Watch Out for Virus - Facebook Users

canarybird01

14 years ago

Here's an item in this morning's news:

Social Networking Virus

Sort by:Oldest

Comments (32)

jessyf
14 years ago
Thanks Sharon. Yet another reason - actually the MAIN kind of reason - I don't use FB!

Here is a link that might be useful: snopes
caliloo
14 years ago
Thanks Sharon! I just linked the aritcle to my FB page.

Alexa
Related Discussions
OT: Facebook invite
Q
Comments (10)
I have a facebook page but I never fill out a detailed profile when asked for this type of information. A lot of people put their city of residence, the name of their spouse and children, where they work, etc. and that is pointing the way to your house! I work for an advertising/reputation management/acquisition firm and we also do a lot of social media for our clients because this is a great way to connect and get info out there about your business. But those of us who use twitter, facebook, and the rest really should be cautious of what we publish.
...See More
New rootkit virus ??
Q
Comments (7)
Heres what the Symantic website had to say about this trojan Targeting over 400 banks and having the ability to circumvent two-factor authentication are just two of the features that push Trojan.Silentbanker into the limelight. The scale and sophistication of this emerging banking Trojan is worrying, even for someone who sees banking Trojans on a daily basis. This Trojan downloads a configuration file that contains the domain names of over 400 banks. Not only are the usual large American banks targeted but banks in many other countries are also targeted, including France, Spain, Ireland, the UK, Finland, Turkeythe list goes on. The ability of this Trojan to perform man-in-the-middle attacks on valid transactions is what is most worrying. The Trojan can intercept transactions that require two-factor authentication. It can then silently change the user-entered destination bank account details to the attacker's account details instead. Of course the Trojan ensures that the user does not notice this change by presenting the user with the details they expect to see, while all the time sending the bank the attacker's details instead. Since the user doesnÂt notice anything wrong with the transaction, they will enter the second authentication password, in effect handing over their money to the attackers. The Trojan intercepts all of this traffic before it is encrypted, so even if the transaction takes place over SSL the attack is still valid. Unfortunately, we were unable to reproduce exactly such a transaction in the lab. However, through analysis of the Trojan's code it can be seen that this feature is available to the attackers. The Trojan does not use this attack vector for all banks, however. It only uses this route when an easier route is not available. If a transaction can occur at the targeted bank using just a username and password then the Trojan will take that information, if a certificate is also required the Trojan can steal that too, if cookies are required the Trojan will steal those. In fact, even if the attacker is missing a piece of information to conduct a transaction, extra HTML can be added to the page to ask the user for that extra information. (In the example below the user is asked to enter their encryption key, in addition to the regular information.) Here is the login form viewed on a clean machine: (Insert Picture of a Regular Log In Screen) Below the form presented to an infected user is shown, the input box added by the Trojan has been marked in red: (Insert Picture of an Infected Log In Screen) When instructed, the Trojan can also redirect users to an attacker-controlled server instead of the real bank in order to perform a classic man-in-the-middle attack. Currently there is only one bank targeted in this way; however, recent updates to the Trojan change the user's DNS settings to point to an attacker-controlled server. Using this technique the Trojan can start redirecting any site to an attacker site at any time. This feature could also mean that if the Trojan is removed but the DNS settings are left unchanged then the user may still be at risk. (See below for the attackers' DNS server addresses.) Add to all of the above the ability to steal FTP, POP, Web mail, protected storage, and cached passwords and then we start to see the capabilities of this Trojan. But, it doesnÂt stop there Â don't forget the porn! The Trojan also contains over 600 pornographic Web site URLs that can be shown to the infected user so that the attacker can make money from the referrals. Lastly, the Trojan can also download updates, which it regularly does. It can also download other executables and it can use the infected machine as a proxy or as a Web server on any chosen port (in tests the http port used was 18102). The multiple configuration files that the Trojan downloads are updated several times per day and currently the Trojan is capable of injecting HTML into about 200 different URLs. The configuration files are compressed and encrypted; however, after decrypting them we can see how the Trojan works in more detail. The configuration files are structured as .ini files and each section of an .ini file represents a different task. Here is a snippet from the configuration file that was used to inject HTML into the banking form shown in the example above: jhw21] pok=insert qas=someBankSite.com/xpage/loginxxxxxxxxxs.htm njd=name="oppasswd; dfr=14 xzn=/)n xzq=2 rek=(div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/)Â req=166 The configuration options in the snippet above are as follows: Token: Purpose: pok Action to take qas URL to take action on njd String to search for xzn End string to search for rek HTML to insert The Trojan searches for the string name="oppasswd; then it finds the end tag /) then it inserts the string into the page: (div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/) Shown below is the HTML shown to the user on a non-infected computer: (label for="clave")Clave personal: (/label) (input id="clave" name="oppasswd" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (/div) And on an infected computer: (label for="clave")Clave personal: (/label) (input id="clave" name="oppasswd" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (/div) Note: I substituted ) for > in the above examples. The Trojan can take any of the following actions when altering the HTML of a page: insert, delete, replace, and replace all. The Trojan uses the keyword "ESpass" (see the form above) as a keyword when the user sends a page to the bank and the Trojan checks if the page contains that keyword. Using this technique the Trojan can recognize pages it has altered and can extract the relevant data from the page and send it to the attacker as well as to the bank. The configuration files for this Trojan currently contain over 200kb of data; however, new URLs and HTML are being added to the configuration files on a daily basis. The Trojan is easily updated since the full HTML of any banking-related Web site is sent to the attackers. Using these submissions they can target banks for which they do not have bank accounts already. We are currently monitoring all of the updates to this Trojan. The Trojan accesses the following URLs for configuration, updates, and to send stolen data: Â iloveie.info Â webcounterstat.info Â microcbs.com Â reservaza.com Â screensaversfor-fun.com Â mystabcounter.info Â 85.255.119.218 The Trojan also downloads a copy of Trojan.Flush.J, which changes the users DNS settings to the following attacker settings: Â 85.255.116.133 Â 85.255.112.87 For protection, please keep your antivirus definitions up to date and block the above addresses at the firewall. Note: Not only did this Trojan grab my attention for obvious reasons, but the Trojan also installed itself as a .midi driver, causing my music to stop! For the record, the Trojan adds itself the following registry key so that it is loaded in all applications that use sound: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\"midi1 But it also said this: Discovered: December 17, 2007 Updated: January 8, 2008 12:54:17 PM Also Known As: Spy-Agent.cm [McAfee] Type: Trojan Infection Length: 54,189 bytes and 98,304 bytes Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP Trojan.Silentbanker is a Trojan horse that records keystrokes, captures screen images, and steals confidential financial information to send to the remote attacker. Protection Initial Rapid Release version December 17, 2007 revision 023 Latest Rapid Release version January 10, 2008 revision 023 Initial Daily Certified version December 17, 2007 revision 032 Latest Daily Certified version January 15, 2008 revision 016 Initial Weekly Certified release date December 19, 2007 Click here for a more detailed description of Rapid Release and Daily Certified virus definitions. Threat Assessment Wild Wild Level: Low Number of Infections: 0 - 49 Number of Sites: 0 - 2 Geographical Distribution: Low Threat Containment: Moderate Removal: Easy Damage Damage Level: Medium Payload: Records keystrokes and captures screen images Releases Confidential Info: Steals confidential financial information Distribution Distribution Level: Low
...See More
facebook warning!!!!
Q
Comments (9)
Why always check Snopes you ask? Because Snopes will (usually) tell you whether the rumor (alert, warning, whatever) is true or false or somewhere in-between. Checking Snopes first tells you whether it is, in fact, something to be worried about or not. Why keep proliferating and getting people on alert if there's nothing to it? (Sort of like yelling "fire" in a crowded theater). Check out the thread started a few days ago about "Why Don't People Check Snopes". Suzieque
...See More
Who do you trust for Corona Virus information?
Q
Comments (42)
Here’s a link to one of the shorter interviews with Mike Osterholm. https://youtu.be/V1xBiBVH7U4 I also trust a family friend who is an MD and specialize in infectious diseases. I read different news sources with different political leaning including some from francophone countries. That's not about "trust" but rather awareness of what people are being told. My basic orientation is toward math and science, but I'm cautious. Some goverments censor data. In places with limited medical resources and/or populations that are already challenged, cause of death may not be identified accurately or at all. Case maps are probably not entirely accurate, but they're good enough for trend analysis.
...See More
compumom
14 years ago
I think FB is fine as long as you don't do the large group greetings or some large sharing app. Thanks Sharon, it validates my wariness!
loagiehoagie
14 years ago
I got zapped a week ago. Destroyed my hardrive. $500.00 later (a new computer and virus protection) and I'm back.

Duane
jessyf
14 years ago
Just curious how you got hit, Duane. I just now got yet another invite, grrrr.
lindac
14 years ago
Practise safe text...
Have a reliable virus control with automatic updates and keep it updated.
And don't consort with wierdoes and strangers and don't click on strange links and don't join large groups.
Jessy, lots of your friends are on Face Book....really! we won't give you bad diseases!
jessyf
14 years ago
(Linda, there are all sorts of reasons I'm staying away, kicking and screaming, which I won't go into)
loagiehoagie
14 years ago
Linda, don't be so smug. Seriously. And Jessy, I had a friend of my DW send me a link...it seemed innocent...and I clicked on it, but did not download the attachment.....I figured I was safe. 2 weeks later somebody hacked into my account and sent a message to everybody in my friends list to 'click on this link'. Two of my friends (that I know of and have contacted me) had the virus. One spent 6 hours getting rid of it and the other spent 5 hours and 89.99 getting rid of the virus. So it isn't just groups Linda...don't be self smug about avoiding it because you don't click on 'groups'....it can hit you if you click on any innocent link...supposedly sent by a friend.

Duane
loagiehoagie
14 years ago
Oh, and by the way LindaC, if I didn't consort with weirdo's and strangers I would have no interaction with you! So there you have it!

D-
lindac
14 years ago
Duane....don't click on links
As for wieirdos....takes one to know one....don't cha know!
Nice to know I am among friends....some of my best friends are...
Well you all know who you are! LOL!!
I am suspicious of people who aren't at least a little bit wierd!
arabellamiller
14 years ago
Thank you for posting this... my kids and I have FB accounts and although I'm constantly warning them, this is exactly the type of email they would open! I'm printing it out and taping it to their monitor as a reminder.

AM
wizardnm
14 years ago
Duane, I received an email with some links from you, I think there were about 5 attachments. When I clicked on the first one my virus program would not let me open it and sent out all kinds of warnings. I quickly deleted, dumped and ran a new scan. I have had no problems since. That was a week or two before Christmas.

I use advast! online scanner...guess it's working!!!

Nancy
loagiehoagie
14 years ago
Nancy, glad to know you had up to date virus protection. I learned the hard way I did not. Linda, I agree with you. People who look and act 'too normal' are usually the ones who are the true weirdo's! Us quirky people are the real normal ones! ...and I like you too :-)

Duane
foodonastump
14 years ago
A friend of mine who is a gazillion times more tech savvy than I (an MSCE) recommends that you set up your computer with an administrator and users. Then in everyday use you log on as a user, and no one can push programs or executables to you because you don't have the rights to accept them. I think he said it only works on Vista, but I could be wrong, and I could be misrepresenting his advice. I'll ask him next time I talk to him.
foodonastump
14 years ago
p.s. Duane - Not accusing you of anything or admitting to anything, but I think it would be amusing to see the results of a study on which gender gets the most viruses. Waddayathink?
jessyf
14 years ago
Today its 'don't click on links' and 'be careful who you friend' (my son just had a friend of a friend experience and it wasn't pleasant). We don't know what tomorrow will bring. I'm not saying that we should all avoid Facebook and other social networking sites - FB is here to stay and it IS the wave of the future. Look at me, posting my picture all over the CF, and already identified by two local lurkers (one of whom I like!). I'm just saying I don't trust FB management - the site is too porous and vulnerable as is, even without the help of 'friends' - who can and do post compromising pictures of their own friends. Those turn up when college admissions officials and employers go hunting!
loagiehoagie
14 years ago
FOAS, I'm not really sure what you are getting at there. The virus that I believe came from my DW friend was a female, but the other friend who had the same thing happen was my buddy Bob, obviously male....so I don't think gender has anything to do with this miscreants who spend their time just to ruin people's computers and/or gain access to steal passwords and bank acct. info. Plus, it looks bad when somebody uses my name and info to send this out to all of my 'friends' on FB. I changed my password on another computer and now log-in and log-out. I used to stay logged in and that may have been part of the problem. I don't know...but all I do know for sure is that I am $500 bucks poorer than I was before Dec.26.

Duane
denise8101214
14 years ago
uh oh

I wonder which I am....
jessyf
14 years ago
(heh heh Denise I knew you would read that! OF COURSE you are a GOOD stalker/lurker! Even to the point of chasing me down in the market last week....)
beanthere_dunthat
14 years ago
"He seemed like such a nice young man. Helped me get my cat out of a tree once...."

sorry, couldn't resist.

I don't do Facebook. Unfortunately, I think DH does, and he said something is screwy with his computer.
loagiehoagie
14 years ago
Beanthere, if your DH thinks something is up he should not wait to investigate. That trojan worm is nasty. It steals passwords and bank account info. That is why I felt safer to get a new computer with updated virus protection. And stick to 99 percent business funcionality with it. Of course I come here and a few garden forums but am almost never going back to facebook. If I check in I make sure to log right out. The novelty has pretty much worn thin anyway. I don't want to play mafia wars of farm games etc. and that is what most of that is turning into.

Duane
annie1992
14 years ago
Well, it sure makes me glad that I have no interest at all in Facebook, although Ashley and Elery have both pushed and pushed that I would "love it".

Elery says I can track down old friends from school and I told him that if they were friends, I already knew where they were!

Ashley says I'm hopeless, but I read this post to her and she said it happened to one of her girlfriends on Facebook too....

Annie
dedtired
14 years ago
I have to say that I enjoy FB and I have found some old friends from college. It has been wonderful to reconnect with them and I don't know how else we would ever have found each other.

I have my settings so that Only Friends can see my info. When you have it set for Friends of Friends, you are really opening the door for a lot of people.

I don't do Farmville mostly because I don't want to get hooked! I don't like the functions that require access to your info, so I don't use those for the most part.

Just remember that current and potential employers have access to FB, so if you belong to a group called "I like to Sleep Late and Play Games at Work", that's not a good idea. I'm sure the same thing goes for schools.

I guess I'm willing to take the risks, but I try to use caution.
compumom
14 years ago
Ditto Pam!
canarybird01
Original Author
14 years ago
I use it to keep in touch with my extended family, brother, sister, kids, grandkids, cousins, cousins' kids etc and see their photos and accounts of family events or holidays which I might not otherwise see.

Apart from that I keep to just a few friends with whom I share comments and photos. I have never been interested in games or virtual gifts, and I do keep high level anti-virus and firewall protections up to date. So I enjoy my visits there.

SharonCb
triciae
14 years ago
This article has been on my comcast homepage for several days so I imagine most everybody's already aware of this newly discovered glitch. I decided to post it just in case there's a few that aren't aware. Seems a new way to have one's info compromised pops up quite frequently.

We've never used Facebook because of security concerns but this article sounds like other sites are potentially also not nearly as safe as some would like you to believe. The random nature of this glitch is really disconcerting.

We do use Skype & have been wondering lately how secure that process is?

/tricia

Here is a link that might be useful: Facebook Glitch
beanthere_dunthat
14 years ago
Duane - He did have a Trojan, and it was indeed a nasty one which was very hard to eradicate. He spent all weekend hunting it down and uprooting it. Fortunately, he's good with computers. Doubley fortunate that this was on a netbook that he uses only for email, internet and the occasional letter -- so no sensitive information on that one at all. Ironically, he usually has no use for FB and that ilk, but had ventured to one particular page that was set up to help some folks in his biz out of a bad situation (by providing hot meals, rides, a place to stay, etc.).

Annie, that is EXACTLY what I have told people who try to push me to FB! If I didn't keep up with someone from twenty years ago, there's probably a really good reason for it!
dedtired
14 years ago
I really don't think there's much in my FB account that would be useful to a stranger, although I am upset to think that a non-Friend could get in. I do not list my phone number, address, etc. I do list my email address but I can;t imagine getting much more spam than I do already.

I think of anything I put on the web as public info, whether it's FB, Gardenweb, Linked In, whatever. If I don't want the world to know, I don't post it.

That said, I am sure I have not been 100% cautious. I posted a lot of info on a web site that was created for my high school reunion and was dismayed to find that it could be found through Googling. Since I had the passsword to the site, I went in a deleted it.

Come to think of it, I could have gone in there and posted all kinds of untrue stuff in others accounts! I didn't.
beanthere_dunthat
14 years ago
The thing is, even if you delete information from a profile or post, once it is on public view, it can (and usually is) copied by datamining bots onto other servers that are in no way related to the original site. So, once public, always findable. (I don't think that's a real word, but it works.)

These bots aren't picky, they'll take any and all info. Might not be worth mich by iteself, but you harvest enough material, and you can build a pretty substantial profile on users, which is then sold to anyone who'll pay for it. I figure these dataming companies are already making plenty selling info they have compiled off public recrods; I don't need to help them get richer by providing them with any freebies.

Can you tell I really despise datamining? They are the telemarketers of the 21st century, only more intrusive and annoying. I had a special cold hard spot in my heart for the likes of Intelius and PeopleFinders. Grrrr.
loagiehoagie
14 years ago
Huge business this data-mining. The funny thing is I read about it in a novel, I think either Dean Koontz or David Baldacci, most likely the latter but I can't be for sure. These people, if they wish, can destroy not only your credit, but your life itself....implenting you into many illegal enterprises.....kiddo porn, etc. that you have had nothing to do with, but when they can access your computer info they can inject whatever they want to implicate you. Very scary stuff and enough to make you want to escape to a cabin in the middle of nowhere. Of course at that point they may make you into the new 'unibomber' and screw up that persona. Okay, most of this is total paranoia.....the likelihood it could happen to you, as a normal citizen is slight....but it could happen. This is a crazy age we live in. I really think the old days were better and I suppose every generation says that....but the days of yore were simpler and I really sometimes wish we never had computers, cell phones, etc. We need more people-to-people contact. Enough said.

Duane
susie_que
14 years ago
Wow...I will be careful!!

I just got into FB when Dan died...weird but it was a way to connect with people he knew.

AnyHoo....I got an account now and use it alot more that I thought I would.

Amy has deleted her account. I guess she doesn't want any potential employers seeing her "stuff" LOL!!
I think she should keep one open and just have a nice professional picture on her profile and a list of intrests and accomplishments.

That said I am on there if ya want to look me up but please don't send me any quizzes or hearts or smiles LOL!!

Cheers!
Susie
jessyf
14 years ago
Susie, from what I understand, accounts are not ever truly deleted unless one goes in and totally cleans it out. The information still sits there on their servers. At least thats what I read.

Watch Out for Virus - Facebook Users

Comments (32)

jessyf

caliloo

Related Discussions

compumom

loagiehoagie

jessyf

lindac

jessyf

loagiehoagie

loagiehoagie

lindac

arabellamiller

wizardnm

loagiehoagie

foodonastump

foodonastump

jessyf

loagiehoagie

denise8101214

jessyf

beanthere_dunthat

loagiehoagie

annie1992

dedtired

compumom

canarybird01
Original Author

triciae

beanthere_dunthat

dedtired

beanthere_dunthat

loagiehoagie

susie_que

jessyf

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

Watch Out for Virus - Facebook Users

Comments (32)

Related Discussions

canarybird01Original Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

canarybird01
Original Author