ROGUE SECURITY - BACK TO THE FUTURE

Fake ActiveX warnings are still used, Trojans are still spreading the trial versions, and browser exploits are still used to deploy e-threats. We'll take a closer look at some of these cases and add some new ones to the list as we go.

 

 

In order to fully understand the way rogue software gets on users' computers, let's look at the way Trojans are spreading. We will take one that's still “in the wild” (meaning actively infecting computers at the time of writing.

Trojan.Zlob is the name of the culprit. It's an e-threat that's downloading software onto the infected computer without the users' knowledge. “Ok, that's all pretty nasty” you say, “but how do I get infected with this Trojan in the first place?” Right, well the easiest way to get yourself a Trojan.downloader is by visiting a website (most of the time adult rated ones) which will infect you in two ways: 

1. by usage of a browser specific exploit that grants the attacker the privilege to download and run applications without the user noticing a thing

2. by social engineering:

a) pretending to be incapacitated of playing back video clips because of the users lack of necessary software and offering an “ActiveX Object” (or some sort of “codec”) as the solution (Img 3.0 – notice the YouTube like environment used to fool users and make them more comfortable with the page). If you trust the fake website and download the “ActiveX Object”, whose true nature is the Trojan in fact, you're there already.

 

Img3.0: Zlob fake ActiveX warning

b) pretending to remotely scan your computer of infections through a web environment. Do not believe those fake websites. They are all scams meant to trick users into downloading “cleaning software”. Although they might look like legitimate applications, they're not. Web scanner development is a laborious undertaking. Very few legitimate security software producers have built such applications. No website is able to scan your computer without asking you to install specific modules beforehand (ActiveX or Java). Scanners that simply start “scanning” and “detecting” e-threats on your computer upon page load are clearly fake ones. You can see an example of such a web page in Img 3.1. After “scanning” is completed a window pops up telling you about the infections on your computer and how you should download their software in order to get rid of them (see Img 3.2).

 

Img3.1: "Antivirus 2008" doing it's "rightful" job

 

Img3.2: Results window after "scanning" has finished

 

Article rating:

• 0/5
• 1
• 2
• 3
• 4
• 5

You must login or sign up before you can rate this article.