4 ms·

Browse news in a throwaway VM instance that doesn't directly have password management. GoogleNews has served me several trojans, because I'm inherently clicking

by kurthr 3y ago

Browse news in a throwaway VM instance that doesn't directly have password management. GoogleNews has served me several trojans, because I'm inherently clicking on unknown links. This attack was interesting, because it didn't leave Ars, but I would fear those who target HN with outlinks. They can serve malware only to targeted domains so you may be the only one hit. Even more targeted and obscured is to include several keywords in an article of interest that lead to a single controlled page optimized for search engines, which again serves targeted malware.

LeoPanthera 3y ago
> GoogleNews has served me several trojans, because I'm inherently clicking on unknown links. [Citation Needed] Extraordinary claims require extraordinary evidence, and I find this extremely difficult to believe. No news outlet linked to from Google News is going to send you a "trojan", or any other kind of malware. You may have misunderstood how the malware described in the article works - simply visiting Ars would not infect you, or anyone.
- nequo 3y ago
  I would be curious to learn more about Google News abuses too. It doesn’t sound completely far fetched. Google search is known to have served up malicious websites masquerading as legitimate ones. For example, here’s one that was disguised as gimp.org: https://news.ycombinator.com/item?id=33384236 https://news.ycombinator.com/item?id=33384236 Unlikely that such an attack would make it far on HN though.
  - kurthr 3y ago
    I think the concern on HN would be targeting to particular IPs or domains, more like spear phishing. Agree it wouldn't last long, but it only takes once.
- kurthr 3y ago
  Thanks for your question. It should be fairly clear that I'm not talking directly about the Ars issue. That isn't about an outlinked article (Ars doesn't aggregate quite that way) the way Google and HN do. However, using a VM separate from the browser sandbox is a nice way to anonymize and prevent any leaks/damage that can occur. I'm interested to know why you think this hasn't happened since most serous compromises are an untrusted link click away (esp in windows). The first time was in about 2012. There was a news link off of GoogNews (not the site itself obviously, and an outlink as described). The "News" trojan link page seemed to be up for only a short while and then blocked, since later searches for the title were completely missing. I'm guessing Google probably caught it on their end since it was probably infecting everyone who clicked. I only noticed it reasonably quickly due to a rapid change in network activity, but it had already escaped the browser sandbox and was downloading more. Drive forensics that day didn't show anything obvious on Friday, but the next Monday a trojan was found that had been using a zero-day. Since then I've used a VM for random browsing (it's not a panacea, but it's easy enough to do). If you believe that's ineffective, I'd like to understand more. A couple of times in the 13 years since, the AV in the VM has caught viruses and I don't really browse much except news from Google, Yahoo, HN, Ars, etc in that VM.
  - 0134340 3y ago
    Ah, 2012, not surprised. Ad-served malware seemed more common in those days. Even in the early days of reddit, it had an episode where one of their third-party ads infected users. I don't recall it being very malicious but it definitely made me button down on my defense of ad-blockers.
rolltrunhert 3y ago
The article explains how ars was used for a second stage payload. The device would have to be initially compromised by other means (by usb drive in their slides). Browsing ars did not expose any users. Did you read, or just writing comments anyway?
- kurthr 3y ago
  Yeah, I read the article on Ars before it showed up here (it's a day old). It seemed more like it was to obscure CC server and payload location. I was talking about outlinks anyway.

by kurthr 3y ago

LeoPanthera 3y ago

> GoogleNews has served me several trojans, because I'm inherently clicking on unknown links. [Citation Needed] Extraordinary claims require extraordinary evidence, and I find this extremely difficult to believe. No news outlet linked to from Google News is going to send you a "trojan", or any other kind of malware. You may have misunderstood how the malware described in the article works - simply visiting Ars would not infect you, or anyone.

nequo 3y ago
I would be curious to learn more about Google News abuses too. It doesn’t sound completely far fetched. Google search is known to have served up malicious websites masquerading as legitimate ones. For example, here’s one that was disguised as gimp.org: https://news.ycombinator.com/item?id=33384236 https://news.ycombinator.com/item?id=33384236 Unlikely that such an attack would make it far on HN though.
- kurthr 3y ago
  I think the concern on HN would be targeting to particular IPs or domains, more like spear phishing. Agree it wouldn't last long, but it only takes once.
kurthr 3y ago
Thanks for your question. It should be fairly clear that I'm not talking directly about the Ars issue. That isn't about an outlinked article (Ars doesn't aggregate quite that way) the way Google and HN do. However, using a VM separate from the browser sandbox is a nice way to anonymize and prevent any leaks/damage that can occur. I'm interested to know why you think this hasn't happened since most serous compromises are an untrusted link click away (esp in windows). The first time was in about 2012. There was a news link off of GoogNews (not the site itself obviously, and an outlink as described). The "News" trojan link page seemed to be up for only a short while and then blocked, since later searches for the title were completely missing. I'm guessing Google probably caught it on their end since it was probably infecting everyone who clicked. I only noticed it reasonably quickly due to a rapid change in network activity, but it had already escaped the browser sandbox and was downloading more. Drive forensics that day didn't show anything obvious on Friday, but the next Monday a trojan was found that had been using a zero-day. Since then I've used a VM for random browsing (it's not a panacea, but it's easy enough to do). If you believe that's ineffective, I'd like to understand more. A couple of times in the 13 years since, the AV in the VM has caught viruses and I don't really browse much except news from Google, Yahoo, HN, Ars, etc in that VM.
- 0134340 3y ago
  Ah, 2012, not surprised. Ad-served malware seemed more common in those days. Even in the early days of reddit, it had an episode where one of their third-party ads infected users. I don't recall it being very malicious but it definitely made me button down on my defense of ad-blockers.

rolltrunhert 3y ago

The article explains how ars was used for a second stage payload. The device would have to be initially compromised by other means (by usb drive in their slides). Browsing ars did not expose any users. Did you read, or just writing comments anyway?

kurthr 3y ago
Yeah, I read the article on Ars before it showed up here (it's a day old). It seemed more like it was to obscure CC server and payload location. I was talking about outlinks anyway.