BBC Site Used as IE Attack Lure

capt turnpike writes "The hits just keep coming... according to eWEEK.com, someone is using actual excerpts of BBC news stories to 'launch drive-by downloads of bots, spyware, back doors and other Trojan downloaders.' One example is a story blurb masking the download and installation of a keylogger -- with no user interaction. And it doesn't even tell you it loves you."

How is this news?

[Anonymous Coward]

So... they used BBC news as bait... WOW! It's not like they took over the BBC site and used it.

Re:How is this news?

[TommyBlack]

WOW! It's not like they took over the BBC site and used it.

No, of course not. I'm the one who did that.

Click here to read an interesting BBC story about it [kevan.org]

Re:How is this news?

[muellerr1]

Probably already got their brains eaten. That will tend to make you slow.

Re:How is this news?

[arivanov]

You are late.

El president Antonio Bliar has p4wn3d it before you.

Re:How is this news?

[Petrushka]

What a grand testament it is to the present political situation in the UK that no one so far thinks you deserve a "troll" mod. (I don't think you do, either.)

eWeek is retarded...

[ninja_assault_kitten]

"The hits keep coming in..." Yeah, 1 every hour. The media wants to make this the most critical vulnerability that ever existed. What a joke.

Erm, why is this a story?

[baldass_newbie]

I mean, a known bug is exploited and it's using quoted text from the BBC site.
If they do it again tomorrow with text from nytimes.com would that be another story?

Re:Erm, why is this a story?

[bersl2]

They need to do it using eWeek.

Re:Erm, why is this a story?

[i_should_be_working]

Maybe slashdot will be spoofed next. That will be a story. That could be the story. Emails that read:

"Tech website Slashdot article links to vulnerability exploiting websites. Read more here [fake-slashdot.org]"

And whoever submits it to /. won't even have to rephrase it.

Re:Erm, why is this a story?

[Firehed]

Wouldn't this end up creating some sort of infinate dupe-loop and tear the fabric of space-time?

Re:Erm, why is this a story?

[asscroft]

Wouldn't this end up creating some sort of infinate dupe-loop and tear the fabric of space-time? ...damn, foiled by slashcode "This exact comment has already been posted. Try to be more original..."

Re:Erm, why is this a story?

[advocate_one]

Wouldn't this end up creating some sort of infinate dupe-loop and tear the fabric of space-time?

dunno, but all the wintrolls who claim their machines never get infected/trojanned might vanish...

Re:Erm, why is this a story?

[kEnder242]

sig

Re:Erm, why is this a story?

[MobileTatsu-NJG]

"Tech website Slashdot article links to vulnerability exploiting websites. Read more here"

Read more here? That wouldn't work. They should say "Click here to comment..."

Re:Erm, why is this a story?

[hackstraw]

If they do it again tomorrow with text from nytimes.com would that be another story?

Wait a couple of hours, this story could be completely duped :)

Re: Erm, why is this a story?

[Black Parrot]

> If they do it again tomorrow with text from nytimes.com would that be another story?

And will it be safe to read about it at BBC?

Re:Erm, why is this a story?

[richdun]

Possibly. It'd be the first exploit that required soul-sucking registration to activate it.

Re:Sickening

[Parham]

They may be "hating", but it's a great way to show people how they shouldn't completely trust the software they are handed. What sucks even more is that users will have to wait another two weeks (second Tuesday of the month) for an update to be officially released by Microsoft.

I want to say "Firefox wins again", but "again" seems to be everytime nowadays and it's not even worth saying it.

Wow

[mboverload]

Wow, saying a link is something that it's not to lure victims! What a novel idea!

*chokes*

Re:Wow

[shredthrashgrind]

someone should patent it. The combination of BBC + old scam = novel! I'm sure the US patent office would agree.

Now I'm worried....

[Black Copter Control]

From TFA:

Click here to read more about drive-by attacks on the Internet Explorer vulnerability.

And if I click there, just what do I get?

(Times like this I'm glad that I use linux ... Until, of course, the next zero-day firefox hole, at which point I'll switch to konqueror or..).

Re:Now I'm worried....

[the-amazing-blob]

And if I click there, just what do I get?

I don't understand why everyone is so afraid of these things. They monitor us, keep track of us. The kind of thing a girlfriend would do if we had one. Think of keyloggers and the like as your new Girlfriend (beta 0.2, results may vary)

Re:Now I'm worried....

[rdoger6424]

Make it better- load on some nice pr0n.

Re:Now I'm worried....

[Mal-2]

> Think of keyloggers and the like as your new Girlfriend (beta 0.2, results may vary)

I'm worried about the child processes that will be spawned...

Mal-2

Re:Now I'm worried....

[DrSkwid]

firefox can be as buggy as hell for all I care

I boot my browsing OS [damnsmalllinux.org] from CD on a laptop with no HD.

What they gonna do ? Post as me on /. !

Now, THAT'S ILLEGAL!

[dmomo]

If we can't convince the government to crackdown on this scumware in the interest of security and privacy, maybe we can get them to do it in the interest of intellectual property.

Re:Now, THAT'S ILLEGAL!

[Tolkien]

We can do all the wishful thinking in the world, but the sad fact is, no matter how bad internet viral/whatnot attacks get, the US government will never force Microsoft to make drastic OS security changes, and Microsoft will never volunteer them. It's all in the name of the almighty dollar, not technological innovation. Otherwise, with the amount of brain-power (or, failing that, at least the sheer number of brains) behind Microsoft, we could only hope that they would not only close security holes, but rest

WOW!

[jav1231]

An IE vulnerability! That's news!

Fake URLS Suck!

[Giant Ape Skeleton]

According to This article [127.0.0.1], using bogus URL's to trick people is still the most effective social engineering trick in the book. Of course, that may not apply to those in the Slashdot community :p

My SITE HAS BEEN HIJACKED

[Billly Gates]

MY name is James Taylor and I clicked on your link and then the web went down all by itself!

It was taking over by a hostile native american terrorist organization called apache running on Gentoo gnu/linux. Damit hacker! I need to call the FBI over and sue you for this.

Re:My SITE HAS BEEN HIJACKED

[Mrcowcow]

Better than Apache on Windows XP. Now that is a real terrorist setup.

Re:My SITE HAS BEEN HIJACKED

[gEvil (beta)]

Wow! Are you the James Taylor? [wikipedia.org]

Re:Fake URLS Suck!

[MBCook]

I clicked your link.

It's an apache configuration page!
I'M BEING HACKED!

AAAAAAaaaaahhhhhh......

I'd better call the FBI!

Re:Fake URLS Suck!

[jftitan]

Tech Support : I'm sorry sir, but Apache is the name for the webserver software used to run your webpage.

you:..... AHHHHHHHHHH

Tech Support: You go right ahead and call the FBI and Police, I'll be sure to let them know about everything, right after I shoot off our transcribed converation to your local news agency.

you: (what you say, next will make an interesting conversation)

Re:Fake URLS Suck!

[Anonymous Coward]

woah, whoever maintains that site is one sick f*cker.

Re:Fake URLS Suck!

[rcamera]

what's so sick about a bank website? apparently, they need me to update my personal info. i don't remember giving my driver's id last time, but they're asking for it now. how strange...

Re:Fake URLS Suck!

[Velox_SwiftFox]

Patriot Act. Well, duh! Better update that info right away!

Re:Fake URLS Suck!

[Anonymous Coward]

If you want to print the story just use this link. [localhost]

Re:Fake URLS Suck!

[Trogre]

It's a known spammer's site.

Better DDOS the bugger before it hurts anyone else.

Re:Fake URLS Suck!

[Doppleganger]

Hey... that idiot uses the same root password I do! He's got loads of MP3s and warez here, I'm gonna download 'em all and then format his drive before he knows what hit him!

Re:Fake URLS Suck!

[nmb3000]

According to This article [127.0.0.1], using bogus URL's to trick people is still the most effective social engineering trick in the book.

u idiot u gave me ur ip addr. now im going 2 hax0r ur punk 455. let me jus run my haxing skrypt...

* nmb3000 (slkc-dsl-gw14-874.slkc.qwest.net) Quit (Ping timeout#)

. /* classic [totalillusions.net] */

How ironic, the full article has drive by links

[rivj0r]

You'd have to be crazy to click on them while reading that article.

Newsworthy?

[Yomer333]

Not really sure why this is even news. After a computer security competition last weekend, I had the chance to talk to professional security auditors, i.e. hackers. The reason I bring it up is that at one point, one of them said that "he had a web page he would like everyone to visit...with firefox." Needless to say, this scared the shit out of me. After pressing for more info of browser related exploits, he said that IE7 is suprisingly solid security-wise. Same goes for Vista, at least the parts of it that are finished (no more ldap). I shudder at the thought of IE pushers trying to convince people to switch away from firefox because it's not secure enough. I don't know, food for thought.

Re:Newsworthy?

[bunratty]

Gosh. I'm glad you told me this. Now I'll know better and ignore all those warnings about extremely critical vulnerabilities in Internet Explorer from Secunia [secunia.com] I keep seeing.

Re:Newsworthy?

[zcat_NZ]

What's the URL?

I can name plenty of URL's that install drive-by spyware on MSIE (astalavista.box.sk, serials.ws). Go ahead and give me even one solitary URL that installs drive-by spyware through firefox. Just one! I promise I will visit it with firefox, and let you know the results.

Re:Newsworthy?

[protoshoggoth]

What he said. If there is such a page, I want to see it.

Re:Newsworthy?

[mgblst]

Yes, this chap sounds like a believable fellow. If he is anything like the upstanding script children that I have had the pleasure of talking too, not a word comes out of his mouth without being absolute gospel.

I really must comend you amazing non-gulibility, and I will be sure to only use Microsoft products from this point on.

Thanks you kind sir. (Idiot!)

Re:Newsworthy?

[sremick]

Eh, I'm not worried.

Is Firefox perfect? Of course not. Is it possible to get a site that will infect Firefox? Probably. Does that make it logical to run to IE for safety? No more than it makes sense to move from the wooded rural countryside to an LA war-zone because you're afraid of a tree falling on your head.

At the current moment, IE has 33 advisories to Firefox's 2. 34 vulnerabilities to FF's 3. And IE averages 449 days to fix a vulnerability, compared to an average of 83 for Firefox.

(Source: http://www. [webdevout.net]

Re:Newsworthy?

[Yomer333]

Holy bejesus fuckchrist. I'm sitting here using firefox, and the second that I state that someone who knows what the fuck they're doing has tested IE7 thoroughly and says it's surprisingly secure, everyone labels me an MS shill? Does IE6 suck? Yes. Is firefox inherently better? Yes. Still, god damn. I guess slashdot isn't the correct forum for stating hypothetically that an MS product might not totally suck. Besides, why believe the word of someone who makes $4000 a day doing security audits on soft

What harm in bundling the browser?

[chill]

So, what harm is there in bundling the browser with the OS shipped on 90% of the retail PCs in the world? What harm is there in integrating the browser into the core of the operating system?

Apparently, if you bundle a half-ass product where only lip service was paid to security, the cost is greater than anyone realizes. IE was crammed in there with the sole purpose of crushing Netscape and dominating the Internet market. It was rushed, with slipshod quality and security only as an afterthough -- and that only by the PR department.

"Where do you want to go today?" seems to have found an answer... ...let's stop by your bank and credit card accounts on the way to an organized crime hangout and/or third-world country! Fun!

  -Charles

Re:What harm in bundling the browser?

[Tim C]

It was rushed, with slipshod quality

Maybe we're thinking of different versions of IE, but while I agree with your comments on security, I can't agree with that statement.

I remember IE 3; it was no match for Netscape 3 in terms of features or stability. Compared to Netscape 4 it was laughable; Navigator shat all over it from a great height.

Then IE 4 came out, and everything changed.

IE 4 was far more stable, faster and had more features. As an example, when resizing the window, Netscape had to rerequest the p

eWeak

[Doomedsnowball]

I used to get eWeek until I realized that the only people that get eWeek are losers who wish they were CEO's with unlimited power. Then I also realized that eWeek was a fertile ground for hacking real (conceited) CEO's computers. I suspect that's what is happening here. Go hackers!

April 11???

[Black Copter Control]

So Microsoft is planning to release a patch for this zero-day drive-by attack on April 11.....

Hackers Thank God for Microsoft Marketing Policy.

The policy may be designed to make life easier on sysadmins (or, at least, their managers), but it also makes life easier on hackers. I mean, if I had a zero day exploit, I'd start using it on patch day. That way I'd probably have a full month to exploit it before Microsoft released their scheduled patch.

Scheduled monthly patches are fine for non-critical issues, but when you have zero-day drive-by exploits like this, you've got to have a policy that puts user security ahead of marketing hype. Waiting until you have a full-fledged epidemic is not the way to secure your user's future.

Which links?

[putko]

Are any of the links on this page bad ones?

http://www.google.com/search?q=+Yuan+hits+new+high +against+dollar&sourceid=mozilla-search&start=0&st art=0&ie=utf-8&oe=utf-8 [google.com]

That is, I googled some phrase from the article, in an attempt to get it.

Don't look at that unless you have the hotfix or mozilla, I guess.

I don't get it.

[benbranch]

Okay how can someone do all of those things to your computer just by visiting a webpage? Seriously? I use Linux and Mac and have not touched windows for years, so maybe I am a little out of the loop here. Someone can just mess up your PC for visiting a website? Is it really that simple? Ben.

Re:I don't get it.

[DrSkwid]

Why are you here ?

Re:Firefox, anyone?

[sremick]

Fear of change, basically. The more Microsoft bundles with the OS, the more conditioned vendors are to not bundle or support 3rd-party apps. There is such an entrenched mindset and culture of IE-use and support that, despite the very real possibility that "something else" might be BETTER and cost LESS to support, they're too-scared to try to retrain their techs and reprint the support manuals, scripts, and flowcharts.

You tell a support tech you're using anything other than IE and he'll throw his hands up an

ObPython

[Rob T Firefly]

The BBC would like to apologise for the following programme.

3rd Party Security Patch to Fix this Problem

[JoshDM]

You download and install the patch from here:

http://www.mozilla.com/firefox/ [mozilla.com]

No Love?

[neersign]

...but how about the common courtesy of a reach-around?