Slashdot Log In
Growth of the Underground Cybercrime Economy
Posted by
samzenpus
on Thu Feb 21, 2008 01:22 AM
from the nothing-is-safe dept.
from the nothing-is-safe dept.
AC50 writes "According to research from Trend Micro's TrendLabs compromised Web sites are gaining in importance on malicious sites created specifically by cyber-criminals. The research debunks the conventional wisdom about not visiting questionable sites, because even trusted Web sites such as those belonging to Fortune 500 companies, schools, and government organizations can serve forth malware."
Related Stories
Submission: Growth of Underground Cybercrime Economy by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Any site (Score:5, Informative)
Re: (Score:2)
it's called No Script (Score:5, Informative)
Re: (Score:3, Informative)
Re:it's called No Script (Score:5, Interesting)
Eventually, I wonder if the Web browser should be completely enclosed in its own VM, where it doesn't require an explicit launching of a client OS, perhaps similar to how Thinstall wraps applications so all changes are only written to a sandbox directory. Vista's protected mode in IE7 is a start, where IE7 does not have access to the full Registry, but more separated from the rest of the machine with limits on CPU and other resources.
Parent
Re: (Score:2, Informative)
Questionable company (Score:2)
It would be great to have a suggestion from a better company.
Re:it's called No Script (Score:5, Informative)
The problem is not lack of virtualization. Everything is virtualized already. The problem is excessive permissions given to the programs running in each virtual address space. For example, the web browser should not have any rights to save files outside a designated 'downloads' directory.
Parent
Re: (Score:3, Insightful)
And this is a problem with VMWare as much any other sort of processor division. The main problems was that once the virtual machines were set up for each process in Window
Re: (Score:3, Informative)
Eventually, I wonder if the Web browser should be completely enclosed in its own VM, where it doesn't require an explicit launching of a client OS, perhaps similar to how Thinstall wraps applications so all changes are only written to a sandbox directory.
http://www.sandboxie.com/ [sandboxie.com] /. thread
I read about it in the comments of some
All changes are written to a sandbox directory, convienently called "sandbox"
And you can launch more than just your web browser in it.
Re: (Score:3, Interesting)
Might help out, might not. If I had something like that running in my company I reckon I co
Re:it's called No Script (Score:5, Informative)
Firefox 3 does this. If you start to load a site that's in Google's database of malicious (and compromised) pages, Firefox 3 will show a big red "Suspected attack site!" thing instead of parsing the page.
Mozilla and Google put a lot of effort into making it possible to do this without slowing down page loads. Firefox downloads a list of 32-bit hash prefixes for compromised sites. If a hash prefix matches (which will happen on any malicious page load and perhaps 0.1% of other page loads), Firefox asks Google for the rest of the hash. Both the local database lookup (which can require disk access) and the possible request to Google happen in parallel with Firefox resolving the DNS entry and connecting to the site.
Last week, the site of Firebug author Joe Hewitt was compromised, and Firefox 3 Beta 3 users saw this [mozilla.com].
Parent
McAfee SiteAdvisor (Score:2)
Re: (Score:2)
An interesting feature of google that I've always liked is the "This page may harm your computer" or whatever they put on dangerous links.
I got an e-mail from my Mom on Monday night that said:
I was downloading something into AVG, and I saw something in red letters that said it was a 'trojan horse'. Is that friend or foe? I think it's probably safe, but I thought I should check with you first..."
Yes, she's confused about what AVG's role in the download is, but that aside.
There was a banner popped up with big red letters, and the word "warning" and she still thought it might be safe.
I guess there is some glimmer of hope, given she had enough doubt to ask me, but still I'd submit she is among the "average users" that need their computers to protect them from themselves. I'm looking at some of the sandboxes that are being linked in this thre
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
... use it together with adblocker and a good antivirus package and your web experience will be safe and much faster.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Interesting)
Forth malware (Score:3, Funny)
Serve Forth malware from a website? I'd be more concerned about JavaScript malware and the like.
Re: (Score:3, Funny)
Haskell malware is the best!
I sure hope (Score:5, Funny)
Re: (Score:2)
Open articles? I don't think
The Power of Google (Score:5, Interesting)
http://www.google.com/search?q=site:.gov+viagra [google.com]
Only two pwned sites in the top 10 for
It'd be ironic if idtheft.utah.gov was handing out malware.
Replace viagra with other spamwords & you'll get more of the same
Re:The Power of Google (Score:5, Interesting)
http://www.google.com/search?q=site:k12.ny.us+viagra [google.com]
That brings up pwned K-12 school websites from New York
http://www.google.com/search?q=site:.ny.us+ringtones [google.com]
This frequently brings up state websites
EG: New York State's Division of Military and Naval Affairs website has been exploited.
I don't mean to pick on New York, but they seem to be worse than many other States.
Replace
Parent
So.... PEBCK (Score:2, Insightful)
Do we really need Trend Micro's PC-cillin?
Windows XP SP3 (Score:5, Insightful)
XP SP3, on the other hand, can have marketing support behind it. Articles can talk about it and how to install it, and people won't get so annoyed at a one-time installation. XP SP3 includes fixes for the still-quite-popular ADODB.Stream and animated cursor exploits, and at this point, finding browser exploits is getting into diminishing returns. Now that Microsoft cares, Windows is having its code audited much more thoroughly than when XP SP2 was made.
Service packs also give Microsoft an opportunity to release fixes for security holes found internally, since service packs are so different from the previous version. If they patched holes quickly like Firefox does with incremental patches, they'd be revealing those holes to attackers armed with machine code diff programs.
Re:Windows XP SP3 (Score:4, Insightful)
Parent
Re: (Score:2)
No, but at least it will be harder for attackers to exploit them. There is a finite number of exploitable bugs in Windows XP and Internet Explorer, and since few new features are being added, few new bugs are being added.
As for Linux, are things really much different [slashdot.org]?
For very large values of finite. (Score:3, Insightful)
Re: (Score:3, Interesting)
This might be more because they havehad an experience where an update broke their computer or some app. This is probably especially true when SP2 came around because of it's ability to fail and render the computer useless if certain Spyware has been installed. They might have f
Re:Windows XP SP3 (Score:4, Funny)
You must have a well-trained set of users. Most people just buy a new computer when that happens.
Parent
Re: (Score:3, Interesting)
Debunks nothing (Score:3, Insightful)
I still believe you're still more likely to get malware on dodgy sites. As worded in the summary, this sounds like an excuse someone came up with to justify their penchant to troll for pr0n, war3z and mp3z.
It's a problem, but the size is limited. (Score:5, Informative)
We have a list of major sites being exploited by active phishing scams, [sitetruth.com] which we update every three hours. There are 56 sites on the list right now. Most sites don't stay on the list too long, but we still have 14 that have been on the list since last year. Most of them are DSL service providers with compromised machines they haven't kicked off. Some providers are proactive about this, and some aren't. Then there are a few compromised sites that just have no clue about how to fix their problem. One such site is the teacher web space for a school district.
By, well, nagging, we've been able to get the big players to fix their problems. Google, Yahoo, MSN, and Dell were all on the list at one point, but they've all tightened up their systems.
The points we make with this list are that 1) the number of major sites involved is small, and 2) blacklisting at the second level domain level causes acceptable levels of collateral damage. So go ahead, blacklist the whole second level domain in your phishing filters. Think of it as a way to encourage sites to clean up their act. Or as a way to find out where to apply the clue stick.
This list is about "major" sites, ones in Open Directory (1.7 million sites.) The issue there is with attackers trying to steal the credibility of the major site. At the other end of the scale, any domain less than a few weeks old probably isn't worth connecting to. Or at least it should be read with all executable content disabled, including HTML email. Also, any link with more than one redirect probably shouldn't be followed.
It's easier to filter out the attackers if you're willing to filter out the bottom-feeders as well. But that's another story.
Re: (Score:2)
It only takes one site to compromise the user's machine if the user is running something exploitable. Surely the only
Re: (Score:2)
You can't rely on users not to do something stupid when the definition of 'stupid' gets wider and wider each year.
Of course it has to be automated. That's what we're working on. Our free browser plug-ins will be out shortly.
Re: (Score:2)
There's a tinyurl on the list, but I don't see how that would serve any good. It should be the site the tinyurl points to, no?
"tinyurl.com" and "notlong.com" are phishing magnets, because phishing filters don't typically block their domain. So phishing sites use them to bypass filters. Those services try to keep up with phish reports and block those URLs, but they're falling behind. We encourage them to automate the process; as soon as a URL appears in any of the major phishing databases (PhishTank, A
No news is old news (Score:2, Interesting)
Firstly, everyone in this market puts out these sort of research reports - monthly, quarterly, annually, it varies - partly to inform and educate, but mostly for the PR value. Of course everyone sees much the same threat environment, so they're all much of a muchness, PR spin notwithstanding. I don't see my employers' annual threat survey on the Slashdot front page; hmmmm, maybe I should submit it? Or maybe not...
Secondly - "serve forth" PUH-leassseee.
This doesn't defy conventional wisdom (Score:5, Insightful)
Or you could just install all updates for your favorite OS or a 3rd party browser and virtually eliminate the chance of unintentionally installing a malware executable. Even IE7 is positively fascist when it comes to downloads and plugins these days.
Re: (Score:3, Informative)
Most of the hosts are not aware their site has been "infected" half of the time. I used a site regularly until one day it tried to download some malware in an iframe and an flv file. Not aware at all their site had got a problem.
Not helped by some people who use a certain
Truth wrapped up in FUD, and the way forward... (Score:5, Insightful)
When people tell me "oh yes, I use Internet Explorer, but I only visit well known websites I can trust" I have been able in some cases to convince them that thanks to forums and other sources of third party content even "trusted" websites can source malware.
Despite what Trend Micro suggests, the best approach to security is still taking proper care with the software you use. They talk about attacks on embedded devices like cellphones, but note that they're primarily talking about their potential as backdoors for infected files, not about their embedded browsers being attacked directly. Antivirus companies want antivirus software installed on everything... that's how they make money... but until they ship software that is purely a scanner and doesn't patch the OS you're more likely to have the AV software than any virus damage your PDA, cellphone, or non-Windows PC.
But taking care with the software you use DOESN'T mean only using bad software on good websites, but not using bad software at all. The best antivirus, then, is to avoid using software that deliberately includes backdoors to allow automatic installation and execution of unsandboxed code from websites. The poster boy for this insane design is, of course, Internet Explorer, which is actually built around this model and were Microsoft to fix it they would have to break a lot of working products. But there are similar design flaws, albeit ones not so automatically easy to exploit, in other browsers... for example Firefox and Safari will happily install code for you if the code is wrapped up in the appropriate package. In Firefox that package is the XPI... and I would recommend keeping the list of whitelisted sites in Firefox empty at all times. In Safari that package is the Dashboard widget, and the option 'Open "Safe" Files after downloading' which is now (thankfully) off by default in new installs (though it doesn't prevent Dashboard widgets from being installed).
And now Microsoft is pushing a cross-platform infection vector under the name Silverlight, and there's an open-source clone of it by the name "Moonlight" under development. Some days I despair, truly.
And no number of "I'm about to do something stupid, is this OK?" dialog boxes are good enough. After 20 years as a system administrator, the last several years of which were spent fighting an increasingly frustrating battle against malware riding on this misfeature of Microsoft's security model, I can only recall one time where someone was *twice* convinced to download and explicitly run an infected file from the shell... but I've repeatedly had people come to me saying "Peter... I clicked on the wrong button again, and my computer's acting funny".
If you're a software developer, and you find yourself adding an "I'm about to do something stupid" dialog... please reconsider whether it's actually necessary. It almost never is. People really would rather explicitly download and install a plugin, for example, than have the browser pop up annoying messages all the time. Really.
Safe to Play in Traffic (Score:2)
Yes, you're not in any greater risk hanging out in crackhouses, because even the banks you visit sometimes have dangerous bank robbers in them.
That statement is one of the stupidest analyses of relative risk that I've ever heard.
What can I say? (Score:2)
You get what you pay for.
Cybercrim tsunami (almast stay 1 ahead) (Score:2)
Re: (Score:3, Funny)
Re: (Score:2)
WTF? Use Adblock not to download the malware-pushing banners.
Don't download code. Music, videos, etc. OK, but NOT code. Unless you KNOW it's safe.
And finally : use a Macintosh or Hackintosh. There's no malware on OSX.
It's really laughable. Fortune500 sites pushing malware? That's why you Americans have "class action lawsuits" and "ambulance-chasing lawyers". 1+1+1=
Re: (Score:3, Insightful)
Try Pfizer, for one (Score:2)
Too many words... (Score:3, Informative)
Surely you mean think twice before [...] you browse with internet exploder..