7 ms·
Some interesting malware I found
- jeroenhd 5y agoKind of interesting that whatever attacker was on the computer had code execution access but limited themselves to adware. You'd expect malware with this amount of privileges to do something more profitable (like install ransomware or a botnet for mining coins while the machine is idle). Ads pay millicents per view, it's gotta be tough to make any money from them unless you've managed to get a huge amount of installs!
- inetknght 5y agoIt could also be less directly about money and more about something far more nefarious.
- 55555 5y agoIIRC adware that replaces default search can earn 10-25 USD annually per US/EU user.
- bryanrasmussen 5y agoso, you mean > it's gotta be tough to make any money from them unless you've managed to get a huge amount of installs!
- belkarx 5y agoIn all likelihood it was exfiltrating data or setting up a C2
- deleted 5y ago[deleted]
- 0x53 5y agoI had a similar experience with my significant other. Instead of typing "selectmedical.com" she didn't type the "c" and got "selectmedial.com". It prompted her to install a browser extension "necessary for the site to work". I imagine that the authors partner did something similar.
- easrng 5y agoI've looked through the network inspector on redirects like these and it's actually pretty interesting. Usually they start with a parked domain on a service like Sedo, or other ad services like PropellerAds, then you're redirected through sites that buy (potentially low quality) traffic, detect bots, and resell the now bot-free traffic for more than they bought it for. One company that does this is Intango. (They own forwrdnow.com, clksite.com, mybetterdl.com, 7proof.com, etc) The adware extensions and tech support scams and Capital One Shopping then buy that traffic and do their thing.
- 55555 5y agoIt’s crazy how Capital One Shopping fits into that sentence so nicely. The first time I got a Capital One popunder I googled for minutes in shock that it was actually Capital One and not a scam using their brand without permission.
- Terry_Roll 5y agoIts crazy where gambling websites popup on the infrastructure that makes up all aspects of the internet.
- more_corn 5y agoIn my excitement I deleted it…
- annoyingnoob 5y agohttps://www.cisa.gov/uscert/ncas/alerts/aa20-245a https://www.cisa.gov/uscert/ncas/alerts/aa20-245a
- vinnymac 5y agoCould you not use your significant others browser history to find the malicious url visited? I imagine that would provide further insight, such as the files you inadvertently removed.
- arcticbull 5y agoIf it was a Chrome sandbox escape there's no way of knowing where it came from, I suspect.
- horsawlarway 5y agoThis machine is 100% still compromised... You have an actor who has system level permissions that allowed creating and registering launchd scripts. A browser extension cannot do that by itself. You've stopped the obvious parts of this malware, and that's absolutely all. This machine needs to be wiped. If you don't have backups - move critical files and media to a new machine, ideally running a different OS, or to a cloud service. Then do a completely fresh install of the OS.
- bobbiechen 5y agoThanks for putting it so clearly, that makes sense. We'll do this soon.
- unnouinceput 5y agoAnd change your internal network passwords as well after you do the fresh install. The old ones are probably already in the hands of that malware author(s)
- nqzero 5y agocertainly if the user executes or opens them (eg for a .doc) they're powned. but automated systems can also have exploits. i'm trying to make a list of these services (and maybe disable them) to minimize my footprint (often testing out untrusted code from github etc in a small secretive community, ie easy to target) for ubuntu 21.04+, i'm aware of: - gnome-tracker-miner - gnome-thumbnailer (may require browsing in nautilus) - mlocate at least the first two appear to be sandboxed, though unclear of the efficacy. any other services that you're aware of that would be automated vectors ?
- TheDong 5y ago> i'm trying to make a list of these services (and maybe disable them) to minimize my footprint (often testing out untrusted code from github etc in a small secretive community, ie easy to target) If you're running a lot of "untrusted code from github", then the list of services you have enabled or disabled on your system isn't going to make a difference. For someone who frequently runs untrusted code, I'd recommend learning any of: 1. qemu / virsh / how to quickly and efficiently spin up isolated VMs 2. ec2/GCP/digital ocean/any similar VPS provider 3. QubesOS https://www.qubes-os.org/ https://www.qubes-os.org/ The first two options will be a more secure way to run untrusted code and provide actual protection. The 3rd has better usability, though isn't as secure. Disabling local thumbnailing services... yeah, sure, do that, but don't expect it to really do much against "testing out untrusted code".
- orf 5y agoYour machine is still infected, and who knows what else it’s targeted. Wipe it, and if your partner works with anything sensitive on the laptop I’d consider that compromised.
- Lammy 5y ago> launchd exists and can be used in a cron-like way by writing plist XML files Relevant: "macOS persistence – Beyond the good ol' LaunchAgents": https://news.ycombinator.com/item?id=28498058 https://news.ycombinator.com/item?id=28498058
- _nickwhite 5y ago"That's the perk of running Linux on your personal laptop, no one bothers writing malware to target you." Yet.
- 0des 5y agoI like this new flavor of Year Of The Linux Desktop posts.
- silisili 5y agoEh, it's been 'yet' for the last 20 years I've used it.
- 8fingerlouie 5y agoIt was also 'yet' for the first 20 years i used MacOS. Get a large enough user base, and malware will follow, and that may be the reason Linux is still relatively free from malware. Despite advancements, normal people still don't run Linux. It's either IT people or people who had their IT friend/child/whatever install it for them. With browser extensions being used as delivery platforms, it may not be long until it hits Linux as well. The same delivery method (using a user lauchd job) would work for a user systemd job.
- ars 5y agoPut linux on the net with a weak ssh enabled root password and watch it get infected within minutes - I did that with a memory only installation, and multiple different people attacked it. I assume they fought with each other for control of the machine, but I rebooted it instead. Try it - it's interesting, use a USB stick to boot it, and make sure to physically disconnect all hard drives. I think they mostly just want to send spam emails.
- jraph 5y agoor to mine crypto coins
- at-fates-hands 5y ago
- watersb 5y agoSurprised that no one has yet mentioned ObjectiveSee tools, KnockKnock and BlockBlock: https://objective-see.com/ https://objective-see.com/ KnockKnock looks for malware like this rogue launchd service. You use it to quickly check for the presence of some forms of malware. It can integrate with VirusTotal databases. BlockBlock runs as a background process, and blocks installation of launchd services and kernel extensions. It displays a (rather technical) alert when something tries to install such features. Relatively lightweight. I also use Little Snitch, from (unrelated) Objective Development: https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html It's quite a bit more complicated, a firewall with a sophisticated user interface that blocks outgoing traffic by default. The alerts let you add rules to allow such traffic. It can generate a _lot_ of alerts as you gradually build up a set of rules that match your usual usage. I've recently re-installed macOS from Recovery, and I was pleasantly surprised that Little Snitch wasn't often triggered as I went about using my Mac. I wouldn't necessarily recommend blocking firewall like Little Snitch for usual users; they wouldn't be able to deal with all the alert noise. Like Windows Vista, all over again. But I've come to rely on it... ObjectiveSee has a similar, free tool, if you want to see what I mean. I strongly recommend ObjectiveSee tools. They are free and (I believe) open source. https://objective-see.com/ https://objective-see.com/
- 8fingerlouie 5y agoI guess it has been a while since i last checked objective-see. Last i was there, i was considering installing Lulu instead of Little Snitch, but felt the overall user experience was better with Little Snitch. Seeing that they've made a whole host of privacy oriented tools surprised me a lot. I will be trying out a few of them. Thanks for sharing.
- jackjeff 5y ago> I'm sympathetic to website operators who want to support their free sites using ads, but these ads are often malicious, leading to installers for malware like the one described in this post. Agreed
- Terry_Roll 5y agoAn elephant in the room, is that noone really reports on how mobile phone's get pwned, just the bigger personal computing devices ie laptops and desktops.
- saagarjha 5y agoThere’s plenty of people looking into this, see Citizen Lab and Google Project Zero for example.
- neurostimulant 5y agoHe sure did deleted the malicious extension and the associated launchctl entries, but did he closed whatever holes from which the malicious extension got installed in the first place?
- athrowaway3z 5y agoThat's no way to talk about his partner.
- gnfargbl 5y ago> A Chrome extension can basically deny the "normal" uninstallation route by preventing you from getting to chrome://extensions (and presumably about://addons for Firefox, etc.) This seems like something that the Chrome/Firefox security teams could explore changing. Have you considered opening tickets with them? It's possible that they are simply unaware of this behaviour.
- kibwen 5y agoHeh, I actually use a productivity extension for Firefox that prevents me from visiting certain sites during certain hours, and it deliberately offers the ability to disable about:addons as well during that time so that I can't easily turn the blocking off.
- 2Gkashmiri 5y ago3 years ago, india blocked my internet access(well, for an entire population of around 8 million) for around 7-8 months. anyways, i was expected to do tax compliance and the government "permitted" limited access terminals as a sort of olive branch because they were charging late fees/interest for late filings. Long story short, i had to access internet on unsecured windows 7 machines that was as dirty as a public restroom in a fair. i had to upload documents on multiple occasions and i managed to infect my media with all sorts of viruses. i decided to "keep" then, maybe if someone is interested in testing out these in a vm or something,i would be glad to share
- 0xdeadb00f 5y ago> And as the last step after removing the malware, I took the opportunity to install uBlock Origin on my partner's computer. I'm sympathetic to website operators who want to support their free sites using ads, but these ads are often malicious ... Exactly. this is why I will never side with LTT's "adblock is piracy and hurts creators waaaa waaa" bullshit. Ads are more often than not malicious, using clickbait to get people to.. Click on them.
- BizarroLand 5y agoIf google would make a paid adblocker extension that allows you to "pay" to not be shown any Google ads anywhere, on your phone, on your PC, youtube, google search, or any other website that shows them, I wouldn't mind paying for that. Since no one offers what I want in a way that gets them paid, I'll use the free method instead.
- easrng 5y agoThey used to do that, it was called Google Contributer. https://en.wikipedia.org/wiki/Google_Contributor https://en.wikipedia.org/wiki/Google_Contributor
- 0xdeadb00f 5y agosigh Another headstone to add to the Google graveyard
- easrng 5y agoAlso LTT has done network-wide adblock tutorials before, so it's rather hypocritical of them to say adblocking is bad.