Slashdot Mirror
Click-Fraud Trojan Politely Updates Flash On Compromised Computers
jfruh writes: Kotver is in many ways a typical clickfraud trojan: it hijacks the user's browser process to create false clicks on banner ads, defrauding advertisers and ad networks. But one aspect of it is unusual: it updates the victim's installation of Flash to the most recent version, ensuring that similar malware can't get in.
Google it.
Or maybe it just wants to make sure that all ads are shown so that it can click on them.
Get free satoshi (Bitcoin) and Dogecoins
Not just "similar" malware, but anything that has a patched-to-date Flash infection vector. It might actually slow the spread of malware, while decreasing its own ability to spread, at least by that mechanism. And finally, when it's found and purged, the infected systems are somewhat more secure.
Not saying this is a good idea, but it seems that if it spread enough, it could decrease infectable targets in the short-term, maybe drastically?
Isn't "secure Flash" an oxymoron? Is there a "secure" version of Flash? Isn't that why we are migrating to HTML5 instead?
It's fucking Canadian malware!
Because every goddam time I try to update flash it fails.
I'm not sure how to feel about this. On the one hand, yes, trojans are bad. But on the other hand, anything that negatively impacts advertisers can't be all that bad.
.. I'm sure there is one of these jokes in here..
The real question is if it installs the Mcaffe, and if it doesn't anybody can point me out where can I get infected?
It's a breach of someone's terms of service maybe, but not fraud.
I want to give them credit, but isn't Flash itself malware in this day and age?
This is not fraud. Nothing of value is lost. It's a fake click. That is all. Bits in action. If you can't tell the difference, then you're the John Schmuck in this. Clicks aren't fraud. Clicks aren't even fake. They are as they are.
Except this headline. It's bait for a click. And it won! Yay!
JailBreakMe.com did a similar thing on iPhones: patched the tiff library exploit that it used to get on the phones in the first place, making it impossible to re-exploit.
I did the same thing with the Commodore Amiga in 1985, modifying a boot virus to include a payload that would patch the MOVE from processor SR. This let me install a 68010, which let me run SVR3 on the thing, without breaking a lot of popular software like Magic Sack and Transformer, both of which used the privileged version of the instruction for no good reason.
The trojan "politely" updates Flash? How would you do that "impolitely", exactly, by flashing a bunch of obscenities while updating Flash in the background?
Several times I've had new browser windows open from just viewing the list of new topics. Click fraud is rampant here on the /. beta.
how is this unusual behaviour? perhaps the author needs to get out more. this has been a well used approach by various hacking groups and malware for a long time to maintain exclusivity to compromised machines.
It could have been news - if you told us what novel exploit it used, who benefited, and how. That would have been news - and interesting.
But no - you had to put lipstick on a pig and try and flog the wedding night videos.
Malware has been doing the same thing for a long time - closing the weaknesses it used for access. The only thing that sounds new is the "reporting" slant. Politely. WTF - does it say "excuse me"? [sigh]
Samzenpuss - stop posting this shit please. (see that's polite).
jfruh - stop submitting this click-bait slanted crap, please. e.g. "Japanese And U.S. Piloted Robots To Brawl For National Pride". All you had to do was say "fighting robots" and more people would have read the story - no need for the Fox News histrionics. Stop acting like a whipped dog trying to get your "stories" published. You just embarrass yourself.
Thanks for lowering the standard.
Honestly I don't know why white hats haven't done something similar. Create a virus that downloads security updates automatically securing machines without the user knowing.
This one does it because multiple malwares start to slow the computer to a crawl forcing the user to get it fixed. where as having a single one may be below the annoyance level of taking the computer to a shop/asking your computer guy relative to fix your computer again.
Many countries work on the same principle. The first wave of immigrants to get established change the rules to stop more immigrants coming in.
Bob.
Wouldn't one way around the botnet issue be to infect vulnerable PCs, patch it, and then distribute it?
Of course a nastier but more effective way would be to put in a "time bomb" to delete every driver that allows for network accessible. Which is still nicer than bricking or wiping them.
Malware disrupts your machine or does something negative. Just because it wasn't invited doesn't make it malware. From the sound of it everything this does is positive.
https://helpx.adobe.com/securi...
Current browser activate click-to-play for insecure flash versions. This prevents auto-clicking. So the trojan horse* need recent flash.
* it's the trojan horse! The trojans were in the city, the greek were in the horse, trying to get into troja!