this is a fairly normal way of malware to get around. been happening for a long long time. i remember seeing this method on early AOL. it spreads much like any email virus. some poor victim gets infected and logs into flickr then their account is hacked by the malware and the malware starts to send out messages to everyone it can on trying to get it to download and run the malware. i dont know why social networking sites just dont block external links from being sent to a contact that hasnt allowed them to be sent to them. i sure know i dont want any external links. i get stuff like this all the time on myspace and am ready to delete my account because of it. grr
<br><br>oh well its just malware. if your stupid enough to install it, i'll take your money to get it off :P<br><br><br><br><div><span class="gmail_quote">On 3/28/07, <b class="gmail_sendername">Josh More</b> <<a href="mailto:morej@alliancetechnologies.net">
morej@alliancetechnologies.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">I had an interesting experience on flickr this morning, involving Windows malware.
<br>The short form is: "If someone leaves you a comment and a URL on flickr (or some other social site), and you do not know them, do NOT click on the link."<br><br>Details, if you are interested in what to look at when *safely* tracing malware, are at
<a href="http://journal.starmind.org/2007/03/27/be-careful-on-social-networking-sites/">http://journal.starmind.org/2007/03/27/be-careful-on-social-networking-sites/</a><br>However, following the rule above, if you do not know me, you shouldn't click on the link, so the details are also included below. As I hear more information from SANS and/or flickr, I will be updating my blog via the URL above.
<br><br><br>Details:<br><br>I started my morning by uploading a set of photos to flickr. Almost immediately, I got a comment from a user that I did not recognize. By itself, that's not unusual. However, what follows triggered my "weirdness" alarms.
<br><br>The comment read as follows:<br><br>"This is such a cool pic, good work! I Love viewing your stream. I Recently constructed a gift for all of my favorite flickr users, you were included, so i would be honored if you can accept it and tell me if you like it or not! Thankyou!"
<br><br>Then, there was a link. As it turns out, the link was to a windows executable, but it could just as easily have been to something harder to detect. What I did next is what saved me (or would have, had my system not been Linux which protected me anyway* from this attack).
<br><br>Since I didn't know the user, I checked out her profile. Interestingly, none of my photos were tagged as her favorites. Also, I was not listed as one of her contacts. So, if I wasn't someone she knew well enough to keep track of that way, why would she be offering me a "gift"?
<br><br>I poked a bit further, and found that the file behind the link was on a website having something to do with paintball. That's odd, but not necessarily a bad thing. However, as she did not have any photos about paintball or listed paintball as an interest, I became more suspicious. Also, the file was stored in
<a href="http://site/calendar/ws/PhotoSeries3412459741.exe">http://site/calendar/ws/PhotoSeries3412459741.exe</a><br><br>Those who are not in the industry might not know, but this means that it's located within the WebCalendar application, which is not a normal place to store files. Additionally, there have been security problems with older versions of this application, so it was highly likely that the site was hacked.
<br><br>I downloaded and scanned the executable, and it came back clean. But, to be safe, I decided to contact SANS (an excellent security group), and they helped me to track down the rest of it. It turns out that the exe file is a "trojan dropper". It connects to another site to download the nasty bits. That way, it can bypass antivirus and other security measures.
<br><br>SANS is contacting the site hosting the malware, and I will be contacting flickr. I suspect that flickr already knows, as they deleted the comment fairly quickly. However, they did not delete it from the RSS feed, which is how I read them. I will let flickr contact the user whose account was hacked.
<br><br><br><br><br>-Josh More, RHCE, CISSP, NCLP<br> <a href="mailto:morej@alliancetechnologies.net">morej@alliancetechnologies.net</a><br> 515-245-7701<br><br><br>_______________________________________________<br>Cialug mailing list
<br><a href="mailto:Cialug@cialug.org">Cialug@cialug.org</a><br><a href="http://cialug.org/mailman/listinfo/cialug">http://cialug.org/mailman/listinfo/cialug</a><br><br></blockquote></div><br>