Slashdot Log In
Malware Spreading Via ... Windshield Fliers?
Posted by
timothy
on Wed Feb 04, 2009 01:12 PM
from the right-at-home-with-the-bug-guts dept.
from the right-at-home-with-the-bug-guts dept.
wiedzmin writes "Another interesting article published by the SANS ISC Handler's Diary is describing a very unusual vector for malware distribution — windshield fliers and fake parking tickets. A website URL provided for "disputing a ticket" actually leads to a malicious website, and a "toolbar" required to find the photo of your violation is, you guessed it, a trojan posing as a fake antivirus. The best part is — according to the VirusTotal report, it doesn't look like most antiviruses have signatures for this one yet."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Neat but.. (Score:5, Insightful)
Re:Neat but.. (Score:5, Funny)
Parent
Re:Neat but.. (Score:5, Funny)
My god, the frustrations I could take out on him!
Also, we could use violence.
Parent
Re:Neat but.. (Score:4, Insightful)
My god, the frustrations I could take out on him!
Also, we could use violence.
Do you think the people putting these flyers on cars are the real authors. i could just as easily pay some little kid 40 bux worth of weed to go around that parking lot of that nice corporate office over there and put these flyers out :P
Parent
Re:Neat but.. (Score:4, Informative)
Indeed. I remember hearing about a Nigerian 419 scammer who got hold of a lad with learning difficulties in America. After he fleeced him for all he could get he gave him a job funneling money from other marks. He had a lot more success because people thought he had a genuine presence in the USA. The poor kid thought he had an honest job and was going to get paid "any day now"...
Parent
Re:Neat but.. (Score:5, Insightful)
Knowing at least one area in which windshield fliers are prevalent (college towns), chances are pretty high you'd be going ballistic over some poor college kid who just needed some cash and wasn't told what these fliers were for, not a malicious malware author/user hiding in an apartment somewhere while his freshly-hired lackeys unwittingly do his bidding.
So unfortunately, catching the guy distributing the fliers wouldn't do you any good, unless you're really THAT upset with the practice of windshield fliering in the first place.
The fake parking tickets, though, those are probably illegal in and of themselves, and the lackey distributing them would have to at least SEE what they are and thus be complicit in the activity, so they probably have some other manner of disguising themselves (official-looking police uniform, etc) so nobody questions them. Unless the REAL cops come by.
Parent
Re:Neat but.. (Score:5, Funny)
Phase 1: Pose as college student looking to make a few bucks
Phase 2: Get to know person distributing the fliers to students
Phase 3: Stand trial for aggravated assault with no regrets.
=Smidge=
Parent
Re:Neat but.. (Score:5, Funny)
Phase 1: Pose as college student looking to make a few bucks
Phase 2: ???
Phase 3: PROFIT!!!
There, fixed that for you.
Parent
Re:Neat but.. (Score:4, Insightful)
Parent
Re:Neat but.. (Score:5, Interesting)
Except in the UK, where it's a public servant with little or no training who, in some instances, actually has more power than a real police officer.
Parent
Re:Neat but.. (Score:4, Insightful)
Parent
Re: (Score:3, Funny)
More likely it was someone who got an email with the subject:
MAKE THOUSANDS OF DOLLARS IN YOUR SPARE TIME!!!!!
Notice Sent to UND Students. (Score:5, Informative)
Urgent! Bogus Parking Tickets Found on Campus Refer Recipients to Virus-laden Web site
Do Not Go To This Web Site!!!
A message concerning bogus parking tickets being distributed on campus that was sent out late Monday contained the URL of a Web site that carries a computer virus. We are resending that message below with the problem URL removed:
Here is the message:
UPD received a call on Jan. 31, 2009 pertaining to someone issuing bogus parking tickets in the parking lot directly east of the ramp. The ticket is yellow in color and states the following: "PARKING VIOLATION This vehicle is in violation of standard parking regulations. To view pictures with information about your parking preferences, go to XXXXXXX.COM" (URL not used for computer safety reasons)
DO NOT GO TO THIS WEBSITE!! IT CONTAINS A VIRUS!
If you visit the Web site and click on the link to view pictures of horrible parking, you will download a virus onto your computer.
Should anyone have any information pertaining to this, please contact UND Police at 777-3491.
Lt. Dan Lund
Night Shift Supervisor
UND Police Dept.
Parent
Re: (Score:3, Insightful)
Ok, but when I try to go to XXXXXXX.COM it doesn't say anything about parking tickets. It says they want to help me find Car Insurance, Chat, Work From Home, Cheap Flights and other stuff. What now?
Re:Easy way to not have it be a problem (Score:4, Insightful)
Parent
Re:Easy way to not have it be a problem (Score:4, Insightful)
To Pay you parking ticket online now, please fill out the following:
Name:______________
SSN:______________
Credit Card Number:_______________
Wouldn't matter what OS you were using if you hand over your info.
Parent
Re:Neat but.. (Score:4, Interesting)
Now, handing out fake tickets to those obviously illegally parked could net a useful income for a while. Especially if the 'objections' site informed you that there had a substantial backlog of cases, and had to be evaluated, parameterized and prioritised. ("and we hope to get back to you before the one month follow up or discard period has passed.) It should be good for two weeks of Paypal heaven. Of course the flier distributor would be caught on video, and identified as wearing a sort of uniform with dayglo highlights including a cap and sunglasses, but hey, its a clue isn't it.
The other worthwhile bit would be advertising. Being caught doing something illegal has your attention. Wow, what an attention grabbing gift. You actually are likely to read the flier. Going to a site www.payubastards.com would be sufficient warning that you are not in standard territory. Opening page tells you that you are (1) a miscreant and (2) so what, rip up the notice and enjoy the site, brought to you by
Of course, city councils would be furious at the disrespect and would find something illegal about it. But if the site poked fun at council misspending and other idiocies, the shut-down could become politically expensive. Political change could be the real objective of the fliers.
Parent
Re:Neat but.. (Score:5, Interesting)
Now, handing out fake tickets to those obviously illegally parked could net a useful income for a while.
Someone did that for a while in Madison, WI:
http://www.madison.com/tct/news/stories/302436 [madison.com]
His trial begins on the 19th.
Parent
Clever idea... (Score:5, Insightful)
Maybe a few people in a town would end up affected, but the cost in time/effort required to trap victims is impractical considering what a simple email can do.
Re:Clever idea... (Score:5, Insightful)
Parent
Re:Clever idea... (Score:5, Interesting)
Depends on where you target your fliers. Put 'em around city hall, and you may be able to get some schmuck to compromise their internal network. Or a bank, or a big company, etc, etc.
That would be the big advantage of being able to geographically target your scam.
Parent
Re:Clever idea... (Score:5, Interesting)
Sure, some security testing firms have already added "leave trojaned USB sticks in the parking lot" to their list of tests.
Slap these on cars before lunch, everyone who goes out to lunch will probably check the url when they get back on their work computer.
Parent
Re: (Score:3, Interesting)
Depends on how many people actually pay the fine.
Re: (Score:3, Interesting)
Ah, but have you ever seen those 5 cent plastic signs advertising DatingIn.com? Somebody local to you nails/stakes those(and probably all those other signs) and they do it for stupid cheap.
Ad agencies realized people will put those up for a pittance if you didn't care where they went, just wherever someone was already going for work/shopping/etc. And those things are everywhere.
Heaven help us if they were to get the idea to give the homeless a bottle of rotgut and a pad of these malware tickets. It'd be
The root of the problem (Score:3, Funny)
You guys are missing the root of the problem. If the cars didn't have windows, then the users wouldn't have gotten infected.
I suggest a car like this.
http://www.m38a1.com/images/Archives/jeep%20_105%20gun%20jpg.jpg [m38a1.com] :p
A virus I'd actually fall for (Score:5, Insightful)
Re:A virus I'd actually fall for (Score:5, Funny)
welcome to the world of personal computing! Now that you've made the decision to dedicate at least some part of your life to staring at a screen and tapping on a keyboard, you should know that we (The Internets) have been working hard to make your computing experience as exciting as possible.
Everyday you will have to learn more and more about computing just to keep up with trends, and if that isn't enough, we have some software coders that want to play a game with you. It's called "Show me your password and finance details" and is such an exciting game you will soon forget all about Zelda. Never mind looking for the hidden doors or avoiding poisonous frogs. In this game, every key you touch could be the one that causes you to lose.
We also have many other options to fill your time. We're glad you are here, enjoy computing in the Internets.
Sincerely,
I.M. Rogue
Parent
Re:A virus I'd actually fall for (Score:5, Interesting)
Parent
Re:A virus I'd actually fall for (Score:5, Insightful)
it still fails to computer literate common sense, "why would i need to install something to..."
Flash. Silverlight. Java. Adobe Reader. Windows Update controls.
People are getting used to installing applications to interact with "trusted" parties.
Parent
That is pretty clever... (Score:5, Interesting)
And then you add in people who are from out of town, who would much rather not have to go back to your city to deal with a ticket...
Re:That is pretty clever... (Score:5, Funny)
do you know what a parking ticket looks like in your city
Only one way to find out. Lemme borrow your keys.
Parent
Re:That is pretty clever... (Score:4, Interesting)
Not always.
In Eugene, Oregon, for instance, much of the parking is contracted out to a company called Diamond, which has the authority to issue tickets.
These tickets have no phone numbers on them, though they do include an address to mail your payment to.
There seems to be no way of contesting the tickets, either, which was annoying a while back when I got a ticket about a minute before the time had expired.
Parent
Re:That is pretty clever... (Score:5, Insightful)
Accidentally modded redundant instead of insightful. Sorry. Posting to kill moderation.
Isn't this awesome new moderation system such a great part of this fantastic new layout? Nobody liked the "confirm" button from the previous system, right?
Parent
Who reads those things anyway? (Score:5, Informative)
1. You are parked legally
2. Everybody else has these "tickets"
And that's before you notice that your local government is using a website like: http://qlmbix.ch/parkingticets.html [qlmbix.ch]
I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.
Re:Who reads those things anyway? (Score:4, Insightful)
I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a good infection rate.
*fixed*
Parent
Re: (Score:3, Insightful)
And that's before you notice that your local government is using a website like: http://qlmbix.ch/parkingticets.html [qlmbix.ch]
How is the average person supposed to know that a suspicious address? For all they know it could be some sort of acronym, and would the average Joe actually notice that the alleged government site doesn't have a .gov TLD?
Re:Who reads those things anyway? (Score:5, Interesting)
1. You are parked legally
2. Everybody else has these "tickets"
I've gotten tickets when I was parked legally and successfully contested them. All the other cars on the block were also incorrectly ticketed at the same time - apparently a cop misunderstood the parking rules, or didn't know how to operate a watch.
Furthermore, given the city's trend of contracting out ticking, the fact that the URL pointed to some third party website and not a subdomain of the city or county sites wouldn't have set off any red flags either (although one hosted in the Czech Republic would :). The red-light tickets we get in the mail today directs you to the website of the contracted company and not to the city website.
Parent
Re: (Score:3, Insightful)
The "parking ticket" gambit seems pretty weak too if you look around and notice two things:
1. You are parked legally
2. Everybody else has these "tickets"
1. All the more reason you'd want to contest it
2. Maybe the people leaving the tickets are instructed to ticket only 1/10 cars down a street? Even if not, I see people getting tickets all in a row quite often. Metermaids cut wide swaths with their pens.
That's how you make money on these things (Score:3, Insightful)
I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.
We have an abundance of uneducated people in the US, specifically those who don't know or understand the dangers of the internet. Also, a low infection rate is all it takes to get some return on investment.
To top it all off, Americans are first and foremost a scared people, especially of our own government and of forces outside our borders. Heaven forbid you piss off the governme
It works better when they are parked legally (Score:3, Insightful)
Some should rip in to the fake person giving out t (Score:3, Informative)
Some should rip in to the fake person giving out the tickets like people do to the real meter maids as you see do on A&E parking wars. And if they are not real say I'm calling the cops as I don't think they will like to have people giving out fake tickets.
Re:Some should rip in to the fake person giving ou (Score:5, Funny)
Some should rip in to the fake person giving out the tickets
How do you catch a fake person? Fake traps?
Parent
More important than a face on the criminal (Score:3, Funny)
There is also a neck we can hang them from... someone police can pursue and arrest, more direct money to follow... leads.
I really want to see some terrible, nearly unimaginable things happen to these people. Some people feel this way about drug pushers. Others feel this way about child molesters. For me, it is malware. Oh I think of the children too, but frankly, a lot can be done in the way of prevention if only most parents paid attention to their own children that would address a good portion of the child molestation thing and as drugs go... well, once again, people don't get hooked on drugs unless they had some other problems that precipitated it first. If they were raised well, odds are better that they'd not be a drug addict.
Should be pretty easy to stop (Score:3, Interesting)
Oh, wait. Registrar accreditation is handled by these bumbling idiots. And how many ISPs that offer hosting services respond to much of anything?
The weirdest thing just happened to me (Score:5, Funny)
I went out to my car to go to lunch and there was this Nigerian Prince and his entourage standing there and he said he needed my helpto move some cash out of his country for his dead uncle or someone.
You don't even need a Virus or Malware to pull thi (Score:3, Insightful)
You don't even need a Virus or Malware to pull this off all you is a pay on link that takes your CC # and that likely will work even on super locked systems.
Bad idea (Score:3, Funny)
To make it much worse, YOU can catch him and take revenge of every spam/malware/spyware/virus you received ever. We can get an updated version of witch burning for the XXI century.
Windshield fliers (Score:3, Funny)
Dear fliers-posting malware authors (Score:5, Funny)
I don't have a car, you insensitive clod!
I bet the antivirus companies didn't have it ... (Score:5, Informative)
... right away because they get their earliest warnings from honeypot machines and this one uses an offline vector.