New York Times Spreading Malware, BEWARE!
For the past two days when I've gone to the New York Times website, www.nytimes.com, I've been getting these pop-ups that say "Your computer may be infected with a virus, download a free scan now" or some such message. If you hit the "No thanks" button, it begins to run a fake scan on your system anyway! If this happens, close your browser immediately, and by no means should you run this bogus scan, because what it is really doing is inserting a trojan into your PC (don't know if Macs are similarly affected).
I wasn't really sure what the deal was until I read this just now:
Here's a front page story the New York Times (NYT) would rather not be running: The paper is warning readers to be aware of bogus ads running on its Web site.
The paper says "some readers" have seen unauthorized pop-up ads promoting antivirus software on NYTimes.com, and warns visitors who see the ad not to click on it but to restart their browsers instead. While the Times doesn't spell this out, it has likely had its site hijacked by a "malware" scammer who is trying to trick visitors into installing pernicious software onto their hard drives.
The complete article can be read here:
http://mediamemo.allthingsd.com/20090913/home-delivery-the-new-york-times-serves-up-some-malware/
It appears that the TImes had been made aware of this and is now warning readers about it on their front page.
In other news...hello to everyone from the chatroom the other night during Obama's health care speech (big fun!). It's been awhile since I've had time to blog, so it was nice to be in touch with all of you.
Cheers,
astral66
Thanks Astral.
It happened to me today, actually. I have a mac and shut it down.
So far, so good.
September 13, 2009 7:37 PM | Reply | Permalink
Ran anti virus on my mac immediately after it happened to me and nothing was there.
September 13, 2009 8:22 PM | Reply | Permalink
Thanks, I feel better
September 13, 2009 8:44 PM | Reply | Permalink
Yes, the Joy of Macs. We PC are always at risk, though.
September 13, 2009 9:19 PM | Reply | Permalink
Including from friends who have Macs - they can forward malicious stuff without realizing it.
That's currently the biggest reason to get anti-virus/malware software on a Mac.
September 14, 2009 5:15 PM | Reply | Permalink
I've experienced two attempts so far.
In both cases, it was one of those trojans that claims to have discovered viruses on your computer, so please click here to download an anti-virus.
The attacking computer was 91.212.107.5, on port 80, and the attack was trying to get me to download Scanner-349c_2006-63.exe from the domain best-antivirus03.com
September 13, 2009 7:44 PM | Reply | Permalink
Yep, that's the one. It is now quarantined by Sophos anti-virus on my laptop, but I haven't figured out (read: bothered to follow the proper steps) how to eliminate it yet.
September 13, 2009 7:51 PM | Reply | Permalink
The attacking IP is in a class C network assigned to "The research center of Cyprys".
Probably one of the advertising servers that NY Times pages refer to has been hacked to have pages with a link to the server in Cyprus.
September 13, 2009 8:09 PM | Reply | Permalink
Most PC have all their ports/sockets left wide open. Gibson Research Corporation use to have an application that disables all sockets not needed.
url : http://www.grc.com
September 14, 2009 6:48 AM | Reply | Permalink
Best thing to do? Block all popups. Those things are annoying anyway, amirite?
September 13, 2009 9:12 PM | Reply | Permalink
Funny thing is, I have my pop-up blocker on, and it came up anyway. Not sure if I rolled over an ad or something like that, but there it was. Sucks.
September 13, 2009 9:18 PM | Reply | Permalink
Astral:
Kaspersky is excellent and aggressive about these types of things. Couple that with Firefox (there's no reason not to use it as a primary browser these days) and you will be pretty safe from pop-unders, pop-overs, etc.
I know you are techie-oriented, hence my mention of Kaspersky. It stops things cold even before the pop-under, etc.
September 13, 2009 9:19 PM | Reply | Permalink
Thanks CT, hadn't heard of Kaspersky so I'm off to check it out.
September 13, 2009 9:41 PM | Reply | Permalink
I got that attempt, too. I closed the window, but I also have a pretty good firewall/AV combo.
September 13, 2009 10:19 PM | Reply | Permalink
I've got a detailed tech explanation at http://troy.yort.com/anatomy-of-a-malware-ad-on-nytimes-com if anyone's interested.
September 13, 2009 11:43 PM | Reply | Permalink
Cool! Thanks for posting this.
September 13, 2009 11:53 PM | Reply | Permalink
Thanks, troy. I was hit with this twice yesterday, also. It was cool to see what lousy spellers and grammarians they are. Ha! Take that.
September 14, 2009 6:22 AM | Reply | Permalink
I'm against waterboarding, but in the case of a malware producers, I'm willing to make an exception.
Considering all the costs and wasted hours due to ailing pc's, certinally some nice prison time is justified.
September 14, 2009 2:13 AM | Reply | Permalink
OH Astral always good to see and hear from you.
I quit taking surveys or even touching a pop-up since I got my new rig in April.
NO MORE
September 14, 2009 2:14 AM | Reply | Permalink
Hey DD! I am normally smart enough to avoid them, but this one outsmarted me with its booby-trapped "no thanks/cancel" button. The bastards got me.
September 14, 2009 8:22 AM | Reply | Permalink
don't know if Macs are similarly affected
My Mac has a motorola chipset - unix. It fears not Trojans Hordes of the Intel Realm! Bring'em On!
September 14, 2009 6:39 AM | Reply | Permalink
Wouldn't it be funny if Astral's link was the real malware :-)
September 14, 2009 7:55 AM | Reply | Permalink
Well, two of the links do go directly to the New York Times, so in a way, you are correct. I haven't seen the pop-up in the past several hours though, so hopefully the have contained it.
September 14, 2009 8:19 AM | Reply | Permalink
There's an ad to mini-me yourself for free at TPM. Is this a similar trojan?
September 14, 2009 8:38 AM | Reply | Permalink
The New York Time IS malware.
C
September 14, 2009 9:48 AM | Reply | Permalink
Another depredation from the dreaded MSM! The spyware, undoubtedly, attempts to hijack the user's computer into supporting immoral, unjustified wars of choice.
September 14, 2009 12:17 PM | Reply | Permalink