How Much Harm Can One Web Site Do? 501
Ben Edelman has written extensively on issues including censorship and spyware. He's got a very interesting piece on his site now about who profits from spyware, and how much spyware can be installed on a Windows XP machine when the user simply visits a single Web site using Internet Explorer.
What was the actual web page? (Score:5, Insightful)
I mean, I'm guessing most people would visit a reputable search engine, or the default MSN page when they first installed Windows and opened up IE, instead of what I'm guessing must be a fairly dodgy site in order to install so much spyware.
That's not to discredit what he's done - I'm sure novice users would easily get onto these sort of spyware laden pages by mistake pretty quickly...I'm just interested, that's all.
You could always use a Mac. (Score:2, Insightful)
No surpises here. (Score:5, Insightful)
Re:You could always use a Mac. (Score:2, Insightful)
It's because there's no money in it. Someone is getting paid to bombard you with spyware installations. They want to hit as many workstations as possible. And that means aiming for Windows users.
Your post suggests everyone should use OS X or Linux. The day Windows looses majority share of the desktop market is the day spyware and viruses will start to pop up on your OS X and Linux workstations.
The solution isn't to get rid of windows. It's to educate users, fortify the OS against spyware and viruses by closing security holes, and by legislating unathorized software install as a punishable offense.
Just my 2 coppers.
Why not a site "death sentence" (Score:3, Insightful)
Why can't this be done?
Just cut them off entirely.
The big players need to get together on this.
Not impressed (Score:4, Insightful)
This is akin to throwing matches at a tub of gasoline and writing an expose' when it catches fire. Either this guy had too little to write about, had too much time on his hands, or had to win a bet and is trying to slip this one by someone.
Even he admitted his lousy methodology in his last sentence.
This isn't news. It's just a bone thrown out to keep the resident "gotta flame microsofties" happy with a fix for the day.
Re:Umm... (Score:5, Insightful)
("warning! you're in danger! all you do with computer is stored forever in your hard disk
OK, if you're going to make fun of someone's English, don't turn the Latin word sic into an acronym. Super Intelligent Comment? Sick Internet Creep? Silly Immature Cretin? Sadly Impoverished Credibility?
Re:You could always use a Mac. (Score:4, Insightful)
Re:You could always use a Mac. (Score:1, Insightful)
So, it is actually a combination of Windows being both easer AND larger that makes it such a tempting target.
If (and I hope this day comes) Linux gets 50% market share, you can bet that things like this will happen. And there might be less of it because it will be more difficult -- but it will happen. All it takes is somebody clever enough and with enough motivation. Right now, 5% or so of all desktops is not motivation. 50% will be.
Re:not much... (Score:2, Insightful)
Again, sensationalism trumps truth (Score:5, Insightful)
Note that the latest version of Internet Explorer, as patched by Windows XP Service Pack 2, is not vulnerable to the installations shown...
In other words, he's running all this on an unpatched XP machine.
Now, before the Slashdot horde stabs me repeatedly with a big sharp knife for being a Microsoft apologist, consider this situation. I've got an old version of Firefox with a few exploits in it. I report the exploit, and the response I get is that these exploits are already patched. Yet I decide to write a story about the horrific exploits, post it to Slashdot, and stir up a raucus about how bad FireFox's security is.
What I'm proposing is that Slashdot report it's stories with less sensationalism and more professionalism. Put in the story that all this was run on an unpatched machine, and that the said security holes have already been fixed.
Thank you.
Re:Not impressed (Score:2, Insightful)
My last Linux install included an automatic upgrade of the latest packages that had been upgraded for security reasons - even before X was started for the first time.
How are the first round of patches applied when you install XP? My guess is after you finish the installation, you must:
1. Start Windows Updater
Which, I imagine is where we lose pretty much everybody because:
a) users just want to get going already - not install secuirty patches
b) as an article about counterfeit copies of XP in Asia put it, "Windows Update wouldn't work, so they gave up."
Yankel
Re:not much... (Score:2, Insightful)
Re:You could always use a Mac. (Score:5, Insightful)
The main defense is their structural strenght, i.e. being thinked from the basis as multiuser, where you have very separated the system admin (the one that have some permission over i.e. what programs are installed) over the user that browses internet.
And dont forget that here the blame goes both for the operating system author (Microsoft) and the browser author (Microsoft again), both good examples of what happens when security is the least priority.
Re:In Case It Gets Slashdotted... (Score:5, Insightful)
If you can install 1 piece of spyware you can install 1000 or 1000000. Once you're pwned you're pwned, "how much" is entirely irrelevant.
SP2 is immune (Score:3, Insightful)
Re:Again, sensationalism trumps truth (Score:5, Insightful)
The same problem happens on:
A patched Windows 2000 Machine
A patched Windows XP SP1 Machine
A patched Windows XP Machine
A patched Windows 98 Machine
To get browser security from Microsoft requirs a user of Windows 98 to spend $100 to get XP and then spend the next two days trying to install it and getting it to work right with his scanner/fax/printer.
Or our Winodws 98 friend could just download Firefox.
Why Microsoft wont realease a standaline Internet Explorer for its old systems is obvious: The want to suck more money out of people. And they suck.
If Slakware can update thier browser - why in the fuck cant one of the largest companies in the world do the same?
Re:Umm... (Score:2, Insightful)
You're missing both points (Score:5, Insightful)
If I leave my door unlocked, I'm an idiot, but if you then walk in and steal my TV while I'm gone and sell it at the local pawnshop you're still just as much a criminal as if you smashed a steel door in with an APC: an unlocked door is not in itself an invitation to enter and make oneself at home. The same principle applies here: the sites and software authors are not the legitimate businesspeople they try to convince everyone they are.
Re:You could always use a Mac. (Score:3, Insightful)
I think we're actually talking about two different things. You seem to be referring to things a user is stupid enough to say yes to. RTFA. These are things that the user never even gets a prompt for.
IE runs under a user with administrator privileges (press ctrl-alt-delete and see who's running what) and has the ability to run active-x controls; there's your vector. IE lets the site run a control, and the system lets an administrator-level program write to the hard drive and the registry. It's not even a real hacker worthy exploit (buffer overflows, etc), just telling the computer to do something stupid and watching as it complies.
By contrast, Java (the only real code Firefox can excute) is much more paranoid than IE - that is, I've seen it throw security exceptions. You'd have to not only find a way to get root privs, but get past Java as well.
Absolutely correct. But that does not mean that not-windows users are not-targeted because of their not-dominent market share. That's a logical fallacy. Linux contributors should not become complacent, yes, but I am of the opinion that users have every right to be stupid, and that their computers should not make it easier for others to exploit that perfectly human condition - that is, that their computers should be well-designed. If XP needs all of these security patches just to keep going, where a mac or linux box could stand like a column of basalt for years, clearly something is deeply wrong with it; hell, that probably qualifies under the lemon law.
Re:Sorry to say it but it's HIS fault (Score:1, Insightful)
They "accidently" click a link and then say they didnt mean to.
Re:Not impressed (Score:3, Insightful)
Obvious to anyone who has dealt with end users: they will stop performing maintenance work the very moment they are capable of surfing the web. As soon as an installation is "good enough", they stop.
Obvious to anyone who has ever actually performed this sort of work: Digrieze is an astroturfing liar.
My e-mail to the TwainTec Legal Dept (Score:3, Insightful)
My letter (to which I got no reply)
Hello there. As you can see, I have had to take steps to insure my identity remain secret.
Due possibly to an oversight on my part (leaving the security level in the internet zone in IE on Low, then going to an untrusted site), I have been infected with your adware. The uninstall procedure on your website does not work -- your software is not listed in add/remove programs. The twaintec.dll in my windows directory is currently being used, however I have removed all permissions to this file so it will not load after I reboot.
I was infected with this as well as a myriad of other spyware (toolbars, programs, browser hijackers... I didn't bother to make a list but you should see all the pornographic bookmarks I now have, it's very impressive) by simply going to an internet site. I didn't accept any requests, I didn't read any privacy policies, and now I have your program.
While your privacy policy attempts to divert responsibility by claiming not to allow this, your failure to insure in software that this actually happens makes your company morally, if not legally, complicit. In short, you could have written software that did this, but instead you put the onus on others to ensure that your software was installed on end-users' computers responsibly. Not surprisingly, many third parties do not do this, and privacy policy be damned, *you profit from it*. You acknowledge this by putting, in your privacy policy, instructions to contact your legal department if one should find examples of abuse of your software. I believe that a person of moral integrity would take steps to ensure that your software was not abused, and that by not doing so, you lack moral integrity.
But I'm not here to put you down. I would like you to stop distributing the software, shut down your servers, destroy the source, and find another job. A company that can produce this software could, instead, produce something like, say, PestPatrol, that would make peoples' lives better, not worse. But the purpose of this e-mail is not to request that.
What I want from you is simple. I want you to write me back with instructions on unregistering that DLL. I don't know who wrote this program, but this should be a simple task for someone with programming knowledge, such as must have been required to write the program. If you can do this for me, your moral obligation to me may be considered fulfilled. There is still the greater issue of this software, but one that I'll let you deal with on your own time. If you reply to help me fix what your software has broken, I will forgive you.
If you promise to take steps to ensure that your software is not abused or that you do not profit from it if it is (charitable donations?), I will applaud you.
But I will never trust you.
David
---
Protect yourself from spam,
use http://sneakemail.com
Re:Again, sensationalism trumps truth (Score:2, Insightful)
Like many Slashdotters, I spend a lot of my time helping less computer-savvy friends clean up their messes. About half of the time is spent cleaning, the other half patching. Even after I've explained the necessisity of checking Windows Update, updating and running SpyBot & AdAware, most of them just can't be bothered - they'd rather have me do it for them.
Every time I get a new client whose computer has slowed to a crawl, I find the same situation.
To put it simply, we are the exception. These exploits exist and persist because the normal user is ignorant of the existence and persistence of Spyware.
It's like welfare for Geeks...
He's not flaming IE (Score:2, Insightful)
The story is not about a browser. The story is about the scum companies that make money using exploits to install their crap. If the money trail is followed and the companies profiting from this got their asses handed to them this wouldn't be near as much of a problem.
His example was exactly that, an example of how many nasty things are willing to exploit you, regardless if it succeeds or not.
Again, Slashdotter posts without RTFA (Score:3, Insightful)
The article is about the scumbags that exploit the flaws, and the lengths they'll go to to get their crap onto your PC. It's also about the money trail that can be followed to nail these suckers. The article was trying to demonstrate that there is a way to fight back against behind-your-back-ware, aside from securing the software and making sure your updates are current.
Just because the lock on the door to your house is an old design and can be easily jimmied doesn't mean someone can come in and take your Stuff and justify it by pointing out what a lamer you are for having such an old lock.
Re:s.i.c. (Score:3, Insightful)
Here's a good rule of thumb: if any term is older than a century or so, it's very unlikely to be an acronym. Port outbound, starboard home? For unlawful carnal knowledge, or fornication under consent of the king? To insure promptness? No, no, no. Acronyms are almost entirely modern, and folk etymology is almost entirely wrong.
Re:Win2K is just as bad. (Score:4, Insightful)
You might as well have blessed it with the wave of your hand.
You must visit windows update to get the post SP4 patches or the very least enable auto-update.
You probably got all this stuff from the lsass and rpc vulnerabilities which SP4 does not address.
Re:Not impressed (Score:4, Insightful)
Basically, the guy was loading and emulating what is probably 80% of the internet users out there (think AOLers
My mom (Score:5, Insightful)
While so many are quick to point out that he used an unpatched machine, that he should know better, that he's just doing it to be difficult, that he can fix it. He know's he should install SP2, he knows he should have his firewall set up. He knows he should practice safe surfing....but my mom doesn't know this stuff.
For every computer whiz (like most of us that visit /.), there's a thousand users like my mom who know that you turn on the box, move the little mouse around, and she can type emails to the whole family every day. Then she surfs around on the internet, types something in wrong, clicks on the wrong site, and now can't send the emails to the family and can't order my Christmas presents from Amazon.
Spyware is a pain in the ass for us, but its a nightmare for the computer novices!
Re:Win2K is just as bad. (Score:3, Insightful)
I also killed all the services. and it never ran a web browser. Just mysql. I didn't have any antivirus software on it.
So after placing it on an unfirewalled connection in a locked room, withing 2 hours there were over dozens of virus, worm and spyware installed on the system till it crashed and couldn't even boot. Coming up with 100's of DLL errors!
Again we never open a single web page.
Specificaly some of what was installed was:
[ snip 40 executables & libraries & whatever else was here ]
W2K is still a supported product. If you have any kind of maintence or service contract with the vendor I would strongly suggest you ask them to fix the product. You may want to seek legal advice.
It kills me that people actually _pay_ for this kind of crap.
Can you envision any other single supported product that you can bring home and plug it in and have it basically self desctruct?
Sometimes I secretly wish I were greedy and ambitious enough to be a snake oil salesman and have much of the world's population give me money and respect me for it.
Unfortunately, I have too much personal pride and respect for my fellow man.
So long as people put up with this, it is only going to get worse. Every day I'm more convinced that people's IQ halves in front of a computer screen.
Re:not much... (Score:5, Insightful)
Some of us don't install SP2 because we're not using Win/XP or Win/XP Professional. I am currently running Win/2000 Professional when I am on the Windows side of this machine.
Unfortunately, Windows/2000 Professional is vunerable to these exploits and there is no patch available. I have a fully patched system, run the latest version of Norton's, and sit behind a Linksys router/switch. If I use IE or Outlook I run the risk of getting spyware, viruses, and trojan horses. There are no patches.
Fortunately, I do not use IE on Windows/2000 except to check my web authoring. I do not use Outlook in any form. In fact, I do not read mail on my Windows/2000 side.
However, I have real problems with all of this. As far as I know, Windows/2000 Professional has not reached end of life. I didn't find any information on the Microsoft web site, but you never know. Until Windows/2000 Professional hits end of life, I expect to have at least the same level of security that the latest patched Windows/XP Professional has.
I am comfortable using alternate tools, and in fact I prefer them (Firefox, Thunderbird, OpenOffice, etc.). However, I do not think that having my computer exposed to malware that I can do nothing about is reasonable, esepcially when the same fixes are available for Windows/XP Professional.
I know that one solution is to upgrade to Windows/XP Professional. There are really no advantages to me in upgrading to Windows/XP Professional. I can test ASP.NET, develop C#, run Tomcat/Apache, write Perl, and use MySQL or PostgreSQL quite nicely on Windows/2000 Professional. For my $200 retail price I get an OS with a bigger footprint, menus that purposely hide non-Microsoft software, and a host of other impediments to computer usage.
Ah . . . but I do get the latest security upgrades from Microsoft, many of which are not available for Windows/2000. This is true even though Windows/2000 Professional is a fully supported product.
An average user is not going to be aware of these considerations when using a computer. An average user will not be aware that while Windows/XP SP2 is patched properly, the same diligence will not suffice for Windows/2000.
A lot more can be said about Microsoft's marketing, planned obselence, and deceptive business practices, but that would probably be off-topic.
Re:Umm... (Score:2, Insightful)
So what he (Edelman) wrote was '"Your computer is broked"[s.i.c][sic]'.
Re:not much... (Score:4, Insightful)
On the other hand, requiring absolute security is not an appropriate standard. This standard does not apply anywhere else; your home insurance probably does not cover you for some "acts of nature or God". You cannot say that a meteorite will not fall on you and kill you; you have no absolute security in your daily life. I agree that "Security is a process, not a product." However, experience so far suggests that runing Linux would be much more secure than running Windows.