Forgot your password?
typodupeerror
Security IT

Cameroon the New Hotbed of Malware 92

Posted by samzenpus
from the none-more-infected dept.
garg0yle writes "According to McAfee, more than a third of Cameroon domains (TLD of .cm) are infested with viruses or other not-so-fun party treats. Given that it's very easy to mis-type .com as .cm, this puts the computers of a lot of fat-fingered typists in peril. Second place on the most-infested domains list goes to China (.cn), while Hong Kong (last year's 'winner') is now comfortably middle-of-the-pack."
This discussion has been archived. No new comments can be posted.

Cameroon the New Hotbed of Malware

Comments Filter:
  • Mistype (Score:1, Insightful)

    by Lunoria (1496339)
    While I can believe that .cm is a mistype for .com, what about .co, .con, .om? They don't seem to be high risk websites. I also bet that .con is a more common mistype than .cm I also wonder whether slashdot.og is infested with viruses.
    • Re:Mistype (Score:5, Funny)

      by DavMz (1652411) on Wednesday December 02, 2009 @11:45PM (#30307552)

      I have n "" letter n my keybard, yu insensitive cld!

      • Re: (Score:1, Informative)

        by Anonymous Coward

        Sounds you got one of those keyboards left by the W Bush admin for the next president.

    • Re:Mistype (Score:5, Informative)

      by Anonymous Coward on Wednesday December 02, 2009 @11:51PM (#30307588)

      what about .co, .con, .om?

      .co is Colombia, .om is Oman, but .con doesn't exist.

      They don't seem to be high risk websites.

      What is "they" in that sentence, or did you mean "TLDs" instead of "websites"?

      I also wonder whether slashdot.og is infested with viruses.

      .og doesn't exist. You might want to consult a list of TLDs before you ask a bunch of "what about" questions. Or install a robust browser and try to load the url instead of just wondering about it.

      • by tsalmark (1265778)
        Some one with mod points give this guy a boost, I was about to say the same thing but, it's already been said by an anon.
      • Re: (Score:3, Funny)

        by Anonymous Coward

        .CONNNNNNNNNNNNNNN!!!!!!!

      • To that I'll add (Score:4, Informative)

        by Sycraft-fu (314770) on Thursday December 03, 2009 @01:04AM (#30307886)

        That different nations treat their TLDs differently. Some sell them to anyone who wants one. You can register them as long as you are willing to pay whatever fee it is they ask. The .tv domain is one such domain. Others make the domains available, but only to people or organizations that meet certain requirements like citizenship. Canada (.ca) would be one like that. Any Canadian can have a .ca domain if they are willing to pay for it, but non-Canadians can't buy one. Still others only use their domain for government or internal functions. The .us domain was like that at one time. You could get it only as an entity like a county government or a high school or something (it is now open for registration). Finally some countries simply don't do anything with their TLD, it just isn't used at all and there's no way to get it.

        So just because a TLD exists, doesn't mean it can be used for any given purposes.

        • by dissy (172727)

          Reminds me of the time I tried to get an Antarctica domain (.aq), and the first email I got back stated "Sorry, to register you must live on the ice"

          As for the history of the .us cctld, even back in the late 80s, one could register a subdomain out of it being an individual (and it was free too! Then again, so was .com)

          However they did have and enforce a strict organizational structure.
          From what I recall, you had to get [something].county.state.us
          Later they opened it up more, but was still state/group sect

      • 'But wheah's the necessity? It seems an uncommonly woundabout and hopelessly wigmawolish method of getting anywheahs. Look heah now, I've got the wuhks of the mastahs -- the gweat ahchaeologists of the past. I wigh them against each othah -- balance of the disagweements -- analyze the conflicting statements -- decide which is pwobably cowwect- and come to a conclusion. That is the scientific method. At least' -- patronizingly -- 'as I see it. How insuffewably cwude it would be to go to Ahctuwus, oah to Sol, foah instance, and blundah about, when the old mastahs have covahed the gwound so much moah effectually than we could possibly hope to.'

        -- Isaac Asimov, Foundation

      • by jez9999 (618189)

        .co is Colombia, .om is Oman, but .con doesn't exist.

        That's a shame, coz then we could have all the malware and phishing websites under one roof like porn is with .xxx. :-(

    • Re:Mistype (Score:5, Informative)

      by jrumney (197329) on Thursday December 03, 2009 @12:09AM (#30307652) Homepage
      It depends on the policies of the registrar for those top level domains. Some countries allow free for all registration of domain names, others restrict registration to local companies and citizens only. Also many country tlds require specific sub-domains such as .com.co, which reduce the usefulness of those domains for typo-squatters.
      • In any case... (Score:3, Insightful)

        by BrokenHalo (565198)
        In any case, if (as the article claims) one third of Cameroon domains host malware, the implication is that two thirds don't. I would be very curious to know what percentage of US domains host malware.

        Regardless of the answer, the appropriate response is to use a robust browser and block individual sites, not block out whole nations. Otherwise one might just as well move to China.
    • Re: (Score:3, Informative)

      by Potor (658520)

      I can't remember the last time I typed "com".

      Seriously - with ctrl+enter, who needs to?

      • by Fred_A (10934)

        I typed "Ctrl+Enter" and nothing happened.

        I want my money back !

      • Re: (Score:3, Funny)

        by tehcyder (746570)
        You should be grateful you're not here where we have .co.uk addresses. You wouldn't believe the number of times I've typed in .cock and got something unexpected popping up on my monitor...
    • Re: (Score:1, Funny)

      by Anonymous Coward

      I just went there, and BUY CHEAP VIAGRA yes, it is WILL MAKE YOU 9 INCHES LARGER full of viruses. SO BIG YOU COULD PUT IT ON A BUN AND EAT IT!

    • Re:Mistype (Score:5, Informative)

      by grcumb (781340) on Thursday December 03, 2009 @12:25AM (#30307724) Homepage Journal

      While I can believe that .cm is a mistype for .com, what about .co, .con, .om? They don't seem to be high risk websites. I also bet that .con is a more common mistype than .cm

      It hardly matters. What many of the press reports (including El Reg) seem to ignore is the second most risky TLD in the world: .com.

      I'll bet you dollars to donuts that, because of the size and popularity of the TLD, .com is significantly more of a threat to the average Internet user than .cm.

      And while we're at it, how about a link to the actual report [mcafee.com]? (warning: PDF)

      • Re: (Score:1, Offtopic)

        by Mad Merlin (837387)

        And while we're at it, how about a link to the actual report [mcafee.com]? (warning: PDF)

        Do people really still fear PDFs? I can't believe Acrobat Reader is still so utterly utterly broken out of the box when every single other PDF reader will open a PDF more or less instantaneously.

      • ...second most risky TLD in the world: .com.

        Are you sure? Can you provide a link?

        And while we're at it, how about a link to the actual report? [mcafee.com] (warning: PDF)

        Mcafee and a PDF. Two pieces of malware from one .com site. Excellent evidence, sir.

    • It's a bit of a stretch for me to believe that .cm is a typo of .com. When I mistype .com, it's usually .co or .cmo. But I never just forget the o like that.

    • what about .co, .om?
      assigned to colombia and oman respectively but don't allow registrations directly under the tld so not useful for cybersquatters. .con
      doesn't exist.

      I also wonder whether slashdot.og is infested with viruses. .og doesn't exist either

  • Missing keys? (Score:2, Interesting)

    by TheProphet92 (1448257)
    I rarely miss the 'o' key altogether, more commonly I press a different one accidentally, like 'cpm' or 'con'.
  • by theNAM666 (179776) on Wednesday December 02, 2009 @11:32PM (#30307486)

    Really? I've never done it. Never. /me goes to point .cm to 127.0.0.1 .

    • I prolly shouldn't do that, this machine I'd point to is full of current malware.

      (if I'm on my analysis machine, that is...)

    • by Nimey (114278)

      Once just recently - I was holding my infant daughter so had to type one-handed.

      OpenDNS caught the error and warned me away from a malware site. Don't remember where I was going at the time.

  • by Antony-Kyre (807195) on Wednesday December 02, 2009 @11:35PM (#30307504)

    to just block the whole Net? That way, you can't visit any website, thus avoid all websites hosting malware. Either that or have a patched, updated browser, and use smart surfing habits.

    • by mysidia (191772) on Wednesday December 02, 2009 @11:51PM (#30307584)

      Blocking .cm can be a helpful step, because it blocks a portion of the hostnames that (A) if you visit has a very high probability of infecting you, and (B) that an intentional visit to is unlikely.

      So you can block .cm with a notable increase in safety, with a minimal decrease in usefulnes of your internet access.

      The same could not be said of blocking the whole net. Blocking the whole net reduces the utility of your network connection, since it means you can no longer navigate to the sites that you do want to, with high probability.

      • Re: (Score:3, Funny)

        by srussia (884021)

        Blocking .cm can be a helpful step

        I live in Cameroon, you insensitive clod! But then again, malware is not at the top of my worry list... carry on then.

    • Seriously, do away with it and go back to gopherspace. No viruses there, probably. The WWW is overrated.

  • .com default (Score:3, Informative)

    by feedayeen (1322473) on Wednesday December 02, 2009 @11:37PM (#30307512)
    Most modern browsers insert .com automatically if no top level domain exist in the URL.
  • by fucket (1256188) on Wednesday December 02, 2009 @11:37PM (#30307514)
    Beef jerky time.
  • by 93 Escort Wagon (326346) on Wednesday December 02, 2009 @11:41PM (#30307536)

    Given that it's very easy to mis-type .com as .cm, ...

    I can safely say I've never done this. I've made other errors - such as ending up in Estonia's (.ee) web space on occasion, since I work in an electrical engineering department. But I can't believe leaving out the "o" from ".com" is particularly easy or at all common.

    Now if you wanted to talk about Colombia (.co) being a frequent typo for .com domains, then I might find it more believable. I have done that on rare occasions.

    • by trawg (308495)

      I can safely say I've never done this. I've made other errors - such as ending up in Estonia's (.ee) web space on occasion, since I work in an electrical engineering department. But I can't believe leaving out the "o" from ".com" is particularly easy or at all common.

      I can't figure out how you think ending up at a domain ending in .ee because you're an electrical engineer is less weird than mistyping .com

    • So missing the m key, or not pressing it hard enough is logical but missing out the o is just crazy talk?

      I guess that makes sense...if you have a particularly weak index finger.

    • I always seem to type c.om, but maybe it's because I type dvorak. My mistakes are different.
  • Yes, but... (Score:4, Funny)

    by InspectorxGadget (1230170) on Wednesday December 02, 2009 @11:47PM (#30307562)

    ...they make those delightful coconut cookies. I think we can forgive them.

  • It's water under the bridge, but in hindsight, it would have been better to not create the alternate TLDs .cm, .co. While I'm at it, tell me there's a good reason we have augmented reality iPhones and 60 MPG cars but not web browsers that autocorrect non-existent TLDs.

    Seriously, why doesn't every browser have a "I don't live in Cameroon or Colombia; auto-correct .cm and .co to .com, don't warn me when doing it, and don't bother me about this again" option? (I know, I know, .hosts and/or Firefox extensions.

  • stuck key (Score:3, Insightful)

    by wizardforce (1005805) on Thursday December 03, 2009 @12:09AM (#30307650) Journal

    typing *.cm instead of .com is as simple as having an o key that gets stuck occasionally and not noticing the typo. All it takes is a keyboard that needs a good cleaning and a user that isn't paying enough attention.

    • by daveime (1253762)

      typing *.cm instead of .cm is as simple as having an key that gets stuck ccasinally and nt nticing the typ. All it takes is a keybard that needs a good cleaning and a user that isn't paying enough attentin.

      FTFY ;-)

  • .pron links

  • by robbak (775424) on Thursday December 03, 2009 @12:31AM (#30307754) Homepage

    Opendns has an option to automatically 'correct' .cm requests to .com, which I always turn on. If Cameroon does not want people doing this, then it would have to police it's domain closely, instead of using it as a cash cow.

    • Re: (Score:1, Informative)

      by Anonymous Coward

      OpenDNS also rewrites NXDOMAINS to host advertisements.

      Why do people keep spamming this service like it doesn't suck?

      • by QuoteMstr (55051)

        OpenDNS really is an abomination unto the Domain Naming System as bad as any ISP's NXDOMAIN redirection.

        But IOKIYFTM --- It's Okay If You're Fighting The Man

        (Or have a PR department that creates that impression.)

      • by shentino (1139071)

        Because it's opt-in and doesn't hijack your DNS unless you tell it to?

        I don't use it myself though sicne I run bind and do my own DNS caching.

      • by gad_zuki! (70830)

        On top of it there's nothing open about them. No source, no open development, community, etc. Its just a company that tracks people and breaks NXDOMAIN. Man, is running bind on something so hard? There's even a pretty nice dumbed down GUI windows port called Treewalk.

    • by KazW (1136177)
      OpenDNS breaks the DNS standard, as it returns a search page for non-existent domains, there was actually a /. article about sites doing this not too long ago. Lastly, not to mention, you're letting a 3rd party track almost 100% of your net activity.

      In closing, "smart" DNS is a dumb decision, even for dumb people.
      • by dissy (172727)

        OpenDNS breaks the DNS standard, as it returns a search page for non-existent domains, there was actually a /. article about sites doing this not too long ago.

        That is an option that can be turned on and off to your own desire.
        Just uncheck the checkbox on your preferences page and it will not rewrite nxdomain.

        FYI, most people like that feature. For the rest, who either don't like it, or do like it but for technical reasons can not have it, you can just not enable it.

        Lastly, not to mention, you're letting

    • Yeah, this option is definitely a life saver.
    • You and the four other people using OpenDNS must really be sitting pretty.

  • by mi (197448)

    I hereby denounce this article — and the pseudo-statistics in it — as racist!

    Gebyy zl nff!..

  • If so, change keyboards.

    I see the real threat in letters getting mixed up (which probably does not matter so much in 3 letter TLDs, since I don't know of a cmo or ogr TLD) or a typo (.con, .prg), which also usually don't really result in anything damaging. .cm being mistyped as .cn might be a problem, though. But then again, it's like missing the flood to reach the drought, so...

  • Let's get real and understand that the real purpose of providing this "information" is marketing. It is there to reinforce the message that the world is hopelessly infected with computer viruses and you absolutely MUST have the offerings of McAffee and other anti-virus software vendors. I'm not even sure why anyone would believe it is true.

    • by dskzero (960168)
      So you are arguing that it's better to avoid antivirus completely?
      • So you are arguing that it's better to avoid antivirus completely?

        There is hope beyond McAffee. Repent and convert to Linux.

        • by dskzero (960168)
          I don't need to convert to anything. I'd rather use NOD32 and continue my windows ways that haven't failed me. Sorry. :)
  • There will always be a worst and best in this category, as in anything you do in life. The problem is when it is deliberately set to that which happens to be .cm (which could be a mistype for many people)...if you think of whether this was intentional on the hackers part, you better believe it.

    It could be any of the countries that have domains, and have no real talent for programming websites, but in the end,
    you have to wonder, most are hosted on regular ISPs that offer the .cm extension, so should they not

  • To block any top level domain? I mean like an entry in the hosts file, etc.....

    • by gad_zuki! (70830)

      Nope, a host file is static and wont support and wildcards like *.cm.

      You can run bind and play with the configuration or you can set your firewall to not let you make connections to cameroon's netblocks. That's assuming the cm stuff is actually hosted there. If not then you need to block via DNS.

      # Country: CAMEROON
      # ISO Code: CM
      # Total Networks: 16
      # Total Subnets: 100,864
      41.92.128.0/17
      41.190.224.0/22
      41.191.100.0/22
      41.202.192.0/19
      41.204.64.0/19
      41.205.0.0/19
      41.205.64.0/19
      41.211.96.0/19
      41.216.176.0/20
      41.217.1

  • I have not heard that country mentioned since Eddie Murphy disguised himself as an exchange student from Cameroon in 'Trading Places' back in the 80's.

Little known fact about Middle Earth: The Hobbits had a very sophisticated computer network! It was a Tolkien Ring...

Working...