Slashdot Log In
Drive-By Download Poisons Google Search Results
Posted by
timothy
on Tue May 19, 2009 07:53 AM
from the monocultural-imperialism dept.
from the monocultural-imperialism dept.
snydeq writes "A new attack that peppers Google search results with malicious links is spreading quickly, CERT has warned. The attack, which can be found on several thousand legitimate Web sites, exploits flaws in Adobe software to install malware that steals FTP login credentials and hijacks the victim's browser, replacing Google search results with links chosen by the attackers. Known as Gumblar because at one point it used the Gumblar.cn domain, the attack is spreading quickly in part because its creators have been good at obfuscating their attack code and because they are using FTP login credentials to change folder permissions, leaving multiple ways they can get back into the server."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
The Importance of Being Forgotten (Score:5, Insightful)
About five years ago, I had installed some Firefox FTP plugin (FireFTP?) and was enjoying the simplicity of having my browser be used for multiple kinds of traffic when transferring files.
Well, we all know how bulletproof secure Firefox is, right? Not very. So I thought about it more and more I got really nervous about using something like this. I thought of the importance of all the things I had connected to--whether it be my friend's FTP server to drop off some pictures of our last vacation or one of several web hosts I had been working on. So in the end, I removed it from my machine as I wasn't sure how it was storing sessions and passwords. I also deleted the passwords from saved sessions in WinSCP on my Windows machines. Nowadays I just use the 'ftp' command in the shell no matter what operating system I'm using. Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!) but you know it sure beats being that guy that lost all his shit (and maybe some other people's) to something like this.
The integration of FTP clients into browsers and I think I've seen plugins in integrated development environments to remotely connect and upload your changes. While this may seem like a stream lined and faster path to development, acknowledge the risks you take when that's a server hosting data to users.
Re:The Importance of Being Forgotten (Score:5, Insightful)
It's a pretty rare thing in the computer world to gain convenience without sacrificing security.
In fact... Drop 'computer' out of that sentence and it's still true.
It's all about a balancing act. You have to take risks to be efficient... It's just part of life.
Parent
Re:The Importance of Being Forgotten (Score:4, Interesting)
On the contrary, security without convenience is a myth. When "logging in" is an arcane protocol, then the user focuses on technical details instead of thinking about potential avenues of attack. Computers should handle the arbitrary and fiddly details and leave only the critical aspects to the user.
The real problem with the security of credentials is that for some reason we're not willing to do the right thing, which is to encapsulate authentication in a small (and therefore easier to secure) subsystem, like a class 3 smart card reader.
Parent
Re: (Score:2, Insightful)
Smart card readers are only as secure as the smart cards themselves.
Re: (Score:3, Insightful)
Re:The Importance of Being Forgotten (Score:4, Informative)
ssh keys with passwords are the best bet. Run an agent so you only have to give your password occasionally and there really is not a lot to steal. They can take the private keyfile, but without the password it is useless. They can use ssh/scp on your behalf, but only until the session ends.
Putty has an agent for windows, OSX Leopard has an agent integrated with keychain, and Linux has agents that integrate with PAM. OSX and Linux allow it to be SSO with little risk of password/credential theft.
Parent
Re:The Importance of Being Forgotten (Score:4, Informative)
Parent
Re: (Score:3, Informative)
Re:The Importance of Being Forgotten (Score:5, Insightful)
Well, we all know how bulletproof secure Firefox is, right?
More to the point, we all know how secure FTP is, right?
Jebus, if you're that paranoid, why, dear god, weren't you using SFTP?
Parent
Re:The Importance of Being Forgotten (Score:4, Informative)
Nowadays I just use the 'ftp' command in the shell no matter what operating system I'm using. Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!) but you know it sure beats being that guy that lost all his shit (and maybe some other people's) to something like this.
You realise FireZilla makes this 100 times easier and is just as secure, right?
Parent
Re: (Score:2, Insightful)
Care to substantiate this? Firefox has a very good track record when it comes to security thanks to its quick responses to known vulnerabilities and patching almost all of them before they become publicly known.
Re:The Importance of Being Forgotten (Score:5, Funny)
Care to substantiate this? Firefox has a very good track record when it comes to security thanks to its quick responses to known vulnerabilities and patching almost all of them before they become publicly known.
Sure, let me explain:
Therefore, it is obvious that I'm right and Firefox has a long-standing track record of swiss cheese security that any infant can get around from remote without the user even turning on the computer. QED.
Next I'll tell you why spaghetti has a lousy track record in security issues. Right after I finish my stuffed pasta shells. Stupid spaghetti, stealing all the best features of stuffed pasta shells...
Parent
Re: (Score:3, Informative)
You make a good point. There's one thing that I find fault with, though:
Where do you see constant updates? HTML 4.01 has been out since 1997 or so. CSS2 has been out since 1998. HTML5, CSS2.1 and CSS3 are still in draft stage, though I will admit that CSS2.1 has been close to completion for quite some time now, which makes it valid for implementation.
I can't argue about ECMAScript. It seems to get an update a little quicker than the previously-mentioned
Wouldn't... (Score:3, Insightful)
... Flashblock basically remove this exploits ability to infect your PC?
Re:Wouldn't... (Score:4, Informative)
I guess this answers your question:
"Users who visit these compromised websites and have not applied updates for known PDF and Flash Player vulnerabilities may become infected with malware"
*sigh* Adobe...
Parent
Re: (Score:2, Insightful)
You hate it when PDFs freeze Firefox? (Score:5, Funny)
Parent
Re: (Score:2)
And with good reason.
Re: (Score:3, Interesting)
Which one should I use? Is FoxIt's reader any better? I suspect it also has some vulnerabilities but gets less attention from the bad guys because Acrobat's Reader is much mode widely used.
Re:Wouldn't... (Score:4, Insightful)
It's a good thing I got sick of it hanging actually, the whole PDF exploit thing came up a little after that. I still get randomly named PDFs downloading themselves sometimes, presumably they're exploit-loaded. Lately it occoured to me that, because Adobe includes a shell extension to render a preview image, simply selecting the file in Windows may be enough to trigger an exploit. Thoughts?
Parent
Re:Wouldn't... (Score:4, Interesting)
Parent
Re: (Score:3, Interesting)
Re: (Score:2)
So your PC can get infected whether the malign Flash code actual gets executed on your PC or not? I don't care about PDF as I don't have Adobe software installed to read them.
Re: (Score:2)
Re: (Score:3, Informative)
Security experts say that if you're using a fully patched system with up-to-date security software, you should be protected from these attacks. To date, they've worked by hitting the victim with malicious PDF or Flash files.
Sophos (Score:5, Informative)
According to Sophos [sophos.com], this particular exploit seems to be a hell of a lot more "popular" than other previous web-based malware.
The problem is with Adobe... (Score:5, Informative)
On OS X I don't even install the reader anymore.
But if you use it on Windows and aren't half bothered to find a more secure PDF reader... At least turn the plugin off in Firefox
Tools > Options > Applications
Set all Adobe to always ask.
Re: (Score:2, Insightful)
Yep. My step-daughter is always saying things like "I hate Ubuntu! It makes you load the PDF in a separate application, not right in the browser like on Windows!"
It's a security thing! The Adobe plugins suck.
Another way to fix the whole thing is to just use NoScript. No scripts running on a Web page == no drive-by downloads.
Re:The problem is with Adobe... (Score:5, Informative)
Install mozplugger and you can use evince to view PDFs inside of Firefox. If you install it on Ubuntu it happens automtically. It will use acroread if it's installed, I think; it will also use kpdf if you happen to be on Kubuntu, and I think xpdf for Xubuntu.
Parent
Re:The problem is with Adobe... (Score:4, Insightful)
> It's a security thing! The Adobe plugin suck.
Oh, it's a security thing. Really? Now please explain to me, why it is more
secure to open the PDF in the standalone Acrobat Reader running under the
same uid as your browser (and thus under the same uid as the standalone Reader).
It would be a security thing to use another PDF reader instead of Acrobat
Reader, but this has nothing to do with the fact if it is runs as a plugin
or not. You can both embed Acrobat Reader and other PDF readers into the
browser window in Linux.
So instead of using lame excuses to your step daugther, thus making her linux
experience bad and therefore make her dislike linux, just fix the damn box
to show the PDF inside the browser.
Parent
Re:The problem is with Adobe... (Score:4, Interesting)
There seems to be no word about this attack working under linux anyway.
Parent
Re: (Score:3, Funny)
No problemo [geocities.com].
Re: (Score:2)
Problem is that pdfreader and flash are made by same company...and a lot of websites are stupid enough to use flash only on their websites....without even so much as some html sidelines, in case you don't have flash. So guess what ....you see u need flash, u download it, then it auto installs other stuff (common to adobe) which might share some of it with pdfreader...so even if you don't have it installed, you might have some of the components installed anyways.
Re: (Score:3, Informative)
or just use foxit
same bug [computerworld.com.au]
Don't use FTP anyways (Score:4, Informative)
Don't use FTP anyways for anything sensitive like uploading to your website. I used to do that, then got infected by a virus of sorts. What it did was sniff the (non-encrypted) FTP packets to steal credentials, then log in and replace all the index files on the server with its malware infected version.
That got me to of my websites to be infected and being blocked by Firefox/Google for being reported as attack sites. Now I only use SFTP/SCP.
Re: (Score:2)
Umm... did I get something wrong? When I'm sitting in the machine establishing an FTP connection, I don't have to sniff the wire. Either I log the keystrokes, or if it's a stored password, I hook into the FTP client and grab the password before it's sent (or, if encrypted, before it's reencrypted).
A little warning (Score:3, Informative)
I got infected with this piece of shit (or some other very similar piece of shit) because malicious code on a website somehow forced Adobe Reader to open a PDF, although Foxit had been my default PDF reader for months (in conjunction with the PDF Download add-on, which was somehow circumvented as well).
Sure, I should have been suspicious instead of just annoyed at AR opening out of the blue. And sure, I should have uninstalled AR when I started using Foxit, instead of just letting it sit on my computer. This is just a warning to other people that are as stupid as me.
6 website infected with this last month (Score:5, Informative)
I had 6 websites infected by this last month. Flash and PDF downloads starting in iframes offscreen.... based out of China.
Not sure if it was a web exploit or ftp login theft. We looked at both early on as the footprint was confusing in that things were happening that shouldn't be possible without direct access to the server via ftp.
We changed all passwords to be sure that there weren't any old ones floating around on insecure PCs in the company or with clients, then updated all applications do remove any known exploits. Then added in rewrite rules to stop libwww and other known agents from accessing any files via the web.
Seems to have worked, no more exploits happening (lots of tagging was happening in addition to Gumblar).
It's odd that it took so long for this advisory to come out though. Maybe we should have reported it but we did not know it was new as both exploits were known at the time, just no connected with a specific initiative by a hacker/botnet.
Adobe Reader 9.1.1 not installed by default! (Score:5, Interesting)
I've seen this. (Score:5, Informative)
I got to clean out a system with this about a week ago. It was really nasty.
The worst part was that I spent the better part of two days trying to figure out why the search links were still being poisoned, even after nothing on several LiveCDs found anything...it turned out that it had installed an invisible Firefox plugin/extension which was doing it.
Exciting, huh?
Re: (Score:2)
Server side of things could use work too.
Uninstall the FTP server. Configure to login using public key authentication and disable passwords.
Re: (Score:2)
With all the better alternatives out there
Yeah, it's not like Adobe's software is the standard in some industries. /sarcasm
Re: (Score:2)
With all the better alternatives out there, anybody who uses Adobe software deserve to get malware. Think of it as evolution in action.
Actually I was thinking the same thing but about ftp. I can't remember the last time I needed to use an ftp client. Must be at *least* 5 years ago - probably more.
DON'T CLICK LINK IN PARENT POST (NSFW) (Score:5, Informative)
This may not have been intentional, but the Scroogle link in parent post is wrong, and goes to a site that is NSFW.
Correct link is here [scroogle.org].
Parent
Re:What is is NSFW? (Score:4, Funny)
Just scroogle it.
Parent
Google Attacks (With Corrected Link) (Score:2, Insightful)
(Reposted with Correct Link)
As the article points out, these trojans/viruses that use Google and other search engines are becoming more common. My mother got one that replaced all of the major search engine results with fake spyware and antivirus software links. I imagine its popular because its a bit subtle and pernicious. How much malware is out there that is undiscovered because the affects are more subtle? Maybe reordering search results? Replacing ads with different ones?
For my mom, I ended up using ht [scroogle.org]
Re:Google Attacks (Score:5, Interesting)
Trojans that modify your browser's behaviour don't care for connections or encryption thereof, because the modification happens much higher in the chain. I had a trojan to dissect that literally changed your online banking information inside the browser. You saw that you're transfering A bucks to B, while the trojan sent to the bank you're transfering C bucks to D. The bank confirmed C bucks for D, and the browser asked the user for the confirmation code to send A bucks to B.
As soon as the browser is under the control of malware, it can manipulate your input before it is encrypted and sent through the wire, and manipulate the output after it has been decrypted and before you get to see it.
Locking down the browser would essentially also mean that you disable anything that can inject code into running processes (createremoteprocess and the like), as well as disallow browser plugins. I doubt many people would really want that.
Parent
Re: (Score:3, Informative)
Hey - thanks for the link to a nice website. :-)
Re: (Score:3, Insightful)
Re: (Score:3)