Guerilla PR redux

Last week, I blogged about the practice of buying up negative names as a defensive PR measure.

As a follow-up, I’m posting part of an email I got from a blog reader (who asked to remain anon).

In the year 2000 (no this isn’t a Conan O’Brien skit) 2600 Magazine ran an article in their print version about how Verizon (which was a brand new company at the time) was registering about 700 domain names along the same lines. The article included every single domain name the 2600 writers could find. I’ve been searching 2600 online and can’t find that exact article (I’m not sure if they put the print articles on-line or not) but I can find several references to it, and to the ‘cyber-squatting’ suit Verizon filed against 2600 and Emmanuel Goldstein for registering ‘verizonreallysucks.com’. Link.

While searching through 2600 for the right article I came across a PDF of a deposition Eric Corley (aka Emmanuel Goldstein) gave when sued by Ford for registering ‘fuckgeneralmotors.com’ and pointing it to Ford’s website. Link here and here.

In item 24 Eric/Emmanuel describes Carl Rove registering 30 some odd domain names like “bushsucks.com’ and Verizon registering 700+ domain names.

In that point he also references a ‘”Lucentsucks” case’. A quick search of ‘lucentsucks’ reveals that some jokester registered that domain and put up a porn site. Lucent sued but the case was dismissed due to Lucent’s failure to comply with the Anti-cybersquatting provisions. Which is a bit off topic… but perhaps is part of the rationale behind mass domain registration.

So as my loyal reader points out, there’s other people doing this and it’s been going on for some time [apparently at least since 1998 (Earthweb) but possibly earlier].

Any other examples out there you know of? Feel free to comment.

Alex Eckelberry

Da CookieMonstor will get you

Cookiemonster12323

This came to me recently: A site threatening to sue us because we scan for their cookies in CounterSpy:

Company: Searchalot, Inc.
Company website: http://www.searchalot.com/ Contact name:
Gerald ODea
Product name affected: http://www.searchalot.com/ Product versions
affected: All Product is detected as: Cookie?
Software can be downloaded here: None
————————————————————
Brief description of software:
No software, and our site has absoultely no cookies. Please remove it
from your list or we will need to pursue this further with our law
firm, and you’ll be responsible for all of our legal fees.
————————————————————
Reason for submission:
to remove the searchalot.com site from your list as having some type
of bad cookie. we set no cookies on the site, so your description is
absoultely incorrect and it causing us to lose users. We will use the
emails from users having a concern about using our site, because of
your software, as evidence of lost revenue, and we will definitely
prevail in court.
————————————————————
Code: DEV_SPYWARE

Needless to say, they’re right, they have stopped pushing cookies pushed from that site, so we have taken them off.

But the idea of suing us because we scan for their cookies is just… out there. They need to listen to CookieMonstor disco and relax…

Alex Eckelberry

Gozi Trojan

Well worth reading. Really.

Russian malware authors are finding new ways to steal and profit from data which used to be considered safe from thieves because it was encrypted using SSL/TLS. Originally, this analysis intended to provide insight into the mechanisms used to steal that data, but it became an investigation into the growing trend of malware sold not as a product, but as a service. Eventually it lead to an alarming find and resulted in an active law enforcement investigation.

Link here.

Alex Eckelberry
(Hat tip to Richard Smith)

Omerta spyware scam

The good folks who run Omerta (a massive multiplayer text-based game) are beyond frustrated as they are being plagued by some slimeballs who are foisting off very dangerous spyware as Omerta’s.

Omerta100000001

Omerta100000000

Omerta29999999999999999

What these pages install is a nasty piece of spyware, ProAgent (for one sample, Sunbelt Sandbox report here, VirusTotal results here).

Omerta players — be careful of any software for the game that’s not from the Omero folks themselves.

Alex Eckelberry

QED

Something I’ve pounding the table on for some time…

But it took a car seat scandal to make them realize that they need to talk to experts in industry to understand how to test.

Jim Guest, president of Consumers Union, the nonprofit publisher of Consumer Reports, said in an interview yesterday that in the future, the magazine would consult with a broad range of experts, including those from the industry, for establishing protocols for complex tests, but it would still make its final assessments on its own.

Good! Security software testing is complex, and very few people have it right. But the people in the industry can really help magazines like Consumer Reports report accurately — and help consumers make the right choice.

Alex Eckelberry

More on the Windows Live pwnage in Italy

As we reported earlier this month, Microsoft Live in Italy is serving massive amounts of infected pages through rogue search engine optimization by the Gromozon crew.

The Register has picked up the story and run with it.

To see for yourself, type “veicolo commerciale noleggio” into Live.com and watch what gets returned. The first result (at the time of writing, anyway) is for a site at b9n3q3.info/yb6u46p76.html, which uses a Javascript to redirect users to another site. This second site actively tries to install several varieties of malware, in some cases the nasty Trojan known as Rustock. This return is just one of many malicious referrals Live.com makes when entering the above search term, which is Italian for “commercial vehicle rental.”

Link here.

Some researchers might get confused by this exercise — because the results aren’t showing malware.

However, they will if you’re using an Italian IP address. Also, according to Francesco Benedini, a Sunbelt researcher and one of the foremost experts on Gromozon, “the Gromozon group pulls off every trick to make sure that when you’re surfing one of those sites you’re doing it with a real browser instead of an http crawler like wget; that includes headers that wget doesn’t normally put in place, like “Accept-language”, “Accept”, a proper user-agent, and apparently even that actual referrer is one of their sites.

So if you don’t live-test it with a real browser you’re not being redirected to their malicious pages. Also, there’s a server-side detection of the user-agent as well; an XP machine with SP1 and IE6 gets infected right away, an XP machine with SP2 and Firefox doesn’t.”

Alex Eckelberry

Seen in the wild: Trojan spawned on MySpace

My colleague John LaCour over MarkMonitor shared this one with me. It just goes to show how social networks can be used to spawn malware (as Dan Hubbard at WebSense describes it, “Web 2 dot uh oh”). When you give anyone in the world the ability to rapidly and anonymously create web pages, and then invite “friends”, you’re asking for trouble.

John got an invite saying “Jocelyn wants to be my friend”. The invite has showed a picture of a young lady in a bikini.

Jocelyn199123812312321

(Perhaps a more accurate portrayal might be here).

Once you check Jocelyn’s profile, you get a link to download the Zlob trojan, from http://privatemsprofiles(dot)net/download(dot)php.

Myspace91991233

(Obviously, don’t download this trojan, and don’t go to Jocelyn’s profile unless you’re in a virtual machine.)

Incidentally, do you want to guess what the number one piece of spyware out there is? Zlob. You can see this right on the front page of our research center, which pulls live threat stats from our ThreatNet network. (Zlob is a trojan that downloads as a fake “Codec”, purporting to be requried in order for you to view a video clip.)

Threatnet1293123123123123

What’s really sad is all those people that you can see on Jocelyn’s profile who have been pwned.

Alex Eckelberry

Higher education and infected wikis and tikis. It’s icky.

We’re finding buckets of infected forums, blogs, wikis and tikis. A lot of “compromised” educational (.edu) sites, most likely from unpatched vulnerabilities.

Take a look at some of these examples (offensive screens are thumbnailed for the easily offended):

Wikit98123123080000

As you can see, a vast number of hits of sites that have been taken over by porn on the University of Southern California system (usc.edu).

But it’s not only USC.

We have Virginia Tech:

Virginiatech1239998

On this one Virginia Tech page, we get some really nasty porn (which we’ve covered up), with an offer to view more porn after installation of a fake codec:

Virginiatech123213400

Here’s the University of Maryland:

Universmd991923

Searching Google for this one term brings up some rather disturbing stuff:

More991238888888

Similarly, searching for “amatuer porn movies free” on Google brings up more nasty stuff, including this:

Luther1998823888

Now, in the case of the Callutheran site, it’s a WIKI – there is a PHP script that loads HTML from here a porn site (http://www(dot)bigvideosonline.com/lesbians/index(dot)php?id=1403&style=orange). How did the script get there? We don’t really know, but suspect it could MediaWiki vulnerability.

A search for “Cheating Wives movies frees inurl:edu” brings us this:

123998888888adfcgeat

And here’s more, Indian River Community College and USC:

Porn12999123818888

Sniffing around one place, we find wide open access:

Snf2923423400888

So there’s an open directory listing with a keyword list and two PHP scripts that load the security scam hijacker porn pages or re-direct to rogue applications like Privacy Protector:

Privacy921949888234

It literally goes on and on and on and on and on.

Alex Eckelberry
(With copious credit to Sunbelt researcher Adam Thomas)

Another explosion in Connecticut

As you may know, I’ve been deeply involved in the case of Julie Amero, the hapless substitute teacher convicted of four felony counts for impairing the morals of a child, while the defense contends that Julie was a victim of popups and spyware. The rest is history, as the tech community exploded into her defense.

Yet the local Norwich, CT town has continually taken the side the prosecution, with virtually every story laced with implications that Julie deserved her sentence. However, the stories were always veiled as “unbiased journalism”, looking at “both sides of the story”.

Well, their true colors were finally shown today. They dropped a bombshell editorial, going on the record that Julie deserves these four felony counts:

Amero could receive up to 40 years, if she gets the maximum sentence allowable for each of her four convictions of risk of injury to a minor, and the judge orders them to be served consecutively. It’s an unlikely sentence, even though children were exposed to six hours of Internet pornography under Amero’s watch. We think Amero is likely to receive some sort of community service, and it would be a fair sentence.

Amero has many supporters, which should not sway the court, as most of them have formed opinions based on limited knowledge of the facts of the case, or simple hearsay. At the heart of this international debate is whether Amero was responsible for causing the pornography to be on the computer screen for an entire school day, when seventh-grade students were able to view it. Many in the technology field have suggested she was the victim of a “porn storm,” which were frequent problems in 2004, when the incident occurred. Some suggested the computer was overtaken by malware or spyware, technical parasites that will plant unwanted images, pop-ups, etc., onto a computer. Some have suggested Amero was the victim of a conspiracy by students.

My answer that I posted:

You say that Amero’s supporters have limited knowledge of the case — yet many supporters are basing their arguments on the very same trial testimony that you are using. I’m not sure I understand this logic.

In this country, one understands that there is the concept of proportional justice, where “the punishment will fit the crime”. In this case, the crime was ignorance, and for this you demand a felony conviction, which will ruin Amero’s life. Do you have any idea what an effect a felony conviction has on someone’s ability to work and live?

You had a pregnant substitute teacher nearing 40 who had popups on the computer. The trial testimony shows that she went for help and attempted to keep the children from seeing the images — even going so far as to push a child away. And despite what anyone says, it’s not clear that these popups were occurring “all day” – in fact, it’s apparent they occurred for less than 2 hours.

Comparing these popups to “a fire in a trashcan” or a “racy magazine on the desk” is misleading. A fire, a magazine, a fight in the classroom — these are all things that people in general have experience in. With computers, you’re entering a different realm — how many relatives or friends do you have that are computer illiterate and really do think that turning off the monitor will end up turning off the computer itself?

Allow me to point out that intent to harm a minor played a role in this case. And yet, we see no proof from the testimony that there was any intent to harm by Amero.

Let’s leave “armchair” jurisprudence to the legal experts. They know the law, let them decide if ignorance is the basis for a devastating felony conviction.

Prominent USA Today journalist Andrew Kantor also comes to her defense, here.

And you can read the transcripts for yourself here and come to your own conclusions.

Alex Eckelberry

Guerrilla PR: Buying up negative names

Earlier this month, an environmentally-oriented blog posted some interesting research. Johnson & Johnson, the makers of Splenda, has gone out and bought buckets of potentially negative names.

Some examples:

splendasucks.net, .org, .biz, .info
splendakills.net, .org, biz .info
splendatruth.com , .net, .org, .biz, .info
splendapoison.com, .net, .org, .biz, .info
thedangersofsplenda.com, .net, .org, .biz, .info
thefactsaboutsplenda.com, .net, .org, .biz, .info
thesplendadangers.com, .net, .org, .biz, .info
thesplendafacts.com, .net, .org, .biz, .info
victimsofsplenda.com, .net, .org, .biz, .info
thetruthaboutsplenda.net, .org, .biz, .info
thesplendatruth.com, .net, .org, ,biz, .info
splendatoxicity.com, .net, .org, .biz, .info
splendatoxicitycenter.com, .net, .org, .biz, .info
splendavictims.com, .net, .org, .biz, .info
splendahealth.com

Many, many more here (via Domain Name Wire).

Interestingly, they didn’t manage to get splendasucks.com, which is a blog by fellow who really doesn’t like Splenda (he says it gives him rashes and is made with chlorine).

Now, buying up negative names to control your PR image isn’t new. EarthWeb owns the domain earthwebsucks.com, and I’m sure there are many other examples.

If you know of have any other similar types of activity by corporations, post a comment with more info or contact me directly.

Alex Eckelberry

RSA plans to charge what PIRT does for free

A while back, Paul Laudanski and I started PIRT, a volunteer group dedicated to taking down phishing sites. Paul later evolved PIRT to become MIRT — the Malware Incident Response and Termination group. MIRT broadens the activities of PIRT to the takedown of actual malware sites, along with sharing of malware samples with vetted security companies and researchers. (They also submit results to VirusTotal, and what they now have is a kind of running tally as to the effectiveness of antivirus engines against new threats.)

Well now RSA is putting together a service to charge for takedowns.

RSA people: Just give Paul a few more servers and volunteer some of your staff’s time… few do takedowns better than PIRT and MIRT.

Alex Eckelberry
(Hat tip to Donna)

A PR nightmare for Yahoo

This is why you don’t give in to foreign governments with abysmal human rights records.  You just don’t. 

Moments later, government agents swarm through the front door — 10 of them, some in uniform, some not. They take Wang away. They take his computers and disks. They shove an official notice into Yu’s hands, tell her to keep quiet, and leave. This is how it’s done in China. This is how the internet police grab you

Five years later, Yu, 55, sits in the dining room of a small house in Fairfax and weeps softly. She is a slight woman — 100 pounds and barely 5 feet tall in slippers. Her eyes betray her exhaustion; but she is determined, too. She carries a thick stack of notes with her, and she has scrawled more on her left hand.

“Yahoo betrayed my husband and deprived him of freedom,” Yu says through a translator, her voice trembling. “Yahoo must learn its lesson.”

Link here, much more at BoingBoing.

Yahoo was in an ackward position, where the law of the land required them to turn over the data.  But what if you know that turning over this data may result in someone losing their life, or facing years in prison

I know for a fact that Yahoo people aren’t evil.  In fact, it is a group largely made of really good, well-meaning people who are actually sickened by this whole situation. So don’t blame the whole company. 

But sometimes, decisions are made by individuals in organizations that result in this type of action.  It’s a lesson in organizational ethics:  Set the standard, and then lose the damn business, fire the MBA moron who is harping about the opportunity, walk away.  Just don’t bother with it.

Alex Eckelberry

A conversation between development and product management

If you’re in the software development space, you’ll get this little humorous exchange that someone here at Sunbelt wrote:

Development: “You want answers?”
Product Management: “I think we are entitled to them!”

Development: “You want answers?!”
Product Management: “I want the truth!”

Development: “You can’t handle the truth!!!

Son, we live in a world that requires software. And that software must be built by people with elite skills. Who’s going to build it? You, Mr. Marketing? You, Mr. Sales? You, Mr. Finance? You, Mr. Human Resources? I don’t think so.

We have a greater responsibility than you can possibly fathom. You scoff at our open work areas and you curse our big screen monitors. You have that luxury. You have the luxury of not knowing what we know — that while the cost of delivering software may be excessive, it drives revenue and saves money. And my very existence, while grotesque and incomprehensible to you, drives BUSINESS!

You don’t want to know the truth because deep down in places you don’t talk about at staff meetings… you want me managing the project. You NEED me managing the project!
We use words like refactoring, test-driven development, continuous integration, sprint, velocity, and release planning. We use these words as the backbone of a life spent delivering something. You use them as a punch line!

I have neither the time nor inclination to explain myself to people who rise and sleep under the very blanket of software I provide and then question the manner in which I provide it. I would rather you just said “thank you” and went on your way. Otherwise I suggest you log in to a computer and write some code. Either way, I don’t give a damn what you think you’re entitled to!”

Product Management: “Did you cut the monthly scheduler feature?”
Development: “I did the job I was hired to do.”

Product Management: “Did you cut the monthly scheduler feature?”
Development: “I delivered the release on time.”

Product Management: “Did you cut the monthly scheduler feature?”
Development: “You’re g%$#@*& right I did!”

Alex Eckelberry

Update: My mistake, this was actually from the Agile chronicles site.

Ninja upgrade shipped

We just did a nice upgrade to our Ninja email security product — it now includes disclaimer functionality built-in. This makes Ninja a ridiculous bargain in email security — dual-engine antispam, dual-engine AV, attachment filtering and disclaimers — all integrated.

New features in Ninja 2.1 include disclaimer functionality, an improved antispam engine for better spam detection, and console management enhancements.

Disclaim1239888123

Disclaim1239888124
You can view the webcast I did yesterday on it here, and our company propoganda here.

Alex Eckelberry

Seen in the wild: Advertising in a trojan

As a brief follow-up to my previous blog today about advertising in spyware:  The Zlob trojan comes through fake codecs.  It’s nasty and not something you want on your system, and one thing you may get is ads.  In this case we found today, ads are spawned through entertainclicks(dot)com/cu/index.html, which you can see for yourself (in a vmware, please), the ads that the site shows on infected machines.  The ads feed top10–offers(dot)com.

Offer10099123

Offer10099123a

Offer10099123b

Offer112934810808

Alex Eckelberry
(Thanks Patrick)

Heads-up: Congress to debate spyware bills this Thursday

Evidently the House Commerce Committee will be holding a hearing on the various spyware bills this Thursday at 11 am EDT. Scheduled to testify are: the CDT, NAI, Zango, and one other group, among others. The FTC will not be testifying.

The house.gov may offer a live feed of the hearing somewhere on the house.gov web site. As soon as I find out more, I’ll post this to the blog.

Alex Eckelberry
(Thanks Eric H.)