Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Malware Spreading Via ... Windshield Fliers?

Posted by timothy on Wed Feb 04, 2009 02:12 PM
from the right-at-home-with-the-bug-guts dept.
Security IT
wiedzmin writes "Another interesting article published by the SANS ISC Handler's Diary is describing a very unusual vector for malware distribution — windshield fliers and fake parking tickets. A website URL provided for "disputing a ticket" actually leads to a malicious website, and a "toolbar" required to find the photo of your violation is, you guessed it, a trojan posing as a fake antivirus. The best part is — according to the VirusTotal report, it doesn't look like most antiviruses have signatures for this one yet."
+ -
story

Related Stories

Firehose:Malware spreading via... parking tickets? by wiedzmin (1269816)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Malware Spreading Via ... Windshield Fliers? 25 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Neat but.. (Score:5, Insightful)

    by Dyinobal (1427207) on Wednesday February 04 2009, @02:14PM (#26727637)
    As clever as this is it seems like catching the person or persons putting these on wind shields would be simple enough.

    • Re:Neat but.. (Score:5, Funny)

      by bensafrickingenius (828123) on Wednesday February 04 2009, @02:16PM (#26727657)
      Absolutely. And just think of actually having the chance to get your hands on one of those assholes. My god, the frustrations I could take out on him!

      • Re:Neat but.. (Score:5, Funny)

        by Anonymous Coward on Wednesday February 04 2009, @02:30PM (#26727871)

        My god, the frustrations I could take out on him!

        Also, we could use violence.

      • Re:Neat but.. (Score:5, Insightful)

        by Captain Spam (66120) on Wednesday February 04 2009, @02:33PM (#26727887) Homepage

        Knowing at least one area in which windshield fliers are prevalent (college towns), chances are pretty high you'd be going ballistic over some poor college kid who just needed some cash and wasn't told what these fliers were for, not a malicious malware author/user hiding in an apartment somewhere while his freshly-hired lackeys unwittingly do his bidding.

        So unfortunately, catching the guy distributing the fliers wouldn't do you any good, unless you're really THAT upset with the practice of windshield fliering in the first place.

        The fake parking tickets, though, those are probably illegal in and of themselves, and the lackey distributing them would have to at least SEE what they are and thus be complicit in the activity, so they probably have some other manner of disguising themselves (official-looking police uniform, etc) so nobody questions them. Unless the REAL cops come by.

    • Notice Sent to UND Students. (Score:5, Informative)

      by Myuu (529245) <myuu@pojo.com> on Wednesday February 04 2009, @04:49PM (#26729475) Homepage

      Urgent! Bogus Parking Tickets Found on Campus Refer Recipients to Virus-laden Web site

      Do Not Go To This Web Site!!!

      A message concerning bogus parking tickets being distributed on campus that was sent out late Monday contained the URL of a Web site that carries a computer virus. We are resending that message below with the problem URL removed:

      Here is the message:

      UPD received a call on Jan. 31, 2009 pertaining to someone issuing bogus parking tickets in the parking lot directly east of the ramp. The ticket is yellow in color and states the following: "PARKING VIOLATION This vehicle is in violation of standard parking regulations. To view pictures with information about your parking preferences, go to XXXXXXX.COM" (URL not used for computer safety reasons)

      DO NOT GO TO THIS WEBSITE!! IT CONTAINS A VIRUS!

      If you visit the Web site and click on the link to view pictures of horrible parking, you will download a virus onto your computer.
      Should anyone have any information pertaining to this, please contact UND Police at 777-3491.

      Lt. Dan Lund

      Night Shift Supervisor

      UND Police Dept.

  • Clever idea... (Score:5, Insightful)

    by O('_')O_Bush (1162487) on Wednesday February 04 2009, @02:17PM (#26727683)
    but I can't seriously imagine this being a widespread problem.

    Maybe a few people in a town would end up affected, but the cost in time/effort required to trap victims is impractical considering what a simple email can do.

    • Re:Clever idea... (Score:5, Insightful)

      by IamGarageGuy 2 (687655) on Wednesday February 04 2009, @02:23PM (#26727757) Journal
      Maybe this is supposed to be a local infection by design. Maybe to attack a local business or gov. office. Anybody have any ideas of how a local ip could be used to attack something?

      • Re:Clever idea... (Score:5, Interesting)

        by SatanicPuppy (611928) * <Satanicpuppy@@@gmail...com> on Wednesday February 04 2009, @02:40PM (#26727975) Journal

        Depends on where you target your fliers. Put 'em around city hall, and you may be able to get some schmuck to compromise their internal network. Or a bank, or a big company, etc, etc.

        That would be the big advantage of being able to geographically target your scam.

      • Re:Clever idea... (Score:5, Interesting)

        by Zerth (26112) on Wednesday February 04 2009, @02:51PM (#26728097) Homepage

        Sure, some security testing firms have already added "leave trojaned USB sticks in the parking lot" to their list of tests.

        Slap these on cars before lunch, everyone who goes out to lunch will probably check the url when they get back on their work computer.

  • What scares me most is that this style of distribution is something I'd actually fall for. I mean, pop ups and stuff are easy enough to ignore, but what about local flies for bands, business cards, and these tickets? Just goes to show that no matter how much protection you have on the tech side, there's always a social engineering way around it.

    • Re:A virus I'd actually fall for (Score:5, Funny)

      by zappepcs (820751) on Wednesday February 04 2009, @02:24PM (#26727773) Journal

      welcome to the world of personal computing! Now that you've made the decision to dedicate at least some part of your life to staring at a screen and tapping on a keyboard, you should know that we (The Internets) have been working hard to make your computing experience as exciting as possible.

      Everyday you will have to learn more and more about computing just to keep up with trends, and if that isn't enough, we have some software coders that want to play a game with you. It's called "Show me your password and finance details" and is such an exciting game you will soon forget all about Zelda. Never mind looking for the hidden doors or avoiding poisonous frogs. In this game, every key you touch could be the one that causes you to lose.

      We also have many other options to fill your time. We're glad you are here, enjoy computing in the Internets.

      Sincerely,

      I.M. Rogue

    • Re:A virus I'd actually fall for (Score:5, Interesting)

      by Guiness17 (606444) on Wednesday February 04 2009, @02:29PM (#26727855)
      Agreed, I could've fallen for this myself. I got a ticket about a year ago in a city I didn't live in, and lo and behold, it had a website on it for paying online. Ticket looked official, but on second thought, I couldn't be sure, having never seen one from that city before. I blindly typed in the URL... I'd like to believe I would have picked off a phishing scam, but still, I took the first step.

      • Re:A virus I'd actually fall for (Score:5, Insightful)

        by Hyppy (74366) on Wednesday February 04 2009, @03:20PM (#26728441)

        it still fails to computer literate common sense, "why would i need to install something to..."

        Flash. Silverlight. Java. Adobe Reader. Windows Update controls.

        People are getting used to installing applications to interact with "trusted" parties.

  • That is pretty clever... (Score:5, Interesting)

    by damn_registrars (1103043) * on Wednesday February 04 2009, @02:21PM (#26727721) Journal
    After all, do you know what a parking ticket looks like in your city, to be able to distinguish between a real one and a fake? I would suspect that most people who recognize the real thing either wouldn't bother to try to contest one, or don't do anything about them anyways. But for the larger portion of a city's population who has not been ticketed, they could well have a hard time telling a fake from the real thing.

    And then you add in people who are from out of town, who would much rather not have to go back to your city to deal with a ticket...

  • Who reads those things anyway? (Score:5, Informative)

    by jandrese (485) <kensama@vt.edu> on Wednesday February 04 2009, @02:23PM (#26727765) Homepage Journal
    I can't imagine there are a large number of people who are not only going to read the flyer, but take it home and remember to get on their computer and type in a URL from it. The "parking ticket" gambit seems pretty weak too if you look around and notice two things:
    1. You are parked legally
    2. Everybody else has these "tickets"

    And that's before you notice that your local government is using a website like: http://qlmbix.ch/parkingticets.html [qlmbix.ch]

    I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.

    • Re:Who reads those things anyway? (Score:5, Interesting)

      by pavon (30274) on Wednesday February 04 2009, @02:37PM (#26727933)

      1. You are parked legally
      2. Everybody else has these "tickets"

      I've gotten tickets when I was parked legally and successfully contested them. All the other cars on the block were also incorrectly ticketed at the same time - apparently a cop misunderstood the parking rules, or didn't know how to operate a watch.

      Furthermore, given the city's trend of contracting out ticking, the fact that the URL pointed to some third party website and not a subdomain of the city or county sites wouldn't have set off any red flags either (although one hosted in the Czech Republic would :). The red-light tickets we get in the mail today directs you to the website of the contracted company and not to the city website.

  • The weirdest thing just happened to me (Score:5, Funny)

    by mandark1967 (630856) on Wednesday February 04 2009, @02:30PM (#26727865) Homepage Journal

    I went out to my car to go to lunch and there was this Nigerian Prince and his entourage standing there and he said he needed my helpto move some cash out of his country for his dead uncle or someone.

  • Dear fliers-posting malware authors (Score:5, Funny)

    by Yvan256 (722131) on Wednesday February 04 2009, @03:32PM (#26728611) Homepage Journal

    I don't have a car, you insensitive clod!

  • I bet the antivirus companies didn't have it ... (Score:5, Informative)

    by Ungrounded Lightning (62228) on Wednesday February 04 2009, @03:59PM (#26728957) Journal

    ... right away because they get their earliest warnings from honeypot machines and this one uses an offline vector.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.