Printable View
"In addition, at least one auction page on the eBay online auction site contained a photograph that links to an infected Web site, said Johannes Ullrich, chief technology officer for the Bethesda, Md.-based SANS Institute's Internet Storm Center."
http://www.washingtonpost.com/wp-dyn...2004Jun25.html
That link requires registration :banghead:
Here's an update anyway -
http://news.com.com/Web+site+virus+a...3-5248279.html
Associated Press
Update 4: Web Virus May Be Stealing Financial Data
06.25.2004, 05:09 PM
A computer virus designed to steal valuable information like passwords spread Friday through a new technique that converted popular Web sites into virus transmitters.
Though the impact of the "Scob" outbreak was mild compared with recent infections like "Sasser" and "Blaster," security experts worried about its method of delivery.
With Scob, virus writers have discovered yet another way - beyond e-mail and network techniques - of distributing their malicious code.
Now that the exploit is out, it won't be long before others adapt it for spamming and for launching broad attacks to cripple the Internet, said Alfred Huger, senior director of engineering at security company Symantec Corp.
The infection, first discovered by Microsoft Corp. on Thursday, appears to take advantage of three separate flaws with Microsoft products and can be difficult to detect.
Stephen Toulouse, a security program manager at Microsoft, said software updates to fix two of them had been released in April, but the third flaw was newly discovered and had no patch available yet.
He recommended that computer owners obtain the latest security updates for Microsoft products and their anti-virus and firewall programs. For the flaw that lacks a patch, he said, users should also turn up security settings on Microsoft's Internet Explorer browsers to the highest levels.
Users could also turn off the "JavaScript" feature on their Microsoft browsers, though doing so could cripple functions on some sites.
The virus does not affect Macintosh versions of Internet Explorer, nor does it spread through non-Microsoft browsers like Mozilla and Opera.
Users can search their computers for the files "Kk32.dll" or "Surf.dat" to see if they are infected. Removal tools are available from major anti-virus vendors.
Experts said the infection was unusually broad but wasn't substantially interfering with Internet traffic.
The U.S. Computer Emergency Readiness Team warned that any Web site, even those trusted by users, might be a vector for spreading the virus.
Security experts worked Friday to pin down how hackers managed to infect hundreds and possibly thousands of Web sites. It appears to target at least one recent version of Microsoft software for operating Web sites, called Internet Information Server.
Hackers made subtle changes to the Web site so visitors get a piece of code that's designed to retrieve, from a Russian Web site, software that records a person's keystrokes.
Such data, which can include credit card numbers, bank accounts and passwords, are collected for remote delivery to hackers, experts say.
The virus, however, does not attempt to spread itself, helping to limit its effect.
Web sites have been used before to spread a form of spyware called "browser hijackers." One, known as Qhosts, disables access to major search engines and resets the Internet Explorer browser home page to a little-known site.
But those typically have involved "users having been visiting shady sites," Chris Kraft, senior security analyst at Sophos Inc. Here, hackers plant the code on business, government and other everyday sites they do not normally control.
"This is kind of ingenious," Kraft said.
Giskard,
Disabling javascript will render many legitmate sites unusable.
"The virus does not affect Macintosh versions of Internet Explorer, nor does it spread through non-Microsoft browsers like Mozilla and Opera."
Mozilla 1.7 is now available
http://www.mozilla.org/
John
Good.
I'm getting ready to deploy XP to 1,000 desktops. Maybe I should uninstall IE 6 and install Mozilla. :p
:yes:Quote:
Originally posted by John Nebel
"The virus does not affect Macintosh versions of Internet Explorer, nor does it spread through non-Microsoft browsers like Mozilla and Opera."
I've been using Firebird, and more recently Firefox, for some time, for many uses. Some websites don't "form" exactly to form with these, but they function just great. I ask the wifey and creeps to use these as they (the surfers...) tend to go to sites more prone to infection / adware. These are very useful browsers because they are not integrated in windows OS - therefore you are much less vulnerable, if at all...
Thanks, John!