Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×
Security IT

Malware Spreading Via ... Windshield Fliers? 207

wiedzmin writes "Another interesting article published by the SANS ISC Handler's Diary is describing a very unusual vector for malware distribution — windshield fliers and fake parking tickets. A website URL provided for "disputing a ticket" actually leads to a malicious website, and a "toolbar" required to find the photo of your violation is, you guessed it, a trojan posing as a fake antivirus. The best part is — according to the VirusTotal report, it doesn't look like most antiviruses have signatures for this one yet."
This discussion has been archived. No new comments can be posted.

Malware Spreading Via ... Windshield Fliers?

Comments Filter:
  • Neat but.. (Score:5, Insightful)

    by Dyinobal ( 1427207 ) on Wednesday February 04, 2009 @02:14PM (#26727637)
    As clever as this is it seems like catching the person or persons putting these on wind shields would be simple enough.
    • by bensafrickingenius ( 828123 ) on Wednesday February 04, 2009 @02:16PM (#26727657)
      Absolutely. And just think of actually having the chance to get your hands on one of those assholes. My god, the frustrations I could take out on him!
      • by Anonymous Coward on Wednesday February 04, 2009 @02:30PM (#26727871)

        My god, the frustrations I could take out on him!

        Also, we could use violence.

        • VirtuaMod: +1

        • Re:Neat but.. (Score:4, Insightful)

          by pasv ( 755179 ) on Wednesday February 04, 2009 @05:16PM (#26729753) Homepage

          My god, the frustrations I could take out on him!

          Also, we could use violence.

          Do you think the people putting these flyers on cars are the real authors. i could just as easily pay some little kid 40 bux worth of weed to go around that parking lot of that nice corporate office over there and put these flyers out :P

          • Re:Neat but.. (Score:4, Informative)

            by Nick Ives ( 317 ) on Wednesday February 04, 2009 @05:24PM (#26729855)

            Indeed. I remember hearing about a Nigerian 419 scammer who got hold of a lad with learning difficulties in America. After he fleeced him for all he could get he gave him a job funneling money from other marks. He had a lot more success because people thought he had a genuine presence in the USA. The poor kid thought he had an honest job and was going to get paid "any day now"...

          • Re: (Score:3, Interesting)

            by sumdumass ( 711423 )

            Do you think the little kid is going to take a felony spot for a $40 bag of weed? Hell no, he is going to rat you out in a heart beat when someone ID's them off the corporate office's parking lot surveillance camera footage.

      • Re:Neat but.. (Score:5, Insightful)

        by Captain Spam ( 66120 ) on Wednesday February 04, 2009 @02:33PM (#26727887) Homepage

        Knowing at least one area in which windshield fliers are prevalent (college towns), chances are pretty high you'd be going ballistic over some poor college kid who just needed some cash and wasn't told what these fliers were for, not a malicious malware author/user hiding in an apartment somewhere while his freshly-hired lackeys unwittingly do his bidding.

        So unfortunately, catching the guy distributing the fliers wouldn't do you any good, unless you're really THAT upset with the practice of windshield fliering in the first place.

        The fake parking tickets, though, those are probably illegal in and of themselves, and the lackey distributing them would have to at least SEE what they are and thus be complicit in the activity, so they probably have some other manner of disguising themselves (official-looking police uniform, etc) so nobody questions them. Unless the REAL cops come by.

        • by Smidge204 ( 605297 ) on Wednesday February 04, 2009 @02:53PM (#26728125) Journal

          Phase 1: Pose as college student looking to make a few bucks

          Phase 2: Get to know person distributing the fliers to students

          Phase 3: Stand trial for aggravated assault with no regrets.

          =Smidge=

        • Re:Neat but.. (Score:4, Insightful)

          by Anonymous Coward on Wednesday February 04, 2009 @03:54PM (#26728899)

          unless you're really THAT upset with the practice of windshield fliering in the first place.

          Yes, I am. There are certain behaviors everyone should know are asshattery. Being a "poor college student" does not make it okay to take a job being a total jerk (telemarketing, spammer, virus writer, and the person who sprays people unasked with perfume).

          • Re: (Score:3, Insightful)

            by ResidntGeek ( 772730 )
            Yes, it does. I care much more about being able to buy ramen than I do about your dinner not being interrupted, or your email inox having a few viagra ads in it. I fully expect other people to have the same priorities.
        • Knowing at least one area in which windshield fliers are prevalent (college towns), chances are pretty high you'd be going ballistic over some poor college kid who just needed some cash and wasn't told what these fliers were for,

          Is it time to invoke Godwin's law yet?

          The fake parking tickets, though, those are probably illegal in and of themselves

          So are the fliers.

          and the lackey distributing them would have to at least SEE what they are and thus be complicit in the activity

          They have to litter to put a flyer on someone else's car. Depending on where you are it might be considered vandalism, esp. if you do it on a rainy day and it dries on and the owner has to expend actual effort (no matter how slight) if they are annoyed enough with you. But it's not like they put a lot of effort into running down the flyer-appliers of the world.

          so they probably have some other manner of disguising themselves (official-looking police uniform, etc) so nobody questions them. Unless the REAL cops come by.

          The parking tickets are more illegal, because applying them is probably in and of itself cons

        • Re: (Score:3, Insightful)

          by John Hasler ( 414242 )

          > So unfortunately, catching the guy distributing the fliers wouldn't do you any good...

          He knows who he got the flyers from.

      • Comment removed based on user account deletion
      • just think of actually having the chance to get your hands on one of those assholes

        Obviously the jerk walking around town putting fake parking tickets on cars isn't going to be the ringmaster of the operation. He's going to be just some guy trying to make a few dollars.

        I'd like to think that enough people are moral enough to know that this is wrong, and the rest will figure it out after being arrested for impersonating a police officer, that the efficacy of this infection vector will quickly fall to zero.

    • Re:Neat but.. (Score:4, Insightful)

      by pclminion ( 145572 ) on Wednesday February 04, 2009 @02:37PM (#26727929)
      Some homeless person who some random dude paid $20 to slap a bunch of fliers on cars is going to help you how?
      • Some homeless person...is going to help you how?

        Another $50 should get you a place and time.

      • Re: (Score:3, Funny)

        by Intron ( 870560 )

        More likely it was someone who got an email with the subject:

        MAKE THOUSANDS OF DOLLARS IN YOUR SPARE TIME!!!!!

    • It'll lead you to someone who got paid a little money to do it but has no idea who the actual person who paid them is. At the most they'll catch one or two of the people who are actually behind the scheme, the rest will all be people who just wanted a quick job that paid a few bucks.
    • by dmomo ( 256005 )

      Agreed. Of course, the next step will be for the malware creator to obscure themselves from the "flier" person. Easy enough, I suppose. Malware provider pays via paypal and has an anonymous scout verifying that the "flier person" is actually doing their job. The person putting the fliers may not even know that what they are doing is bad.

    • This seems like more of a kids prank, really. Unless you have a network of people around the country / world doing the same thing, you're only going to effect a very small number of people. You can't do this to build a botnet, which seems to be the goal of most virus writers these days.
    • by Myuu ( 529245 ) <myuu@pojo.com> on Wednesday February 04, 2009 @04:49PM (#26729475) Homepage

      Urgent! Bogus Parking Tickets Found on Campus Refer Recipients to Virus-laden Web site

      Do Not Go To This Web Site!!!

      A message concerning bogus parking tickets being distributed on campus that was sent out late Monday contained the URL of a Web site that carries a computer virus. We are resending that message below with the problem URL removed:

      Here is the message:

      UPD received a call on Jan. 31, 2009 pertaining to someone issuing bogus parking tickets in the parking lot directly east of the ramp. The ticket is yellow in color and states the following: "PARKING VIOLATION This vehicle is in violation of standard parking regulations. To view pictures with information about your parking preferences, go to XXXXXXX.COM" (URL not used for computer safety reasons)

      DO NOT GO TO THIS WEBSITE!! IT CONTAINS A VIRUS!

      If you visit the Web site and click on the link to view pictures of horrible parking, you will download a virus onto your computer.
      Should anyone have any information pertaining to this, please contact UND Police at 777-3491.

      Lt. Dan Lund

      Night Shift Supervisor

      UND Police Dept.

      • Re: (Score:3, Insightful)

        by Endo13 ( 1000782 )

        Ok, but when I try to go to XXXXXXX.COM it doesn't say anything about parking tickets. It says they want to help me find Car Insurance, Chat, Work From Home, Cheap Flights and other stuff. What now?

  • Clever idea... (Score:5, Insightful)

    by O('_')O_Bush ( 1162487 ) on Wednesday February 04, 2009 @02:17PM (#26727683)
    but I can't seriously imagine this being a widespread problem.

    Maybe a few people in a town would end up affected, but the cost in time/effort required to trap victims is impractical considering what a simple email can do.
    • Re:Clever idea... (Score:5, Insightful)

      by IamGarageGuy 2 ( 687655 ) on Wednesday February 04, 2009 @02:23PM (#26727757) Journal
      Maybe this is supposed to be a local infection by design. Maybe to attack a local business or gov. office. Anybody have any ideas of how a local ip could be used to attack something?
      • Re:Clever idea... (Score:5, Interesting)

        by SatanicPuppy ( 611928 ) * <Satanicpuppy@g[ ]l.com ['mai' in gap]> on Wednesday February 04, 2009 @02:40PM (#26727975) Journal

        Depends on where you target your fliers. Put 'em around city hall, and you may be able to get some schmuck to compromise their internal network. Or a bank, or a big company, etc, etc.

        That would be the big advantage of being able to geographically target your scam.

      • Re:Clever idea... (Score:5, Interesting)

        by Zerth ( 26112 ) on Wednesday February 04, 2009 @02:51PM (#26728097)

        Sure, some security testing firms have already added "leave trojaned USB sticks in the parking lot" to their list of tests.

        Slap these on cars before lunch, everyone who goes out to lunch will probably check the url when they get back on their work computer.

      • by Hyppy ( 74366 )
        Get enough local IPs, and you could mount an extremely effective DDOS attack over underutilized peering lines between the local ISPs.
      • by Sleepy ( 4551 )

        >Anybody have any ideas of how a local ip could be used to attack something?

        Well, if you want to make ad money you would change the "DNS server" field on the gateweay router. Most clueless router installs use default admin passwords. Then all your LAN PC's would be using the alternate DNS servers...

        You could also troll the inside RFC1918 netspace, and scp random documents found on a fileserver that grants "guest" logins.

    • Re: (Score:3, Interesting)

      by John Hasler ( 414242 )

      Depends on how many people actually pay the fine.

    • Re: (Score:3, Interesting)

      by Zerth ( 26112 )

      Ah, but have you ever seen those 5 cent plastic signs advertising DatingIn.com? Somebody local to you nails/stakes those(and probably all those other signs) and they do it for stupid cheap.

      Ad agencies realized people will put those up for a pittance if you didn't care where they went, just wherever someone was already going for work/shopping/etc. And those things are everywhere.

      Heaven help us if they were to get the idea to give the homeless a bottle of rotgut and a pad of these malware tickets. It'd be

      • I think with the right labor pool and right area this could very troublesome. Get homeless people to do the leg work, and target major metropolitan areas like New York, San Francisco, and LA. Also if you have a few rootkits waiting on the other side of the URL you could propagate to Linux and Mac machines as well.
    • You guys are missing the root of the problem. If the cars didn't have windows, then the users wouldn't have gotten infected.

      I suggest a car like this.

      http://www.m38a1.com/images/Archives/jeep%20_105%20gun%20jpg.jpg [m38a1.com] :p

  • by pwnies ( 1034518 ) * <j@jjcm.org> on Wednesday February 04, 2009 @02:18PM (#26727689) Homepage Journal
    What scares me most is that this style of distribution is something I'd actually fall for. I mean, pop ups and stuff are easy enough to ignore, but what about local flies for bands, business cards, and these tickets? Just goes to show that no matter how much protection you have on the tech side, there's always a social engineering way around it.
    • by zappepcs ( 820751 ) on Wednesday February 04, 2009 @02:24PM (#26727773) Journal

      welcome to the world of personal computing! Now that you've made the decision to dedicate at least some part of your life to staring at a screen and tapping on a keyboard, you should know that we (The Internets) have been working hard to make your computing experience as exciting as possible.

      Everyday you will have to learn more and more about computing just to keep up with trends, and if that isn't enough, we have some software coders that want to play a game with you. It's called "Show me your password and finance details" and is such an exciting game you will soon forget all about Zelda. Never mind looking for the hidden doors or avoiding poisonous frogs. In this game, every key you touch could be the one that causes you to lose.

      We also have many other options to fill your time. We're glad you are here, enjoy computing in the Internets.

      Sincerely,

      I.M. Rogue

    • Re: (Score:2, Insightful)

      What scares me most is that this style of distribution is something I'd actually fall for.

      How so? Anytime I get a prompt to install anything from a website I'm not expecting, especially on Windows, I tell it no. Just because something is printed on a flier doesn't mean it's any more trustworthy than some random site you found through googling.

      • Just because something is printed on a flier doesn't mean it's any more trustworthy than some random site you found through googling.

        Most people have by now been taught to no click willy-nilly on the screen, but people get fliers and other handouts with URLS on them all the time. We've been conditioned that to be sure you are going to the sight you really intend to go to, you have to manually enter the full URL.

    • by Guiness17 ( 606444 ) on Wednesday February 04, 2009 @02:29PM (#26727855)
      Agreed, I could've fallen for this myself. I got a ticket about a year ago in a city I didn't live in, and lo and behold, it had a website on it for paying online. Ticket looked official, but on second thought, I couldn't be sure, having never seen one from that city before. I blindly typed in the URL... I'd like to believe I would have picked off a phishing scam, but still, I took the first step.
      • Re: (Score:3, Interesting)

        by FangVT ( 144970 )

        Agreed, I could've fallen for this myself. I got a ticket about a year ago in a city I didn't live in, and lo and behold, it had a website on it for paying online. Ticket looked official, but on second thought, I couldn't be sure, having never seen one from that city before. I blindly typed in the URL... I'd like to believe I would have picked off a phishing scam, but still, I took the first step.

        Which suggests the best way to distribute these might be to go near some touristy place and put these on cars

    • erm if a band/buisness/etc need me to install an EXE im not using it. there are plenty of safe mediums to exchange with unkown people, mp3, pdf/image formats. while these attacks are more devious it still fails to computer literate common sense, "why would i need to install something to..."

      • by Hyppy ( 74366 ) on Wednesday February 04, 2009 @03:20PM (#26728441)

        it still fails to computer literate common sense, "why would i need to install something to..."

        Flash. Silverlight. Java. Adobe Reader. Windows Update controls.

        People are getting used to installing applications to interact with "trusted" parties.

        • Re: (Score:3, Interesting)

          I suppose that in a certain way, many linux distributions help with this. They condition users only to install applications from the software repositories.

          Package managers do not need to be exclusive to linux. It might be a positive thing for microsoft to create a package management system of "trusted" programs and force all other executables to be run in a sandbox.

    • What makes it slightly scary is that it claims to be a parking violation.

      However, I would likely make a very loud noise about being required to not only have Internet, but also a specific browser and a specific operating system, and having to download their software.

      For unemployment, at least here, the entire thing is done over the Internet. However, the website pretty much works in any browser (though the layout was slightly off in Konqueror), and if you don't have Internet (or a computer), you walk to the

    • Easy..

      1) if it is not a parking ticket - Ignore it. I don't do business with that sort of business.

      2) if it is a parking ticket. Don't go to the site, go to the most logical traffic court - take a day off from work. If it's real you can pay your fine or whatever. If it's not - hey at least you get a day off from work.

    • Just goes to show that no matter how much protection you have on the tech side, there's always a social engineering way around it.

      True, but the better your protections on the tech side, the harder they have to work at social engineering and the less widespread and effective it will be. There is plenty of room on the tech side for technologies to mitigate trojans.

    • ... because the domain probably didn't end in .gov It's supposed to be a parking ticket, right? But http://www.some.plausible.domain.name.com/ [name.com] should be a red flag, just because of the .com
    • Exactly. Recently scammers and spammers have achieved a step change in their approach, which greatly increases the danger they pose even to alert citizens:

      They have learnt how to spell.

      Be afraid...
  • by damn_registrars ( 1103043 ) * <damn.registrars@gmail.com> on Wednesday February 04, 2009 @02:21PM (#26727721) Homepage Journal
    After all, do you know what a parking ticket looks like in your city, to be able to distinguish between a real one and a fake? I would suspect that most people who recognize the real thing either wouldn't bother to try to contest one, or don't do anything about them anyways. But for the larger portion of a city's population who has not been ticketed, they could well have a hard time telling a fake from the real thing.

    And then you add in people who are from out of town, who would much rather not have to go back to your city to deal with a ticket...
    • by pwnies ( 1034518 ) * <j@jjcm.org> on Wednesday February 04, 2009 @02:26PM (#26727795) Homepage Journal

      do you know what a parking ticket looks like in your city

      Only one way to find out. Lemme borrow your keys.

    • by z80kid ( 711852 )
      Accidentally modded redundant instead of insightful. Sorry. Posting to kill moderation.
    • by Valdrax ( 32670 )

      After all, do you know what a parking ticket looks like in your city, to be able to distinguish between a real one and a fake?

      And if you do, then do you have any reason to believe they haven't changed ticket formats since the last time you got one?

  • by jandrese ( 485 ) <kensama@vt.edu> on Wednesday February 04, 2009 @02:23PM (#26727765) Homepage Journal
    I can't imagine there are a large number of people who are not only going to read the flyer, but take it home and remember to get on their computer and type in a URL from it. The "parking ticket" gambit seems pretty weak too if you look around and notice two things:
    1. You are parked legally
    2. Everybody else has these "tickets"

    And that's before you notice that your local government is using a website like: http://qlmbix.ch/parkingticets.html [qlmbix.ch]

    I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.
    • by RiotingPacifist ( 1228016 ) on Wednesday February 04, 2009 @02:33PM (#26727891)

      I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a good infection rate.

      *fixed*

    • Re: (Score:3, Insightful)

      by Billhead ( 842510 )

      And that's before you notice that your local government is using a website like: http://qlmbix.ch/parkingticets.html [qlmbix.ch]

      How is the average person supposed to know that a suspicious address? For all they know it could be some sort of acronym, and would the average Joe actually notice that the alleged government site doesn't have a .gov TLD?

      • by Hyppy ( 74366 )
        Agreed. Also, many government entities don't reside in the .gov tld anyway.

        www.ocpafl.org is a good example. That's not exactly an easy one to decipher unless you work with that office regularly.
    • if you look around and notice two things:

      Depending on who you are, that's a big if.

    • by pavon ( 30274 ) on Wednesday February 04, 2009 @02:37PM (#26727933)

      1. You are parked legally
      2. Everybody else has these "tickets"

      I've gotten tickets when I was parked legally and successfully contested them. All the other cars on the block were also incorrectly ticketed at the same time - apparently a cop misunderstood the parking rules, or didn't know how to operate a watch.

      Furthermore, given the city's trend of contracting out ticking, the fact that the URL pointed to some third party website and not a subdomain of the city or county sites wouldn't have set off any red flags either (although one hosted in the Czech Republic would :). The red-light tickets we get in the mail today directs you to the website of the contracted company and not to the city website.

    • I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.

      Or just too wrapped up in their own lives to notice other cars. Sure most would know that they aren't parked illegally, but then they'd be even more interested in getting to the website. Hell in some cities, one wouldn't even have to look hard for people parked illegally, as often double parking is the norm. Other towns have confusing rules about where and when one can park. Personally, I could see this as being a very effective attack, in particular if one wants to target a specific individual or small

    • I can't imagine there are a large number of people who are not only going to read the flyer, but take it home and remember to get on their computer and type in a URL from it. The "parking ticket" gambit seems pretty weak too if you look around and notice two things:

      1. You are parked legally

      2. Everybody else has these "tickets"

      And that's before you notice that your local government is using a website like: http://qlmbix.ch/parkingticets.html [qlmbix.ch]

      I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.

      I'll admit, the parking ticket might catch me enough to get to the site if the URL was realistic enough. Something ending in a foreign domain or some completely "out there" URL would set off my flags right away, but a good enough parking ticket scam might nail me at first.

      But the instant I'd have to install something I'd stop what I was doing. I wouldn't care if the domain ended in .gov, I am very particular about what goes onto my PCs. I'd immediately look for alternative routes like the city's or count

    • Re: (Score:3, Insightful)

      by Culture20 ( 968837 )

      The "parking ticket" gambit seems pretty weak too if you look around and notice two things:
      1. You are parked legally
      2. Everybody else has these "tickets"

      1. All the more reason you'd want to contest it
      2. Maybe the people leaving the tickets are instructed to ticket only 1/10 cars down a street? Even if not, I see people getting tickets all in a row quite often. Metermaids cut wide swaths with their pens.

    • I mean for this infection to work, the victim has to be not only stupid, but also not lazy. It has to have a low infection rate.

      We have an abundance of uneducated people in the US, specifically those who don't know or understand the dangers of the internet. Also, a low infection rate is all it takes to get some return on investment.

      To top it all off, Americans are first and foremost a scared people, especially of our own government and of forces outside our borders. Heaven forbid you piss off the governme

    • If you target a big company or something, all you need is one person to be stupid, and that's not just probable, it's certain. That's why this stuff works.

      The person may very well know they're legally parked, and so they'll take the logical next step: they'll contact the issuing body to complain, and look, they left the address of their handy website! And, look, they have a photo app, so I can see what bastard got a ticket, then stuck it on my car!

      It's clever.

    • by sjames ( 1099 )

      Cops handing out bogus tickets is all too believable in some cities and towns, particularly the cash strapped ones.

    • by Qzukk ( 229616 )

      1. You are parked legally

      If you read the SANS article, the fake site apparently has a photo of the ticket recipient's car.

      The example car is taking up two parking spaces.

      Maybe everyone gets the same photo, but I suspect that the person who did this found a new way to take their frustration out on idiots who can't figure out how to operate their vehicle, rather than the tried and true method of parking against their doors so they can't get back in.

      • by Valdrax ( 32670 )

        Maybe everyone gets the same photo...

        Obviously. If you read the text above the photo in the image, you can see that there's a lot of different car images to choose from to "find" your car in. Naturally, there's absolutely no need to create real individualized photos for a malware site, even for a "revenge" site rather than a traditional one. You would only go to that kind of trouble if the site were legit.

    • The victim gets all pissed and wants to see the evidence and yell at someone. Their rational thinking (what little they have) goes out the window.
    • 1. You are parked legally
      2. Everybody else has these "tickets"

      You've never been to Philly have you? Hell, I hear they even have a TV show about those ticketing madmen now...

  • by Joe The Dragon ( 967727 ) on Wednesday February 04, 2009 @02:25PM (#26727779)

    Some should rip in to the fake person giving out the tickets like people do to the real meter maids as you see do on A&E parking wars. And if they are not real say I'm calling the cops as I don't think they will like to have people giving out fake tickets.

  • by erroneus ( 253617 ) on Wednesday February 04, 2009 @02:26PM (#26727789) Homepage

    There is also a neck we can hang them from... someone police can pursue and arrest, more direct money to follow... leads.

    I really want to see some terrible, nearly unimaginable things happen to these people. Some people feel this way about drug pushers. Others feel this way about child molesters. For me, it is malware. Oh I think of the children too, but frankly, a lot can be done in the way of prevention if only most parents paid attention to their own children that would address a good portion of the child molestation thing and as drugs go... well, once again, people don't get hooked on drugs unless they had some other problems that precipitated it first. If they were raised well, odds are better that they'd not be a drug addict.

  • by damn_registrars ( 1103043 ) * <damn.registrars@gmail.com> on Wednesday February 04, 2009 @02:27PM (#26727807) Homepage Journal
    If the flier says "go to evilticketcontesting.com", you just need to find who that domain is registered to, and contact the registrar and ISP to have it shut down. This is quick and straightforward, since internet registrars all keep good records of who they sell domains to, and all ISPs respond quickly to requests that are written in plain English. We should have this problem licked in time for dinner.

    Oh, wait. Registrar accreditation is handled by these bumbling idiots. And how many ISPs that offer hosting services respond to much of anything?
  • Genius!
    Now you can get viruses by looking at anything with text on it!

    WARNING This virus requires:
    -A Computer running Windows
    -Human stupidity, but not that much (i would fall for that maybe)
    • by Creepy ( 93888 )

      The computer not only needs to be running Windows, but also IE according to the exploit report.

      This is hardly the first virus to use that method - I've heard of similar 1-click or no-click infections using flaws in IE (specifically because it is the dominant browser - other browsers have flaws, too).

      And from the initial poster, new viruses rarely have signatures right away - it usually takes several days from the initial report before they appear in a definitions file. When my wife popped a malicious e-car

  • by mandark1967 ( 630856 ) on Wednesday February 04, 2009 @02:30PM (#26727865) Homepage Journal

    I went out to my car to go to lunch and there was this Nigerian Prince and his entourage standing there and he said he needed my helpto move some cash out of his country for his dead uncle or someone.

  • by Joe The Dragon ( 967727 ) on Wednesday February 04, 2009 @02:34PM (#26727895)

    You don't even need a Virus or Malware to pull this off all you is a pay on link that takes your CC # and that likely will work even on super locked systems.

  • Bad idea (Score:3, Funny)

    by gmuslera ( 3436 ) on Wednesday February 04, 2009 @02:55PM (#26728149) Homepage Journal
    Only works locally, a parking cam can catch the real culprit (think in catching the originator of most of the spam/malware that goes thru email), and is somewhat shortlived (by the time most of the ones that got the ticket went to internet the site could have been taking down).

    To make it much worse, YOU can catch him and take revenge of every spam/malware/spyware/virus you received ever. We can get an updated version of witch burning for the XXI century.
  • by Hordeking ( 1237940 ) on Wednesday February 04, 2009 @03:08PM (#26728309)
    Aren't those the little pieces of paper that go under my wipers and always make it rain/snow?
  • by Yvan256 ( 722131 ) on Wednesday February 04, 2009 @03:32PM (#26728611) Homepage Journal

    I don't have a car, you insensitive clod!

  • by Ungrounded Lightning ( 62228 ) on Wednesday February 04, 2009 @03:59PM (#26728957) Journal

    ... right away because they get their earliest warnings from honeypot machines and this one uses an offline vector.

    • I bet the antivirus companies didn't have it right away because they get their earliest warnings from honeypot machines and this one uses an offline vector.

      Well, they also monitor network traffic looking for network usage signatures that are likely to be worms or viruses and do not match known malware. I suspect the limited range of this malware causes little traffic, since it is only machines from a tiny number of people who obtained a flyer. It is likely just not big enough to have shown up yet.

      • by Tacvek ( 948259 )

        Besides, not all virus scanners can search the contents of all installer types, and the installer is what was passed to the site. The results of the installation will probably trigger more virus scanners.

  • NEWSFLASH!!! (Score:2, Insightful)

    by SCHecklerX ( 229973 )

    malware is, and always will be, a stupid user issue. You can't solve stupid user issues with technology. Antivirus software is a sham, and a virus itself.

  • All those schmucks who are running Internet Explorer will get the virus. They deserve all they can get for installing random executables from random websites. Doesn't matter if they don't understand what they are doing. Unless they face the consequences of their actions, they will never change. Simple Darwinian principle.

    And we informed slashdotters will use FireFox with NoSript extension and laugh at them.

"I am, therefore I am." -- Akira

Working...