Drive-By Download Poisons Google Search Results 136
snydeq writes "A new attack that peppers Google search results with malicious links is spreading quickly, CERT has warned. The attack, which can be found on several thousand legitimate Web sites, exploits flaws in Adobe software to install malware that steals FTP login credentials and hijacks the victim's browser, replacing Google search results with links chosen by the attackers. Known as Gumblar because at one point it used the Gumblar.cn domain, the attack is spreading quickly in part because its creators have been good at obfuscating their attack code and because they are using FTP login credentials to change folder permissions, leaving multiple ways they can get back into the server."
The Importance of Being Forgotten (Score:5, Insightful)
About five years ago, I had installed some Firefox FTP plugin (FireFTP?) and was enjoying the simplicity of having my browser be used for multiple kinds of traffic when transferring files.
Well, we all know how bulletproof secure Firefox is, right? Not very. So I thought about it more and more I got really nervous about using something like this. I thought of the importance of all the things I had connected to--whether it be my friend's FTP server to drop off some pictures of our last vacation or one of several web hosts I had been working on. So in the end, I removed it from my machine as I wasn't sure how it was storing sessions and passwords. I also deleted the passwords from saved sessions in WinSCP on my Windows machines. Nowadays I just use the 'ftp' command in the shell no matter what operating system I'm using. Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!) but you know it sure beats being that guy that lost all his shit (and maybe some other people's) to something like this.
The integration of FTP clients into browsers and I think I've seen plugins in integrated development environments to remotely connect and upload your changes. While this may seem like a stream lined and faster path to development, acknowledge the risks you take when that's a server hosting data to users.
Re:The Importance of Being Forgotten (Score:5, Insightful)
It's a pretty rare thing in the computer world to gain convenience without sacrificing security.
In fact... Drop 'computer' out of that sentence and it's still true.
It's all about a balancing act. You have to take risks to be efficient... It's just part of life.
Re:The Importance of Being Forgotten (Score:4, Interesting)
On the contrary, security without convenience is a myth. When "logging in" is an arcane protocol, then the user focuses on technical details instead of thinking about potential avenues of attack. Computers should handle the arbitrary and fiddly details and leave only the critical aspects to the user.
The real problem with the security of credentials is that for some reason we're not willing to do the right thing, which is to encapsulate authentication in a small (and therefore easier to secure) subsystem, like a class 3 smart card reader.
Re: (Score:2, Insightful)
Smart card readers are only as secure as the smart cards themselves.
Re: (Score:2, Insightful)
Re: (Score:2)
I think you mean "Smart cards are only as smart as the people using them"
In conclusion; the future looks very insecure.
Re: (Score:2)
Smart card readers are only as secure as the smart cards themselves.
And that's why I run my smartcard device through a rot13 filter, folks! And, when I'm getting truly paranoid about it, I skip straight to TRIPLE-rot13 filtering!
Re: (Score:3, Insightful)
Re: (Score:2)
On the contrary, security without convenience is a myth. When "logging in" is an arcane protocol, then the user focuses on technical details instead of thinking about potential avenues of attack. Computers should handle the arbitrary and fiddly details and leave only the critical aspects to the user
I couldn't agree more. The trouble is this: how? Secondarily, who defines what is important enough to bother the user with?
Re:The Importance of Being Forgotten (Score:4, Informative)
ssh keys with passwords are the best bet. Run an agent so you only have to give your password occasionally and there really is not a lot to steal. They can take the private keyfile, but without the password it is useless. They can use ssh/scp on your behalf, but only until the session ends.
Putty has an agent for windows, OSX Leopard has an agent integrated with keychain, and Linux has agents that integrate with PAM. OSX and Linux allow it to be SSO with little risk of password/credential theft.
Re:The Importance of Being Forgotten (Score:4, Informative)
Re: (Score:3, Informative)
Re:The Importance of Being Forgotten (Score:5, Insightful)
Well, we all know how bulletproof secure Firefox is, right?
More to the point, we all know how secure FTP is, right?
Jebus, if you're that paranoid, why, dear god, weren't you using SFTP?
Re: (Score:1, Insightful)
Well, we all know how bulletproof secure Firefox is, right?
More to the point, we all know how secure FTP is, right?
Jebus, if you're that paranoid, why, dear god, weren't you using SFTP?
Um, if you bothered to read his post, WinSCP and FireFTP are both SFTP or support it at least. And if he's connecting to other people's servers, what is he supposed to do? Ask them to move to SFTP before he will help or transfer?
Re:The Importance of Being Forgotten (Score:4, Informative)
Nowadays I just use the 'ftp' command in the shell no matter what operating system I'm using. Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!) but you know it sure beats being that guy that lost all his shit (and maybe some other people's) to something like this.
You realise FireZilla makes this 100 times easier and is just as secure, right?
Re: (Score:2, Insightful)
Care to substantiate this? Firefox has a very good track record when it comes to security thanks to its quick responses to known vulnerabilities and patching almost all of them before they become publicly known.
Re:The Importance of Being Forgotten (Score:5, Funny)
Care to substantiate this? Firefox has a very good track record when it comes to security thanks to its quick responses to known vulnerabilities and patching almost all of them before they become publicly known.
Sure, let me explain:
Therefore, it is obvious that I'm right and Firefox has a long-standing track record of swiss cheese security that any infant can get around from remote without the user even turning on the computer. QED.
Next I'll tell you why spaghetti has a lousy track record in security issues. Right after I finish my stuffed pasta shells. Stupid spaghetti, stealing all the best features of stuffed pasta shells...
Re: (Score:3, Informative)
You make a good point. There's one thing that I find fault with, though:
Where do you see constant updates? HTML 4.01 has been out since 1997 or so. CSS2 has been out since 1998. HTML5, CSS2.1 and CSS3 are still in draft stage, though I will admit that CSS2.1 has been close to completion for quite some time now, which makes it valid for implementation.
I can't argue about ECMAScript. It seems to get an update a little quicker than the previously-mentioned
Re: (Score:2)
Re: (Score:2)
Use lftp [lftp.yar.ru] and you'll get your tab-completion, both local and remote...
Re: (Score:1)
Hi,
You may find lftp a good cli client! Very handy tab-completion and shell integration. I use it whenever possible.
Re: (Score:2, Insightful)
Nowadays I just use the 'ftp' command in the shell no matter what operating system I'm using. Yeah, it's annoying to change directories both locally and remotely by hand (without even tab-complete!) but you know it sure beats being that guy that lost all his shit (and maybe some other people's) to something like this.
As you mentioned that you use Windows machines, why not just use Windows Explorer for FTP purposes?
Re: (Score:2)
Re: (Score:2)
Incidentally, the command line FTP program is just as vulnerable to the exploit in TFA. A security hole in unpatched Adobe software (i.e. Flash player, PDF viewer) installs spyw
Wouldn't... (Score:3, Insightful)
... Flashblock basically remove this exploits ability to infect your PC?
Re: (Score:1)
Re: (Score:3, Informative)
Security experts say that if you're using a fully patched system with up-to-date security software, you should be protected from these attacks. To date, they've worked by hitting the victim with malicious PDF or Flash files.
Re:Wouldn't... (Score:4, Informative)
I guess this answers your question:
"Users who visit these compromised websites and have not applied updates for known PDF and Flash Player vulnerabilities may become infected with malware"
*sigh* Adobe...
Re: (Score:2, Insightful)
You hate it when PDFs freeze Firefox? (Score:5, Funny)
Re: (Score:2)
And with good reason.
Re: (Score:2)
Re: (Score:1)
You're still using Adobe Reader? (Score:1)
Shame on you! Get a free reader that isn't so vulnerable.
Re: (Score:3, Interesting)
Which one should I use? Is FoxIt's reader any better? I suspect it also has some vulnerabilities but gets less attention from the bad guys because Acrobat's Reader is much mode widely used.
Re: (Score:2, Informative)
In Windows, I like Sumatra [kowalczyk.info]. It's smaller and faster than Foxit, and doesn't allow javascript and crap that causes problems in Adobe Reader. It does, however, sometimes have trouble rendering some more complicated pdf's, but you could always keep foxit around for that rare occasion.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
"I suspect it also has some vulnerabilities but gets less attention from the bad guys because Acrobat's Reader is much mode widely used."
Precisely. Using the most popular, and being part of the crowd, marks you as prey for the predators.
I use Foxit and Sumatra. Haven't installed Adobe PDF products in years - literally. I would stop using Flash, but often times I'm just to lazy to download a version for VLC. Besides which, some sites seem to block access by any means other than Adobe Flash.
Re: (Score:2)
My reaction to sites which are only accessible via Flash are 1) a complaint to the webmaster, if I can find even that much, and 2) to not use that site.
If they're so feeble as all that, then they deserve what they get.
Re:Wouldn't... (Score:4, Insightful)
It's a good thing I got sick of it hanging actually, the whole PDF exploit thing came up a little after that. I still get randomly named PDFs downloading themselves sometimes, presumably they're exploit-loaded. Lately it occoured to me that, because Adobe includes a shell extension to render a preview image, simply selecting the file in Windows may be enough to trigger an exploit. Thoughts?
Re:Wouldn't... (Score:4, Interesting)
Re: (Score:3, Interesting)
Re: (Score:1)
I think Adobe (PDF and Flash) are the biggest nuisance to computers. I hate it when PDFs in firefox freeze the browser.
Check out the FF add-on PDF Download [mozilla.org]. When you click on a link that goes to a PDF it prompts you and asks if you want to open it in the browser, save it to disk, or open in with Adobe Reader (outside the browser). No more FF lockups on PDFs for me.
Re: (Score:2)
Go to Tool->Options->Applications section.
Look for Adobe Acrobat # Document or Application/pdf and make sure it is set to Always Ask
No need to install an extension for this. Now you can choose Open which will download the pdf, save it to the temp dir, then open your local pdf program. Or you can choose Save and save it somewhere.
The main reason FF will freeze is because the Adobe plugin will display the first page of the pdf as soon as it can. Then if you hit page down before the next page is finished
Re: (Score:2)
So your PC can get infected whether the malign Flash code actual gets executed on your PC or not? I don't care about PDF as I don't have Adobe software installed to read them.
Re: (Score:1)
I've given up on adobe acrobat reader. I'm using mozplugger and xpdf/kpdf/insert favourite pdf viewer here.
Re: (Score:1)
It's like a helmet law. "Which is even stupider, the idea behind the helmet law being to preserve a brain whose judgment is so poor, it does not even try to avoid the cracking of the head it's in." to quote Jerry Seinfeld.
Re: (Score:2)
You're ignoring the scenario where the person who gets pwned has access rights to your sensitive information (bank, school, government agency, employer).
Re: (Score:2)
While I would appreciate the darwin theory applied to computer viruses, since they are non-fatal it doesn't really apply. All a luser does once their computer is packed full of viruses is to get a new computer, doesn't quite work...
Re: (Score:2)
Re: (Score:1)
Re: (Score:1)
Its actually a lot like noscript in that regard (noscript leaves placeholders for some objects as well).
Sophos (Score:5, Informative)
According to Sophos [sophos.com], this particular exploit seems to be a hell of a lot more "popular" than other previous web-based malware.
The problem is with Adobe... (Score:5, Informative)
On OS X I don't even install the reader anymore.
But if you use it on Windows and aren't half bothered to find a more secure PDF reader... At least turn the plugin off in Firefox
Tools > Options > Applications
Set all Adobe to always ask.
Re: (Score:1)
Re: (Score:3, Informative)
or just use foxit
same bug [computerworld.com.au]
Re: (Score:2, Insightful)
Yep. My step-daughter is always saying things like "I hate Ubuntu! It makes you load the PDF in a separate application, not right in the browser like on Windows!"
It's a security thing! The Adobe plugins suck.
Another way to fix the whole thing is to just use NoScript. No scripts running on a Web page == no drive-by downloads.
Re:The problem is with Adobe... (Score:5, Informative)
Install mozplugger and you can use evince to view PDFs inside of Firefox. If you install it on Ubuntu it happens automtically. It will use acroread if it's installed, I think; it will also use kpdf if you happen to be on Kubuntu, and I think xpdf for Xubuntu.
Re:The problem is with Adobe... (Score:4, Insightful)
> It's a security thing! The Adobe plugin suck.
Oh, it's a security thing. Really? Now please explain to me, why it is more
secure to open the PDF in the standalone Acrobat Reader running under the
same uid as your browser (and thus under the same uid as the standalone Reader).
It would be a security thing to use another PDF reader instead of Acrobat
Reader, but this has nothing to do with the fact if it is runs as a plugin
or not. You can both embed Acrobat Reader and other PDF readers into the
browser window in Linux.
So instead of using lame excuses to your step daugther, thus making her linux
experience bad and therefore make her dislike linux, just fix the damn box
to show the PDF inside the browser.
Re:The problem is with Adobe... (Score:4, Interesting)
There seems to be no word about this attack working under linux anyway.
Re: (Score:3, Funny)
No problemo [geocities.com].
Re: (Score:1)
I was not aware of mozplugger. *shrug*
Re: (Score:2)
Just off the top of my head, running it in a separate process would protect from there being an exploit against the plugin communications channel. It would also mean that if there was active scripting in the PDF (Acrobat allows this), it would be substantially harder to get access to other browser data, such as the authentication cookie you have currently active to your bank account, etc.
Exploits within a browser plugin are higher risk than exploits against the same software but not in plugin form.
One slight problem (Score:2)
No scripts running on a Web page == no drive-by downloads
Unfortunately, with most 'modern' websites...
No scripts == no working links
No scripts == no images
And more often than not
No scripts == no content (blank page)
But you sure won't get drive-bys. Of course, just leaving the machine off has the exact same effect. And is about as useful.
(I use FF3 w/noscript, abp & noflash)
Re: (Score:2)
Problem is that pdfreader and flash are made by same company...and a lot of websites are stupid enough to use flash only on their websites....without even so much as some html sidelines, in case you don't have flash. So guess what ....you see u need flash, u download it, then it auto installs other stuff (common to adobe) which might share some of it with pdfreader...so even if you don't have it installed, you might have some of the components installed anyways.
Re: (Score:2)
There's only one reason why I have Adobe Reader on my Mac. It's because I don't know any other way to search through a directory full of PDFs. Is there anything else that can do it?
(Don't bother suggesting Spotlight unless there's a way to run the search on demand rather than pre-building a big index file. I need to run this on arbitrary directories on network drives.)
Don't use FTP anyways (Score:4, Informative)
Don't use FTP anyways for anything sensitive like uploading to your website. I used to do that, then got infected by a virus of sorts. What it did was sniff the (non-encrypted) FTP packets to steal credentials, then log in and replace all the index files on the server with its malware infected version.
That got me to of my websites to be infected and being blocked by Firefox/Google for being reported as attack sites. Now I only use SFTP/SCP.
Re: (Score:2)
Umm... did I get something wrong? When I'm sitting in the machine establishing an FTP connection, I don't have to sniff the wire. Either I log the keystrokes, or if it's a stored password, I hook into the FTP client and grab the password before it's sent (or, if encrypted, before it's reencrypted).
Re: (Score:2)
Its easier to modify a browser plugg-in to sniff network activity than it is to monitor the keyboard or look at programs outside the browser.
Re: (Score:1)
Password sniffing is a real threat, and is easier to pull off than keylogging.
Re: (Score:1, Redundant)
Thats if the ISP u r signed up with offers sftp...godaddy...you have to pay more for that service...you woudl think it isnt that much more to offer their clients security for the same price...but wow....how bad does it have to get before they make these options standard for any website?
Re: (Score:2)
Yeah, that's almost as dumb as charging customers for tone dialing when your equipment can handle it much easier than pulse dialing in the first place (though both are an anachronism)
Re: (Score:2)
I agree, they try to make up all these excuses, like offering dedicated servers if you want to run cgi scripts or updating the server to be able to run flash.....sometimes, they have to come up with novel ways to charge for stuff you normally should have with the base service.
PDF and FTP (Score:1)
stuck with adobe (Score:1)
Consider an organization where every desktop has the full version of adobe acrobat and flash player. Both are pushed out with GPO's. Thank god I can push the updates.
Re: (Score:3, Insightful)
Re: (Score:2)
Adobe's software is the industry standard
Don't you mean Adobe's file format (i.e. PDF)?
There are plenty of other programs which support it that are both more secure and less bloated than Acrobat. One that I recommend is Foxit [foxitsoftware.com].
Re: (Score:3)
A little warning (Score:3, Informative)
I got infected with this piece of shit (or some other very similar piece of shit) because malicious code on a website somehow forced Adobe Reader to open a PDF, although Foxit had been my default PDF reader for months (in conjunction with the PDF Download add-on, which was somehow circumvented as well).
Sure, I should have been suspicious instead of just annoyed at AR opening out of the blue. And sure, I should have uninstalled AR when I started using Foxit, instead of just letting it sit on my computer. This is just a warning to other people that are as stupid as me.
6 website infected with this last month (Score:5, Informative)
I had 6 websites infected by this last month. Flash and PDF downloads starting in iframes offscreen.... based out of China.
Not sure if it was a web exploit or ftp login theft. We looked at both early on as the footprint was confusing in that things were happening that shouldn't be possible without direct access to the server via ftp.
We changed all passwords to be sure that there weren't any old ones floating around on insecure PCs in the company or with clients, then updated all applications do remove any known exploits. Then added in rewrite rules to stop libwww and other known agents from accessing any files via the web.
Seems to have worked, no more exploits happening (lots of tagging was happening in addition to Gumblar).
It's odd that it took so long for this advisory to come out though. Maybe we should have reported it but we did not know it was new as both exploits were known at the time, just no connected with a specific initiative by a hacker/botnet.
Re: (Score:2)
Because Adobe still hasn't fixed their kludged/messy/slow/buggy/piecemeal program that is Adobe Acrobat and Adobe Acrobat Reader. Other companies instead stepped in and made free readers that use up much less resources and won't get your machine owned.
How do you know you're infected? (Score:1)
I haven't seen malware links on Google, but I'm wondering if I'm infected because I don't regularly update Flash on my laptop (I don't have Flash on my main PC).
Adobe Reader 9.1.1 not installed by default! (Score:5, Interesting)
I've seen this. (Score:5, Informative)
I got to clean out a system with this about a week ago. It was really nasty.
The worst part was that I spent the better part of two days trying to figure out why the search links were still being poisoned, even after nothing on several LiveCDs found anything...it turned out that it had installed an invisible Firefox plugin/extension which was doing it.
Exciting, huh?
These people are morons. (Score:2)
I see that they are taking advantage of unsecure websites and security holes to propagate this crap.
I have several websites that I regularly visit compromised by this.
May these people be sent somewhere experience long term "extraordinary rendition".
Re: (Score:2)
Server side of things could use work too.
Uninstall the FTP server. Configure to login using public key authentication and disable passwords.
Re: (Score:2)
With all the better alternatives out there
Yeah, it's not like Adobe's software is the standard in some industries. /sarcasm
Re: (Score:2)
With all the better alternatives out there, anybody who uses Adobe software deserve to get malware. Think of it as evolution in action.
Actually I was thinking the same thing but about ftp. I can't remember the last time I needed to use an ftp client. Must be at *least* 5 years ago - probably more.
DON'T CLICK LINK IN PARENT POST (NSFW) (Score:5, Informative)
This may not have been intentional, but the Scroogle link in parent post is wrong, and goes to a site that is NSFW.
Correct link is here [scroogle.org].
Re: (Score:1)
Ack!
Whoops!
Sorry about that!
What is is NSFW? (Score:1, Informative)
What is is NSFW?
Re:What is is NSFW? (Score:4, Funny)
Just scroogle it.
Re: (Score:1, Informative)
You understand that now, thanks to you, people will intentionally click on the OP's link. And fill firefox with tabs from that page. For about 5 minutes or so.
Re: (Score:1, Insightful)
Google Attacks (With Corrected Link) (Score:2, Insightful)
(Reposted with Correct Link)
As the article points out, these trojans/viruses that use Google and other search engines are becoming more common. My mother got one that replaced all of the major search engine results with fake spyware and antivirus software links. I imagine its popular because its a bit subtle and pernicious. How much malware is out there that is undiscovered because the affects are more subtle? Maybe reordering search results? Replacing ads with different ones?
For my mom, I ended up using ht [scroogle.org]
Re:Google Attacks (Score:5, Interesting)
Trojans that modify your browser's behaviour don't care for connections or encryption thereof, because the modification happens much higher in the chain. I had a trojan to dissect that literally changed your online banking information inside the browser. You saw that you're transfering A bucks to B, while the trojan sent to the bank you're transfering C bucks to D. The bank confirmed C bucks for D, and the browser asked the user for the confirmation code to send A bucks to B.
As soon as the browser is under the control of malware, it can manipulate your input before it is encrypted and sent through the wire, and manipulate the output after it has been decrypted and before you get to see it.
Locking down the browser would essentially also mean that you disable anything that can inject code into running processes (createremoteprocess and the like), as well as disallow browser plugins. I doubt many people would really want that.
Re: (Score:2, Informative)
Re: (Score:2)
Hooking one of the winsock/ws2_32 functions? Probably just rewriting the destination address?
God, I miss being in IT-Sec... I don't even have a sample of that, I feel kinda pathetic.
Re: (Score:3, Informative)