Alternative browser spyware infects IE

**egghead** · March 12th, 2005, 20:22 PM

Some useful citizen has created an installer that will nail IE with spyware, even if a surfer is using Firefox (or another alternative browser) or has blocked access to the malicious site in IE beforehand. The technique allows a raft of spyware to be served up to Windows users in spite of any security measures that might be in place.

Christopher Boyd, a security researchers at Vitalsecurity.org, said the malware installer was capable of working on a range of browsers with native Java support. "The spyware installer is a Java applet powered by the Sun Java Runtime Environment, which allows them to whack most browsers out there, including Firefox, Mozilla, Netscape and others. In the original test, only Opera and Netcaptor didn't fall for the install but Daniel Veditz, who is the head of Mozilla security, has since confirmed to me that this will also work in Opera and Netcaptor," he explained.
\

http://www.theregister.co.uk/2005/03...ive_slimeware/

lovely

egghead

**rik** · March 13th, 2005, 01:09 AM

Gotta love it...

**cash_site** · March 15th, 2005, 03:14 AM

nice one, must be a clever dude :rollseyes:

**Curio** · March 19th, 2005, 08:59 AM

more detail at http://www.edbott.com/weblog/archives/000562.html

Moderators - is it allowed/reasonable to post a link to where this exploit actually is?

**Conan** · March 19th, 2005, 11:19 AM

Quote:

Originally Posted by Curio

more detail at http://www.edbott.com/weblog/archives/000562.html

Moderators - is it allowed/reasonable to post a link to where this exploit actually is?

Will it infect everyone who visits it?

**Curio** · March 19th, 2005, 13:42 PM

You don' get infected unless you click yes in the dialog but you will see some hard disk activity when the exe file is downloaded to your system when the page loads - this may trigger some AVs but when I did it I was using Xandros so I wasn't worried anyway. I have since found another link which does some different exploits and crashes I.E. but bitdefender caught all that and prevented the exploit from completing - this is on an otherwise unprotected Windows ME system. Perhaps posting them in a seperated format so you have to reconstruct the link would be nice for interested people, if only to add them to your block list.

**Curio** · March 19th, 2005, 16:23 PM

Here is the iframe exploit that will crash Firefox - it doesn't do any harm I just thought it might interest people to actually experience the exploit and see what happens.

http://www.active-bait.co.uk/crashmozilla.htm - warning! if you click it using firefox then your firefox will crash

**FastGame** · March 19th, 2005, 23:43 PM

Quote:

warning! if you click it using firefox then your firefox will crash

Yep it blew my Firefox to pieces

That proves how safe FF is, it will die in order to save its master

March 12th, 2005, 20:22 PM	#1
egghead Precision Processor Super Moderator Join Date: May 2002 Location: In Your Monitor Posts: 3,861	Alternative browser spyware infects IE Some useful citizen has created an installer that will nail IE with spyware, even if a surfer is using Firefox (or another alternative browser) or has blocked access to the malicious site in IE beforehand. The technique allows a raft of spyware to be served up to Windows users in spite of any security measures that might be in place. Christopher Boyd, a security researchers at Vitalsecurity.org, said the malware installer was capable of working on a range of browsers with native Java support. "The spyware installer is a Java applet powered by the Sun Java Runtime Environment, which allows them to whack most browsers out there, including Firefox, Mozilla, Netscape and others. In the original test, only Opera and Netcaptor didn't fall for the install but Daniel Veditz, who is the head of Mozilla security, has since confirmed to me that this will also work in Opera and Netcaptor," he explained. \ http://www.theregister.co.uk/2005/03...ive_slimeware/ lovely egghead __________________ ------------------------------------------------------------

March 13th, 2005, 01:09 AM	#2
rik Old, Cranky and Perverted Super Moderator Join Date: Aug 2003 Location: Watching Your every move... Posts: 5,299	Gotta love it... __________________ Spyware Removal Tips \| Read the Forum Rules

March 15th, 2005, 03:14 AM	#3
cash_site Security Intelligence TZ Veteran Join Date: Jul 2002 Location: Software Paradise Posts: 4,210	nice one, must be a clever dude :rollseyes: __________________ --- 0wN3D by 3gG ---

March 19th, 2005, 08:59 AM	#4
Curio Triple Platinum Member Join Date: Nov 2004 Location: London Posts: 907	more detail at http://www.edbott.com/weblog/archives/000562.html Moderators - is it allowed/reasonable to post a link to where this exploit actually is? __________________ I'm using Windows 7 - you got a problem with that? Last edited by Curio; March 19th, 2005 at 09:05 AM.

March 19th, 2005, 13:42 PM	#6
Curio Triple Platinum Member Join Date: Nov 2004 Location: London Posts: 907	You don' get infected unless you click yes in the dialog but you will see some hard disk activity when the exe file is downloaded to your system when the page loads - this may trigger some AVs but when I did it I was using Xandros so I wasn't worried anyway. I have since found another link which does some different exploits and crashes I.E. but bitdefender caught all that and prevented the exploit from completing - this is on an otherwise unprotected Windows ME system. Perhaps posting them in a seperated format so you have to reconstruct the link would be nice for interested people, if only to add them to your block list. __________________ I'm using Windows 7 - you got a problem with that?

March 19th, 2005, 16:23 PM	#7
Curio Triple Platinum Member Join Date: Nov 2004 Location: London Posts: 907	Here is the iframe exploit that will crash Firefox - it doesn't do any harm I just thought it might interest people to actually experience the exploit and see what happens. http://www.active-bait.co.uk/crashmozilla.htm - warning! if you click it using firefox then your firefox will crash __________________ I'm using Windows 7 - you got a problem with that?

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode