Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

UK PC Users Hit By Huge Fake Antivirus Attack

timothy posted more than 3 years ago | from the first-you'll-need-this-fake-antidote dept.

Security 75

An anonymous reader writes "UK Internet users were on the receiving end of a large drive-by web attack at the end of February, which attempted to push fake antivirus at least 750,000 times on a single day alone, security company AVG has said. According to a company analysis, on Sunday 27 February, detection levels for the previously obscure Russian 'Blackhole' exploit kit suddenly spiked to 900,000 globally from a few tens of thousands that would be typical for such kits, before dropping back again. Unusually, almost 750,000 of these detections were for UK PCs, which offers a baseline for what must have been a sustained attack several times that size against mainstream web servers frequented by users in the country."

Sorry! There are no comments related to the filter you selected.

Computers not fun anymore? (-1)

Compaqt (1758360) | more than 3 years ago | (#35540806)

Does it seem to anyone else that the background tasks (like preventing malware) you have to perform in order to use computers have increased to the level where computers aren't fun any more?

What will the result of this be?

More and more people will be attracted to the Apple closed garden model.

That, on the other hand, doesn't appeal to us geeks.

Is there a future for open platforms, and what can the FOSS community do to keep them both 1) open and 2) safe?

Re:Computers not fun anymore? (3, Interesting)

antifoidulus (807088) | more than 3 years ago | (#35540818)

What the hell are you talking about? 99.9% of the viruses affect Windows and only Windows, which, correct me if I'm wrong, last time I checked was LESS open than OS X. And if you want a totally safe, totally open OS, go with Linux. Your post contains lots of words but about 0 actual content.

Re:Computers not fun anymore? (1, Troll)

Danieljury3 (1809634) | more than 3 years ago | (#35540866)

No OS is totally safe. Much of the safety of linux comes from its small market share and because the people that run linux are often more security conscientious than those that run other operating systems.

Re:Computers not fun anymore? (0, Troll)

Anonymous Coward | more than 3 years ago | (#35541020)

Well that is just simply untrue.

The whole Linux system has been designed to be anti-processing. In the sense that it will try to murder you and burn down your house if you want to get a program running.
God forbid what happens to the poor guys who try to run programs remotely. They go to a whole new level of Hell.

Re:Computers not fun anymore? (1)

antifoidulus (807088) | more than 3 years ago | (#35541100)

God forbid what happens to the poor guys who try to run programs remotely. They go to a whole new level of Hell.

Yeah, because Windows runs ssh right out of the box....oh wait....

Re:Computers not fun anymore? (4, Insightful)

cyberfin (1454265) | more than 3 years ago | (#35541254)

I think what people here are getting at is not IF something can be done (it obviously can), but whether "The Bad Guys", actually are willing to go through the effort to do it. It's a simple business choice:

1) You try exploiting a system that has MANY documented holes and that its users are more than likely less security conscientious than other tighter systems; ergo, unlikely to cancel credit cards in time or change passwords.

2) You try exploiting a system where it's generally harder to implement a successful exploit and where its users are more likely to reset their security in a blink of an eye if they smell foul play.

Hint: "The Bad Guys" are lazy by nature...

Re:Computers not fun anymore? (1)

tepples (727027) | more than 3 years ago | (#35541814)

Yeah, because Windows runs ssh right out of the box

Of course it does:

  1. Connect to the Internet.
  2. Download ssh [greenend.org.uk] .
  3. Run ssh.

Or did you mean run ssh as a server? In that case, Windows has RDP.

Re:Computers not fun anymore? (1)

F.Ultra (1673484) | more than 3 years ago | (#35545046)

That's a very broad definition of "out of the box".

Preinstall? Watch out for the DOJ. (1)

tepples (727027) | more than 3 years ago | (#35546016)

So it appears by "out of the box" you mean "preinstalled". But the last time Microsoft included a lot of preinstalled software, it got slapped down in U.S. antitrust court.

Re:Preinstall? Watch out for the DOJ. (1)

F.Ultra (1673484) | more than 3 years ago | (#35554326)

That's not what I mean, that is what everybody mean with that term. And no MS was never fined for preinstalling software. They where fined because they tried to use their monopoly in market to gain market shares in another market, is that still so hard to understand? It's not like it hasn't been discussed and explained before...

Re:Preinstall? Watch out for the DOJ. (1)

tepples (727027) | more than 3 years ago | (#35554786)

And no MS was never fined for preinstalling software. They where fined because they tried to use their monopoly in market to gain market shares in another market, is that still so hard to understand?

Then what's the rule distinguishing one instance of preinstalling, which is abuse of monopoly, from another instance of preinstalling, which you claim is not abuse of monopoly? Including an SSH client would help Microsoft gain market share in the market in which VanDyke Software and Tectia compete.

Re:Preinstall? Watch out for the DOJ. (1)

F.Ultra (1673484) | more than 3 years ago | (#35565550)

Well such is the life of having a monopoly, then you are much more limited in what you can do. Which is naturally. But that don't change the fact that MS cannot include preinstalled software, they include a lot of preinstalled software.

With Windows Media Player they where fined because they included it not to enable people to play media, but to use their OS monopoly to sell streaming servers for media (since the WMP out of the box didn't play any other formats than their own and it was impossible to license [at that point in time, I don't know the current situation] the WMP format for companies creating streaming servers).

Including a SSH client would probably not be a problem for MS since #1 - They do not try and sell an expensive SSH server. 2# - The SSH protocol is open. 3# - The SSH market for Windows is very small.

Re:Computers not fun anymore? (1)

Anonymous Coward | more than 3 years ago | (#35541924)

The whole Linux system has been designed to be anti-processing. In the sense that it will try to murder you and burn down your house if you want to get a program running.

You're thinking of ReiserFS [wikipedia.org] . Also it won't murder you or burn down your house, but it may murder your wife.

Re:Computers not fun anymore? (0)

Anonymous Coward | more than 3 years ago | (#35542248)

No OS is totally safe, but the safety of linux comes mainly from a more robust design than windows. A linux user does not have administrator privileges. Windows can be run that way, but it doesn't work too well. E-mail viruses is a windows-specific thing, because only microsoft was stupid enough to make a mail client that executes attatchments - or a word processor scripting language capable of replacing system files.

Hackers have plenty of reason to attack linux - if they could. Quite a few internet servers with excellent high-speed connections are running linux. Just what an illegal hacker wants. Still they struggle.

Re:Computers not fun anymore? (1)

SuricouRaven (1897204) | more than 3 years ago | (#35542274)

It also helps that most Windows computers are used by people who have little idea of how a computer works or good security practice. This can't be held entirely to blame - after all, OSX is targetted at users with a similar level of knowledge - but it does go a long way towards explaining why linux is so much more secure.

Re:Computers not fun anymore? (1)

Anonymous Coward | more than 3 years ago | (#35541054)

And if you want a totally safe, totally open OS...

...then you're shit out of luck because there's no such thing.

Re:Computers not fun anymore? (5, Interesting)

symes (835608) | more than 3 years ago | (#35540864)

I like to fiddle with computers as much as anyone else, but oddly enjoy having an iPhone that just does and is locked down. So perhaps the way forward is to ship products that are, by default, locked up tighter than an iPhone but with the option to incrementally relax restrictions. This way the average user who couldn't care less about what is going on under the hood and is susceptible to drive-by attacks is fairly safe. But then those who would like to fiddle and are probably a lot more security conscious have the freedom they need. I also think that continual updates don't help much. The average user does just want a machine that they can use to browse the internet, type the odd letter, and so on. Continually pushing new versions of this and that gets them into the habit of updating and installing stuff they don't understand. It might be better to encourage these people to take their machine in for a regular service to someone who knows what they are doing, same as a car.

Re:Computers not fun anymore? (2)

somersault (912633) | more than 3 years ago | (#35541064)

It might be better to encourage these people to take their machine in for a regular service to someone who knows what they are doing, same as a car.

It would be better just to do silent updates. Many people don't take their car for regular servicing, and even if they waited a couple of days, their machine could be pwned by then, credit card/banking info stolen, etc..

Re:Computers not fun anymore? (3, Insightful)

owlstead (636356) | more than 3 years ago | (#35541872)

I like to fiddle with computers as much as anyone else, but oddly enjoy having an iPhone that just does and is locked down. So perhaps the way forward is to ship products that are, by default, locked up tighter than an iPhone but with the option to incrementally relax restrictions. This way the average user who couldn't care less about what is going on under the hood and is susceptible to drive-by attacks is fairly safe. But then those who would like to fiddle and are probably a lot more security conscious have the freedom they need.

That's much like Andriod behaves together with the Google store. The Google store provides the safety catch and you can get around that if you want to. A difference is that it does not rely on code inspection, so there is more chance of bad programs getting through. It also does not protect as much against programs that are just badly designed or are careless regarding security/privacy. The access conditions make sure that applications cannot just access any API even if you use another store or direct download. E.g. a game would require me to allow it to use phone functions.

I also think that continual updates don't help much. The average user does just want a machine that they can use to browse the internet, type the odd letter, and so on. Continually pushing new versions of this and that gets them into the habit of updating and installing stuff they don't understand. It might be better to encourage these people to take their machine in for a regular service to someone who knows what they are doing, same as a car.

I'm sorry, but that's a very bad idea. Even applications that are not susceptible to buffer overflows and other low level memory management related attacks are vulnerable to other kinds of attacks. If I would have a banking application on my mobile, I would like to make sure that it is up to date. Hey, maybe there is a bug in the SSL handling where they allow third party certs to be accepted.

The trick is to let the OS handle the updates, and make applications resistant against these updates. Again, with Android you get continuous messages that your application update won't harm your user data (and configuration, most of the time). That said, Android 2.1 has only been given auto-update functionality some time ago, and users need to activate it themselves. It would be a good idea to make that a access condition/setting as well for security relevant applications.

The problem with updates is that many people associate it with the (old) windows way of doing updates. Some kind of application specific updater (within the app itself or as a service/tray icon) indicates that there is an update. The user then has to go through X steps for the update to take place, shutting down all the required applications. Then the user may even be asked to do a restart, and should pray that the update went successfully. It's just so stupid if you have an operating system that does not even reliably let you manage your applications, it's just beyond belief.

Re:Computers not fun anymore? (1)

mcrbids (148650) | more than 3 years ago | (#35542420)

Linux has long had the "repo" concept. It's like a cross between the "Windows way" and the app store you see on mobile. I think it's ideal!

1) There's no gatekeeper. Anybody can build a repo, and customers can choose what repos they want.

2) Everything is cryptographically verified, so security is strong.

3) You have just one place in your computer to do updates, so you aren't barraged by a raft of "OMG U R UPDATEZ!" when you boot up a computer that's been sitting for a while, like you do on Windows.

4) Updates can occur in the background. For me, it's a small KDE Icon that alerts me to the process. I can continue working while it's happening. If I need to reboot, I don't have to do it right away.

I think MS really blew it with their Windows Update, because it requires end users to reboot multiple times, and it doesn't handle application updates, just Windows.

Re:Computers not fun anymore? (1)

Waccoon (1186667) | more than 3 years ago | (#35542880)

Unfortunately, developers will immediately require people to disable all those security features. People will say Yes to anything if it makes the messages go away.

When a game demands admin access and requires me to restart my computer after installation, the first thing I ask is, "why?" I don't run those kinds of games on my work computer, knowing full well why a stupid game wants total, unrestricted control over my system. I'd rather buy software that "just works."

Re:Computers not fun anymore? (4, Informative)

SimonTheSoundMan (1012395) | more than 3 years ago | (#35540892)

I have had to remove several viruses lately. It wasn't by "drive-by web attack", it happened by people getting phone calls or letters through the post, some were even sent CDs and told to install the "AV software". Quite odd, but I have fixed several PCs where people have followed the 'advice' given to them.

I know I have several others to fix because they received phone calls pretending to be their ISP for example.

Re:Computers not fun anymore? (2)

Dunbal (464142) | more than 3 years ago | (#35540908)

No it doesn't. Computers are still fun.

More and more people will be attracted to the Apple closed garden model.

Only the non creative types who don't care or want to know how computers actually work. Oh wait - fancy that - PC users will end up developing the software for the Mac sheeple that just want to doodle in paintshop all day while telling everyone how wonderful their expensive Macs are. The problem with the closed garden is that it's a closed garden. That's all well and good if you have no idea what a computer is. But if you want to innovate and write, say, the NEXT closed garden, you cannot do that while constrained by artificial limits.

Re:Computers not fun anymore? (1, Insightful)

Anonymous Coward | more than 3 years ago | (#35541328)

Non-creative types? What shit is this?

Are you really suggesting that creative types, by definition, will want to take their PC's apart? Really?

Re:Computers not fun anymore? (1)

JoeMerchant (803320) | more than 3 years ago | (#35542202)

write, say, the NEXT closed garden, you cannot do that while constrained by artificial limits.

Knock yourself out: XCode [apple.com]

No easier, or harder, with gcc or Visual Studio - well, Visual Studio does have the annoying multi-tiered pay for your software model, that's a bit of a time sink, but otherwise, all are competent tools.

Re:Computers not fun anymore? (0)

Anonymous Coward | more than 3 years ago | (#35542304)

All those "creative types" running Linux on the desktop... Is this a joke? What exactly is "creative" about the Linux desktop? Gnome is about on par with Windows 98 and KDE basically committed suicide with version 4. So creative!

Re:Computers not fun anymore? (1)

mcrbids (148650) | more than 3 years ago | (#35542360)

I've read your post twice. I'm still not sure what it was that you said.

Re:Computers not fun anymore? (2)

grumbel (592662) | more than 3 years ago | (#35540980)

Is there a future for open platforms, and what can the FOSS community do to keep them both 1) open and 2) safe?

1) It already is open, so nothing to fix there. I don't run any time wasting virus scanner processes in the background, as I don't need any virus scanner on Linux, not because it more secure, but because I download my apps from an official Ubuntu repository, not random webpages found on the Internet. That doesn't stop bad things from happening, but if they happen that way its unlikely that any other local measurement would have prevented them.

2) Safe is relatively easy in theory, put every single application into a chroot()-alike and don't grand them full system access. The few cases where an application needs access (like files) can be handled in a secure manner without to much problem. In practice of course its not that easy, as nobody seems to be willing to take the first step and security is as always threated as an afterthought, not a core design feature.

The thing that provides hope and might be the reason to go "Safe" one day is that "Safe" isn't an opposite of "Open", they go hand in hand. A system where a single application can't destroy the system, is a system where I can run whatever I want from whoever I want. Its a system that provides the user with the most possible freedom. An unsecure system on the other side doesn't allow you to run anything you don't trust, thus drastically limiting your choices.

Re:Computers not fun anymore? (0)

Yvanhoe (564877) | more than 3 years ago | (#35541148)

Most people never asked to have a computer. They just want their emails, facebook, youtube and video games. They will be happy with their iPhone iPad, etc...

I long for the time where computers will become a nerd-only item again. Then, maybe, governments will stop making silly laws about silesharing, reverse engineering and DMCAs and will just force Apple or Google to put his or that limitation in their sandboxed mobile operating systems.

Re:Computers not fun anymore? (2)

tepples (727027) | more than 3 years ago | (#35541850)

They just want their emails, facebook, youtube and video games.

Until they learn about a video game or other work that their walled garden of choice rejected.

I long for the time where computers will become a nerd-only item again.

Then the economies of scale will disappear, and nerds won't be able to afford a computer.

Re:Computers not fun anymore? (0)

Anonymous Coward | more than 3 years ago | (#35542476)

Until they learn about a video game or other work that their walled garden of choice rejected.

These plebs should install Linux and be totally free! Then they won't be burdened by choosing video games! TuxRacer it is!

Gap between freeware and the mainstream industry (1)

tepples (727027) | more than 3 years ago | (#35542626)

These plebs should install Linux and be totally free!

I'm not trying to imply that end users need to go all the way and install GNU/Linux on a PC or buy a GNU/Linux based phone or PDA such as the N900 or Pandora. But at least they should buy devices with the option of turning on the equivalent of Android's "Settings > Applications > Unknown sources". Ask anybody who had an idea for a PS3, Wii, or home theater PC game but had to retool it for Xbox 360 (with all its flaws [pineight.com] ) because PS3 and Wii have no indie developer program and HTPC penetration is next to nil. Or ask Bob Pelloni [wikipedia.org] , who anybody who had an idea for a DS, PSP, or GP2X game but had to retool it for iOS and Android because DS and PSP have no indie developer program and GP2X penetration is next to nil.

TuxRacer it is!

You know, there is a middle ground between video games released as free software or freeware and video games developed by an established company with an office and employees who have years of experience working for an incumbent video game developer. It's just that certain walled gardens make it difficult to jump that gap without moving hundreds of miles away to another state.

Re:Computers not fun anymore? (1)

GameboyRMH (1153867) | more than 3 years ago | (#35541776)

I disagree, computers are more fun and lower-maintenance than ever!

I might be saying that because all my devices except my gaming PC run Linux*

*well actually my gaming PC dual-boots, but I rarely use the Linux install for anything. Turn on, play games, turn off...

Re:Computers not fun anymore? (1)

drinkypoo (153816) | more than 3 years ago | (#35542142)

Does it seem to anyone else that the background tasks (like preventing malware) you have to perform in order to use computers have increased to the level where computers aren't fun any more?

Computers have always been un-fun when they don't work. Right now my fancy low-power nVidia card is locking up on me during heavy use... but only in Windows, not in Linux. Hilarious. Trying a beta driver that says nothing about my problem now, because nVidia often fixes problems with nary a mention in the release notes... just like everyone else.

Fake AV loaded on Mac OS systems on 14 occasions. (2)

Danieljury3 (1809634) | more than 3 years ago | (#35540844)

I wonder, are the Mac users protected by their stupidity from fake anti-virus software. Were they thinking along the lines of a Certain XKCD comic [xkcd.com] but with Mac OS in place of liniux.

Re:Fake AV loaded on Mac OS systems on 14 occasion (1)

somersault (912633) | more than 3 years ago | (#35541082)

Just offer them a preview of the next iPhone or whatever, the stupid ones will run that.

Re:Fake AV loaded on Mac OS systems on 14 occasion (3, Interesting)

DJRumpy (1345787) | more than 3 years ago | (#35541272)

They largely are. These offers of protection tend to download .EXE's since these fake antivirus companies don't waste time on anything that's non-Windows. In addition, a large majority of Mac users don't bother with Antivirus so they simply ignore these. Last but not least, they tend to be less gullible than Windows users.

http://www.daniweb.com/hardware-and-software/networking/news/218521 [daniweb.com]

http://techcrunch.com/2009/12/10/microsoft-users-gullible-advertising/ [techcrunch.com]

Last but not least, these types of attacks tend to be fear driven and Windows users simply have more to fear from Viruses than Mac users at the moment. After years of sustained attacks, they are simply much to jumpy and easily frightened to pass up.

Re:Fake AV loaded on Mac OS systems on 14 occasion (1)

JimboFBX (1097277) | more than 3 years ago | (#35547992)

I think a lot of people would disagree that Mac users are "less gullible" than windows users. Considering Apple is lauded for being "such a good marketing company that can get people to pay significantly more for a product that the competition charges a bit less and also provides more features" would actually scream to me that "apple buyers are more gullible".

Not trying to say my "fact" is more truthy than yours but hopefully you see the problem with that statement now that is supported by bad statistics from that fanboi article you link to (for example, how about "making ads look like windows pop-ups are more effective than making them look like apple pop-ups").

Re:Fake AV loaded on Mac OS systems on 14 occasion (1)

Stuarticus (1205322) | more than 3 years ago | (#35570706)

The attitude I usually see from Mac owners, is more "Haha, with my powerful OSX I am invulnerable to all know Viruses!". An attitude which will in time create it's own problems, I suspect.

Re:Fake AV loaded on Mac OS systems on 14 occasion (0)

Anonymous Coward | more than 3 years ago | (#35548444)

You do know that the article you link to merely says that there are more clickthroughs coming from IE than from Safari? This is a bit like saying that Luxemborgians are less gullible than Americans because they buy less off of Ebay.

Omission (2, Funny)

tm2b (42473) | more than 3 years ago | (#35540848)

No mention of the Malware attacks named "McAfee" and "Symantec."

Re:Omission (1)

Danieljury3 (1809634) | more than 3 years ago | (#35540878)

That's because they're such good fakes that no one has noticed yet.

Re:Omission (0)

Anonymous Coward | more than 3 years ago | (#35543170)

Or AVG for that matter.

portion of population infactdead, spreading fast (0)

Anonymous Coward | more than 3 years ago | (#35540902)

they live in the shadows, & on the media now. some have been identified. eugenatics (vaccines, caste system), weapons peddlers, ga stone freemasons (4.billion too many of US?), kings (inbred/altered)/minions(politics/military), fake weather cos., adrians, rothschilds, turners, cheneys, it goes on&on.

Re:portion of population infactdead, spreading fas (1)

Dunbal (464142) | more than 3 years ago | (#35540928)

If you take your meds it stops going on and on.

everybody knows lyndon larouche is a whack job? (0)

Anonymous Coward | more than 3 years ago | (#35541104)

well portrayed by the well owned media as such. what he writes about, is much of what we're seeing, if we look. eisenhower & kennedy had similar views. one of kennedy's last speeches was a 'we're coming for you' aimed at the banking industry. his brother had similar aspirations, & demise. so long ago.

Works Good (0)

Anonymous Coward | more than 3 years ago | (#35540972)

It only cost me $25.00 and seems to be finding all kinds of stuff and it's tells me it's working well!

Re:Works Good (0)

Anonymous Coward | more than 3 years ago | (#35541026)

Amazing, and let me guess - every week or so it downloads updates, and once in a while it tells you that it has found something completely new?

Funny, the only stuff my anti-virus programs seem to have found (and marked as SEVERE THREATS) are "trojans" called WGA Activation Tool and WinLoader, etc. Not that I have any idea what those programs are and how they got on my hard drive. I'm a legitimate Windows user - look, I even have this "genuine" certificate to prove it!

Don't be a fool (0)

Anonymous Coward | more than 3 years ago | (#35540996)

Apple OS X is less secure than Windows. More people use PC computers, more people use Windows, so obviously, people will write viruses and malware FOR them, and thus, Anti-Viruses and protection is made to keep up with it. No one really attacks OS X, and thus, Apple likes to be gleeful in saying its secure when it fact, it's not. Not at all.

Many of my customers affected (0)

Anonymous Coward | more than 3 years ago | (#35541072)

I own a small PC repair shop here in the UK and we had about 20 PCs in during a two week period with this malware. After that most AV software was detecting it and automatically removing it. It wasn't terribly virulent and booting into safe-mode was enough to prevent it running.

i don't trust Norton or McAfee... (0)

Anonymous Coward | more than 3 years ago | (#35541078)

Used them, uninstalled them & even had to google search "how do i completely remove norton." They might as well be fakes themselves and what alarms me most is the number of noobs & businesses who use their product and think they are protected.

Anyway, question: Who manages or creates those links you get when you search for "top 10 antivirus" or "best antivirus 2010?"

I make a living from these guys. (3, Informative)

grahamlord86 (1603545) | more than 3 years ago | (#35541206)

I've spent the past month clearing up the fall out of this explosion of Fake AV... It's the most common issue I see on computer in my repair shop these days, and has been for a few years now, but this confirms why it's been so hectic the past couple of weeks!

I am amused that AVG are going on about it when, like the rest of the mainstream antivirus products, AVG itself cannot prevent or remove these Fake AVs- by the time the user brings their computer to me, AVG, or any other antivirus is broken and crying in the corner of C:\Program Files, or just gone completely.

Re:I make a living from these guys. (0)

Anonymous Coward | more than 3 years ago | (#35544074)

I'm wondering if this is related to all the phonecalls we have been getting over here (Dublin). From mid-February or so some nigerians were calling here purporting to be from a 'internet security company', informing people that their windows computers were infected and directing them to a website for a fix. They called my home number as well as a bunch of people I know (all on the same phone exchange).

Re:I make a living from these guys. (1)

grahamlord86 (1603545) | more than 3 years ago | (#35545762)

I don't tink the two are directly related, although it wouldn't surprise me if the 'sources' of both scams are links or even the same.

I've had scattered reports of these phone calls over here, I hear about it every now and then, but it's sporadic. Not sure how these calls are targeted.

Hollywood Hackulture (3, Insightful)

eyenot (102141) | more than 3 years ago | (#35541486)

Had a typical midwesterner conversation this morning in college. It wasn't over exactly this antivirus fakeout, but it led up to the flaws behind the antivirus system, namely the symbiotic relationship between virus/antivirus. But the reason the antivirus companies make so much money, and the reason why fake virus attacks work, and so on, is because people are educated from the wrong directions.

This morning, after somebody realised I was a computer programmer they asked if I could hack into computer systems. Once we got past my incredulous phase where I can't believe somebody would ask something like that out in the open in front of other people, it came down to, "no, I can't, or if I can I don't want to".

Do you walk up to people and say "could you jack a car?" "Could you murder somebody?" Just right out in the open, not even meeting them? Try it out like this: do you tell them, "yeah, oh yeah!" You know how much federal time that is, right out the gate? By the time you affirm something like that, it's not the other person's liable time, either, it's yours. Even if it's also illegal to ask in the first place, seeking to conspire over these things and soliciting such skill through such a line of questioning.

But if it's computer hacking, well everybody feels that's a great thing. Everybody wants to know a hacker, see a hack going on. This is why it's very lucrative to make games where a person believes they are hacking a computer system, but never to make it very complex: they wouldn't know a hack if they were one, but they love the idea of trumping all this new-fangled computer nonsense that puts knots in their brains and makes them feel inferior. Oh, if only they could hack the machine and get it out of the damn way and just get down to brass tacks and business.

So I had to weather wave after wave of this guy begging for the reality of the grey-hat market. That maybe it's okay to commit computer crimes because if you get caught, you won't go to jail, the NSA will show up with the men in black and hire you into the upper, upper, uppity echelon of secret dream, top-level, wish fulfillment and instant gratification the real world won't let you have.

He promoted himself as some kind of brilliant business person, because he's spending money to go to college for business. He didn't even know to bring cash with him to do the printing he needed for this uppity business class trip of his, and wasn't independent minded enough to put it together on his own. I explained to him how to put the scanner and the printer together through the computer and pay for it off his printing account instead. I didn't even get a thanks, just a frankly indifferent, self-scolded, urban-culture "yeah that'll work that's cool".

So, when he got on me about where's all the grey hat money money, I told him, it's not supposed to be like that. The systems should be installed properly and used properly the first time. You don't go around giving your housekey away to strangers all in order to sustain the police records filing level industry, do you? You keep your shit secure because you want it. You do that because that's what your instincts want, is security. That's exactly what an employer is thinking, too. They aren't saying, hey, I want holes in my security to hire a grey-hat, so I'm going to go buy a security system, have it installed properly, and then have a mad hatter at the front desk surfing the web from an admin level unpatched windows desktop and taking bathroom breaks with the system password post-it noted over the keyboard numerical pad. That way I can hire a cool-sounded thing, like, the rugged individualist down on his luck who got caught stealing my wife's credit card number and now has been hand-picked by the NSA to come to me to charge me twice for my security: once to point out how I screwed it up and again to install the whole new system.

When I put it to him like that, he said, well, ha-ha, it's obvious you don't know biz-niss. I explained as well as I could that, in fact, he doesn't know business: I said, go on out there and do a little hacking. Without any experience or skill in it, just try and find the market for these grey-hat jobs that the spooks and felons have ensured exist for all of us knotheads who either don't want a proper education and discipline to install a nice all-levels security system and ensure the client uses it properly or who just don't understand any of it but think it sounds really cool and want to get involved you know for the money.

He was like, what do you mean? I explained: it's turning into a culture, which he was like, "right! Yes, it is!" to emphasize my point back to me. I said: but it's not based on reality, it's entirely a cultural construct. It's not only not based on principles of security, or on ethics, or even on skills, it's based on movies and crap. Which he smilingly admitted I was right about.

BUT HE TAKES THE MOVIES SERIOUSLY!

Let's draw another parallel. You don't watch "Butterfly Effect" and go messing your life up because, hell, you can just go back and change it, do you? You don't watch "Nightmare on Elm Street" and never sleep again, do you? You don't watch "Transformers" and think your car is a robot from outer space, do you? Why not? Because you know movies have no bearing on reality.

Well why the hell would you think that there's this whole, cool, hacker underground existing wherever there are computer programmers, just because of a few crap-tastic flicks with clicky keyboard sounds and close-ups of people talking to screens? And when that never surfaces, why would you think that this non-existent world is becoming a legitimized and paid form of grand larceny and espionage, just because a screenwriter heard there's an NSA?

He says, oh, but the NSA do give out jobs like dat, to people whose broke inta systems and got caught, instead of doin time, they gave em, uh, jobs workin doin that for them. For real! For real!

I said, know what, first of all, you don't know that because anybody who ever did get such a deal or such a job would be under strict control not to tell anyone about it. So there's no way to verify such a job opportunity does or ever did exist. And second of all, you have no way of knowing that that isn't a social engineering honey pot set up by the NSA to catch hackers who will get sloppy and get caught because they don't care so much about getting caught because in the back of their minds they're saying, hey, if I get caught, at least I'll be getting paid and vacationing at Area 51.

And he retorted, "but I saw this MOVIE".

I had about had it. I explained to him, it's like virus protection software. That's not supposed to exist. People aren't supposed to open attachments from strangers and go on to attempt to infect everyone they ever wrote an email to or received one from with a zombie backdoor so some hacker can DDOS a window of opportunity for stealing credit cards from the Pentagon employee database. But they do, because they're stupid. So virus protection authors have this market to make money off of no, not a flaw, but plain stupidity. Here's the catch: there's no way of verifying, ever, that the protection authors aren't also writing the viruses. You're probably not going to just haphazardly open attachments any more knowing that, right? Even though it would make money for someone to do so. Even though it would create a need for the sort of person you're asking me if it's possible to be. Catching onto the interconnected nature of all the flaws and how they sure, theoretically might create a webwork that could sustain a microeconomy of cottage industry fuckups, do you really, really want to say that it's "good business"?

He did! He really thinks it's good business because this movie had a cool soundtrack and was less a hard sci-fi rather just an action flick with sex and blood.

I should've been more on top of my shit but I haven't even had breakfast yet this morning and my mind is preoccupied with all the drafting I have to do. But it was another conversation with another one of those potential Jerry Springer guests or what the rest of America refers to as "midwesterners", and I wasn't even trying to talk to this guy any more because he was starting to get patronizing and entertained. But what I should have said was: why are you in business?

Why don't you just get into film-making?

Re:Hollywood Hackulture (1)

mcrbids (148650) | more than 3 years ago | (#35542340)

WTF? Could you include a "TL;DR" for everybody next time you decide to write a book?

Re:Hollywood Hackulture (1)

Shikaku (1129753) | more than 3 years ago | (#35542642)

It was very interesting, if a bit hard to read. You should read it.

Re:Hollywood Hackulture (1)

umrguy76 (114837) | more than 3 years ago | (#35560242)

Had a typical midwesterner conversation this morning in college.

But it was another conversation with another one of those potential Jerry Springer guests or what the rest of America refers to as "midwesterners"...

I was born, raised, and currently live in Missouri. Not only that but I drive, get this, a 4 wheel drive truck and own a rifle. Somehow, in spite of all that, I was able to read and comprehend your entire rambling post. I must truly be a diamond in the rough out here in the vast wasteland of drooling idiots that exists between Los Angeles and New York City.

Sheesh...

Re:Hollywood Hackulture (0)

Anonymous Coward | more than 3 years ago | (#35695592)

I dont like your midwesterners comment. But I do understand the point you were making. Computers seem to fascinate the average person and they cannot tell the difference between hollywood or reality.

Headline Left Out Something (0)

Wingsy (761354) | more than 3 years ago | (#35541542)

Hey, the headline forgot to include, "Mac Users Unaffected" :)

Re:Headline Left Out Something (1)

herojig (1625143) | more than 3 years ago | (#35541630)

I don't think that could be done, as the article states that 14 macs were infected. Fortunately, I was not one of them.

Re:Headline Left Out Something (1)

Wingsy (761354) | more than 3 years ago | (#35541682)

I dunno about that. Does "loaded" equate to "infected"?

Re:Headline Left Out Something (1)

herojig (1625143) | more than 3 years ago | (#35555036)

Not sure either, but loaded would mean "affected" right?

Where's the education? (1)

gtvr (1702650) | more than 3 years ago | (#35541612)

I can almost answer my own question. I've run into too many people who don't WANT to know anything about their computers. Sort of like that old Barbie "Girls aren't good at math" thing, except it's "I'm not a computer person so I'm not GOOD at computers" and they're doing it to themselves. My gut does tell me that this is worse with older people, but not 100%.

Re:Where's the education? (2)

owlstead (636356) | more than 3 years ago | (#35541908)

This is a complex world, one cannot know about everything. Why would users be interested in the inner workings of anti-virus engines? Even I cannot grasp why *I* am interested in all this while the weather is just beautiful outside. How many people know about the inner workings of their car?

Sorry, but it is the job of the OS and applications to make sure that their users are safe. A good setup certainly should not require any anti-virus applications. Virus scanners are just a patch up job that is required when the OS and applications are not doing their job very well. The current batch of smart phone operating systems shows that the job can be done well; of course they have the luxury to drop legacy support.

Re:Where's the education? (1)

gstoddart (321705) | more than 3 years ago | (#35542224)

At the end of the day, a computer to most people is intended to be a tool for productivity. The device itself is secondary to what I actually want to accomplish.

They don't want (or care) to be "good at computers", they'd just prefer the computer did what they wanted with the least hassle. They just want to print something, look up a recipe, or, apparently, play Farmville.

Similarly, I fly on business ... I have no interest in being "good at planes", I just want the damned thing to work, and get me there. Same goes for plumbing, and even the engine of my car.

Many people want their computer to be more like a microwave or their TV ... It does what it does well, consistently, and without any surprises.

Older people have less time for fiddly bullshit which is secondary to what they're actually trying to do. My iPad is something I actually use a fair bit, precisely because it is less fiddly, and because I use for such different things I don't even sit in the same kind of chair as I do when I use a computer. I'm not trying to do my professional work on it, I'm doing essentially leisure activities on it.

There's a case to be made for not HAVING to do some of these tasks. For people who aren't interested in the nuts and bolts, or just don't care anymore, it is nice to have the option of something that just goes and doesn't need a whole lot of attention.

Re:Where's the education? (1)

jackdub (1938908) | more than 3 years ago | (#35542594)

I send this link [youtube.com] to anyone whose computer has been infected that I have been tasked to clean up.
It is a fool me once, shame on me kind of situation. (You would have to be pretty ignorant to fall victim multiple times.)

Re:Where's the education? (1)

Mr. DOS (1276020) | more than 3 years ago | (#35544296)

Hi – I'm the education, right here. I worked as a tech in a mom-and-pop service shop for a bit over two years. People would come in with spyware-infested machines, and rogue antimalware products were often involved. They'd ask why it happened, and we'd explain. And they'd have questions, and we'd explain. And they'd act like they understood, and thank us, pay their bill, and head on their way.

Several times, they came back in again with more of the same problems a few months down the road.

People don't want to have to think, and common sense security – the best, most effective kind of security – requires conscious thought.

And actually, I'd say the situation is somewhat better with older people. If you can make them understand (analogies work best, I find) what's being dealt with, they're much more likely to latch on and do (or not do) what you tell them to.

Education wasn't enough this time for me.. (0)

Anonymous Coward | more than 3 years ago | (#35553156)

I started using PCs in 1987. I've been using Linux for over a decade. I have firewalls, anti-virus on all my (Windows) PCs and generally take care out there on the Interweb. I am the person the rest of my family calls when their computers go wrong.

And still I got infected at the end of February. My first malware infection ever.

At the time of the infection (or at least the timestamps on the files I later removed after dual-booting into Ubuntu) my wife was using the family PC to surf some popular websites - checking details of a large London hotel she was visiting, as well as flight times into Heathrow, that sort of thing. No dodgy porn sites involved (as far as I know). She was running a user account without admin privileges.

To this day I'm not 100% sure how we got infected, but I think it's possibly because our version of Java was about 18 months out of date - turns out the automatic update hadn't been working (and hadn't made a big enough noise about the failure for me to react). Maybe I'm just comforting myself but I think that this was a *very* sophisticated attack and I'm not surprised that so many users fell victim to it.

Happening in US too (0)

Anonymous Coward | more than 3 years ago | (#35541824)

There's been a spike in the US too. We've seen more of those type of repairs recently.

And I want to like AVG, but their program can't fix it. :(

Effigy? Why, Lord Inglip, if you insist...

You meant Windows Users not PC users (0)

Anonymous Coward | more than 3 years ago | (#35541990)

...there is a huge difference.

ebay the main source? (0)

Anonymous Coward | more than 3 years ago | (#35542170)

I've not saw it reported elsewhere, but a lot of people who got this fake AV (it was "system tools"), seemed to get it in drive-by-fashion from ebay.

AVG is past tense (3, Insightful)

macraig (621737) | more than 3 years ago | (#35542698)

I don't give credence to anything AVG says, since I caught its version 9.0 product red-handed denying me the ability to format any of my disk drives so long as it was installed. It maintained continually open files/folders on every drive, such that Windows would refuse to allow formatting any of them, and not just the boot drive. I uninstalled it and never looked back. The day an AV product denies me the ability to use a fundamental feature of the operating system is the day that product gets the boot.

Happened to my sister (2)

JimboFBX (1097277) | more than 3 years ago | (#35548064)

This happened to my sister, who isn't really a dumb person. After talking with her I've come to establish the profile of an individual that would fall for these kinds of attack:

1. They are very trusting of something when they do trust it. This behavior is often associated with people who do well at school and follow their parents advice/beliefs
2. They don't use their computer much anymore, mainly relying on their phone instead
3. They own a computer that came pre-installed with an antivirus brand they don't recognize, so all they know about is that they wouldn't recognize it if it gave them a pop-up
4. Their anti-virus is expired and they falsely believe an expired anti-virus would detect viruses but refuse to to clean them
5. They get this fake virus full screen banner when they visit a trusted website. In my sister's case it was hotmail.com. This leads me to suspect it could had been either a rogue banner or she has a virus on her machine prior to the incident
6. Money is not an issue for them so they would rather throw money (and their credit card information) at an immediate problem ("YOUR COMPUTER HAS A VIRUS") than stop and think about the situation they aren't familiar with and try to deduce what is really happening
7. They don't read the newspaper in detail much anymore so they miss the millions of columns that have already warned about this scam

Fortunately she called me within minutes of installing the software and realized it all started to be very suspicious. We then got a new credit card number, disputed the charges, and used system restore (which is apparently all that is needed to get rid of this particular fake anti-virus).

Re:Happened to my sister (1)

NSN A392-99-964-5927 (1559367) | more than 3 years ago | (#35548518)

Normally you get rogue banners and as JimboFBX has said "5. They get this fake virus full screen banner when they visit a trusted website. In my sister's case it was hotmail.com. This leads me to suspect it could had been either a rogue banner or she has a virus on her machine prior to the incident".

This happened to a friend yesterday and I went around to his place to fix his PC. Thankfully it was not a huge issue as I made him buy Malwarebytes a few months ago which is set up to monitor in real time and had already quarantined these rogues.

It does actually bring into question what he was doing; including his 15 year old daughter who installed for him the sweet IM toolbar thinking it was Kool (idiot). You just have to remember people are not very well educated when it comes around to computers. It is more a case of I want something now; you get offered something free; one does not read the terms and conditions; therefore by installing this CLICK YES TO INSTALL AND DISABLE ALL YOUR SECURITY SETTINGS OR CLICK NO TO DISABLE YOUR SECURITY SETTINGS AND INSTALL IT ANYWAY AND OR/CLOSE TO INSTALL ANYWAY.
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?