Net users are victimized by simply doing what they do hundreds of times each day – visiting a Web page. Then, while the consumer browses content normally, a computer virus or Trojan horse program is silently installed.
In the study, Google found 300,000 Web sites laced with such malicious code, and another 700,000 suspicious sites. For perspective, the study found only 18,000 Web sites laced with adware.
So called drive-by downloads are not new, but criminals have seized on the tactic lately because their success rate with traditional e-mail viruses has tapered off thanks to improved software and consumer education. Avoiding e-mail viruses is fairly easy, as long as consumers following clear rules like “don’t click on any attachments.” But drive-by downloads are much more sinister, as no user interaction is required beyond opening an infected site in a Web browser. **
Web 2.0 – more risks
Dave Cole, a Symantec researcher, said even the tried-and-true advice to “stay out of the bad Web neighborhoods” doesn’t work anymore. That’s largely because of the rapid increase in user-contribution Web 2.0-style sites – sites like this blog that allow comments and other content to be uploaded. Hackers can often trick such Web sites into hosting their virulent computer code by using these tools to upload viruses. That means it’s possible for consumers to visit what was once a harmless site – say a blog they’ve looked at every day for a year without any problems – and still become infected.
"Today it is not unlikely that you’ll end up on a dangerous Web page even if you stick to good areas of ‘neighborhood,’” Cole said.
Once a consumer’s computer is infected by a drive-by download, it’s likely to become a zombie in an army of computers used by spammers to send out millions of unsolicited e-mails.
To see a demonstration of how spammers used hijacked computers to make money click on the video attached to this story (http://video.msn.com/v/us/msnbc.htm?g=a33d6b91-d89b-4a4b-8756-42170b947c73&f=00&fg=email).
The problem of hijacked computers – some believe as many as 100 million computers on the Net have been hijacked by hackers – is the subject of our recent three-part series, “Is Your Computer a Criminal (http://redtape.msnbc.com/2007/03/bots_story.html).”
The advent of drive-by downloads as the next important hacker tool puts search engines in the uncomfortable position of acting as a conduit between consumers and criminals. To counteract this threat, Google has quietly begun warning users whose searches turn up potentially malicious Web pages that “this site may harm your computer.” The labeling began close to a year ago, said Google’s Niels Provos, who co-authored the “Ghost in the Browser” report.
“The installation of software without user consent is something that can be detected easily,” Provos said. The company ran billions of Web pages through a filter that looked for suspicious behavior. Of those, about 4.5 million pages tripped Google’s alarm, about 1 million contained some suspicious computer code and 450,000 were positively identified as dangerous.** These sites now come with Google warning labels, and users must go to some trouble to actually visit the sites.
The practice has generated some controversy online, with a few writers criticizing Google for “policing” the Net and potentially censoring content. But Provos said the company has an appeals process for site owners who feel they have been improperly labeled as malicious, and that the firm is doing the right thing to keep users safe.
“We are taking the security of our users very seriously,” Provos said. "No matter where the content comes from.”
How do we know that when we click that link, you’re not leading us into an unsafe web neighborhood, huh Tac??
Trying to turn our computers into crazy P96-emitting zombies, are we?
That’s the reason why it’s important to not log in as an administrator when you are doing “regular” things on your computer. Unfortunately that is the mode most computers are run in by default. Probably the best thing to do is to set up an account that is an administrator, then reset your normal account as a “restricted user”. You won’t be able to install software or add printers in this mode, but since most of the “drive by installs” install with the user privileges you are logged in with, neither will the malicious web site be able to install “crapware”. When you do need to install software or add a printer, just log in to that “administrator” account you created, or do a “RunAs”.
That’s funny only because yesterday I went to a site, unbeknowest to me, (even unsure which site it was) and a backdoor.haxdoor instance was attempted to be downloaded via the route Tacitus suggested.
It’s a good thing I am aware of every instance of everything that attempts to take place on my computer.
I have a few suggestions myself on computer safety
Get yourself an updated virus protection service. No McAfee and Norton are certainly not the best out there. A better one is AVG, which can be obtained for free, but you must keep it updated.
Mtnjim has a great suggestion of not logging in as an admin. I always do since I network of my computer and run a Internet Marketing company that needs to be always tweaked. Summer months are the worst months for the business and adwords need to be constantly changed so I can maintain a slight profit.
Don’t open SPAM ever. If you don’t know where it’s from delete it and don’t open it. Chain letters, especially religious ones are for the sole purpose of obtaining email addresses. You send a letter to all your friends after you are promised love and money for sending it. Eventually that letter gets to a spamer and we collect the email addresses. I can either sell those emails at a penny a piece or spam them myself. It adds up.
Spam comes attached with a little thingy that allows the user to see if the email was opened or not. If you open it, it sends a signal that the email is valid and the person opens emails thus sending out hundreds of more emails to that address. Do yourself a little test: Open a spam email and watch as your spam grows 100% in the following days preceding you opening a spam email.
Once in a while use a registry cleaner, but use with caution and only if you are advanced.
Use Killbox
smitfraudfix
ATF-cleaner
combofix
All these are for the seriously advanced user. You will be extremely surprised how may instances of poison you find operating on your system.
The best advice though is to be vigilant.
this is very true, the first malicious spam type email message tends to be a trojan horse for the multitude to follow…