Slashdot Log In
MySpace Phishing Attack Leads Users to Zango Adware
Posted by
CowboyNeal
on Sat Dec 02, 2006 12:13 PM
from the movies-that-add-something dept.
from the movies-that-add-something dept.
An anonymous reader writes "Security site Spywareguide.com reports that a new worm is doing the rounds on MySpace. Taking advantage of the HREF feature in Quicktime movies, a fake login bar is displayed on infected users profiles via some JavaScript coding. If you login (via one of the many hacked servers hosting the JavaScript and movie file) you'll find you start spamming messages containing a pornographic movie. That movie leads to a site that's pushing Zango Adware left, right and center. Is this more evidence that Zango has yet to clean up their affiliate networks?"
Related Stories
[+]
Social Networking Site Safety Questioned 73 comments
An anonymous reader writes to mention a TechNewsWorld article about social networking sites. Researchers are finding these places are goldmines for social engineering exercises. Between worm attacks and simple human observation, sites like MySpace are the perfect place to obtain saleable personal information. From the article: "The danger is real, according to a study conducted by CA and the National Cyber Security Alliance (NCSA). In October, the alliance issued its first social networking study examining the link between specific online behaviors and the potential for becoming a victim of cybercrime. Despite all the publicity about sexual predators on sites like MySpace and FaceBook, the alliance took a different approach by measuring the potential for threats such as fraud, identity theft, computer spyware and viruses. Although 57 percent of people who use social networking sites admit to worrying about becoming a victim of cybercrime, they are still divulging information that may put them at risk, as Boyd suggested. Social networkers are also downloading unknown files from other people's profiles, and responding to unsolicited instant messages that could contain worms, the NCSA reported."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
How do you get rid of Zango? (Score:1, Offtopic)
Re: (Score:2, Funny)
Re:How do you get rid of Zango? (Score:4, Informative)
Parent
Sigh (Score:5, Insightful)
Re: (Score:1)
Re:Sigh (Score:4, Insightful)
It won't get fixed because it's not a bug. Face the reality: the only way to "fix" phishing attacks is by taking away the computers of everyone.
Phishers just concentrate on the easiest method available. You take it away: they find another method. They don't need scripting at all.
Parent
[Slightly OT] Phishing -- a partial solution (Score:4, Informative)
- Phishing attacks are becoming more common, and obviously, it is necessary for all users to be more cautious about exactly where they are entering their passwords -- this means being very alert to the contents of the URL bar (so as to not be deceived by things like "http://www.google.com.blahblah.phisher.tripod.co
m /google..."), and also not being misled by javascript window-within-window things that make something else look like the URL bar, etc. All this probably requires a greater level of attention than is within the capabilities of, say, old people (or even those teenagers on MySpace). So how do you make sure you don't give away your password to the wrong guys? - A common phishing-like attack is to somehow hack into some low-security site and get some username-password pairs, then try them at other sites. As you might guess, this trick is quite effective, because most people use the same password everywhere. Remembering hundreds of different hard-to-guess strings is somewhat hard, after all.
So given that Grandma is going to use the same password everywhere, and isn't going to be very alert to phishing, how do you still make it safe for her to use the internet? (Or, if you don't care about Grandma: How can you get away with remembering only one password and be reasonably safe against phishing?)There is a solution that's simple, effective, and comes at no cost -- no changes to the "user experience". It's PwdHash [stanford.edu], developed by Dan Boneh [stanford.edu] and others at Stanford. It's available as a Firefox extension [mozilla.org]. Basically, to use it, you just pick for each site (while registering or changing the password) a password and prefix it with "@@". It could even be the same password for all sites. PwdHash will transparently convert the password you typed into a one-way hash based on the site's domain, so that the password with which you are registered on the site is actually something other than what you typed -- but you don't need to know what it is, because the next time you visit the site, you again type your password (begining with "@@"), and PwdHash will send the site your correct password (does the same thing again). So if a phisher (who is by definition on some other domain) tries to steal your password, he actually gets a different one from what the correct site would get. (Oh, and PwdHash warns you if you type "@@" into something that is not a password field.) Everything else works the same -- all you have to do is to consistently type "@@" before your password each time (or hit F2, alternatively). The idea of domain-based generators is not [hashapass.com], new [sysprosoft.com], but the beauty of this one is that it fits perfectly into one's existing workflow. A long as you ask Grandma to pick a password that "begins with" @@, you can be sure no phishing website will get her password. (Of course, it is still susceptible to email scams and malware programs, but at least safety while browsing is taken care of.)
The researchers demonstrate it as a solution to phishing, but I use it simply because remembering too many passwords is a pain. And it's by some of the top Crypto researchers, so you can be quite sure it doesn't have any stupid vulnerabilities. Read the paper [stanford.edu] (or see the Powerpoint presentation [stanford.edu] if you'd prefer it) for a more in-depth consideration of other issues. (Interestingly, one of the co-authors is Stanford student and Firefox guy Blake Ross [wikipedia.org].)
Parent
pwdhash compared to alternatives (Score:2)
Re: (Score:3, Informative)
Re: (Score:2, Interesting)
In this situation, you'd have to reset all your passwords, but even that would be tricky because many sites demand your old password before you set a new one.
I suppose one could use t
Re: (Score:2, Informative)
I doubt the project will die, though.
Re: (Score:3, Interesting)
(1) Use of cruise missiles against the perpetrators
(2)the same what that on-line gambling was stopped - action against the credit card companies.
All this stuff is for monitary reward - read "credit card transactions". No Credit card involvement means no problem.
And dont come with that "its the foreigners doing it" Who ever is doing it, its Americans paying, with American credit cards and banks. None of the stu
Re: (Score:2)
There, I fixed it for you.
Re: (Score:2)
Apple.
You can do that from Flash as well.
Re: (Score:1)
They want it. They don't care about the consequenses. Not because they like to wreck the internet, just because they don't know any better.
Re: (Score:2)
Right. Blame the users rather than the programmers or designers who put such a retarded security hole into a movie file format... anything that lets files access the web without user intervention is inevitably going to be exploited.
Re: (Score:2)
Re: (Score:2)
Some more info and removal instructions (Score:5, Informative)
Please note that you can be infected by this virus by simply viewing an infected profile. It doesn't matter what browser you use, I was using Firefox 2.0 with AdBlockPlus and a decent filterset updater and was infected. I DO NOT believe it steals your password without going to the fake login page. So if your profile gets infected you are probably fine simply removing it
Here's how to remove it:
To truly protect yourself you need to adblock the offending Quicktime object - or better yet all
Re:Some more info and removal instructions (Score:5, Informative)
Parent
It's hard to control affiliates. (Score:2, Informative)
What idiot at Apple put that in? (Score:2)
What idiot at Apple put a giant hole like this in?
An automatic URL loads as a movie is playing at the exact frame specified by a text descriptor timestamp in the HREF track. With automatic URLs, you can create a narrated tour of a website, use web pages as slides in a presentation, activate a JavaScript command, or do anything else that requires loading movies or web pages in a predetermined sequence.
That's got to come out of Quicktime players. They're a huge security hole now. That's just unaccepta
Re:What idiot at Apple put that in? (Score:4, Informative)
What security hole? Quicktime is a multimedia authoring and playback tool, just like Flash, RealPlayer, WMP, and every other multimedia system. It needs to be able to get media, display it, and allow interactive behavior just like every other multimedia program. You could create the exact same "security hole" using 100% W3C-approved SMIL.
The only security hole is the server allowing unauthorized Javascript to initiate MySpace user actions without any confirmation. Someone clever realized that the Javascript blocks wouldn't recognize JS sent from the plugin -- that doesn't mean the plugin has a security hole, it means the web application itself was vulnerable to a malicious injection of code from perfectly normal and common network behavior. The plugin worked perfectly and didn't do anything sketchy with the OS or network. If allowing code to be sent is a security hole then every browser has a huge security hole called the anchor tag.
Parent
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Hi, 1991 is calling. Quicktime was created from the very beginning, and has always been, a complete interactive multimedia development and presentation system. Most of the multimedia CD-ROMs produced in the 90s were just giant Quicktime applications. In fact, it can play most Flash files, so trying to make a distinction between Quicktime and Flash features is most
Re: (Score:2)
The Flash plugin has all the same "security vulnerabilities" of using Javascript as Quicktime does. Java can send JS, too! There is nothing even remotely unique or special about a plugin that supports Javascript. If you're on a mission to eradicate JS from the Internet, have fun raging against the machine. Changing Quicktime because you are as ignorant about the Internet as the average MySpace user is not a
Got some bad news for you... (Score:2)
...but if you've got Windows Media Player, I can embed a script in Microsoft's .asx format and have WMP serve up whatever sort of mischief I can code up, cleverly hidden in an audio or video media file. Supposedly Microsoft has been paying attention to the issue, but just between you and me I wouldn't have your bank's login page open in IE while playing any unfamiliar .asx or .asf files:
http://support.microsoft.com/kb/828026 [microsoft.com]
* * * * * *
Adobe Illustrator is a programmer's idea of how a graphic artist
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
So people could play movie files that are stored in Apple's format without exposing themselves to security risks such as this one, thereby allowing
Oh, now I get it. You're one of those.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Quicktime is the problem? (Score:5, Insightful)
Sounds like MySpace is the problem here.
To summarize, I think that the situation goes like this: A user places a movie file on their page manually to start with. People visiting that page view the movie which loads a link containing javascript. The javascript modified that MySpace user's profile to include the movie somehow.
Why do you even need a movie for this to happen? Why can javascript just change an entire MySpace page around? It sounds like the entire problem here is that MySpace users get too much customization abilities over their pages. A simple onload="infectuser()" javascript line would seem to me like it could accomplish the same worm effect.
Re: (Score:2)
Yeah, its a tough job, but it needs to be done. Maybe they can work out a deal with one of the antivirus companies?
Re: (Score:3, Informative)
The problem with the web is always a two-folded, rich content and possibilities but still secure..
One more thing you could do with Javascript is having a simple PHP script that writes this to your database:
'clipboardData.getData("Text");'
This does exacly what you think it does, fetch your clipboard data (might contain personal stuff!!). Lot of people copy-paste things like passwords and
Re: (Score:2, Informative)
Re: (Score:2)
They allow Quicktime movies and this is a feature of Quicktime movies.
Can't ASF/WMV files and Flash both do the same types of things anyway?
Re: (Score:2)
Well, you can use a Microsoft tool to do dangerous stuff in .asf/.wmv files:
http://www.plattsburgh.edu/technology/it/help/strFirefox Extension: NoScript (Score:5, Informative)
Extra protection for your Firefox: NoScript allows JavaScript, Java and other executable content only for trusted domains of your choice, e.g. your home-banking web site. This whitelist based preemptive blocking approach prevents exploitation of security vulnerabilities (known and even unknown!) with no loss of functionality... Experts do agree: Firefox is really safer with NoScript
Scammers/spammers (Score:2)
Dudes! SSL? (Score:2)
Joe Job? (Score:2)
Maybe this is the way nature/evolution handles things when laws don't work? Hey, I'm just asking....
Re: (Score:2, Insightful)
There's no way that's true; the Zango adware itself is written for Windows and thus would never be installed on other operating systems. The ads themselves, however, would still come.
Re: (Score:3, Funny)
Zango are the filthiest scum outside of Al Quieda.
SECOND RULE OF ___ (Score:2)