Trojans and Popups and Slimeball Business

Selanit writes "Salon.com is reporting on a company which exploited a vulnerability in an old but common version of Internet Explorer's Java engine to install spyware on the visitor's machine. " It's a pretty in depth story showing the lack of respect that some companies have. My favorite part is that the guy who denies any knowledge of the trojan popup is named 'Frank Bigott'.

I wonder if this is true...

[Marx_Mrvelous]

There are a few things about the article that don't seem to make sense, aside from the basic premise and the guy's name. Is this another internet rumour that slipped into the press? Anyone have real-live experience with this?

The line gets thinner

[ringbarer]

How is this type of cancerware distinguishable from a virus that spreads by exploiting security vunerabilities?

It seems that all the Klez and Chernobyl kiddies have gone and got themselves some venture capital, and are turning their malware into a business.

Um..

[xtermz]

...Call me naive, but why isnt that states attorney general investigating this company? This is nothing short of corporate sponsored hax0ring.

I didnt see any mention in the article of somebody lodging a criminal or even civil complaint.

I think a big reason these companies get away with this crap is that nobody takes them to task for what they are doing...

Re:Microsoft, security and Java...

[Anonymous Coward]

Come on. Netscape's engine didn't follow the Java spec. In fact, it had more violations that Microsoft's engine.

Look who Sun chose to sue. Hmm...

That would explain...

[Nos.]

all those lame server on wwws1.com entries in my log files. My girlfriend's computer got hit by this, and I cleared it out (eventually). Funny, guys who can write these programs to monitor everything you do on the 'net, but can't setup DNS properly.

i thought flowgo.com was a known spamhouse...

[Anonymous Coward]

I am pretty sure that flowgo.com is a known spamhouse that sends fake "opt-in" mailbombs to users. I would recommend that blocking all mail from flowgo.com if you have a large userbase and need to keep spam off your servers.

Yep - definitely

[BenHmm]

I have.

Many times: it's why I now use Mozilla (well, that and the tabbed browsing and...and...and...) and Ad Aware.

Mostly it seems to be dialler programs for offshore ISPs. Porn, basically.

Use IE unprotected for a while, then run AdAware - it's quite scary.

Another reason why choice is good.

[aao-brad]

I think this is the problem with M$ trying to take over the world, so to speak. If all users in the world had to use M$ products and browsers, this kind of thing would happen a lot more. Why? There are a lot of other slimeball businesses out there thinking up ways of doing things, and I bet they'd read this article and wonder why they didn't think of it first.

With that in mind, if the slimeballs knew that they can target one platform / browser (which is the case now as most normal people use IE anyway), they can devise things like this. Personally I use Mozilla, and tonight I'm converting to Linux, so this won't be much of an issue. I just wish more people knew there were other choices out there besides M$, and then they wouldn't fall victim to this.

That comment is not insightful

[Darren Winsper]

It's just a statement with no supporting evidence.

Re:Um..

[ocelotbob]

...Call me naive, but why isnt that states attorney general investigating this company? This is nothing short of corporate sponsored hax0ring.

from the article:

Susan Henrichsen, deputy attorney general for the state of California, declined to comment on specifics of the IntelliTech situation. But she noted that downloading software onto someone's computer without permission is tantamount to hacking.

Sounds like the AG is looking into them. They probably are just getting their ducks into a row for a criminal case. With tech crimes like this, they don't want to make any mistakes and let someone go free who would have otherwise gone to jail.

Re:'scuse my language, but

[kubrick]

I can dream.

A lot of the large media companies would be happier if no other competition existed for people's attention. A lot of the recent legislation is aimed not only at controlling the means of media consumption, but also the means of media production.

In ten years, it could be illegal to put up a web site or run an ISP without arranging content licensing and censoring (like, say, Iran or China).

Don't like it? Get active about it.

You can dream, but the reality gets more and more like a nightmare each day. :(

Re:r-e-s-p-e-c-t

[gmack]

Personally I blame both sides.. on one hand you have some idiot taking advantage but on the other MS should have considered the security implictions before a lot of those features were shown the light of day.

Scary Stuff!

[newerbob]

Fortunately, I run ProximaBob, a pop-up killer that neuters Java and JavaScript from sites that I don't mark as trusted.

I hope this company is held accoutable.

There's another company that's nearly as bad: Real Networks. Ever see how much crap they try to install if you're not paying attention?

Our company now has RealPlayer on its banned list, because we consider it a virus.

Re:'scuse my language, but

[Steveftoth]

It used to be that you had to have an IQ of greater then 100 to actually even USE the internet.

Maybe that's why the internet was so much better before the Homer Simpsons of the world decided to get on the internet.

Re:Speaking of slimeball tactics....

[peddrenth]

the sleaziest thing I've yet seen in spyware, i.e., capitalizing on the emotional turmoil for 9/11

No, respectable people would never do that, would they? Respectable people like, hmmm, THE FBI???

Re:It was only a matter of time...

[cicho]

Not Kazaa. RadLight [slashdot.org]. They've been slapped for this and apparently stopped.

Re:That comment is not insightful

[spectecjr]

He didn't make any statement that needed any more supporting evidence than the post he was responding to.

If you had written applets between 1996 and 1998 using Netscape's VM, the Sun JVM and the Microsoft JVM at the time, and tried to get the same code working on all three, you wouldn't have needed any corroboration.

One of the worst was that Netscape's VM used completely different Z-Order to everyone else's. Their security manager was different.

I'd come up with more examples, but I've blocked out that awful part of my memory.

Simon