Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Advertising Security IT

Anatomy of an Attempted Malware Scam 139

Posted by samzenpus from the dial-M-for-malware dept.
Dynamoo writes "Malicious advertisements are getting more and more common as the Bad Guys try to use reputable ad networks to spread malware. Julia Casale-Amorim of Casale Media details the lengths that some fake companies will go to to convince ad networks to take the bait."
This discussion has been archived. No new comments can be posted.

Anatomy of an Attempted Malware Scam More

Anatomy of an Attempted Malware Scam

Comments Filter:

  • 127.0.0.1 for Casale (Score:5, Insightful)

    by ScottCooperDotNet ( 929575 ) on Thursday August 05, 2010 @12:52AM (#33147212)

    They've been on my HOSTS block for years, ever since one of those annoying GIF popups damn near gave me a seizure bouncing in its frame. Have they improved since?

    • Re: (Score:3, Informative)

      by Anonymous Coward

      Better to use 0.0.0.0 - since it's a real invalid IP, connecting to it fails instantly, while a program trying to connect to 127.0.0.1 will take a while before giving up.

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        Your firewall is misconfigured. Dropping instead of denying is a shitty default policy.

        • Re: (Score:2)

          by cynyr ( 703126 )

          but DENY lets the remote know you do exist, where as DROP makes you a black hole. I prefer TARPIT myself, but thats reserved for the throttling rules of things like my ssh blocker, and such.

      • Re: (Score:2)

        by TheLink ( 130905 )
        If the sites you visit are mostly http, you could run your own webserver on port 80 and serve up ads you want.

        Like reminders to not surf so much ;).

        Anyway, on one fine April 1st, I configured a webproxy to show the company's logo instead of some ads. I didn't get fired for that, hardly anyone noticed. I think I did save some bandwidth.

  • I'm Surprized... (Score:5, Insightful)

    by powerspike ( 729889 ) on Thursday August 05, 2010 @01:14AM (#33147300)
    I read the article, and in doing reference checks in the digital age, esp when there is a large chance of fraud, that checking domain reg's etc only came in last. It's not hard to program in automatic checking, and by the sounds of it, would stop how easy this type of scam would be implemented. Also they could do reverse phone number checks etc as well. I'm quite sure if they had that information automatically populated during an application, any attempts to defraud the companies would be found out with alot less time.

    • Re:I'm Surprized... (Score:5, Insightful)

      by adamofgreyskull ( 640712 ) on Thursday August 05, 2010 @02:35AM (#33147566)
      I'm also suitably stupefied. All the "pink" and "red" flags that they are obviously so clever to spot, and which she spends almost the entire article talking about, are just her dancing around the elephant in the room: that she and her team are complete fucking idiots.

      Seriously. The important things they learnt, consolidated in the "6 steps" at the bottom of the article are pure common-sense. Even if they're not concerned about "malvertisements" (ick) they should already have been checking references properly (i.e. using a bank's listed number, not one provided by the "agency" and checking the certificates of incorporation of them and their referees). It's common fucking sense even when you are just trying to establish whether or not to extend a line of credit to them! I wish I could have avoided swearing, but it makes me feel physically sick to think that someone can publically admit to being such a colossal moron and still have a job. Not only that, but to have people thanking her for her insight!! Idiots! How much time was wasted by her, her sales droids, her marketers etc.? Idiots! Using the word "creative" as a noun when referring to banner-ad files? Idiot!! AAAGHHH!

      • Re:I'm Surprized... (Score:5, Interesting)

        by jimicus ( 737525 ) on Thursday August 05, 2010 @03:30AM (#33147732)

        I'm also suitably stupefied. All the "pink" and "red" flags that they are obviously so clever to spot, and which she spends almost the entire article talking about, are just her dancing around the elephant in the room: that she and her team are complete fucking idiots.

        Part of me wonders if there is a difference in industries which makes this look so damn stupid.

        Anyone in IT has probably seen so much malware, so many phishing and scam attempts that there's a strong chance most of us would have checked any company registration numbers with the relevant authorities, checked WHOIS information and contacted the bank directly using one of the banks' own published numbers before even returning the first email. But if you didn't normally meet such rubbish (because the IT department has already filtered out most of the malware, scams and phishing attempts before they even hit your mailbox), I wonder if you'd develop the same level of cynicism?

      • Re: (Score:3, Insightful)

        by WrongSizeGlass ( 838941 )
        I agree that she shouldn't be applauded for finally figuring out she was on 'Candid Camera', but keep in mind that it isn't always in their best interest to find these scammers out. They profit from providing their services to all comers, including those that happen to be in the malware business. Keeping the 'cash engine' running often serves up some blinders.

        Some of our clients have forums on their sites. We train them to check the domain info of the user trying to join their forum, compare the IP to oth

        • I agree that she shouldn't be applauded for finally figuring out she was on 'Candid Camera', but keep in mind that it isn't always in their best interest to find these scammers out.

          But she did refuse their business in the end. Thus she would have saved money had she checked the bank phone number and therefor dropped them at the very beginning.

          They profit from providing their services to all comers, including those that happen to be in the malware business. Keeping the 'cash engine' running often serves u

        • "It's unfortunate that being suspicious is now a prerequisite to being good at what you do on the internet."

          Being suspicious is a prerequisite to being good at life.

      • Re: (Score:2)

        by v1 ( 525388 )

        I thought that was downright hilarious, just taking numbers off the client's provided reference sheet, calling them, and getting the green light. With absolutely no verification of who was at the other end of the phone. There's absolutely zero point in taking references if you're going to implicitly trust them without any guarantee of who they are. The whole point of a reference is to get facts from a credible source. And all they were using it for is to get facts, completely skipping the "credible sour

    • Re: (Score:1)

      by jkxx ( 739331 )
      Me too.. or three - Verifying phone numbers and domain registrations is basic common sense stuff. These guys must've never heard of spammers or been victimized by the same. And they are running ads that will be unleashed on an unsuspecting audience? Perhaps running noscript/adblock/etc is no longer the paranoid thing to do - looks like it's becoming the only *right* thing to do.

    • Re: (Score:3, Interesting)

      by RDW ( 41497 )

      There's a suitably harsh analysis here:

      http://industrypace.com/frontpage/2010/8/4/who-can-you-trust-interactive-advertising-is-dangerous.html [industrypace.com]

      • Re: (Score:3, Informative)

        by Dynamoo ( 527749 )
        Interesting.. but written by someone who works for Media Breakaway (formerly OptInRealBig) who don't exactly have a squeaky clean reputation when it comes to checking who they do business with.

  • Pink flag (Score:4, Funny)

    by kaoshin ( 110328 ) on Thursday August 05, 2010 @01:20AM (#33147330)
    "We've also highlighted some pink flags"

    Is that close to a fuchsia, because I like totally need a flag like that to match my new outfit.
    • That got me too. She was looking for a color to denote a situation that warranted concern, and she thought of pink instead of yellow. Does she throw out the white flag when everything's a go? Must be color blind.

  • Such high standards! (Score:4, Insightful)

    by Anonymous Coward on Thursday August 05, 2010 @01:28AM (#33147352)

    I'm comforted to know that Casale Media will pass on obnoxious mortgage refinance advertising from only verified and legitimate predatory lenders!

    These checks aren't in place out of any concern for the security of ad viewers. Casale Media here is only concerned that the phantom business will disappear without paying once the botnet is established. Ad networks have demonstrated they don't give a damn so long as they get their cut.

    My AdBlock Plus stays on.

  • Big Surprise (Score:5, Insightful)

    by VonSkippy ( 892467 ) on Thursday August 05, 2010 @01:46AM (#33147392) Homepage

    And site owners and advertisers wonder why users go to such extremes with Adblock plus and NoScript to block ad's.

    If the sites (or ad distributors) can't guarantee the safety of their own sites, then users have to do whatever is necessary to protect their own systems. If that means no advertising income for those sites - tough luck.

    • Re: (Score:3, Informative)

      by toQDuj ( 806112 )

      Not very extreme anymore. I just noticed that with the safari extensions, it is just one click away from the safari extensions gallery from being useful and implemented.

    • Re:Big Surprise (Score:4, Insightful)

      by Tapewolf ( 1639955 ) on Thursday August 05, 2010 @03:53AM (#33147812)

      And site owners and advertisers wonder why users go to such extremes with Adblock plus and NoScript to block ad's.

      This. I don't mind advertisements, but after I got stung by a drive-by exploit on a work machine (either on Slashdot itself or one of its linked articles), I went straight for Adblock Plus.

      I can't remember what the payload was now - something that installed 'XP Antivirus 2010' or whatever (*) - but at the time, only two AV suites could detect it and the company-mandated AV wasn't among these.

      (*) Which gleefully detected 'viruses' in several ARM, MIPS and SH3 binaries before I was able to kill it

      • "I got stung by a drive-by exploit on a work machine .. something that installed 'XP Antivirus 2010"

        Run your browser from a read-only device, that way you won't ever get stung.

        Pendrive [pendrivelinux.com]

        • Run your browser from a read-only device, that way you won't ever get stung.

          I did the next best thing and installed Xubuntu on an old laptop for browsing. Some of us have to develop on Windows, though. Unfortunately.

        • "I got stung by a drive-by exploit on a work machine .. something that installed 'XP Antivirus 2010"

          Run your browser from a read-only device, that way you won't ever get stung.

          Pendrive [pendrivelinux.com]

          You could also just run your browser in a virtual machine and set the write-back to a file that's deleted every restart.

    • No kidding. I finally got ABP for Firefox. For a long time I didn't, because I understand sites need ads to be able to provide good content for free. I'm a realist. However, I finally got fed up and loaded it for three reasons:

      1) Ads that block off the whole page, or redirect you while surfing and so on. Used to be just Flash shit did that so flashblock did the trick nicely. Not any more, now there's HTML ads that are massive problems. They don't want to show you an ad, they want to stop you from browsing a

  • Maybe it's me (Score:5, Insightful)

    by rk ( 6314 ) on Thursday August 05, 2010 @01:54AM (#33147422) Journal

    But if a WHOIS lookup on a new customer's domain isn't in your SOP from the get-go, you're strictly amateur hour.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      There is a bit of a work around.

      The guys who provided a fresh set of domains really were not thinking through all of the angles.

      You can easily purchase a dated domain for cheap and with any planning it would be trivial to wind up with a handful of older domains spanning various ages.

      However, I do not know if the re-purchase resets the date. Otherwise, a private sale would have to be used.

      In the end, these guys are likely hitting multiple sales agencies looking for a catch. While these guys might have not ta

    • Re: (Score:2, Interesting)

      by Kireas ( 1784888 )
      Oddly enough, that's what I thought...a WHOIS on the domains provided, as well as some checks on the bank (to check that the number you are given is actually their number) can't be that hard.

      I mean, we have Google. Checking these things must only take another 10 minutes or so...? Nonetheless, can't blame them. 10 minutes adds up across many prospective clients.

    • Re: (Score:3, Informative)

      by Dynamoo ( 527749 )
      Well, that's how *I* would start vetting, but then I work in the IT security field and not advertising!

      But.. check the WHOIS for the registration date and valid contact details, check that the registrar isn't someone odd like China or Russia, check to see where the site is hosted, check the other sites on the same server and nearby IP addresses, also check the nameservers and if you are feeling more advanced check the MX handler. DomainTools or Robtex is your friend here.. very often you will find red fla

    • Re: (Score:1)

      by greed ( 112493 )

      That, and accepting the bank phone number provided by the customer.

      On the rare occasion my bank phones me, I ask them how I can call back with information I have (on my ATM card, on my statement, in my telephone book). Every single time they have complimented me on that procedure and provided the name and extension number to reach them. (OK, some times they've told me anyone in the call centre can help, and I don't need to talk to the person who called me in the first place.)

      If you're verifying something

    • Re: (Score:2)

      by swb ( 14022 )

      Isn't the part of the problem that these "ad networks" and the tangled webs of ad brokers, resellers, agencies, service providers, programmers, designers, etc that result the person offering the ad may well be thrice removed from the ad's actual creator, the company being advertised, etc?

      For example, if I'm a small agency that wants to place banner ads, I'm not going to bother trying to place them directly with web sites, I go through a network. Now I may go through a small network that places its ads in

  • reputable ad networks? (Score:5, Interesting)

    by stephanruby ( 542433 ) on Thursday August 05, 2010 @02:10AM (#33147480)
    reputable ad networks? What are those? Is he speaking of google ad-sense? or Hulu ads? Personally, I don't consider ad networks that use banner ads as anything that are reputable (this includes any of the shady ad-networks that Google purchased as well). Non-obtrusive text ads, I can deal with. Even Hulu ads, I can deal with since it's film on film. It's just that I hate banner ads, or animated ads, when I'm in reading-mode.

    • reputable ad networks? What are those? Is he speaking of google ad-sense? or Hulu ads? Personally, I don't consider ad networks that use banner ads as anything that are reputable (this includes any of the shady ad-networks that Google purchased as well). Non-obtrusive text ads, I can deal with. Even Hulu ads, I can deal with since it's film on film. It's just that I hate banner ads, or animated ads, when I'm in reading-mode.

      I've noticed more and more ads are finding ways to subtly act like they are a part of the site. Instead of the old crap that pretended to be a Windows window, now it's "Download now" or "Download Torrent Here" or "More about this here". What's even worse are one's that attempt to provide information in the middle of instructive articles misleading you.

      It's all a monstrosity. There is nothing I despise more than advertising, it's the reason I stopped watching television years ago and it may yet be the reason

    • "Reputable ad networks" is an oxymoron.
      Like "trustworthy door-to-door salesman", "truthful infomercial", "respectable telemarketer", or "honest politician".

  • SOP from the get-go, you're strictly amateur hour. pgup http://www.klimaservisii.com/ [klimaservisii.com]
  • But, I'm not really surprised the lengths these "fake companies" will go. Money is a precious thing in this world and if you can't 'seem' to make it legally, you may just turn to crime. Even people who would have never considered doing something like this may be driven to new heights [digitaljournal.com] in desperation.

    However, some of these people may or may not be the desperate, dirt poor, starving, "means-to-an-end" people I portrayed but, take a minute and think of the things you would probably do if there was truly, no
  • Ultimately, how does the end users computer get infected by this `malware'?

    • Re:Malicious malverts (Score:4, Informative)

      by asdf7890 ( 1518587 ) on Thursday August 05, 2010 @05:42AM (#33148206)

      Ultimately, how does the end users computer get infected by this `malware'?

      The site linked to by the advert includes code that exploits a drive-by install using an unpatched exploit for the user's browser/OS, or uses some form of human engineering to get them to install it (i.e. like the many many "your machine is infected, follow these instructions to fix this" things that are seen out there).

      At least one ad network I've seen seems to allow advertises to include custom javascript in their adverts, either that or the advertisers have found a way around the filtering the ad network does on the content, at which point such unpatched flaws can be exploited without the user needing to click the ad at all.

  • You lost me at "reputable ad networks" (Score:5, Insightful)

    by erroneus ( 253617 ) on Thursday August 05, 2010 @06:10AM (#33148308) Homepage

    In so many words others have expressed what I have summarized down to "advertisers don't respect their audience." Their approach has almost always been the capitalist "what the market will bear" approach and as people have grown accustomed to being assaulted with ever more eye-catching colors, styles, techniques and technologies, the limits of what the market will bear erode. People no longer realize they are being disrespected. Their paid-for internet connection are being utilized. Their time is being wasted. They will install software that resists being uninstalled and drains performance and stability from their computers. I see no end to what they will do.

    There is a blurry and indistinguishable line between "reputable ad networks" and "the bad guys." The reputable are certainly not constrained by morals and not by law. How can we know they aren't simply being complicit?

    • Most consumers pay a fixed fee for their connection and rarely use 50% of it's throughput. For these people ads are not taxing enough to be considered abusive even if the ads are being served partly on their dime. It's like TV or radio to them. Unmetered access so no opportunity cost.

      • If I have 20 acres of land and someone decides they want to post a sign advertising their crap on an unused portion of my land, it is actionable. It does not matter that I do not use it. It's mine, not theirs. It is a form of trespass.

        The same goes for any medium or service I pay for. Look at cable/satellite TV. I don't pay for it and never have. (I don't watch it any longer either because my cable guy wouldn't take a bribe the last go around.) I don't pay for anything to provide ad space for someone

    • Re: (Score:3, Interesting)

      by Aphoxema ( 1088507 )

      In so many words others have expressed what I have summarized down to "advertisers don't respect their audience." Their approach has almost always been the capitalist "what the market will bear" approach and as people have grown accustomed to being assaulted with ever more eye-catching colors, styles, techniques and technologies, the limits of what the market will bear erode. People no longer realize they are being disrespected. Their paid-for internet connection are being utilized. Their time is being wasted. They will install software that resists being uninstalled and drains performance and stability from their computers. I see no end to what they will do.

      There is a blurry and indistinguishable line between "reputable ad networks" and "the bad guys." The reputable are certainly not constrained by morals and not by law. How can we know they aren't simply being complicit?

      They're disrespectful and idiots. What "targeted advertising" gets is showing people what they already have. I play EVE Online. I look up stuff on EVE Online. Going by my cookies and such, advertisers know I play EVE Online. So, what is advertised to me? To try EVE Online. They succeed in nothing.

    • I am not a customer of the advertisers. I (and my family) are a resource or commodity they don't have to pay for but are selling to other people. They only care about me insofar as my shrieks of pain at being abused don't cause the advertising customers (clients) to stop buying advertising from them, or the web hosting sites from selling space to them.

      There are so many advertising agencies - all trying to harvest money from their clients - all chasing each other to the bottom of the gutter.

      Given the

  • Do something about pages that wont load noscript'd (Score:4, Insightful)

    by Marrow ( 195242 ) on Thursday August 05, 2010 @06:19AM (#33148370)

    There are plenty of pages where the site just will not load unless you give permission to run layers and layers of 3rd,4th,5th party scripts. What can we do as consumers or developers to prevent such behavior on the part of websites?

    • Re:Do something about pages that wont load noscrip (Score:5, Insightful)

      by pushf popf ( 741049 ) on Thursday August 05, 2010 @07:33AM (#33148746)
      There are plenty of pages where the site just will not load unless you give permission to run layers and layers of 3rd,4th,5th party scripts. What can we do as consumers or developers to prevent such behavior on the part of websites?

      Install User Agent Switcher and browse as Google.

      nobody blows off Google.

    • What can we do as consumers or developers to prevent such behavior on the part of websites?

      Take your business elsewhere.

    • Re: (Score:2)

      by sjames ( 1099 )

      I see those from time to time. I just google whatever topic I was wanting information on and go top one of those sites instead.

      Sites that require all that crap to be even vaguely useful far too often prove that sufficiently advanced incompetence is indistinguishable from malice.

  • ...is an oxymoron.

  • "During our investigation we discovered the phone number provided in the credit application was not a legit phone number for the bank. We also learned that the domains of each of the references provided were registered within two days of each other... and that the registrations took place only days before Bellas Interactive's request for credit was issued - despite the fact that the references "claimed" to be working with Bellas across a 6-24 month spread. And finally, the Bellas Interactive website claimed

  • "have created a false environment designed specifically to validate their non-existence." try "have created a false dichotomy (good guys and bad guys in the spyware advertising business) designed specifically to validate their parasitic existence." Wow. I'd never have thought that Casale would claim such a high moral ground. Serious labour has gone into removing their stuff from spyware ridden computers.

Slashdot Top Deals

To be awake is to be alive. -- Henry David Thoreau, in "Walden"

Close