Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security Businesses Google The Internet IT

Drive-By Download Poisons Google Search Results 136

Posted by timothy from the monocultural-imperialism dept.
snydeq writes "A new attack that peppers Google search results with malicious links is spreading quickly, CERT has warned. The attack, which can be found on several thousand legitimate Web sites, exploits flaws in Adobe software to install malware that steals FTP login credentials and hijacks the victim's browser, replacing Google search results with links chosen by the attackers. Known as Gumblar because at one point it used the Gumblar.cn domain, the attack is spreading quickly in part because its creators have been good at obfuscating their attack code and because they are using FTP login credentials to change folder permissions, leaving multiple ways they can get back into the server."
This discussion has been archived. No new comments can be posted.

Drive-By Download Poisons Google Search Results More

Drive-By Download Poisons Google Search Results

Comments Filter:

  • ... that steals FTP login credentials ...

    About five years ago, I had installed some Firefox FTP plugin (FireFTP?) and was enjoying the simplicity of having my browser be used for multiple kinds of traffic when transferring files.

    Well, we all know how bulletproof secure Firefox is, right? Not very. So I thought about it more and more I got really nervous about using something like this. I thought of the importance of all the things I had connected to--whether it be my friend's FTP server to drop off some pictures of our last vacation or one of several web hosts I had been working on. So in the end, I removed it from my machine as I wasn't sure how it was storing sessions and passwords. I also deleted the passwords from saved sessions in WinSCP on my Windows machines. Nowadays I just use the 'ftp' command in the shell no matter what operating system I'm using. Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!) but you know it sure beats being that guy that lost all his shit (and maybe some other people's) to something like this.

    The integration of FTP clients into browsers and I think I've seen plugins in integrated development environments to remotely connect and upload your changes. While this may seem like a stream lined and faster path to development, acknowledge the risks you take when that's a server hosting data to users.

    • Re:The Importance of Being Forgotten (Score:5, Insightful)

      by Aladrin ( 926209 ) on Tuesday May 19, 2009 @08:06AM (#28010503)

      It's a pretty rare thing in the computer world to gain convenience without sacrificing security.

      In fact... Drop 'computer' out of that sentence and it's still true.

      It's all about a balancing act. You have to take risks to be efficient... It's just part of life.

      • Re:The Importance of Being Forgotten (Score:4, Interesting)

        by Anonymous Coward on Tuesday May 19, 2009 @08:17AM (#28010615)

        On the contrary, security without convenience is a myth. When "logging in" is an arcane protocol, then the user focuses on technical details instead of thinking about potential avenues of attack. Computers should handle the arbitrary and fiddly details and leave only the critical aspects to the user.

        The real problem with the security of credentials is that for some reason we're not willing to do the right thing, which is to encapsulate authentication in a small (and therefore easier to secure) subsystem, like a class 3 smart card reader.

        • Re: (Score:2, Insightful)

          by morgan_greywolf ( 835522 )

          Smart card readers are only as secure as the smart cards themselves.

          • Re: (Score:2, Insightful)

            by CatBegemot ( 1326539 )
            "Smart card readers are only as secure as people using them" Here, fixed that for you. You're welcome.

            • Re: (Score:2)

              by Dan541 ( 1032000 )

              I think you mean "Smart cards are only as smart as the people using them"

              In conclusion; the future looks very insecure.

          • Smart card readers are only as secure as the smart cards themselves.

            And that's why I run my smartcard device through a rot13 filter, folks! And, when I'm getting truly paranoid about it, I skip straight to TRIPLE-rot13 filtering!

        • Re: (Score:3, Insightful)

          by Presto Vivace ( 882157 )
          Security that is too cumbersome with be ignored by users, they will us go-arounds that dispense with security all together. Ease of use is a critical part of security.

        • On the contrary, security without convenience is a myth. When "logging in" is an arcane protocol, then the user focuses on technical details instead of thinking about potential avenues of attack. Computers should handle the arbitrary and fiddly details and leave only the critical aspects to the user

          I couldn't agree more. The trouble is this: how? Secondarily, who defines what is important enough to bother the user with?

    • Re:The Importance of Being Forgotten (Score:4, Informative)

      by _LORAX_ ( 4790 ) on Tuesday May 19, 2009 @08:32AM (#28010779) Homepage

      ssh keys with passwords are the best bet. Run an agent so you only have to give your password occasionally and there really is not a lot to steal. They can take the private keyfile, but without the password it is useless. They can use ssh/scp on your behalf, but only until the session ends.

      Putty has an agent for windows, OSX Leopard has an agent integrated with keychain, and Linux has agents that integrate with PAM. OSX and Linux allow it to be SSO with little risk of password/credential theft.

    • Re:The Importance of Being Forgotten (Score:5, Insightful)

      by Abcd1234 ( 188840 ) on Tuesday May 19, 2009 @08:45AM (#28010919) Homepage

      Well, we all know how bulletproof secure Firefox is, right?

      More to the point, we all know how secure FTP is, right?

      Jebus, if you're that paranoid, why, dear god, weren't you using SFTP?

      • Re: (Score:1, Insightful)

        by Anonymous Coward

        Well, we all know how bulletproof secure Firefox is, right?

        More to the point, we all know how secure FTP is, right?

        Jebus, if you're that paranoid, why, dear god, weren't you using SFTP?

        Um, if you bothered to read his post, WinSCP and FireFTP are both SFTP or support it at least. And if he's connecting to other people's servers, what is he supposed to do? Ask them to move to SFTP before he will help or transfer?

    • Re:The Importance of Being Forgotten (Score:4, Informative)

      by gparent ( 1242548 ) on Tuesday May 19, 2009 @09:18AM (#28011333)

      Nowadays I just use the 'ftp' command in the shell no matter what operating system I'm using. Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!) but you know it sure beats being that guy that lost all his shit (and maybe some other people's) to something like this.

      You realise FireZilla makes this 100 times easier and is just as secure, right?

    • Re: (Score:2, Insightful)

      by BenoitRen ( 998927 )

      Well, we all know how bulletproof secure Firefox is, right? Not very.

      Care to substantiate this? Firefox has a very good track record when it comes to security thanks to its quick responses to known vulnerabilities and patching almost all of them before they become publicly known.

      • Re:The Importance of Being Forgotten (Score:5, Funny)

        by Anonymous Coward on Tuesday May 19, 2009 @10:39AM (#28012537)

        Well, we all know how bulletproof secure Firefox is, right? Not very.

        Care to substantiate this? Firefox has a very good track record when it comes to security thanks to its quick responses to known vulnerabilities and patching almost all of them before they become publicly known.

        Sure, let me explain:

        1. I am snide.
        2. I am a bitter fanboy of another browser, which, for the sake of argument, I'll call... um... "Mop-er-ah".
        3. Firefox is more popular than my pet browser.
        4. By points 2 and 3 (and with help from 1), I am indier than thou.

        Therefore, it is obvious that I'm right and Firefox has a long-standing track record of swiss cheese security that any infant can get around from remote without the user even turning on the computer. QED.

        Next I'll tell you why spaghetti has a lousy track record in security issues. Right after I finish my stuffed pasta shells. Stupid spaghetti, stealing all the best features of stuffed pasta shells...

    • FTP is sent in plain text. Even a noob can sniff your credentials out of the ether. You would be much better off using SCP where available.

    • Re: (Score:2)

      by knarf ( 34928 )

      Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!)

      Use lftp [lftp.yar.ru] and you'll get your tab-completion, both local and remote...

    • Hi,

      You may find lftp a good cli client! Very handy tab-completion and shell integration. I use it whenever possible.

    • Re: (Score:2, Insightful)

      by 117 ( 1013655 )

      Nowadays I just use the 'ftp' command in the shell no matter what operating system I'm using. Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!) but you know it sure beats being that guy that lost all his shit (and maybe some other people's) to something like this.

      As you mentioned that you use Windows machines, why not just use Windows Explorer for FTP purposes?

    • You think ftp:// [ftp] is forgotten about? What about gopher:// [gopher] !?

    • Re: (Score:2)

      by S-100 ( 1295224 )
      So you had no indication that your credentials were being stored improperly, but you dumped FireFTP anyway? If you were worried about vulnerable FTP credentials, all you had to do was delete them after you were done, or delete the plug-in in between uses (it's fast and easy to re-install). But I guess you like to punish yourself.

      Incidentally, the command line FTP program is just as vulnerable to the exploit in TFA. A security hole in unpatched Adobe software (i.e. Flash player, PDF viewer) installs spyw

  • Wouldn't... (Score:3, Insightful)

    by Jaysyn ( 203771 ) on Tuesday May 19, 2009 @07:59AM (#28010413) Homepage Journal

    ... Flashblock basically remove this exploits ability to infect your PC?

    • TFA says that it exploits flaws in adobe reader and acrobat, so no

      • Re: (Score:3, Informative)

        by TheP4st ( 1164315 )
        TFA [infoworld.com] says:

        Security experts say that if you're using a fully patched system with up-to-date security software, you should be protected from these attacks. To date, they've worked by hitting the victim with malicious PDF or Flash files.

    • Re:Wouldn't... (Score:4, Informative)

      by ZirconCode ( 1477363 ) on Tuesday May 19, 2009 @08:05AM (#28010497)

      I guess this answers your question:

      "Users who visit these compromised websites and have not applied updates for known PDF and Flash Player vulnerabilities may become infected with malware"

      *sigh* Adobe...

      • Re: (Score:2, Insightful)

        by Anonymous Coward
        I think Adobe (PDF and Flash) are the biggest nuisance to computers. I hate it when PDFs in firefox freeze the browser.

        • You hate it when PDFs freeze Firefox? (Score:5, Funny)

          by Norsefire ( 1494323 ) * on Tuesday May 19, 2009 @08:19AM (#28010643) Journal
          I hate it when PDFs freeze Acrobat Reader.

          • Re: (Score:2)

            by Minwee ( 522556 )

            I hate [...] Acrobat Reader.

            And with good reason.

          • i hate flash when i can't play hd youtube videos, even though i can watch 1080p video on vlc easily.

          • Shame on you! Get a free reader that isn't so vulnerable.

            • Re: (Score:3, Interesting)

              by andi75 ( 84413 )

              Which one should I use? Is FoxIt's reader any better? I suspect it also has some vulnerabilities but gets less attention from the bad guys because Acrobat's Reader is much mode widely used.

              • Re: (Score:2, Informative)

                by fluffman86 ( 1006119 )

                In Windows, I like Sumatra [kowalczyk.info]. It's smaller and faster than Foxit, and doesn't allow javascript and crap that causes problems in Adobe Reader. It does, however, sometimes have trouble rendering some more complicated pdf's, but you could always keep foxit around for that rare occasion.

                • Re: (Score:2)

                  by ais523 ( 1172701 )
                  Well, my experience has been that Linux PDF readers work much better than Windows PDF readers. I don't use Foxit because I don't like the licensing of it; Adobe Reader is awful as always, and Sumatra is nice although its UI needs work and it often renders differently to other readers. On the other hand, both Evince and KPDF are excellent at reading PDFs; they get out of the way and render PDFs as I expect them to render. (I wonder if KPDF is available for Windows yet, or if it will be in the future? That mi

              • "I suspect it also has some vulnerabilities but gets less attention from the bad guys because Acrobat's Reader is much mode widely used."

                Precisely. Using the most popular, and being part of the crowd, marks you as prey for the predators.

                I use Foxit and Sumatra. Haven't installed Adobe PDF products in years - literally. I would stop using Flash, but often times I'm just to lazy to download a version for VLC. Besides which, some sites seem to block access by any means other than Adobe Flash.

                • My reaction to sites which are only accessible via Flash are 1) a complaint to the webmaster, if I can find even that much, and 2) to not use that site.

                  If they're so feeble as all that, then they deserve what they get.

        • Re:Wouldn't... (Score:4, Insightful)

          by Spatial ( 1235392 ) on Tuesday May 19, 2009 @08:34AM (#28010787)
          Me too. It's crap anyway, so I turned it off and set FF to download PDFs to a folder instead.

          It's a good thing I got sick of it hanging actually, the whole PDF exploit thing came up a little after that. I still get randomly named PDFs downloading themselves sometimes, presumably they're exploit-loaded. Lately it occoured to me that, because Adobe includes a shell extension to render a preview image, simply selecting the file in Windows may be enough to trigger an exploit. Thoughts?

        • Re: (Score:3, Interesting)

          by averner ( 1341263 )
          This is pretty much the only reason I use Chrome rather than Firefox - Chrome freezes less often when something in it acts slow.

        • I think Adobe (PDF and Flash) are the biggest nuisance to computers. I hate it when PDFs in firefox freeze the browser.

          Check out the FF add-on PDF Download [mozilla.org]. When you click on a link that goes to a PDF it prompts you and asks if you want to open it in the browser, save it to disk, or open in with Adobe Reader (outside the browser). No more FF lockups on PDFs for me.

          • Go to Tool->Options->Applications section.

            Look for Adobe Acrobat # Document or Application/pdf and make sure it is set to Always Ask

            No need to install an extension for this. Now you can choose Open which will download the pdf, save it to the temp dir, then open your local pdf program. Or you can choose Save and save it somewhere.

            The main reason FF will freeze is because the Adobe plugin will display the first page of the pdf as soon as it can. Then if you hit page down before the next page is finished

      • Re: (Score:2)

        by Jaysyn ( 203771 )

        So your PC can get infected whether the malign Flash code actual gets executed on your PC or not? I don't care about PDF as I don't have Adobe software installed to read them.

      • I've given up on adobe acrobat reader. I'm using mozplugger and xpdf/kpdf/insert favourite pdf viewer here.

      • I believe that this is simply the Darwin theory at work in the world of computer users. Why should we fret? I, for one, welcome the extinction of those not smart enough to protect themselves.

        It's like a helmet law. "Which is even stupider, the idea behind the helmet law being to preserve a brain whose judgment is so poor, it does not even try to avoid the cracking of the head it's in." to quote Jerry Seinfeld.

        • You're ignoring the scenario where the person who gets pwned has access rights to your sensitive information (bank, school, government agency, employer).

        • Re: (Score:2)

          by chaim79 ( 898507 )

          While I would appreciate the darwin theory applied to computer viruses, since they are non-fatal it doesn't really apply. All a luser does once their computer is packed full of viruses is to get a new computer, doesn't quite work...

    • Re: (Score:2)

      by dnwq ( 910646 )
      No: Flashblock doesn't prevent flash applets from running, it merely hides them as soon as it can. If your connection is sufficiently fast and your computer sufficiently slow, you'll still get hit by Flash exploits. And then there's PDF exploits/misc browser holes, too.
      • yes, i've seen loading animations for about half a second with flashblock turned on, and then the flash object is removed.
      • i think that may just be incorrect. The applet doesnt start playing until you click--and it doesnt pick up somewhere in the middle. It doesnt hide them either, it leaves a placeholder that you can click to start the flash. If it was just hiding them, and they were running, they would use up CPU--which they dont.

        Its actually a lot like noscript in that regard (noscript leaves placeholders for some objects as well).

  • Sophos (Score:5, Informative)

    by Spad ( 470073 ) <[slashdot] [at] [spad.co.uk]> on Tuesday May 19, 2009 @08:04AM (#28010475) Homepage

    According to Sophos [sophos.com], this particular exploit seems to be a hell of a lot more "popular" than other previous web-based malware.

  • The problem is with Adobe... (Score:5, Informative)

    by vertinox ( 846076 ) on Tuesday May 19, 2009 @08:06AM (#28010501)

    On OS X I don't even install the reader anymore.

    But if you use it on Windows and aren't half bothered to find a more secure PDF reader... At least turn the plugin off in Firefox

    Tools > Options > Applications

    Set all Adobe to always ask.

    • or just use foxit http://www.foxitsoftware.com/pdf/reader/ [foxitsoftware.com]

    • Re: (Score:2, Insightful)

      by morgan_greywolf ( 835522 )

      Yep. My step-daughter is always saying things like "I hate Ubuntu! It makes you load the PDF in a separate application, not right in the browser like on Windows!"

      It's a security thing! The Adobe plugins suck.

      Another way to fix the whole thing is to just use NoScript. No scripts running on a Web page == no drive-by downloads.

      • Re:The problem is with Adobe... (Score:5, Informative)

        by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Tuesday May 19, 2009 @09:16AM (#28011313) Homepage Journal

        Install mozplugger and you can use evince to view PDFs inside of Firefox. If you install it on Ubuntu it happens automtically. It will use acroread if it's installed, I think; it will also use kpdf if you happen to be on Kubuntu, and I think xpdf for Xubuntu.

      • Re:The problem is with Adobe... (Score:4, Insightful)

        by kju ( 327 ) on Tuesday May 19, 2009 @10:06AM (#28012047)

        > It's a security thing! The Adobe plugin suck.

        Oh, it's a security thing. Really? Now please explain to me, why it is more
        secure to open the PDF in the standalone Acrobat Reader running under the
        same uid as your browser (and thus under the same uid as the standalone Reader).

        It would be a security thing to use another PDF reader instead of Acrobat
        Reader, but this has nothing to do with the fact if it is runs as a plugin
        or not. You can both embed Acrobat Reader and other PDF readers into the
        browser window in Linux.

        So instead of using lame excuses to your step daugther, thus making her linux
        experience bad and therefore make her dislike linux, just fix the damn box
        to show the PDF inside the browser.

        • Re:The problem is with Adobe... (Score:4, Interesting)

          by smoker2 ( 750216 ) on Tuesday May 19, 2009 @10:18AM (#28012211) Homepage Journal
          Is PDF a web format ? If not then use a separate app to view them. The browser is not supposed to do everything. I have no plugins for PDF in my linux browser and my experience doesn't suck. Next you'll be wanting MS word to be viewable in the browser. Wanting something, and it being a good idea are sometimes very far removed. She probably wants a pony too, try getting that to run in a browser !

          There seems to be no word about this attack working under linux anyway.

        • I was not aware of mozplugger. *shrug*

        • Just off the top of my head, running it in a separate process would protect from there being an exploit against the plugin communications channel. It would also mean that if there was active scripting in the PDF (Acrobat allows this), it would be substantially harder to get access to other browser data, such as the authentication cookie you have currently active to your bank account, etc.

          Exploits within a browser plugin are higher risk than exploits against the same software but not in plugin form.

      • No scripts running on a Web page == no drive-by downloads

        Unfortunately, with most 'modern' websites...

        No scripts == no working links
        No scripts == no images
        And more often than not
        No scripts == no content (blank page)

        But you sure won't get drive-bys. Of course, just leaving the machine off has the exact same effect. And is about as useful.

        (I use FF3 w/noscript, abp & noflash)

    • Problem is that pdfreader and flash are made by same company...and a lot of websites are stupid enough to use flash only on their websites....without even so much as some html sidelines, in case you don't have flash. So guess what ....you see u need flash, u download it, then it auto installs other stuff (common to adobe) which might share some of it with pdfreader...so even if you don't have it installed, you might have some of the components installed anyways.

    • On OS X I don't even install the reader anymore.

      There's only one reason why I have Adobe Reader on my Mac. It's because I don't know any other way to search through a directory full of PDFs. Is there anything else that can do it?

      (Don't bother suggesting Spotlight unless there's a way to run the search on demand rather than pre-building a big index file. I need to run this on arbitrary directories on network drives.)

  • Don't use FTP anyways (Score:4, Informative)

    by 4D6963 ( 933028 ) on Tuesday May 19, 2009 @08:25AM (#28010703)

    Don't use FTP anyways for anything sensitive like uploading to your website. I used to do that, then got infected by a virus of sorts. What it did was sniff the (non-encrypted) FTP packets to steal credentials, then log in and replace all the index files on the server with its malware infected version.

    That got me to of my websites to be infected and being blocked by Firefox/Google for being reported as attack sites. Now I only use SFTP/SCP.

    • Umm... did I get something wrong? When I'm sitting in the machine establishing an FTP connection, I don't have to sniff the wire. Either I log the keystrokes, or if it's a stored password, I hook into the FTP client and grab the password before it's sent (or, if encrypted, before it's reencrypted).

      • Its easier to modify a browser plugg-in to sniff network activity than it is to monitor the keyboard or look at programs outside the browser.

      • If someone compromises a single machine on either end--server (hosting company) end or locally-- they can fire up Cain and arp poison the switch to grab all the traffic they want. Presumably this can be done with cable connections for the local network, tho ive never tried--but Ive certainly seen a hosting company compromised by a single one of their customers, whose servers were discovered running Cain.

        Password sniffing is a real threat, and is easier to pull off than keylogging.

    • Re: (Score:1, Redundant)

      by hesaigo999ca ( 786966 )

      Thats if the ISP u r signed up with offers sftp...godaddy...you have to pay more for that service...you woudl think it isnt that much more to offer their clients security for the same price...but wow....how bad does it have to get before they make these options standard for any website?

      • Re: (Score:2)

        by Richy_T ( 111409 )

        Yeah, that's almost as dumb as charging customers for tone dialing when your equipment can handle it much easier than pulse dialing in the first place (though both are an anachronism)

        • I agree, they try to make up all these excuses, like offering dedicated servers if you want to run cgi scripts or updating the server to be able to run flash.....sometimes, they have to come up with novel ways to charge for stuff you normally should have with the base service.

  • Two of the most secure technologies on the interwebs...

  • Consider an organization where every desktop has the full version of adobe acrobat and flash player. Both are pushed out with GPO's. Thank god I can push the updates.

    • Re: (Score:3, Insightful)

      by Norsefire ( 1494323 ) *
      Consider an organisation, such as a newspaper or print company, where Adobe's software is the industry standard.

      • Re: (Score:2)

        by rdnetto ( 955205 )

        Adobe's software is the industry standard

        Don't you mean Adobe's file format (i.e. PDF)?
        There are plenty of other programs which support it that are both more secure and less bloated than Acrobat. One that I recommend is Foxit [foxitsoftware.com].

        • No, software such as indesign and photoshop. Alternative PDF readers are fine for casually looking at downloaded PDFs but I haven't found one yet with the features Acrobat pro has; the bloat you mention are feautures people in some industries actually use.

  • A little warning (Score:3, Informative)

    by Anonymous Coward on Tuesday May 19, 2009 @08:48AM (#28010959)

    I got infected with this piece of shit (or some other very similar piece of shit) because malicious code on a website somehow forced Adobe Reader to open a PDF, although Foxit had been my default PDF reader for months (in conjunction with the PDF Download add-on, which was somehow circumvented as well).

    Sure, I should have been suspicious instead of just annoyed at AR opening out of the blue. And sure, I should have uninstalled AR when I started using Foxit, instead of just letting it sit on my computer. This is just a warning to other people that are as stupid as me.

  • 6 website infected with this last month (Score:5, Informative)

    by foniksonik ( 573572 ) on Tuesday May 19, 2009 @09:24AM (#28011417) Homepage Journal

    I had 6 websites infected by this last month. Flash and PDF downloads starting in iframes offscreen.... based out of China.

    Not sure if it was a web exploit or ftp login theft. We looked at both early on as the footprint was confusing in that things were happening that shouldn't be possible without direct access to the server via ftp.

    We changed all passwords to be sure that there weren't any old ones floating around on insecure PCs in the company or with clients, then updated all applications do remove any known exploits. Then added in rewrite rules to stop libwww and other known agents from accessing any files via the web.

    Seems to have worked, no more exploits happening (lots of tagging was happening in addition to Gumblar).

    It's odd that it took so long for this advisory to come out though. Maybe we should have reported it but we did not know it was new as both exploits were known at the time, just no connected with a specific initiative by a hacker/botnet.

    • Re: (Score:2)

      by Renraku ( 518261 )

      Because Adobe still hasn't fixed their kludged/messy/slow/buggy/piecemeal program that is Adobe Acrobat and Adobe Acrobat Reader. Other companies instead stepped in and made free readers that use up much less resources and won't get your machine owned.

  • I haven't seen malware links on Google, but I'm wondering if I'm infected because I don't regularly update Flash on my laptop (I don't have Flash on my main PC).

  • Adobe Reader 9.1.1 not installed by default! (Score:5, Interesting)

    by AxelBoldt ( 1490 ) on Tuesday May 19, 2009 @10:01AM (#28011953) Homepage
    In their security alert [adobe.com], Adobe urges people to upgrade from Adobe Reader 9.1.0 to 9.1.1. If you install Reader from their main download site, they still give you 9.1.0. The 9.1.1 update is available only if you follow the links at the bottom of the security alert. Insecurity through obscurity!

  • I've seen this. (Score:5, Informative)

    by rincebrain ( 776480 ) on Tuesday May 19, 2009 @10:10AM (#28012105) Homepage

    I got to clean out a system with this about a week ago. It was really nasty.

    The worst part was that I spent the better part of two days trying to figure out why the search links were still being poisoned, even after nothing on several LiveCDs found anything...it turned out that it had installed an invisible Firefox plugin/extension which was doing it.

    Exciting, huh?

  • I see that they are taking advantage of unsecure websites and security holes to propagate this crap.
    I have several websites that I regularly visit compromised by this.
    May these people be sent somewhere experience long term "extraordinary rendition".

Slashdot Top Deals

Suggest you just sit there and wait till life gets easier.

Close