Firefox Plugin Shipped with Malicious Code

Because of a virus infection, the Vietnamese language pack for Firefox 2 was polluted with adware.


Mozilla: Firefox Plugin Shipped With Malicious Code

Mozilla warned Wednesday that a malicious program inserted adware code into a Firefox plugin that has been downloaded thousands of times over the past three months.

Because of a virus infection, the Vietnamese language pack for Firefox 2 was polluted with adware, Mozilla security chief Window Snyder said in a blog posting. "Everyone who downloaded the most recent Vietnamese language pack since February 18, 2008 got an infected copy," she wrote. "Mozilla does virus scans at upload time but the virus scanner did not catch this issue until several months after the upload."

Mozilla is now going to add additional scans of its software to prevent this kind of thing from happening in the future, she said.

The malware in the language pack is from the Xorer Trojan, according to discussion on Mozilla's Bugzilla developer Web site, which indicates that Mozilla developers first discovered the issue on Tuesday.

"I think it (happened) just because the author's local network was infected with the virus, so it modified HTML files," wrote developer Hai-Nam Nguyen. "The infected code just display(s) annoying banner but it can't propagate."

The open-source browser maker does not know how many people were infected with the adware, but the plugin was downloaded more than 1,200 times in the past week and has been downloaded 16,667 times since November.

On Wednesday afternoon, the Web page for the plugin was off-line as Mozilla scrambled to come up with a new, adware-free version of the language pack. In the meantime, users of the software should disable the plugin, Snyder said.

Storm Worm Reappears this Valentine

Security vendor McAfee warns of a Valentine come-on that downloads a virus instead of a greeting.

Storm Worm Reappears as Malicious Valentine

Carrie-Ann Skinner, PC Advisor

A Valentine's themed outbreak of the Storm worm has been detected.

Around the world, malicious e-mail messages are being received that contain a link that directs users to a website where they can supposedly download a Valentine's card, but in fact are infected with the Storm bug. The virus mirrors the fake Christmas and New Year messages seen in previous months.

According to Greg Day, security analyst at McAfee, the virus will try to steal personal information from your PC, bring down its security defenses and use your PC to send out millions of junk emails.

"There are about 10 million PCs worldwide infected with the Storm worm. These threats have suddenly spiked from 0 percent of all spam emails to 1.5 percent and they are continuing to rise as we draw closer to Valentine's Day and more people are fooled into downloading the malicious file," he commented.

"With all the hype that surrounds Valentine's Day, it was only to be expected that they (the people behind Storm) would use a similar tactic and exploit people's eagerness to receive Valentine's cards," added Diego d'Ambra of email-security company SoftScan.

source: PCWorld

Google to Combat Malicious Sites

Last month, news about malicious sites taking advantage of Google's PageRank to stay on top of the search results, drawing unsuspecting users into their malware-ridden sites. Google creates an online form so users can report any malicious sites they may see.


Google's Response to Malware Sites
News leaked out about malicious sites using a technique called Google Bombing and spamdexing to stay on top of the search results, last month. Malware sites will likely to occur on the top of the search results, drawing unsuspecting victims into their malware-ridden sites, by exploiting Google's PageRank system. Once the user enters the site, it will try to install a number of malwares on the system.

Security vendor Sunbelt Software said hackers appeared to be using various tricks to ensure their malicious sites appear high in Google's search results. Sunbelt said it turned up 27 different domains hosting malware, each with up to 1,499 malicious pages, or some 40,000 pages in total.

Google's initial response was to purge from its index these sites, although Google has not confirmed that this happened. At least, your search result will now less likely contain a malicious website. It was the first search engine to act on this situation. After all, it is its technology being used to bait users. Yahoo and Windows Live Search has not yet reported to the said breakout.

Currently, we know of hundreds of thousands of Web sites that attempt to infect people's computers with malware. Unfortunately, we also know that there are more malware sites out there," Google's Ian Fette wrote in the company's security blog.

To protect online users even more, Google launched an online form so ordinary web users can report any website they suspect that contain malicious code. It contains a simple form that lets users enter the URL of the site and additional information. It also features a CAPTCHA to prevent automated bots from reporting sites automatically.

Google Cleans Up Malware

Reports say that certain malware distributing sites are making their way to the top of Google's search results, taking advantage of their PageRank system.

Google Purges Malware Websites
This week, news spread in the web saying that malware sites are taking advantage of Google's PageRank system to appear on the top of the search results. Researchers confirmed this Wednesday that Google Inc. has cleaned its index for malware websites.

Malware websites forced its way to the top of search results in Google search by processes known as spamdexing and Google bombing. Spamdexing creates invisible text in the websites that is used to lure users to the websites and is usually irrelevant to the page's content, while Google bombing employs the work of bots that increases the PageRank of a page. For more information about these techniques, see the article, Clicking Google Search Result May Lead to Malware in Sonicsoft Wired.

Researchers, however, said that Google has purged the malware sites from its index, effectively removing these sites from appearing on their search results.

The malware sites, once visited, will attempt to install tons of spywares, viruses, password stealers, rootkits onto the user's system. These malwares are easily prevented by the most recent patches available and uses no new exploits of software.

"They look gone to us," said Alex Eckelberry, the CEO of Sunbelt Software Distribution Inc., the company that broke the news Monday of a massive, coordinated campaign by attackers to spread malware through search results on Google, Yahoo, Microsoft Live Search and other sites.
Google did confirm yesterday with us that they were working the case, and they are good about nailing this stuff," Eckelberry added. He notified Google about his research this Monday.

Ironically, Google refuses to confirm or deny that it did remove from its index the 40,000 malware hosting sites, or even that they had existed. "Google takes the security of our users very seriously, especially when it comes to malware," a company spokeswoman said Wednesday. "In our search results, we try to warn users of potentially dangerous sites when we know of them. Sites that clearly exploit browser security holes to install software, such as malware, spyware, viruses, adware and Trojan horses, are in violation of the Google quality guidelines and may be removed from Google's index."

However, she did not mention how long Google made the purge, and if the company had ever done any countermeasures against malware sites from perform this kind of trick in the future.

Microsoft has just confirmed the presence of the malware sites, and are working on it, says a representative of the Live Search team. Yahoo has not yet made a comment.

Google Trouble

A new wave of malware distribution is stewing, and it utilizes Google's PageRank system to appeal to users.


Clicking Google Search Result May Lead to Malware
Google is really famous for this technology, and is probably why it's service is leading from its rivals, Yahoo! Search and MSN Search. Google's PageRank technology was designed so popular websites appear on top of search results.

Google's PageRank uses a nifty logic to determine which page is important and which are not by counting the websites that links to the website. In an example, let's say we will need to rank Page A. Google's spiderbot will count how many websites will link to Page A, thus adding a vote to the site, and increasing its rank. The higher the number of sites, the higher the rank would be. All websites are ranked using this technology. For more information about Google PageRank, see this page.

Although this may look like a very good system, it's not without its flaws. A technique known as Google bombing is a technique used to manipulate the search results of Google Search. Since Google uses PageRank, which counts how many websites that links to a page, Google bombing involves creating tons of websites, or blogposts, that links to a page you want its rank to increase. If enough false websites or posts links to the page, it might appear on top of the search result of Google. Also, a technique called Spamdexing, is closely related to Google bombing, employing a different technique, usually involves creating invisible text (like white text, that blends perfectly with the background) to increase the likelihood that the page is ranked higher.

Malwares are now using these techniques to direct unsuspecting users to enter the website, that installs tons of viruses, trojan horses, rootkits, and password stealers. A bot may be used to create hundreds of blogposts that links to the malware page, effectively increasing its rank, and increasing its chance to appear on top of the search result page. Innocent keywords, from 'how to I teach my dog to play fetch' to 'how to cisco routing vpn dial in', may produce links that leads malicious websites on the very top of the results. Most users wouldn't suspect anything's amiss with the rogue results, although the ultra-wary might be suspicious because many of the malicious URLs are just a jumble of characters, with China's .cn top-level domain at their ends.

Once a user enters the bogus site, he'll be bombarded with malware installation. It may guise itself as a fake video codec. If that doesn't get the user, its IFRAME will. "This is what's doing the most damage," added Sunbelt malware researcher Adam Thomas. "It's loaded with every piece of malware you can think of, including fake toolbars, rogue software and scareware."

One site that Thomas encountered tried to install more than 25 separate pieces of malware, including numerous Trojan horses, a spam bot, a full-blown rootkit, and a pair of password stealers. All the malicious code pitched at users is well-known to security vendors, and can only exploit PCs that aren't up-to-date on their patches.