How Much Harm Can One Web Site Do?

Ben Edelman has written extensively on issues including censorship and spyware. He's got a very interesting piece on his site now about who profits from spyware, and how much spyware can be installed on a Windows XP machine when the user simply visits a single Web site using Internet Explorer.

Gnome + spyware?

[k4_pacific]

Particularly amusing was that the article mentioned a proposal to bundle spyware into Gnome 2.0 [gnome.org]. I bet that went over like a strip club in the Vatican.

Re:not much...

[Anonymous Coward]

If you have two network interfaces, then installing WinXP SP2 results in a strange bug: Suppose your laptop has a wireless interface and a normal ethernet interface. If you start wireless and plug in ethernet while Windows is running, then the ethernet interface won't aquire an IP address via DHCP, even if you turn off wireless networking. If you leave the ethernet cable plugged in, deactivate the ethernet interface and reactivate it, it works as expected. But now the wireless interface doesn't aquire an IP address if you turn it back on, until you disable/reenable it.

Re:not much...

[robslimo]

You guys on the "don't install SP2!" bandwagon need to wise up.

I am personally responsible for the software on 67 windows computers at a university. I am jointly responsible for almost 400 of same.

On the image I created and support, there are 93 applications loaded on top of a base XP install. These range from silly stuff like DivX player to Pro/Engineer. I had to test each and every one of them for SP2 compatibility.

A grand total of 4 applications wouldn't work at all. 2 or 3 more had minor problems. Every one of those with problems were corrected by getting updated versions of said app.

Any other usability problems are strictly a function of the firewall and if you (being a /.er) can't deal with that, then you don't need to be using a computer or posting in this forum.

Does he have a lawyer?

[serutan]

I was not shown licenses or other installation prompts for any of these programs, and I certainly didn't consent to their installation on my PC.

I would love to see somebody slap some criminal charges against the site owner. Hiding behind an obfuscated EULA is bad enough, but installing software without any permission whatsoever has to be illegal, doesn't it?

Did anyone else read the title as...

[Seth Finklestein]

..."How much harm can one do to a web site?"

That would be a good question to ask Michael Sims [slashdot.org], who goatse'd my web site last year and said of the experience, "I'd do it again."

This Ron Artest-like display shall not stand. Read all about it in my upcoming book entitled Cheating Death: How the Censorware Project Became Fraudened [yahoo.com].

Re:not much...

[afidel]

Guess you haven't installed SP2 on a spyware infested PC then. Because MS specifically doesn't (and can't) support spyware infected PC's they failed to test with a computer as it exists in the real world. So about 10-20% of pc's upgraded to XP SP2 just fail to come up at boot time, and another 10% or so fail to connect to the network after login. That's a really high failure rate, and unlike a university situation where you just make a new image and push it out to the machines in most small and medium businesses that's just not an option as the users scream bloody murder if they have to reinstall stuff.

simulating spyware installs

[diakka]

I was thinking, what if you could do something to simulate a spyware install on a computer to the point that they would be fooled in to paying out these per-install fees to websites. If they're paying out a lot of money for installs that will promptly be deleted, then it would hurt these companies financially and also hurt the revenue streams to the websites that use these exploits for financial gain.

Win2K is just as bad.

[John Sokol]

I reciently installed a new win2K system and installed the latest service pack 4.

I also killed all the services. and it never ran a web browser. Just mysql. I didn't have any antivirus software on it.

So after placing it on an unfirewalled connection in a locked room, withing 2 hours there were over dozens of virus, worm and spyware installed on the system till it crashed and couldn't even boot. Coming up with 100's of DLL errors!

Again we never open a single web page.

Specificaly some of what was installed was:

alte.exe
beird.exe
c.bat
clonzips.ssc
clsobe rn.isc
cvqaikxt.apk
cult.exe
cygwin1.dll
dgssx y.yoi
dual.exp
emoti.bat
enotxa2.exe
explorx.e xe
ger.exe
gt.x
hosts was altered
knlps.exe
knlps.sys
ksat.bat
medo.dl
mirc.exe
nonzipsr.noz
ntcnsl.dll
orrl.exe
Odin -Anon.Ger
repcale.exe
riqa
scheduler.exe
sysmm s32.lla
svcshost.exe
titlex.exe
w.e
wshield.ex e
winguard.exe
ymnz.exe
unmt.exe
vnicmon.exe
zema
a qsws directory
zippedsr.piz

Re:You could always use a Mac.

[Sporkinum]

By contrast, Java (the only real code Firefox can excute) is much more paranoid than IE - that is, I've seen it throw security exceptions. You'd have to not only find a way to get root privs, but get past Java as well.

November 23, 2004 (1:39 PM EST)
Java Bug Makes IE, Firefox Vulnerable

By TechWeb News

A flaw in Sun's Java Virtual Machine can open up the two most popular browsers, Microsoft's Internet Explorer and Mozilla's Firefox, to attack, security researchers said Tuesday.

Re:not much...

[Rasta Prefect]

There's got to be more to it besides your browser. If you're getting 80-160 pieces of spyware you must be visiting some pretty sketchy sites and have your security settings set to minimal. I use IE almost exclusively and the worst I get is a couple of tracking cookies when I run AdAware.

/me laughs maniacally. Oh, the naivette...I do desktop support in an University setting for students and faculty. Amongst my duties is supporting the students XP laptops (we don't technically support other windows versions). I've seen Adaware remove well over a 1000 items from laptops, and my supervisor has seen over 3000. One laptop brought in (by somebody who I'll guarantee wasn't searching for warez and pr0n) had 256MB of Ram and was using an additional 350 MB of swap by the time it finished booting. The hard drive light wasn't flashing. It was just _on_.
These people don't do anything but browse the web and use office. It's all comin in through IE. :) Just as dangerous as the w4r3z and pr0n is that inspirational link Mom sent you that requries you turn all your additional browser crap...

Re:not much...

[Lordrashmi]

Specialized machines should be locked down, no internet access, no right to install anything or run anything other the the specific programs they need. They could only read from and write to a specific network drive. Anything else is nuts.

Stupid Spyware Companies.

[jellomizer]

You know the Spyware companies are pritty dumb. What they should do when they make the program is remove all the other pieces of spyware so only you adds are beeing seen to the User. You know if they all did this then in Theory you should only have one piece of spyware on your system and most people wouldn't notice.

virgin install

[fishdan]

At our crazy workplace, with around 60k networks PCs, It takes about 20 seconds to get infected with a virgin install. As a result, all the installers now carry flash drives with zonealarm, adaware, and our anti-virus flavor of the month. We install ALL that before connecting to the network.

It bothers me that some people still install windows while connected to the internet.

The test is not particularly valid

[Fnagaton]

The test is not particularly valid because in the video the person quite clearly clicks "Yes" to running scripts on the page even after there are errors. I have to ask myself what kind of person blindly clicks on yes and I come up with the answer "the person who gets software installed on their machine". Also the machine is not patched, which also makes the test less than meaningful.

The "test" is basically the same as saying "Hi I know that this lock is vulnerable to this method of being opened and I will now prove it is not secure by using an old lock with that vulnerability."

If I was in a really pedantic mood I could use a nice old copy of any other operating system with known and patched security problems and demonstrate how vulnerable they were in the past as well. Lets see, maybe I could make a website dedicated to the old known Irix user able to set root password to nothing exploit.

It's not scientific and it's not clever.