SRL Archive - News and General

Caution, JAVA Drive-By Warning


PatDuffy

2012-01-15 13:44:15

I saw on sythe today this thread

http://www.sythe.org/announcement.php?f=221

I recall seeing that exact same thread here….and see'ing that fishy game…I even opened it but denied the Java plug-in request, fortunately saving myself there.

If you played that game, reformat everything for you are at risk.

For those that can't view the link….



Andddd the link to the offending thread, as found by Jakey

http://villavu.com/forum/showthread.php?t=72382&highlight=dexter

PLEASE DO NOT PLAY THAT GAME

jakeyboy29

2012-01-15 13:50:58

Cant get on the link, maybe copy and paste here :) <3

PatDuffy

2012-01-15 13:56:15

Updated OP

RISK

2012-01-15 14:01:18

Wasn't there a thread here like the one posted there? With the malicious link. Though I can't find it anymore.

PatDuffy

2012-01-15 14:03:20

From: RISK
Wasn't there a thread here like the one posted there? With the malicious link. Though I can't find it anymore.


Exactly why I posted this. I tried to find the thread aswell just now….can't seem to find it.

RISK

2012-01-15 14:04:39

Well, anyhow, if anyone has viewed that link, it might explain the recent thread about the guy's account being robbed.

I wonder where the thread went…

jakeyboy29

2012-01-15 14:06:33

I'm actually really annoyed if we got fucked over like that, ill have a search now


EDIT:

http://villavu.com/forum/showthread.php?t=72382&highlight=dexter

the fucker

PatDuffy

2012-01-15 14:07:38

From: RISK
Well, anyhow, if anyone has viewed that link, it might explain the recent thread about the guy's account being robbed.

I wonder where the thread went…


It would explain why several accounts all got robbed with the same evidence…..

I almost fell for it myself, except I refused to allow the "game" to use Java with an unregistered security token.

E: Updated OP again with the thread

josh81193

2012-01-15 14:09:53

What is a "Java drive-by"?

Nava2

2012-01-15 14:11:59

That thread on here has been unapproved, it will be pushed up.

jakeyboy29

2012-01-15 14:12:15

From: josh81193
What is a "Java drive-by"?


Drive-by download means three things, each concerning the unintended download of computer software from the Internet:

1. Downloads which a person authorized but without understanding the consequences (e.g. downloads which install an unknown or counterfeit executable program, ActiveX component, or Java applet).

2.Any download that happens without a person's knowledge.

3.Download of spyware, a computer virus or any kind of malware that happens without a person's knowledge.[1]

josh81193

2012-01-15 14:13:57

From: jakeyboy29
Drive-by download means three things, each concerning the unintended download of computer software from the Internet:

1. Downloads which a person authorized but without understanding the consequences (e.g. downloads which install an unknown or counterfeit executable program, ActiveX component, or Java applet).

2.Any download that happens without a person's knowledge.

3.Download of spyware, a computer virus or any kind of malware that happens without a person's knowledge.[1]


oh ok, i get it

Nava2

2012-01-15 14:16:29

If ANYONE played this, please PM a staff member and we will ban your account until you can sort this out. This is for your security.

[XoL]

2012-01-15 15:14:33

Oh crap, I played the game on that guy's thread; my Norton was able to Block the virus though.

>.<, let me go check my accounts…

E: They are all still not hacked; For safety's sake I will just change passwords.
EE: These are the pictures are what my Security managed to pickup.


Mind you the "medium" alerts don't mean anything, (I get them all the time, it is simply because of a separate firewall I have running)

Harry

2012-01-15 15:19:13

https://addons.mozilla.org/en-US/firefox/addon/noscript/

But you had to approve to run the applet, didn't you? An unsigned Java shouldn't have access to your HD.

stuffs

2012-01-15 17:13:42

Clicked the link, but didn't allow the applet to run. I'm safe, right?

jakeyboy29

2012-01-15 17:17:13

From: stuffs
Clicked the link, but didn't allow the applet to run. I'm safe, right?


should be, run a checker

stuffs

2012-01-15 20:26:38

From: jakeyboy29
should be, run a checker

Ran two scans each with Norton and Malwarebytes, still a little paranoid though.

Bleh.

PatDuffy

2012-01-15 20:29:26

From: stuffs
Ran two scans each with Norton and Malwarebytes, still a little paranoid though.

Bleh.


Your fine. I also opened it first time I saw it, but denied the Java applet to run. As a precaution I still ran a full-scan of McAfee and Malwarebytes and I'm good.

Kyle Undefined

2012-01-15 21:01:44

Sigh…why do people have to do this?

uz3

2012-01-15 22:30:13

From: Kyle Undefined
Sigh…why do people have to do this?


Because they just don't care about what you feel. A lot of times they infect people just to fuck with them.

Also, Norton sucks ass.

nickrules

2012-01-15 23:14:51

I feel that reformatting is rather extreme. There's no need to wipe everything just to avoid a driveby; furthermore, you ought to have a proper anti-virus program. Seeing as the probability of a zero-day exploit is unlikely, to say the least, most AV software should be able to pick up and remove it with ease - if yours didn't, it's time to switch.

First, try to remove it with your current AV.
Then, if available as an option, call your AV company. They should have a licensed professional capable of taking remote control of your PC and removing it manually, for you.

Now, if you and/or customer support are unable to remove it, try going back to a restore point. If all else fails, reformat.

Claymore

2012-01-15 23:18:57

I still dont get what the this Fishy Game is about? I mean yes its a virus, but why are people opening it? Whats so great about it that you guys are tempted to open it?

Harry

2012-01-16 00:19:29

From: nickrules
I feel that reformatting is rather extreme. There's no need to wipe everything just to avoid a driveby

From: http://technet.microsoft.com/en-us/library/cc512587.aspx
You can't clean a compromised system by patching it.

You can't clean a compromised system by removing the back doors.

You can't clean a compromised system by using some "vulnerability remover."

You can't clean a compromised system by using a virus scanner.

You can't clean a compromised system by reinstalling the operating system over the existing installation.

You can't trust any data copied from a compromised system.

You can't trust the event logs on a compromised system.

You may not be able to trust your latest backup.

The only way to clean a compromised system is to flatten and rebuild.

Jesper M. Johansson, Ph.D., CISSP, MCSE, MCP+I

Security Program Manager
Microsoft Corporation

The only way to be sure is a complete wipe. Is an hours worth of time to reformat and reinstall your commonly used programs (unless you have an insane setup, it shouldn't take more than an hour or two to get your system working almost exactly the same way it was pre-reformat), or worth the headache and time you lose dealing when your bank account/RS account/etc gets hacked?

Hero

2012-01-16 00:37:01

I am so happy that I don't have AV or any protection. :) I love a good virus now and then. Keeps me sane.

PhaseCode

2012-01-16 02:46:39

I was reading that earlier today. It was a very nice catch by the fellow members at Sythe. I almost ended up playing a couple of those games but was to tired and said nawww.

n3ss3s

2012-01-16 03:55:14

From: R4nd0m
Oh crap, I played the game on that guy's thread; my Norton was able to Block the virus though.

>.<, let me go check my accounts…

E: They are all still not hacked; For safety's sake I will just change passwords.
EE: These are the pictures are what my Security managed to pickup.


Mind you the "medium" alerts don't mean anything, (I get them all the time, it is simply because of a separate firewall I have running)


Loled irl at typo (regietry) in norton sonar, shits like $100

stuffs

2012-01-16 10:41:16

Scanned with Malwarebytes, Norton, and did a system restore. Rescanned with Norton after the restore, and rescanning with Malwarebytes now. So far so good. I'm sure I'm clean, but I guess there's only one way to find out.

Shame I have too many important documents scattered around my computer to reformat.

nickrules

2012-01-16 13:12:31

From: Harry
The only way to be sure is a complete wipe. Is an hours worth of time to reformat and reinstall your commonly used programs (unless you have an insane setup, it shouldn't take more than an hour or two to get your system working almost exactly the same way it was pre-reformat), or worth the headache and time you lose dealing when your bank account/RS account/etc gets hacked?


Of course not - I'd be silly to say otherwise. But how do you suppose he found out it was a virus? Did he just stumble across it because he disassembles every java applet that he encounters? Probably not. Was he alerted by someone? If so, who and how did THEY know? Did they do that?

Or is it the more likely route, that he/someone else had their AV go off.

I imagine more than a few of the people on our forums are using shared or old computers. I don't know about you, but I keep a good deal of things which are important to me on my computer. For example, my laptop. At 4 years, it's somewhat old and quite slow, but there's too much "stuff" on it. You can't just download all those pictures from a vacation, or that night out with your friends (Of course, ignoring the fact that you should have a backup of important data - unfortunately, many neglect to do this). Reformatting before exhausting other options is downright silly and paranoid. It's a more likely than not a simple exploit, likely put there by some skiddie.

Change your password(s) on another computer (if you're really paranoid, do it on a different network than your own, too) and then exhaust other routes before you reformat. There's simply too much data lost for many people to make reformatting their go-to option right off the bat, just like you don't go to war with a country over something without first trying the diplomatic approach (or, usually atleast ;)).

And of course, make sure it's gone for good, and walk away from the experience with a lesson learned - regardless of how you go about solving the problem.

———
E: Look at that, the post right before mine

From: stuffs
Shame I have too many important documents scattered around my computer to reformat.


A prime example of someone with too much stuff to just reformat. Suggesting a reformat off the bat is like being on the playground, and all the swings are being used, so you set the whole swingset on fire - sure, you removed the person(s) from your swing, but at what cost? You just "ruined" the whole swingset.
Admittedly a rather extreme example, but still gets the point of what I'm saying across.

Harry

2012-01-16 13:45:00

From: nickrules
A prime example of someone with too much stuff to just reformat.

Suggesting a reformat off the bat is like being on the playground, and all the swings are being used, so you set the whole swingset on fire - sure, you removed the person(s) from your swing, but at what cost? You just "ruined" the whole swingset.
Admittedly a rather extreme example, but still gets the point of what I'm saying across.

Sounds like a personal problem that they don't have them backed up somewhere. Dropbox is quite simple and could hold most common people's amount of data. Not backing up is a silly excuse, I seriously hope most people back up important stuff…

More like, your swingset is already on fire, and you dump some water onto it to put out the fire. But the swingset is unsafe due to the damage before you put water onto it. You then try to ride on it, and crack your head open because the wood wasn't stable/safe enough to ride again on. :p

RISK

2012-01-16 13:49:30

I actually have all of 'My' movies, games, PS2 games, e-books, mmorpg installs, application installs and CD-key lists all backed up on my 2TB external hard-drive. :p I couldn't imagine not backing things up, really.

footballjds

2012-01-16 14:03:06

From: nickrules
First, try to remove it with your current AV.
Then, if available as an option, call your AV company. They should have a licensed professional capable of taking remote control of your PC and removing it manually, for you.

Now, if you and/or customer support are unable to remove it, try going back to a restore point. If all else fails, reformat.


First, turn off your computer.
Second, insert a thumb drive.
Thirdly, reformat and re-install windows. (if quick format is selected installing from a usb drive will take 15 minutes tops)
Fourth, enjoy your cleaned system, tops 30 minutes.

or you could do all that spyware crap that MAY fully remove it…

nickrules

2012-01-16 15:11:51

From: footballjds
First, turn off your computer.
Second, insert a thumb drive.
Thirdly, reformat and re-install windows. (if quick format is selected installing from a usb drive will take 15 minutes tops)
Fourth, enjoy your cleaned system, tops 30 minutes.

or you could do all that spyware crap that MAY fully remove it…


And what of all your old data? I'm not arguing over if a reformat is a "fast" solution, I'm arguing practicality and data loss.

Unless you're saying to install over the old OS, in which case, that's not really reformatting….


You can't clean a compromised system by reinstalling the operating system over the existing installation.


—-
Sounds like a personal problem that they don't have them backed up somewhere. Dropbox is quite simple and could hold most common people's amount of data. Not backing up is a silly excuse


But do you think that most of our (and scythes) users do so? You have to remember that most are pretty darn tech illiterate. And to simply say "Meh, we didn't really try any other method, but we'll just say bye bye to everything anyways" is downright silly.

More like, your swingset is already on fire, and you dump some water onto it to put out the fire. But the swingset is unsafe due to the damage before you put water onto it. You then try to ride on it, and crack your head open because the wood wasn't stable/safe enough to ride again on.


Doesn't change the fact that he knew about it somehow, which likely means an AV picked it up. And thus, to extend the metaphor an AV is the swingsets automatic fire retardation system (it's a nice swingset :p)

It'd be pretty nifty chemical fire (virus) not to set off the protection ;)

footballjds

2012-01-16 15:14:50

From: nickrules
And what of all your old data? I'm not arguing over if a reformat is a "fast" solution, I'm arguing practicality and data loss.

Unless you're saying to install over the old OS, in which case, that's not really reformatting….


I mean reformatting, as far as data loss, if you don't back up everything on your computer you shouldn't care if you get viruses. Because you probably don't know you have a virus…

Harry

2012-01-16 15:17:07

From: nickrules
Doesn't change the fact that he knew about it somehow, which likely means an AV picked it up. And thus, to extend the metaphor an AV is the swingsets automatic fire retardation system (it's a nice swingset :p)

It'd be pretty nifty chemical fire (virus) not to set off the protection ;)

Most viruses replicate, grab new data and such when you think it's all self-contained. Installing elsewhere, grabbing other undetected samples, etc. Even if you put the fire out on the swingset, it's already lit the dry grass on fire and it's spreading elsewhere. You could get lucky and manage to extinguish all the lit dry grass, or it will go and burn your entire house down.

nickrules

2012-01-16 15:31:03

From: footballjds
I mean reformatting, as far as data loss, if you don't back up everything on your computer you shouldn't care if you get viruses. Because you probably don't know you have a virus…


Someone's awfully presumptuous. Do you think 94% of PC users really don't care if they get a virus?

Oh, and http://money.cnn.com/2006/06/07/technology/data_loss/index.htm for additional statistics - to avoid bias, of course. A different number, but there isn't much detail on what was polled about.

@harry Most AVs nowadays scan files before they're allowed to execute.

footballjds

2012-01-16 15:36:20

From: nickrules
Someone's awfully presumptuous. Do you think 94% of PC users really don't care if they get a virus?

Oh, and http://money.cnn.com/2006/06/07/technology/data_loss/index.htm for additional statistics - to avoid bias, of course. A different number, but there isn't much detail on what was polled about.

@harry Most AVs nowadays scan files before they're allowed to execute.


I was saying in an over exaggeration that if you don't care enough about your data to back it up, why would you care if you have a virus? You most likely wouldn't even know unless it raped your CPU…

Harry

2012-01-16 15:37:33

From: nickrules
@harry Most AVs nowadays scan files before they're allowed to execute.

And if it doesn't detect the first one? And if the Java goes and loads multiple viruses at once, one of which is undetected?

Gimpy666

2012-01-16 15:39:00

Google Chrome would have warned you about running an outdated version of Java and possibly detected the exploit.

nickrules

2012-01-16 16:19:37

From: footballjds
I was saying in an over exaggeration that if you don't care enough about your data to back it up, why would you care if you have a virus? You most likely wouldn't even know unless it raped your CPU…


I back up my data infrequently, at best. There are SOME things which I have backed up elsewhere, but very little, and I still have a decent amount of stuff that I don't want to lose. Does that mean I want a virus? Nope.

@harry, are you proposing a zero-day exploit (or similar) being used to target *runescape* accounts? And that this scythe admin decided to personally check random java/flash games for viruses, using methods other than an AV? More likely than not, it's a skiddy. And if it's a skiddy, it's likely a known exploit.

footballjds

2012-01-16 17:05:46

From: nickrules
I back up my data infrequently, at best. There are SOME things which I have backed up elsewhere, but very little, and I still have a decent amount of stuff that I don't want to lose. Does that mean I want a virus? Nope.


I'm guess you missed every single word I said, I'll say it again.
I was making an EXAGGERATION. Now, that being said, lets look at what you're saying. You're saying that because you don't backup you're data doesn't inherently mean that you want a virus. Okay, I would agree.
Now, lets take a look at what I said. I said if you don't back up your data you most likely don't care very much about or you don't know you have a virus.

Basically, if you are one of the many that doesn't back up, you're stupid. OKAY?
That's ^^^ plain English, you should be able to understand that….

Kyle Undefined

2012-01-16 17:09:12

I don't back up anything, but I don't store anything on the actual HDD. It all goes into my personal cloud after it's been scanned and made sure to be clean.

footballjds

2012-01-16 17:11:00

From: Kyle Undefined
I don't back up anything, but I don't store anything on the actual HDD. It all goes into my personal cloud after it's been scanned and made sure to be clean.


how many different physical HDD's do you have of the files in the cloud? If it's a service you pay for then I'm positive they're backed up, unless it's just a server you have sitting somewhere… Then again, that is technically still better, at least it's(hopefully) in a sever room with climate control and no motion. That better IMO then only have files on the local HDD of your laptop that could get dropped 12 inches and corrupt your entire file system. Unless it's an SSD. Although tho's have limited read/writes(should last 5+ yrs tho, :P). Please don't tell me the park break on your HDD works if you use windows because it doesn't. It just doesn't.

Kyle Undefined

2012-01-16 17:14:14

I have 3 1TB HDD's, one if for all Media, one is for documents, and the other one I use for sharing files with family/friends.

footballjds

2012-01-16 17:15:22

From: Kyle Undefined
I have 3 1TB HDD's, one if for all Media, one is for documents, and the other one I use for sharing files with family/friends.


if you only have 1 physical HDD copy of each file i would HIGHLY suggest you start backing up.

Kyle Undefined

2012-01-16 17:18:49

You don't NEED to backup, the point of backing up is in case you do something stupid and fuck everything up. I upgrade HDD's every few years. If you're a stupid PC user, then yeah, you should backup.

I've never backed up anything, ever since I can remember. Why? Because I'm not a fucking moron on the internet.

footballjds

2012-01-16 17:23:23

From: Kyle Undefined
You don't NEED to backup, the point of backing up is in case you do something stupid and fuck everything up. I upgrade HDD's every few years. If you're a stupid PC user, then yeah, you should backup.

I've never backed up anything, ever since I can remember. Why? Because I'm not a fucking moron on the internet.


I agree'd with you. I've never EVER had my data lost due to a virus either.
HOWEVER, HDD's can simply fuck up, or if you if you drop your laptop. Which, you could argue you're an extremely nimble person and not "a fucking moron on the internet".
Your house could burn down.

EDIT: I got a warning recently for swearing… I thought you were allowed to, plus you just swore. WTF is this nonsense?
Don't tell me i swore at someone either. I said "Fuck yes!" out of excitement because of a link someone posted.
wtf? wtf? wtf?


EDIT2: IDC because it was a warning, i wouldn't have cared if it was a fraction either though. my list of fractions and warnings is so long. cool thing tho is they EXPIRE! :D
It's easier to get banned on runescape then here! :D

Kyle Undefined

2012-01-16 17:28:58

The HDD's are external, and as far as the house burning down, normally that would be a problem. They're high grade insulated HDD's :D But yes, an extreme house fire could damage them, but wouldn't destroy most of the data on there.

footballjds

2012-01-16 17:45:53

From: Kyle Undefined
The HDD's are external, and as far as the house burning down, normally that would be a problem. They're high grade insulated HDD's :D But yes, an extreme house fire could damage them, but wouldn't destroy most of the data on there.


I'm not gonna make you back up(:
But, I would like it if you did! (:

nickrules

2012-01-16 18:34:24

From: footballjds
I'm guess you missed every single word I said, I'll say it again.
I was making an EXAGGERATION. Now, that being said, lets look at what you're saying. You're saying that because you don't backup you're data doesn't inherently mean that you want a virus. Okay, I would agree.
Now, lets take a look at what I said. I said if you don't back up your data you most likely don't care very much about or you don't know you have a virus.

Basically, if you are one of the many that doesn't back up, you're stupid. OKAY?
That's ^^^ plain English, you should be able to understand that….


Now now, there's no need to get your panties in a bunch about this, or a warning.

Now, to move on to your actual point, I do care about my data, and I wouldn't want to lose it - that having been considered, I also do not wish to use my time/resources backing it up, as I have you to stumble across a service which does what I wish. Does this mean my data is not valuable to me? Certainly not - I shop online from time to time, I play games and enter passwords to services I'd rather not have compromised.

Backing up my data:
WILL NOT prevent me from getting a virus.
WILL NOT alert me if I have a virus
WILL NOT help if in some situation I got a virus and didn't know (and then had my now corrupted computer backed up)
WILL allow me to reformat and go back to the point before any virus/complications
WILL result in some loss of information, though considerably less, depending on how paranoid I am of data loss.

Oh, and it certainly does not lower ones intelligence. Calling me stupid because I don't back up data is neither appreciated nor warranted. Grow up.

I should also add that I'm running this nifty little program called comonsense 2012 edition. You should check it out (: it's like the best AV out there - only 5 viruses to date have slipped past it, and were immediately stopped by secondary protection.

So yeah.

Gimpy666

2012-01-16 18:50:17

I own and use one of these for my backup: http://www.high-rely.com/HR3/includes/FirstRAID/FirstRAIDG2.php

I have 4 drives that are rotated every week as I run a backup every Saturday night. The RAID consists of 5 1TB drives (RAID5 so 4TB of data). I keep my backup drives in a safe in case of a fire.

I backup for the fact of disaster recovery. I haven't gotten a virus unintentionally since I was 13 (21 now). Whenever I install warez or shady software, I load it onto a vm and test it out there to see if it is clean or not and then I restore a snapshot. I do not use anti-virus on my host machine as I have no need for it. As for network security, I am behind 2 routers, WAN is DMZ'd to a linux box in my outter LAN. My secure network is all wired and the external one with the DMZ has a wireless access point.

I also wear a tinfoil hat to bed every night.

footballjds

2012-01-17 10:21:25

From: nickrules
I should also add that I'm running this nifty little program called comonsense 2012 edition. You should check it out (: it's like the best AV out there - only 5 viruses to date have slipped past it, and were immediately stopped by secondary protection.


Just wear a condom.

So yeah.


yeah?