity, IMO. I much prefer the way sudo works. Since it requires a password, and generally GUI implementations accent that "administrative tasks" are about to be performed and the password is required, it puts a bullet point on the level of importance of what is being asked.
--
Toro
But then how can they claim that IE is an "integrated part of the OS" and not removable?
By continuing to use MSHTML for the help system. "Internet Explorer" itself is an insignificant piece of code, acting as a wrapper around an MSHTML browser control.
"The biggest security hole is Microsoft's version of the javascript interpreter."
Let me fix that for you.....
The biggest security hole is Microsoft's versions of operating systems... or what they laughingly call an "operating" system *cough-cough*
soylentnews.org Go there to enjoy the people!
1. This is a deceptive scam.
2. They are stealing people's money via easily proven fraud
3. The perpetrators should be easily identified by whoever cashes the cheques
What am I missing here?