Adware Test Video - Windows Security Holes

[AndyManchesta]

Sorry i sent the last post by mistake

I've written before about unwanted software installed on
users' computers via security holes.

How bad is this problem?

How much junk can get installed on a user's PC by merely
visiting a single site?

I set out to see for myself -- by visiting a single web
page taking advantage of a security hole (in an ordinary
fresh copy of Windows XP), and by recording what programs
that site caused to be installed on my PC. In the course
of my testing, my test PC was brought to a virtual stand-
still -- with at least 16 distinct programs installed. I
was not shown licenses or other installation prompts for
any of these programs, and I certainly didn't consent to
their installation on my PC.

In my testing, at least the following programs were
installed through the security hole exploit:

180solutions, BlazeFind, BookedSpace, CashBack by
BargainBuddy, ClickSpring, CoolWebSearch, DyFuca, Hoost,
IBIS Toolbar, ISTbar, Power Scan, SideFind, TIB Browser,
WebRebates (a TopMoxie distributor), Ebates Moe Money
Maker, EliteToolBar, XXXtoolbar, Your Site Bar, WinAD,
and WindUpdates. (All programs are as detected by Ad-
Aware.)

See a video of the installations

http://andymanchesta.com/Video/security-111804.wmv


Other symptoms of the infection included unwanted
toolbars, new desktop icons (including sexually-explicit
icons), replacement desktop wallpaper extra popup ads,
nonstandard error pages upon host-not-found and page-not-
found error conditions, unrequested additions to my HOSTS
file, a new browser home page, and sites added to my
browser's Trusted Sites zone.


Installation of 180solutions software through security
holes is particularly notable because 180 specifically
denies that such installations occur. 180's "privacy
pledge" claims that 180 software is "permission based"
and is "programs are only downloaded with user consent
and opt-in."

These claims are false as to the installation occuring
in the video linked above, and as to other installations
I have personally observed. Furthermore, 180's separate
claim of "no hiding" is false when 180 software is
installed into nonstandard directories (i.e. into
C:\Windows rather than a designated folder within Program
Files) and when 180 software is installed with a
nonstandard name (i.e. sais.exe) rather than a name
pertaining to 180's corporate name or product names.

What's particularly remarkable about these exploits is
that the bad guys here aren't working for free. Quite the
contrary, they're clearly expecting payment from the
makers of the software installed, payments usually
calculated on a per-install basis. By reviewing the
network logs, You can see the specific "partner" IDs
associated with the installations. If the installers want
to get paid, they must have provided accurate payment
details (address, bank account number, etc.) to the
makers of the programs listed above. So it should be
straightforward to track down who's behind the exploits --
just follow the money trail.



Andy Manc (UK)

 

[plun]

Great Andy...............

Up and down in winamp but ok in wmp.

--
plun



After serious thinking AndyManchesta wrote :

 

[AndyManc]

Thanks Plun

The test was done last year but ive only recently been
ably to host the video after upgrading my site.It shows
how important the protection products are though.

I think anyone who uses IE should also use Spywareblaster
& SpywareGuard plus use cleaners like Ccleaner whenever
they finish on the net its far safer than cleaning all
that crap off


Regards Andy

 

[Tom Emmelot]

AndyManchesta schreef:

Sorry i sent the last post by mistake

I've written before about unwanted software installed on
users' computers via security holes.

How bad is this problem?

How much junk can get installed on a user's PC by merely
visiting a single site?

I set out to see for myself -- by visiting a single web
page taking advantage of a security hole (in an ordinary
fresh copy of Windows XP), and by recording what programs
that site caused to be installed on my PC. In the course
of my testing, my test PC was brought to a virtual stand-
still -- with at least 16 distinct programs installed. I
was not shown licenses or other installation prompts for
any of these programs, and I certainly didn't consent to
their installation on my PC.

In my testing, at least the following programs were
installed through the security hole exploit:

180solutions, BlazeFind, BookedSpace, CashBack by
BargainBuddy, ClickSpring, CoolWebSearch, DyFuca, Hoost,
IBIS Toolbar, ISTbar, Power Scan, SideFind, TIB Browser,
WebRebates (a TopMoxie distributor), Ebates Moe Money
Maker, EliteToolBar, XXXtoolbar, Your Site Bar, WinAD,
and WindUpdates. (All programs are as detected by Ad-
Aware.)

See a video of the installations

http://andymanchesta.com/Video/security-111804.wmv


Other symptoms of the infection included unwanted
toolbars, new desktop icons (including sexually-explicit
icons), replacement desktop wallpaper extra popup ads,
nonstandard error pages upon host-not-found and page-not-
found error conditions, unrequested additions to my HOSTS
file, a new browser home page, and sites added to my
browser's Trusted Sites zone.


Installation of 180solutions software through security
holes is particularly notable because 180 specifically
denies that such installations occur. 180's "privacy
pledge" claims that 180 software is "permission based"
and is "programs are only downloaded with user consent
and opt-in."

These claims are false as to the installation occuring
in the video linked above, and as to other installations
I have personally observed. Furthermore, 180's separate
claim of "no hiding" is false when 180 software is
installed into nonstandard directories (i.e. into
C:\Windows rather than a designated folder within Program
Files) and when 180 software is installed with a
nonstandard name (i.e. sais.exe) rather than a name
pertaining to 180's corporate name or product names.

What's particularly remarkable about these exploits is
that the bad guys here aren't working for free. Quite the
contrary, they're clearly expecting payment from the
makers of the software installed, payments usually
calculated on a per-install basis. By reviewing the
network logs, You can see the specific "partner" IDs
associated with the installations. If the installers want
to get paid, they must have provided accurate payment
details (address, bank account number, etc.) to the
makers of the programs listed above. So it should be
straightforward to track down who's behind the exploits --
just follow the money trail.



Andy Manc (UK)

Hello Andy,

the way i install XP is, no internet connection, Install XP,
then Sp2, then Trend Micro Internet Security 2005, then make the
internet connection and nothing what happend on your nice video, happens
than!

With regards,

 

[AndyManc]

SP2 takes care of alot of the problems even updating the
security patches would block this hole,Its just to show
how easy it can be to get infected without protection.

I agree Service Pack 2 wouldn't allow this to get as bad
as the video.It was just on a sandbox pc which was
formatted after the test,its a reminder to anyone who
uses the net without SP2 or any protection products how
easy it is to be infected.


Regards

Andy

 

[JohnF.]

Your video plainly demostrates that you in fact infected yourself not
Windows XP all by itself.

1. The first thing you did was click yes when asked if you wished to
continue to run scripts after you get a script error - bad choice. One
script error can lead to many problems not intended. You chose YES.

2. You clicked OK on the next popup instead of closing it out by clicking
the X in the top right corner or even more safely by executing an ALT F4.

3. You then select your country on the next popup and then click OK. Why?
What did you think you were installing? Spyware?

4. You clicked OK on the There appears to be no modem on your computer and
then you clicked on OK in the No Modem popup. SO far you are batting 1,000
for infecting yourself with popups.

Atr this point you demonstrate what your choices have led to and of course
these are enough to drag in all their cousins.

YES, Windows XP uppatched and unsecured is EASY to infect BUT -
You did it to yourself.

I teach every person I can to NEVER click OK or answer questions on popups -
they are simply tricks to infest your machine.

 

[Jacques]

Hi,

I'm curious to know if, after this install, you tried to run MSAS and see
what can be cleanned (or detected) among all these unwanted softs.

Regards,

Jacques

 

[AndyManc]

Hi Jacques

No i didnt try to remove any of the programs ,I did use
Ad-aware to identify what was being installed but didnt
even use that to clean the pc i got the pc to the point
where it just wouldnt respond as it had so much crap
running,

I agree though it would be good to see how much can be
cleaned up by MS Antispy after removal ,Id like to think
MS antispy would detect and remove all the problems as Ad-
aware detected them all easy enough,I just formatted the
pc as it wasnt my main one.

Regards Andy