Slashdot Mirror
UK PC Users Hit By Huge Fake Antivirus Attack
An anonymous reader writes "UK Internet users were on the receiving end of a large drive-by web attack at the end of February, which attempted to push fake antivirus at least 750,000 times on a single day alone, security company AVG has said. According to a company analysis, on Sunday 27 February, detection levels for the previously obscure Russian 'Blackhole' exploit kit suddenly spiked to 900,000 globally from a few tens of thousands that would be typical for such kits, before dropping back again. Unusually, almost 750,000 of these detections were for UK PCs, which offers a baseline for what must have been a sustained attack several times that size against mainstream web servers frequented by users in the country."
What the hell are you talking about? 99.9% of the viruses affect Windows and only Windows, which, correct me if I'm wrong, last time I checked was LESS open than OS X. And if you want a totally safe, totally open OS, go with Linux. Your post contains lots of words but about 0 actual content.
Monstar L
I wonder, are the Mac users protected by their stupidity from fake anti-virus software. Were they thinking along the lines of a Certain XKCD comic but with Mac OS in place of liniux.
No mention of the Malware attacks named "McAfee" and "Symantec."
"It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
I like to fiddle with computers as much as anyone else, but oddly enjoy having an iPhone that just does and is locked down. So perhaps the way forward is to ship products that are, by default, locked up tighter than an iPhone but with the option to incrementally relax restrictions. This way the average user who couldn't care less about what is going on under the hood and is susceptible to drive-by attacks is fairly safe. But then those who would like to fiddle and are probably a lot more security conscious have the freedom they need. I also think that continual updates don't help much. The average user does just want a machine that they can use to browse the internet, type the odd letter, and so on. Continually pushing new versions of this and that gets them into the habit of updating and installing stuff they don't understand. It might be better to encourage these people to take their machine in for a regular service to someone who knows what they are doing, same as a car.
I have had to remove several viruses lately. It wasn't by "drive-by web attack", it happened by people getting phone calls or letters through the post, some were even sent CDs and told to install the "AV software". Quite odd, but I have fixed several PCs where people have followed the 'advice' given to them.
I know I have several others to fix because they received phone calls pretending to be their ISP for example.
More and more people will be attracted to the Apple closed garden model.
Only the non creative types who don't care or want to know how computers actually work. Oh wait - fancy that - PC users will end up developing the software for the Mac sheeple that just want to doodle in paintshop all day while telling everyone how wonderful their expensive Macs are. The problem with the closed garden is that it's a closed garden. That's all well and good if you have no idea what a computer is. But if you want to innovate and write, say, the NEXT closed garden, you cannot do that while constrained by artificial limits.
Seven puppies were harmed during the making of this post.
Is there a future for open platforms, and what can the FOSS community do to keep them both 1) open and 2) safe?
1) It already is open, so nothing to fix there. I don't run any time wasting virus scanner processes in the background, as I don't need any virus scanner on Linux, not because it more secure, but because I download my apps from an official Ubuntu repository, not random webpages found on the Internet. That doesn't stop bad things from happening, but if they happen that way its unlikely that any other local measurement would have prevented them.
2) Safe is relatively easy in theory, put every single application into a chroot()-alike and don't grand them full system access. The few cases where an application needs access (like files) can be handled in a secure manner without to much problem. In practice of course its not that easy, as nobody seems to be willing to take the first step and security is as always threated as an afterthought, not a core design feature.
The thing that provides hope and might be the reason to go "Safe" one day is that "Safe" isn't an opposite of "Open", they go hand in hand. A system where a single application can't destroy the system, is a system where I can run whatever I want from whoever I want. Its a system that provides the user with the most possible freedom. An unsecure system on the other side doesn't allow you to run anything you don't trust, thus drastically limiting your choices.
It might be better to encourage these people to take their machine in for a regular service to someone who knows what they are doing, same as a car.
It would be better just to do silent updates. Many people don't take their car for regular servicing, and even if they waited a couple of days, their machine could be pwned by then, credit card/banking info stolen, etc..
which is totally what she said
I've spent the past month clearing up the fall out of this explosion of Fake AV... It's the most common issue I see on computer in my repair shop these days, and has been for a few years now, but this confirms why it's been so hectic the past couple of weeks!
I am amused that AVG are going on about it when, like the rest of the mainstream antivirus products, AVG itself cannot prevent or remove these Fake AVs- by the time the user brings their computer to me, AVG, or any other antivirus is broken and crying in the corner of C:\Program Files, or just gone completely.
I think what people here are getting at is not IF something can be done (it obviously can), but whether "The Bad Guys", actually are willing to go through the effort to do it. It's a simple business choice:
1) You try exploiting a system that has MANY documented holes and that its users are more than likely less security conscientious than other tighter systems; ergo, unlikely to cancel credit cards in time or change passwords.
2) You try exploiting a system where it's generally harder to implement a successful exploit and where its users are more likely to reset their security in a blink of an eye if they smell foul play.
Hint: "The Bad Guys" are lazy by nature...
"I'm taking this loop off." - Jack O'Neill
They largely are. These offers of protection tend to download .EXE's since these fake antivirus companies don't waste time on anything that's non-Windows. In addition, a large majority of Mac users don't bother with Antivirus so they simply ignore these. Last but not least, they tend to be less gullible than Windows users.
http://www.daniweb.com/hardware-and-software/networking/news/218521
http://techcrunch.com/2009/12/10/microsoft-users-gullible-advertising/
Last but not least, these types of attacks tend to be fear driven and Windows users simply have more to fear from Viruses than Mac users at the moment. After years of sustained attacks, they are simply much to jumpy and easily frightened to pass up.
Had a typical midwesterner conversation this morning in college. It wasn't over exactly this antivirus fakeout, but it led up to the flaws behind the antivirus system, namely the symbiotic relationship between virus/antivirus. But the reason the antivirus companies make so much money, and the reason why fake virus attacks work, and so on, is because people are educated from the wrong directions.
This morning, after somebody realised I was a computer programmer they asked if I could hack into computer systems. Once we got past my incredulous phase where I can't believe somebody would ask something like that out in the open in front of other people, it came down to, "no, I can't, or if I can I don't want to".
Do you walk up to people and say "could you jack a car?" "Could you murder somebody?" Just right out in the open, not even meeting them? Try it out like this: do you tell them, "yeah, oh yeah!" You know how much federal time that is, right out the gate? By the time you affirm something like that, it's not the other person's liable time, either, it's yours. Even if it's also illegal to ask in the first place, seeking to conspire over these things and soliciting such skill through such a line of questioning.
But if it's computer hacking, well everybody feels that's a great thing. Everybody wants to know a hacker, see a hack going on. This is why it's very lucrative to make games where a person believes they are hacking a computer system, but never to make it very complex: they wouldn't know a hack if they were one, but they love the idea of trumping all this new-fangled computer nonsense that puts knots in their brains and makes them feel inferior. Oh, if only they could hack the machine and get it out of the damn way and just get down to brass tacks and business.
So I had to weather wave after wave of this guy begging for the reality of the grey-hat market. That maybe it's okay to commit computer crimes because if you get caught, you won't go to jail, the NSA will show up with the men in black and hire you into the upper, upper, uppity echelon of secret dream, top-level, wish fulfillment and instant gratification the real world won't let you have.
He promoted himself as some kind of brilliant business person, because he's spending money to go to college for business. He didn't even know to bring cash with him to do the printing he needed for this uppity business class trip of his, and wasn't independent minded enough to put it together on his own. I explained to him how to put the scanner and the printer together through the computer and pay for it off his printing account instead. I didn't even get a thanks, just a frankly indifferent, self-scolded, urban-culture "yeah that'll work that's cool".
So, when he got on me about where's all the grey hat money money, I told him, it's not supposed to be like that. The systems should be installed properly and used properly the first time. You don't go around giving your housekey away to strangers all in order to sustain the police records filing level industry, do you? You keep your shit secure because you want it. You do that because that's what your instincts want, is security. That's exactly what an employer is thinking, too. They aren't saying, hey, I want holes in my security to hire a grey-hat, so I'm going to go buy a security system, have it installed properly, and then have a mad hatter at the front desk surfing the web from an admin level unpatched windows desktop and taking bathroom breaks with the system password post-it noted over the keyboard numerical pad. That way I can hire a cool-sounded thing, like, the rugged individualist down on his luck who got caught stealing my wife's credit card number and now has been hand-picked by the NSA to come to me to charge me twice for my security: once to point out how I screwed it up and again to install the whole new system.
When I put it to him like that, he said, well, ha-ha, it's obvious you don't know biz-niss. I explained as well as I could that, in fact, he doesn't know bu
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
They just want their emails, facebook, youtube and video games.
Until they learn about a video game or other work that their walled garden of choice rejected.
I long for the time where computers will become a nerd-only item again.
Then the economies of scale will disappear, and nerds won't be able to afford a computer.
I like to fiddle with computers as much as anyone else, but oddly enjoy having an iPhone that just does and is locked down. So perhaps the way forward is to ship products that are, by default, locked up tighter than an iPhone but with the option to incrementally relax restrictions. This way the average user who couldn't care less about what is going on under the hood and is susceptible to drive-by attacks is fairly safe. But then those who would like to fiddle and are probably a lot more security conscious have the freedom they need.
That's much like Andriod behaves together with the Google store. The Google store provides the safety catch and you can get around that if you want to. A difference is that it does not rely on code inspection, so there is more chance of bad programs getting through. It also does not protect as much against programs that are just badly designed or are careless regarding security/privacy. The access conditions make sure that applications cannot just access any API even if you use another store or direct download. E.g. a game would require me to allow it to use phone functions.
I also think that continual updates don't help much. The average user does just want a machine that they can use to browse the internet, type the odd letter, and so on. Continually pushing new versions of this and that gets them into the habit of updating and installing stuff they don't understand. It might be better to encourage these people to take their machine in for a regular service to someone who knows what they are doing, same as a car.
I'm sorry, but that's a very bad idea. Even applications that are not susceptible to buffer overflows and other low level memory management related attacks are vulnerable to other kinds of attacks. If I would have a banking application on my mobile, I would like to make sure that it is up to date. Hey, maybe there is a bug in the SSL handling where they allow third party certs to be accepted.
The trick is to let the OS handle the updates, and make applications resistant against these updates. Again, with Android you get continuous messages that your application update won't harm your user data (and configuration, most of the time). That said, Android 2.1 has only been given auto-update functionality some time ago, and users need to activate it themselves. It would be a good idea to make that a access condition/setting as well for security relevant applications.
The problem with updates is that many people associate it with the (old) windows way of doing updates. Some kind of application specific updater (within the app itself or as a service/tray icon) indicates that there is an update. The user then has to go through X steps for the update to take place, shutting down all the required applications. Then the user may even be asked to do a restart, and should pray that the update went successfully. It's just so stupid if you have an operating system that does not even reliably let you manage your applications, it's just beyond belief.
This is a complex world, one cannot know about everything. Why would users be interested in the inner workings of anti-virus engines? Even I cannot grasp why *I* am interested in all this while the weather is just beautiful outside. How many people know about the inner workings of their car?
Sorry, but it is the job of the OS and applications to make sure that their users are safe. A good setup certainly should not require any anti-virus applications. Virus scanners are just a patch up job that is required when the OS and applications are not doing their job very well. The current batch of smart phone operating systems shows that the job can be done well; of course they have the luxury to drop legacy support.
I don't give credence to anything AVG says, since I caught its version 9.0 product red-handed denying me the ability to format any of my disk drives so long as it was installed. It maintained continually open files/folders on every drive, such that Windows would refuse to allow formatting any of them, and not just the boot drive. I uninstalled it and never looked back. The day an AV product denies me the ability to use a fundamental feature of the operating system is the day that product gets the boot.
This happened to my sister, who isn't really a dumb person. After talking with her I've come to establish the profile of an individual that would fall for these kinds of attack:
1. They are very trusting of something when they do trust it. This behavior is often associated with people who do well at school and follow their parents advice/beliefs
2. They don't use their computer much anymore, mainly relying on their phone instead
3. They own a computer that came pre-installed with an antivirus brand they don't recognize, so all they know about is that they wouldn't recognize it if it gave them a pop-up
4. Their anti-virus is expired and they falsely believe an expired anti-virus would detect viruses but refuse to to clean them
5. They get this fake virus full screen banner when they visit a trusted website. In my sister's case it was hotmail.com. This leads me to suspect it could had been either a rogue banner or she has a virus on her machine prior to the incident
6. Money is not an issue for them so they would rather throw money (and their credit card information) at an immediate problem ("YOUR COMPUTER HAS A VIRUS") than stop and think about the situation they aren't familiar with and try to deduce what is really happening
7. They don't read the newspaper in detail much anymore so they miss the millions of columns that have already warned about this scam
Fortunately she called me within minutes of installing the software and realized it all started to be very suspicious. We then got a new credit card number, disputed the charges, and used system restore (which is apparently all that is needed to get rid of this particular fake anti-virus).