Slashdot Log In
Storm Hits Blogger Network
Posted by
CowboyNeal
on Thu Aug 30, 2007 11:18 PM
from the ridin'-the-storm-out dept.
from the ridin'-the-storm-out dept.
ancientribe writes "Researchers have discovered the Storm Trojan nestled in hundreds of blog sites in Google's Blogger network, according to an article in Dark Reading. And this isn't simple comment spam, but actual blogs that post spam, and now, Storm executable files. A researcher who's been tracking the Storm-infested blog sites says he's working with Google to clean up this latest appearance of Storm."
Related Stories
[+]
Storm Botnet Is Behind Two New Attacks 226 comments
We've gotten a number of submissions about the new tricks the massive Storm botnet has been up to. Estimates of the size of this botnet range from 250K-1M to 5M-10M compromised machines. Reader cottagetrees notes a writeup at Exploit Prevention Labs on a new social engineering attack involving YouTube. The emails, which may be targeted at people who use private domain registrations, warn the recipient that their "face is all over 'net" on a YouTube video. The link is to a Storm-infected bot that attacks using the Q4Rollup exploit (a package of about a dozen encrypted exploits). And reader thefickler writes that the recent wave of "confirmation spam" is also due to Storm, as was the earlier, months-long "e-card from a friend" series of attack emails.
Firehose:Storm Hits Blogger Network by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Passing Fad (Score:5, Insightful)
Re:Passing Fad (Score:5, Funny)
Parent
No surprise (Score:3, Funny)
Figures... (Score:3, Funny)
Skynet (Score:5, Funny)
Sad... (Score:5, Informative)
It doesn't do anything technically new. The only thing new here is the particular brand of social engineering used, and it bothers me that this still works.
Parent
Re:Sad... (Score:4, Informative)
With regards to the link, they were also masked well to show up as a youtube url.
All in all I think this means that you don't have to be a total idiot to get infected, maybe just a little naive.
Parent
Re:Sad... (Score:5, Informative)
If by "masked well", you mean:
Yeah, I'd say that's more than "just a little naive" -- it's downright stupid. I don't know how Outlook does it, but Kontact/Kmail does two things: First, it defaults to displaying everything as text if it can, with a big red box at the top that says:
(Link goes nowhere, as this is Slashdot, not actually Kmail.)
After clicking that link, the HTML is shown, but without images. A similar box will be there if there are external images, allowing you to turn them on. But even with everything enabled, it's still easy as hell -- mouseover the youtube link, and the nappy IP address link shows up in the status bar.
Ok, fine, let's assume that someone can be "just a little naive" at that point -- which I think is a stretch, in this day and age; someone who doesn't know that much should take a course before touching a computer.
In that case, the last time I tried to do that, it opened up Konqueror, which popped up a window asking me what I wanted to do with this file. HINT, HINT, HUGE FUCKING HINT -- the file ends in .exe, which again, every computer user should know, means "executable". But even if they don't, every computer user should at least know not to download/open random files from the Internet, unless it's a format they recognize.
How long did it take us to convince computer users to not open attachments? And now this takes the world by storm...
In IE, if I remember, this is going to give you one prompt to download it or "open" it, and after you click "open", it will download, and then give you at least one, if not two more prompts about the program being unsigned. If you're running Vista, it will give you yet another prompt, telling you that this program needs your permission to continue fucking with your computer.
That's -- let me count -- about five separate clues that you don't even have to go out of your way to run into -- realistically, probably three or four. Not to mention the fact that my spamfilter caught most of these before I even started seeing them and training on them, and that example I just pasted to you contains the email address "jerk2werk@nehp.net" -- yet another obvious clue; I don't know anyone with an email address like that.
And there are yet more clues if you start digging -- turning on "all headers", you can see two "Received:" headers and one "Sender:" header, neither of which matches, in any way, the "From:" header.
I'm not saying that everyone should know how to dig through email headers, until they have to -- but those are just the technical "duh" factors. There's also the nontechnical one -- I didn't make a video, and I didn't upload it to Youtube. I might click that link out of curiosity, but clicking a normal Youtube link doesn't ask me if I want to download or open anything.
So what's sad to me is not only that this kind of shit still happens, but that you, like many others, consider it to be "not stupid, just a little naive." We require Driver's Education in my state to operate a car, which is significantly easier than a computer -- if you don't know how to use a computer, it absolutely IS your fault. Go educate yourself.
As for the browser vulnerability, nope, sorry, read TFA. It's the exact same thing as the email "virus" -- it just has Youtube links to an exe file. Another one is even more obvious -- the link includes the nappy IP address right there, links to a file calle
Parent
Re:Sad... (Score:4, Informative)
Parent
Re:Sad... (Score:4, Insightful)
People are dumb and horny. Not necessarily in this order.
Parent
Re:Sad... (Score:4, Insightful)
Parent
Re:Sad... (Score:4, Insightful)
It's social engineering, and it will always work until/unless we remove control of computers from the users. That's not a solution I'm personally willing to endorse. How about you?
Parent
Don't forget the nematodes (Score:4, Funny)
And 2% of worms!
And I thought Trojans [trojancondoms.com] were supposed to prevent infections. Hah.
lol (Score:4, Funny)
Google does not terminate spammers. (Score:4, Interesting)
"Thousands upon thousands of *.blogspot.com pages, all spammed and used to re-direct to other spammer landing pages"
I blocked .blogspot.com referrers a few days ago (Score:3, Informative)
order allow,deny
deny from 206.51.229.
deny from 206.51.233.
allow from all
RewriteEngine on
RewriteCond %{HTTP_REFERER} blogspot\.com [NC]
RewriteRule
This has cut the formmail spam that I receive down to zero ever since I set it up.
The deny from lines take care of some guy who downloads the html submit form and posts spam from "Darksites.com", and the Rewrite denies access from all
Here is a single example from a few minutes ago:
72.47.89.233 --[30/Aug/2007:22:28:22 -0600] "GET / HTTP/1.0" 403 3931 "http://hydrocodone--4t1.blogspot.com" "Opera/9.0 (Macintosh; PPC Mac OS X; U; en)"
Re: (Score:3, Insightful)
Re:They have no idea? (Score:5, Interesting)
I'm on the outside also, but can tell you how. Blogger has a mail2 feature where you can post to an email address that you make up, and keep secret. Like a password. With users who makeup easy mail2 addresses (then don't monitor or abandon their blogs), and millions of emails being sent by the Storm BotNet, not hard to figure out how they are getting posted. Eventually the botnet hits them, just like they do with regular email addresses, and they get posted to the blog.
And also note, the summary is misleading somewhat. The actual files that do the "infection" aren't hosted on Blogger at all. The same thing that is getting sent to peoples emails are being posted to blogs that leave their mail2 address open and easy. So you still have to fall for the click here to get infected...
This has been going on for awhile. I first saw it at least 2 months ago. It may be increasing, but not new.
Parent
Re:Ballmer's Revenge? (Score:4, Interesting)
That's quite the glib statement, considering that worm requires so much user action (or inaction, depending on how you look at it) to infect a Windows box, it's not even funny.
Are you serious?
Oh, wait a minute... *slaps head* "Erris" is twitter's sockpuppet [slashdot.org] account, which he uses to shill his own posts.
I thought this looked familar.
Parent
Re: (Score:3, Funny)
When people realize how user-friendly and fast and efficient and shiny Vista is, they'll come around and realize that it really is such an improvement over Windows XP and certainly reflects the quality improvement you'd expect from the biggest company in the world spending seven years working on it, just to make those of us who use compu
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Some sort of electric shock, sent through the keyboard or mouse, should do the trick!!
Re: (Score:3, Funny)