6 ms·

New OS X trojan injects ads into pages in Chrome, Firefox, and Safari

37 points by recoiledsnake 14y ago

JagMicker 14y ago
Will people ever learn to not install random codec packages? KaZaA / K-Lite, anyone?
- Lightning 14y ago
  Those were the dark days. Then VLC showed up.
mrcharles 14y ago
I would love to see stats on how many infections happen per platform based on this virus, since it's on both Windows and OS X. I would expect to see a higher penetration on Macs, since I assume people using Macs don't have the higher level of paranoia that has been engendered in Windows.
- X-Istence 14y ago
  I don't think any of this has to do with higher level of paranoia. The same reason Windows machines are vulnerable to social engineering attacks are the same reason OS X is vulnerable to it. --- Hey, I want to watch this video/movie/clip/trailer but I need to download and install this tool first, alright, click click click, hey, my trailer didn't show up. On to the next website I go. --- There is no good way to stop crap like this either, the user is willingly installing it themselves, people hate the walled garden that iOS has become, and that OS X is becoming with the App Store, yet that is one of the ways that the OS can be secured. You have people up in arms about it being closed off or being inaccessible because of these new restrictions, but at the same time people want to be able to install whatever they want. Whitelisting is the only real secure way to make sure that the wrong app doesn't run. Blacklisting means you are always chasing the ball and the target.
  - Samuel_Michon 14y ago
    "people hate the walled garden that iOS has become, and that OS X is becoming with the App Store [...] You have people up in arms about it being closed off or being inaccessible" 'People' say a lot of things. I've personally never heard a non-geek complain about Apple's 'walled garden'. Mac and iOS device sales are higher than ever.
weirdcat 14y ago
I'd love to see a program that blocks any new installs until approved by a "family geek". When your mother clicks that INSTALL NEW TOOLBAR! link, it emails you with details on the software to be installed, and only after you approve it, your mom is able to proceed with the installation.
- Kronopath 14y ago
  So, Gatekeeper? It won't send you any emails, but it will prevent rogue software from being installed.
- m_d 14y ago
  I would definitely pay for something like this. The ability to approve installs remotely would be amazing.
- cube13 14y ago
  It would be nice if OSX's security model was extended to require the root password for any application or plugin installer that isn't handled directly within a process.
- Samuel_Michon 14y ago
  You can set the security preferences in OS X to only allow installation of Mac App Store applications. That minimizes risk greatly. http://support.apple.com/kb/ht5290 http://support.apple.com/kb/ht5290
  - dmix 14y ago
    Only about 20% of the apps I use I've ever downloaded on Mac app store. But I imagine for some non-tech savvy users this could work.
- JonnieCache 14y ago
  That's a really good idea. Maybe hacking it into the OS like that is going a bit far, but automating the "hey, does this look ok to you?" process is definitely a goer IMO.
scrrr 14y ago
Can't the benefactor of this malware not be traced back using the ad-codes he spreads rather easily?
gailees 14y ago
I actually had this happen on my windows laptop a few months ago. I initially thought it was Facebook rolling out ridiculous ads haha https://news.ycombinator.com/item?id=4558985 https://news.ycombinator.com/item?id=4558985
geocarncross 14y ago
I've seen Yontoo for a while now(aka PageRage aka Sambreel), and they're not the only one doing this. It's trivial for publishers to detect Yontoo's technology, and alert people when it's happening. Something as simple as: try{if(new ActiveXObject("YontooIEClient.Api"))found=!0;}catch(e){}; try{found=!!localStorage['y2LocXML'+location.pathname];}catch(e){};

37 points by recoiledsnake 14y ago

JagMicker 14y ago

Will people ever learn to not install random codec packages? KaZaA / K-Lite, anyone?

Lightning 14y ago
Those were the dark days. Then VLC showed up.

mrcharles 14y ago

I would love to see stats on how many infections happen per platform based on this virus, since it's on both Windows and OS X. I would expect to see a higher penetration on Macs, since I assume people using Macs don't have the higher level of paranoia that has been engendered in Windows.

X-Istence 14y ago
I don't think any of this has to do with higher level of paranoia. The same reason Windows machines are vulnerable to social engineering attacks are the same reason OS X is vulnerable to it. --- Hey, I want to watch this video/movie/clip/trailer but I need to download and install this tool first, alright, click click click, hey, my trailer didn't show up. On to the next website I go. --- There is no good way to stop crap like this either, the user is willingly installing it themselves, people hate the walled garden that iOS has become, and that OS X is becoming with the App Store, yet that is one of the ways that the OS can be secured. You have people up in arms about it being closed off or being inaccessible because of these new restrictions, but at the same time people want to be able to install whatever they want. Whitelisting is the only real secure way to make sure that the wrong app doesn't run. Blacklisting means you are always chasing the ball and the target.
- Samuel_Michon 14y ago
  "people hate the walled garden that iOS has become, and that OS X is becoming with the App Store [...] You have people up in arms about it being closed off or being inaccessible" 'People' say a lot of things. I've personally never heard a non-geek complain about Apple's 'walled garden'. Mac and iOS device sales are higher than ever.

weirdcat 14y ago

I'd love to see a program that blocks any new installs until approved by a "family geek". When your mother clicks that INSTALL NEW TOOLBAR! link, it emails you with details on the software to be installed, and only after you approve it, your mom is able to proceed with the installation.

Kronopath 14y ago
So, Gatekeeper? It won't send you any emails, but it will prevent rogue software from being installed.
m_d 14y ago
I would definitely pay for something like this. The ability to approve installs remotely would be amazing.
cube13 14y ago
It would be nice if OSX's security model was extended to require the root password for any application or plugin installer that isn't handled directly within a process.
Samuel_Michon 14y ago
You can set the security preferences in OS X to only allow installation of Mac App Store applications. That minimizes risk greatly. http://support.apple.com/kb/ht5290 http://support.apple.com/kb/ht5290
- dmix 14y ago
  Only about 20% of the apps I use I've ever downloaded on Mac app store. But I imagine for some non-tech savvy users this could work.
JonnieCache 14y ago
That's a really good idea. Maybe hacking it into the OS like that is going a bit far, but automating the "hey, does this look ok to you?" process is definitely a goer IMO.

scrrr 14y ago

Can't the benefactor of this malware not be traced back using the ad-codes he spreads rather easily?

gailees 14y ago

I actually had this happen on my windows laptop a few months ago. I initially thought it was Facebook rolling out ridiculous ads haha https://news.ycombinator.com/item?id=4558985 https://news.ycombinator.com/item?id=4558985

geocarncross 14y ago

I've seen Yontoo for a while now(aka PageRage aka Sambreel), and they're not the only one doing this. It's trivial for publishers to detect Yontoo's technology, and alert people when it's happening. Something as simple as: try{if(new ActiveXObject("YontooIEClient.Api"))found=!0;}catch(e){}; try{found=!!localStorage['y2LocXML'+location.pathname];}catch(e){};