Slashdot Mirror
New Malware Imitates Browser Warning Pages
Jake writes with this excerpt from Ars:
"Microsoft is warning about a new piece of malware, Rogue:MSIL/Zeven, that auto-detects a user's browser and then imitates the relevant malware warning pages from Internet Explorer, Firefox, or Chrome. The fake warning pages are very similar to the real thing; you have to look closely to realize they aren't the real thing. The ploy is a basic social engineering scheme, but in this case the malware authors are relying on the user's trust in their browser, a tactic that hasn't been seen before. Beyond the warning pages, the actual malware looks like the real deal: it allows you to scan files, tells you when you're behind on your updates, and enables you to change your security and privacy settings. Performing a scan results in the product finding malicious files, but of course it cannot delete them unless you update, which requires paying for the full version. Attempting to buy the product will open an HTML window that provides a useless 'Safe Browsing Mode' with high-strength encryption. To top it all off, the rogue antivirus webpage looks awfully similar to the Microsoft Security Essentials webpage; even the awards received by MSE and a link to the Microsoft Malware Protection Center have been copied."
Imitating warning pages or other elements of the UI is not a new tactic. Back in the 90s and 2000s there were lots of "You are the 223423424th person to view this page" banners that were deliberately trying to imitate Windows 9X or XP.
Taxation is legalized theft, no more, no less.
All the more reason to theme your window manager - it makes this stuff obvious.
Go green: turn off your refrigerator.
There's plenty of rogue/fake AntiVirus programs out there. Is the new part that they imitate your browser rather than looking like a real anti virus program?
The first time the browser is used, create a security image like bank websites use. Store that image or the word used to generate it someplace where the malware will presumably not be able to access it.
One part is old - imitating the web browser error page, specifically the IE error page. I've had many a chuckle when running Galleon or some other Linux browser and seeing it pop up a well-imitated IE error page. The new part on this one is that they're checking which browser it is and making sure the error page matches the browser.
Is this just an advance posting of a presentation at MalCon?
These guys really need a conference to hone their skills, and take advantage of everyone who doesn't read /. daily (because those of us who do read /. daily are too smart to be conned by these losers). Right?
I need trepanation like I need a hole in the head.
You spend all this time writing this creative software (malware)...
Try fracking finding someone who can proofread your english; it's abysmal and frankly embarrassing. I realize it is not your native language but this lack of attention to detail is exactly the reason you find yourself writing malware in the first place ... oh and why the only people you manage to trick into this are on the bottom side of the intelligence bell curve.
"Oh, you hate your job? There's a support group for that, it's called everyone, they meet at the bar."
Firefox will have it fixed within hours.
Chrome will have it fixed within days.
Microsoft will issue a patch with in months.
A feeling of having made the same mistake before: Deja Foobar
The .gif image of a shield SAID SO!
You see? You see? Your stupid minds! Stupid! Stupid!
Bastards, I use Elinks. Couldn't they at least humor me and do background=#00000000 and set the font to courier 10 in neon green?
The biggest security hole is Microsoft's version of the javascript interpreter. They should collaborate with Google and adopt the rewrite for Chrome, it would solve half the problems right there.
BTW, I found a virius in yor post - clikc this link to free triel of PostScan 2010!
A feeling of having made the same mistake before: Deja Foobar
The biggest security hole is Microsoft's version of the javascript interpreter.
IE 9 will not use Windows Script Host's JavaScript interpreter. I predict that this change will make it easier for Microsoft to maintain the integrity of the sandbox.
Is there a Linux port? I'd love some malware. I miss having people trying to install software on my computer without permission! Maybe I should go get a Mac.
What offends me most about these malware tactics is that I'm savvy enough to recognize the spoof, but the low income kids and old people in my neighborhood aren't. I know not to click on anything that pops up in my browser when I'm surfing, but every week I get people on my porch needing help cleaning out their infected systems, which I do and they get infected again within a week. How can these malware authors take pride in preventing little kids and old people access to the Internet or their software? Where's the sport? What pathetic losers.
i ~ Celebrating Science, Cyberspace, Speculation
What about Safari and Opera users?
I've actually seen this malware in action. If you're infected and it decides to start running, there's not really much you can do. Disables the task manager as well. Library computers are most at risk.
I thought it was weird of Mozilla to push the personas idea since it seems tacky. But it's true that the window frame represents the security context for an application like a web browser, and a uniform customization of the frame would make the browser more secure against window imitation threats.
Looking at these new screenshots, they STILL have fucking grammar issues. If I'm going to fall for something, it's not going to be an error page with spelling errors and unnecessary exclamation points. How hard would it be for these fuckers to find a native English speaker to proofread their shit for them? Jeez.
WHO NEEDS SHIFT WHEN YOU HAVE CAPSLOCK/ DAMN1
God I love lynx. Can't infect my shit.
Of course, i have to borrow my neighbors computer to post here, lynx don't do web 2.0.
But I'm sure there's be a lynxweb2.0 fork anytime now...
Be seeing you...
The solution to this problem is to teach users to think for themselves, and to understand what's being asked of them. You sure as hell wouldn't trust a brand new doctor if he put you in for major surgery/medications after simply taking your weight ("Ooh, you're heavy, let's put a staple in your stomach"), why would you trust some inane browser message to do the same to your computer?
Any user must know what their level of aptitude is, know their limitations, and think for themselves (which is not the same as DIY or "trust no one"), to arrive at a solution that is circumspect of the user's knowledge level, perhaps supplemented by a trusted friend or paid professional. Any real pain can generally be avoided. But the defense must be human based, and must pass a Turing test, as this cannot be automated.
Software tools work for a thinking user, they don't think for the user.
Any company who claims their product makes security simple is full of it. The idea of a computer "so simple a child can use it" is a myth, or at least an unattained aspiration. So is easy security, for the foreseeable future. It takes at least one thinking adult human being to design, operate and maintain any machine.
Specifically, users also need to know the level of severity of "privilege escalation," and what constitutes such escalation in their environment. It's like signing a contract. You don't sign one without reading it. Sometimes all it takes is a single mouse click, and that's ridiculous. At a bare minimum, a user should know why they're escalating, what process is getting the escalation, and that it is warranted. They have to read the contract.
UAC leans too far toward "one click" casualness/simplicity, IMO. I much prefer the way sudo works. Since it requires a password, and generally GUI implementations accent that "administrative tasks" are about to be performed and the password is required, it puts a bullet point on the level of importance of what is being asked.
--
Toro
But then how can they claim that IE is an "integrated part of the OS" and not removable?
By continuing to use MSHTML for the help system. "Internet Explorer" itself is an insignificant piece of code, acting as a wrapper around an MSHTML browser control.
"The biggest security hole is Microsoft's version of the javascript interpreter."
Let me fix that for you.....
The biggest security hole is Microsoft's versions of operating systems... or what they laughingly call an "operating" system *cough-cough*
soylentnews.org Go there to enjoy the people!
1. This is a deceptive scam.
2. They are stealing people's money via easily proven fraud
3. The perpetrators should be easily identified by whoever cashes the cheques
What am I missing here?