Search Engine Malware – The Same Old, Same Old

In the News within the past 3 days –

Web security firm Armorize – over 6 million e-commerce web pages have been compromised in order to serve malware to users.

Ed Bott Report – criminal gangs that specialize in malware love search engines, because they represent an ideal vector for getting Windows users to click on links that lead to potentially dangerous Trojans. The latest attack targets ads, and the social engineering is frighteningly good.

Not in the News –

The specifics may be news but, this particular malware attack vector is so old I’m surprised that more Internet users aren’t aware of it. No, I take that back – based on a conversation I had just last night.

Me: “So, what antimalware applications are you currently running?”

She: “Well, I can cut and paste and I can get on the Internet, but I don’t worry about all that other stuff. I don’t understand it anyway.”

I’m well past the point where I allow myself to show surprise when I hear this type of response – it’s just so typical. Given that level of knowledge, it’s hardly surprising then, that consumer confidence in the reliability of search engine results, including relevant ads, is taken for granted.

I’ve yet to meet a typical user who would consider questioning a search engine’s output as to its relevant safety.  It’s been my experience, that typical Internet users blindly assume all search engine results are malware free.

This, despite the reality that the manipulation of search engine results, exploiting legitimate pages, and the seeding of malicious websites among the top results returned by search engines in order to infect users with malware, is a continuing threat to system security.

Here’s how the cyber crooks do it:

When a potential victim visits one of these infected sites the likelihood of the downloading of malicious code onto the computer by exploiting existing vulnerabilities is high.

Let’s take, as an example, a typical user running a search for “great vacation spots” on one of the popular search engines.

Unknown to the user, the search engine returns a malicious or compromised web page as one of the most popular sites. Users with less than complete Internet security who visit this page will have an extremely high chance of becoming infected.

There are a number of ways that this can occur. Cyber-crooks can exploit vulnerabilities on the server hosting the web page to insert an iFrame, (an HTML element which makes it possible to embed another HTML document inside the main document). The iFrame can then activate the download of malicious code by exploiting additional vulnerabilities on the visiting machine.

Alternatively, a new web page can be built, with iFrames inserted, that can lead to malware downloads. This new web page appears to be legitimate. In the example mentioned earlier, the web page would appear to be a typical page offering great vacation spots.

Be proactive when it comes to your computer’s security; make sure you have adequate software based protection to reduce the chances that your machine will become infected.

Install an Internet Browser add-on such as WOT (my personal favorite), which provides detailed test results on a site’s safety; protecting you from security threats including spyware, adware, spam, viruses, browser exploits, and online scams

Don’t open unknown email attachments

Don’t run programs of unknown origin

Disable hidden filename extensions

Keep all applications (including your operating system) patched

Turn off your computer or disconnect from the network when not in use

Disable Java, JavaScript, and ActiveX if possible

Disable scripting features in email programs

Make regular backups of critical data

Make a boot disk in case your computer is damaged or compromised

Turn off file and printer sharing on the computer

Install a personal firewall on the computer

Install anti-virus and anti-spyware software and ensure it is configured to automatically update when you are connected to the Internet

Ensure the anti-virus software scans all e-mail attachments

Be proactive when it comes to your computer’s security; make sure you have adequate software based protection to reduce the chances that your machine will become infected.

The following comment (posted here March 15, 2011), illustrates perfectly the issues discussed in this article.

Funny you write about this today. I was reading about the spider issue Mazda was having and wanted to know what the spider looked like so I Googled it, went to images and there it was. There was also a US map that had areas highlighted, assuming where the spiders exist, and before I clicked on the map I made sure there was the green “O” for WOT for security reasons.

I clicked on the map and BAM I was redirected instantly and hit w/ the “You have a virus” scan malware. I turned off my modem then shut my computer off. I restarted it and scanned my computer w/ MS Security Essentials and Super Anti Spyware. MS Essentials found Exploit:Java/CVE-2010-0094.AF, and Trojan:Java/Mesdeh and removed them. I use WOT all the time, but now I’m going to be super cautious.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Comment Spam Is Dangerous BS!

If you’ve ever wondered why comments on this site, and many other sites for that matter, are held for moderation by a site administrator, the simple answer is – comment spam, and the need to control it.

Without a doubt, comments are an important part of the mix for a technology site. Comments can spark discussion (always a good thing), allow a reader to present his/her point of view, share tech wisdom, or spread the word on a unique piece of software.

But, comments are not without their share of issues; with comment Spam, in my view, being a significant problem. Spam is virtually everywhere on the Internet. In your inbox, on Twitter and Facebook and other social networks, and so it’s not surprising that you’ll find Spam comments. Recently however, I’ve seen a major increase in the amount of comment Spam.

The following comment spam (full of praise – like many are), is just a small example of the type of nonsense Spam I deal with daily. (click on the screen capture to expand to original size – 1280 x 589).

Take a look at this one, and try to imagine the type of creep who would submit this as a comment.

Hard as it is to believe, there are many sites that rely only on a Spam filter to sort out the wheat from the chaff. Unfortunately, this complacency can lead to the posting of comment Spam that contains dangerous links. Links, which if followed, can lead to a malware site – guaranteeing a very painful experience. The comment shown above, for example, contains a number of malicious links.

Some advice:

Be cautious when following links contained in comments on any web site.

Be particularly cautious of comments, on any web site, where the writer is describing a problem with recommended software and offers a link to alternative software.  This is a favorite technique employed by cyber-criminals.

Be cautious when following any link contained in any web site, since the latest reports indicate there are 5.8 million individual web pages infected across 640,000 compromised websites. Cyber-criminals are finding it easier than ever to inject malicious content into legitimate sites.

Be cautious following links on web forums. Forums can often be a source of dangerous links.

Since the majority of infected sites are infected with Java based scripts, consider using Firefox with the NoScript add-on active. NoScript offers superior protection.

Install an Internet Browser add-on that provides protection against questionable or unsafe websites. My personal favorite is Web of Trust, an Internet Explorer/Firefox add-on, that offers substantial protection against questionable, or unsafe websites.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Google’s CEO Eric Schmidt Stars In “Don’t Be Evil” Video

According to one regular reader here, Google’s CEO Eric Schmidt is “a dangerous fool”. Another reader expressed a similar view (albeit, in slightly stronger words), when he wrote “Google are bast**ds. And so is anyone else who keeps information on people ….. they don’t have the right, or our permission.”

Unusual points of view do you think? Or, are these two views more broadly held than either Google, or Schmidt, are prepared to acknowledge?

Listening to Schmidt pontificate on the privacy issue in the last year or so, you would be forgiven if you believed the fight against Google’s virtually raping of the public’s privacy, for commercial gain, is all over – except perhaps for the crying.

Quotable quotes from Schmidt in the last year include:

“If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.”

“We (Google) know roughly who you are, roughly what you care about, roughly who your friends are.”

“I actually think most people don’t want Google to answer their questions. They want Google to tell them what they should be doing next.”

He managed to top these inflammatory bits of Google wisdom recently however, when he suggested  – children could be entitled to change their names when they got older, if they want to escape their youthful indiscretions, and disassociate themselves from their one-time online lives.

Given the unprecedented ability Google has to collect endless streams of data, and correlate that data (much of that ability jealously guarded), I have no doubt, that Schmidt’s seemingly bizarre view, is well founded.

I’m not a conspiracy theorist in any sense, but I do believe that the very structure of Google constitutes an attack on a basic human right – the right to be “left alone”.

I admit, I’m in the minority in recognizing the truth, in that occasionally seen bumper sticker – “Google Is Not Your Friend”. But, I’m far from being alone.

Consumer Watchdog’s, Inside Google, which describes itself as “a nonpartisan nonprofit public interest group, ….. to educate the public and opinion leaders about Google’s dangerous dominance over the Internet, computing and our online lives”, has crafted a short though provoking video – “Don’t Be Evil?”, in which “Google Is Not Your Friend”, takes on new meaning.

To view the video on YouTube, just click on the graphic.

As well, the video is currently running 36 times a day in New York’s Times Square.

While the fight to rein in Google might seem unwinnable, privacy advocates have not lost the battle yet. Earlier this year, Google was condemned by the privacy watchdogs of 10 countries (including the UK, Canada, France, Germany and Italy), for showing a “disappointing disregard” for safeguarding the private information of its users.

If you believe that your privacy is worth fighting for, then join with the “good guys” and become proactive in the campaign to manacle the Google octopus.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Follow the Link and You “Takes Your Chances”

Regular readers on this site are aware, that virtually all downloads I recommend, are linked to CNET (download.com).

There is good reason for this – CNET scrupulously audits hosted downloads and linked sites, to ensure they are not contaminated by malware.

But links on Blogs can be a special problem for surfers – particularly links contained in comments. Don’t get me wrong –  comments are an important part of the blogging mix.

Amongst other things, comments can spark discussion (always a good thing), allow a reader to present his/her point of view, share tech wisdom, or spread the word on a unique piece of software.

But, Blog comments are not without their share of issues; with comment Spam (some containing malicious links), being the leading problem.

Spam is virtually everywhere on the Internet. In your inbox, on Twitter and Facebook, and other social networks, and so it’s not surprising that you’ll find Spam Blog comments.

WordPress, on which this Blog is hosted, has a Spam plug-in filter, Akismet, which does a good job of catching comment spam. Akismet automatically analyzes comments and flags for review, those it considers Spam.

On this Blog, Akismet routinely captures about 90% of spam comments, according to my blog stats. In real number terms, Akismet has captured in excess of 60,000 spam comments here, in the past two years. But what about the other 10%? – some of which will contain malicious links?

As a matter of policy, I test every allowed link included in a comment, for safety.

Regretfully, there are Bloggers who are fairly complacent and who rely only on a Spam filter to do this job. In doing so, they miss the reality: Spam filters can often miss comment spam, some of which are highly dangerous.

While comment Spam is a pain for the Blogger, a reader who follows a link in a malicious Blog comment, which leads to a malware site, is in for a very painful experience.

Here’s a case in point – any time I write on registry cleaners I can expect the following comment, (shown in the following screen capture), or one like it, to show up.

This comment included a link, to a free application, which supposedly is superior to the free application I recommended in the article.

The comment itself looks harmless, but if I’d allowed this comment to be posted (and I’ve seen this comment published many times over, on many other sites), a reader who followed the link would have become infected simply by visiting the site.

Don’t think that this is an unusual set of circumstances – it’s not. On an average day, here on Tech Thoughts, 10 or more comments (thankfully picked up by Akismet), contain malicious, or dangerous links.

Some advice:

Be cautious when following links contained in comments on any web site – not just Blogs.

Be particularly cautious of comments, on any web site, where the writer is describing a problem with recommended software and offers a link to alternative software.  This is a favorite technique employed by cyber-criminals. All software reviewed on this site, for example, has been thoroughly tested, by me, for usability. If a reader has a problem with recommended software, it’s generally a machine specific problem.

Be cautious when following any link contained in any web page. Recent reports indicate there are 5.8 million individual web pages infected across 640,000 compromised websites. Cyber-criminals are finding it easier than ever to inject malicious content into legitimate sites.

Since the majority of infected sites are infected with Java based scripts, consider using Firefox with the NoScript add-on. NoScript offers superior protection.

Install an Internet Browser add-on that provides protection against questionable, or unsafe websites. My personal favorite is Web of Trust, an Internet Explorer/Firefox add-on, that offers substantial protection against questionable, or unsafe websites.

Use Norton DNS as an added safety precaution.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

A Message for Spam Commenters – WTF!

For many Bloggers, particularly technology Bloggers, comments are an important part of the mix. Amongst other things, comments can spark discussion (always a good thing), allow a reader to present his/her point of view, share tech wisdom, or spread the word on a unique piece of software.

But, Blog comments are not without their share of issues; with comment Spam, in my view, being the leading problem. Spam is virtually everywhere on the Internet. In your inbox, on Twitter and Facebook and other social networks, and so it’s not surprising that you’ll find Spam Blog comments.

Let me throw some numbers at you. In the roughly two years I have been writing this Blog, there have been 67,000+ comments of which 59,000 +  have been Spam. In other words only 8,000 (approximately), have been legitimate comments.

WordPress, on which this Blog is hosted, has a Spam plug-in filter, Akismet, which does a reasonable job of catching comment spam. Akismet automatically analyzes comments and flags for review, those it considers Spam. This is not as effective as it once was, since it’s now much harder to distinguish Spam comments from legitimate comments.

Except of course, for comments that look like these two examples from this morning:

Itboibltlx – fAHU7K kfyvjnunmugw, [url=http://avfqgyvilzvj.com/]avfqgyvilzvj[/url], [link=http://jlroercbkvod.com/]jlroercbkvod[/link], http://sjxsnveldoke.com/

Rzjulixnne – JvgMqE sakykccvvzrv, [url=http://dpbvrodxgikt.com/]dpbvrodxgikt[/url], [link=http://tiewycygcttc.com/]tiewycygcttc[/link], http://etukxnfppged.com/

When you see this type of comment, you have to wonder about these morons.

Since it takes time and effort to manually cull comments so that they are  relevant and Spam free, there are Bloggers who are fairly complacent and who rely only on a Spam filter to do this job. In doing so, they miss the reality: Spam filters can often miss comment spam, some of which is highly dangerous.

While comment Spam is a pain for the Blogger, a reader who follows a link in a malicious Blog comment, which leads to a malware site, is in for a very painful experience.

Here’s a case in point – just this past week (and not for the first time), a site which is renown as a site that specializes in malicious content, left a comment which was not filtered by Akismet. This comment included a link, to a free application, which supposedly was superior to the free application I recommended in the article.

The comment itself looks harmless – but you pay me to be careful – right?

If I’d allowed this comment to be posted (and I’ve seen this comment published many times, on many other sites), a reader who followed the link would have become infected simply by visiting the site.

Don’t think that this is an unusual set of circumstances – it’s not. On an average day, 10 or more comments (thankfully picked up by Akismet), contain malicious or dangerous links.

Some advice:

Be cautious when following links contained in comments on any web site – not just Blogs.

Be particularly cautious of comments, on any web site, where the writer is describing a problem with recommended software and offers a link to alternative software.  This is a favorite technique employed by cyber-criminals. All software reviewed on this site, for example, has been thoroughly tested for usability. If a reader has a problem with recommended software, it’s generally a machine specific problem.

Be cautious when following any link contained in any web site, since the latest reports indicate there are 5.8 million individual web pages infected across 640,000 compromised websites. Cyber-criminals are finding it easier than ever to inject malicious content into legitimate sites.

Since the majority of infected sites are infected with Java based scripts, consider using Firefox with the NoScript add-on active. NoScript offers superior protection.

Install an Internet Browser add-on that provides protection against questionable or unsafe websites. My personal favorite is Web of Trust, an Internet Explorer/FireFox add-on, that offers substantial protection against questionable, or unsafe websites.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

Dangerous Comment Spam – Deadly Links

For many Bloggers, particularly technology Bloggers, comments are an important part of the mix. Amongst other things, comments can spark discussion (always a good thing), allow a reader to present his/her point of view, share tech wisdom, or spread the word on a unique piece of software.

But, Blog comments are not without their share of issues; with comment Spam, in my view, being the leading problem. Spam is virtually everywhere on the Internet. In your inbox, on Twitter and Facebook and other social networks, and so it’s not surprising that you’ll find Spam Blog comments.

Let me throw some numbers at you. In the roughly two years I have been writing this Blog, there have been 61,560 comments of which 55,957 have been Spam. In other words only 5,603 have been legitimate comments or, barely 1 in 10.

WordPress, on which this Blog is hosted, has a Spam plug-in filter, Akismet, which does a reasonable job of catching comment spam. Akismet automatically analyzes comments and flags for review, those it considers Spam. This is not as effective as it once was, since it’s now much harder to distinguish Spam comments from legitimate comments.

Since it takes time and effort to manually cull comments so that they are  relevant and Spam free, there are Bloggers who are fairly complacent and who rely only on a Spam filter to do this job. In doing so, they miss the reality: Spam filters can often miss comment spam, some of which is highly dangerous.

While comment Spam is a pain for the Blogger, a reader who follows a link in a malicious Blog comment, which leads to a malware site, is in for a very painful experience.

Here’s a case in point – just this past week (and not for the first time), a site which is renown as a site that specializes in malicious content, left a comment which was not filtered by Akismet. This comment included a link, to a free application, which supposedly was superior to the free application I recommended in the article.

The comment itself looks harmless – but you pay me to be careful – right?

If I’d allowed this comment to be posted (and I’ve seen this comment published many times, on many other sites), a reader who followed the link would have become infected simply by visiting the site.

Don’t think that this is an unusual set of circumstances – it’s not. On an average day, 10 or more comments (thankfully picked up by Akismet), contain malicious or dangerous links.

Some advice:

Be cautious when following links contained in comments on any web site – not just Blogs.

Be particularly cautious of comments, on any web site, where the writer is describing a problem with recommended software and offers a link to alternative software.  This is a favorite technique employed by cyber-criminals. All software reviewed on this site, for example, has been thoroughly tested for usability. If a reader has a problem with recommended software, it’s generally a machine specific problem.

Be cautious when following any link contained in any web site, since the latest reports indicate there are 5.8 million individual web pages infected across 640,000 compromised websites. Cyber-criminals are finding it easier than ever to inject malicious content into legitimate sites.

Since the majority of infected sites are infected with Java based scripts, consider using Firefox with the NoScript add-on active. NoScript offers superior protection.

Install an Internet Browser add-on that provides protection against questionable or unsafe websites. My personal favorite is Web of Trust, an Internet Explorer/FireFox add-on, that offers substantial protection against questionable or unsafe websites.

If you enjoyed this article, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.