Mariposa bot creator arrested in Slovenia

The Register is reporting that police in Slovenia have arrested a 23-year-old man, who went by the handle Iserdo, and charged him with writing and selling the code that has been used to create the Mariposa botnet.

Iserdo and two other suspects were taken into custody in Maribor, Slovenia, two weeks ago in the wake of an investigation by the FBI, Spanish Guardia Civil and Slovenian police, officials said.

The Mariposa bot crime kit, which was sold for $500-$1,300 on underground sites, was used by operators to create the botnet of 12-million computers used to steal banking credentials as well as other online crime.

The authorities have taken down Iserdo’s web site as well as the main Mariposa command-and-control servers.

Story here: “Mariposa mastermind arrested in Slovenia”

In March, the Guardia Civil in Spain arrested three people in connection with the Mariposa botnet as part of an investigation that began in 2009.

Sunbelt Blog story here: “Spain arrests three, shuts down Mariposa botnet”

Tom Kelchner

Don’t pay to read public domain content on your iPad

There are large amounts of videos on Youtube right now advertising a site called Bestpadmedia(dot)com. Although some are being whacked by Youtube due to “terms of use violation” there’s still a lot of them online. The videos claim the site allows you to “download hundreds of eBooks, comic books and more to the iPad”. I’ve seen clips over the last few days reference everything from Marvel and DC Comics to Disney, videogames and, er, Dennis Hopper.

ipadmedia on youtube
Click to Enlarge

If a website wants money from you upfront but gives no indication of how they give you the content (while promising “no software to download, no databases to wade through”), put your credit card away and forget about it. If the site promises media such as TV or movies you can guarantee all you’ll end up with is a download of free P2P software.

Similarly, websites that offer up “thousands of free downloads” for devices like iPads without indicating how this is done will usually take your money then redirect you to a free source of public domain material – which also means the innocent content provider has to field complaints from angry “customers” of the original site. A telltale sign is when a site offers vague information, or contradictory claims saying they have “no direct database”, while also claiming a database is “added to daily”. Like this:

Ipdmedia2
Click to Enlarge

Ipdmedia3
Click to Enlarge

Note that they mention comics from Marvel and DC, yet there is absolutely no mention of licensing – Marvel and DC don’t roll like that. Comics seem to feature heavily in promotion of the site, whether through Youtube vids or the splash of Wolverine on the website itself.

ipad comics
Click to Enlarge

ipadmedia
Click to Enlarge

Sure enough, it seems Bestpadmedia has been dissected in detail – it seems they simply link to free content websites, placing a banner at the top of the frame to make it look like the content is theirs. Of course, once the end-user realises they’re paying for public domain material, the complaints go to the owner of the public domain sites.

Here’s an interesting example of how the site starts linking to new content sources as old ones block them, along with the warning message displayed by the site epubbooks(dot)com who understandably weren’t too pleased about becoming the new fall guy.

Legal threats? Yep, those are in the mix too along with a curious attempt to convert the critic into an affiliate. The good news is that the site uses Clickbank for payments, which means you should be able to get your money back within 60 days.

The owner of Feedbooks(dot)com, whose site was being linked to from Mypadmedia until the complaints started coming in estimates roughly 250 people paid for this service. That’s a lot of money for content that you should be able to access for free. When in doubt, Google the content you’re looking for first – Project Gutenberg is an excellent place to start.

Christopher Boyd

Don’t pay to read public domain content on your iPad

There are large amounts of videos on Youtube right now advertising a site called Bestpadmedia(dot)com. Although some are being whacked by Youtube due to “terms of use violation” there’s still a lot of them online. The videos claim the site allows you to “download hundreds of eBooks, comic books and more to the iPad”. I’ve seen clips over the last few days reference everything from Marvel and DC Comics to Disney, videogames and, er, Dennis Hopper.

ipadmedia on youtube
Click to Enlarge

If a website wants money from you upfront but gives no indication of how they give you the content (while promising “no software to download, no databases to wade through”), put your credit card away and forget about it. If the site promises media such as TV or movies you can guarantee all you’ll end up with is a download of free P2P software.

Similarly, websites that offer up “thousands of free downloads” for devices like iPads without indicating how this is done will usually take your money then redirect you to a free source of public domain material – which also means the innocent content provider has to field complaints from angry “customers” of the original site. A telltale sign is when a site offers vague information, or contradictory claims saying they have “no direct database”, while also claiming a database is “added to daily”. Like this:

Ipdmedia2
Click to Enlarge

Ipdmedia3
Click to Enlarge

Note that they mention comics from Marvel and DC, yet there is absolutely no mention of licensing – Marvel and DC don’t roll like that. Comics seem to feature heavily in promotion of the site, whether through Youtube vids or the splash of Wolverine on the website itself.

ipad comics
Click to Enlarge

ipadmedia
Click to Enlarge

Sure enough, it seems Bestpadmedia has been dissected in detail – it seems they simply link to free content websites, placing a banner at the top of the frame to make it look like the content is theirs. Of course, once the end-user realises they’re paying for public domain material, the complaints go to the owner of the public domain sites.

Here’s an interesting example of how the site starts linking to new content sources as old ones block them, along with the warning message displayed by the site epubbooks(dot)com who understandably weren’t too pleased about becoming the new fall guy.

Legal threats? Yep, those are in the mix too along with a curious attempt to convert the critic into an affiliate. The good news is that the site uses Clickbank for payments, which means you should be able to get your money back within 60 days.

The owner of Feedbooks(dot)com, whose site was being linked to from Mypadmedia until the complaints started coming in estimates roughly 250 people paid for this service. That’s a lot of money for content that you should be able to access for free. When in doubt, Google the content you’re looking for first – Project Gutenberg is an excellent place to start.

Christopher Boyd

Work-at-home spam with some twists

The spam bucket is a great place to go looking for net ugliness. And when you’re in this business, that’s business as usual. Here’s a new one:

Today we checked out a spam email contained random letters and characters and a link in the middle of the body:

Work-at-home_6

OK, we’ll bite (don’t try this at home.) We’ll see what sexycake555@hotmail.com is selling:

The link leads to a web site moneymakermother.com (domain registered June 10, address information withheld) that tries to look like a television station web page featuring the “Clearwater Job Report,” clearly drawing on the fact that I’m coming at it from Clearwater Florida.

“Work At Home Mom Makes $8,795/Month Part-Time” is the headline they want you to see.

Work-at-home_2

Coupla problems with the page though:

— There’s no “Daily News 7” around here
— The links on the top of the page (“Sign in” etc.) aren’t links, they’re just text.)

Work-at-home_3

And the best one: The weather box:

Work-at-home weather

A high temperature in the 60s this time of year in Florida? Riiiiiiiight!

Here’s the real forecast from weather.com: how about highs the 90s:

Work-at-home_4

The MoneyMakerMother page has lots of testimonials and a form for you to fill out to get your “FREE STARTER KIT.” You “Only Pay The $9.95 S&H Fee!”

So, somebody’s making $9.95 selling shipping and handling to suckers. They’ll do direct deposit too, so, you can give them your bank account information.

Riiiiiiiight!

Tom Kelchner

Work-at-home spam with some twists

The spam bucket is a great place to go looking for net ugliness. And when you’re in this business, that’s business as usual. Here’s a new one:

Today we checked out a spam email contained random letters and characters and a link in the middle of the body:

Work-at-home_6

OK, we’ll bite (don’t try this at home.) We’ll see what sexycake555@hotmail.com is selling:

The link leads to a web site moneymakermother.com (domain registered June 10, address information withheld) that tries to look like a television station web page featuring the “Clearwater Job Report,” clearly drawing on the fact that I’m coming at it from Clearwater Florida.

“Work At Home Mom Makes $8,795/Month Part-Time” is the headline they want you to see.

Work-at-home_2

Coupla problems with the page though:

— There’s no “Daily News 7” around here
— The links on the top of the page (“Sign in” etc.) aren’t links, they’re just text.)

Work-at-home_3

And the best one: The weather box:

Work-at-home weather

A high temperature in the 60s this time of year in Florida? Riiiiiiiight!

Here’s the real forecast from weather.com: how about highs the 90s:

Work-at-home_4

The MoneyMakerMother page has lots of testimonials and a form for you to fill out to get your “FREE STARTER KIT.” You “Only Pay The $9.95 S&H Fee!”

So, somebody’s making $9.95 selling shipping and handling to suckers. They’ll do direct deposit too, so, you can give them your bank account information.

Riiiiiiiight!

Tom Kelchner

Privacy bills in U.S. Congress in brief

Congressional staffers have posted a very well-written summary of the two Internet privacy bills working their way through the U.S. Congress. It provides a nice birds-eye-view of what the two bills are trying to accomplish without the usual reams of supporting information and point-counterpoint verbiage.

The memorandum was prepared by the staff of the Committee on Energy and Commerce subcommittee on Commerce, Trade, and Consumer Protection, which held hearings last week on the two.

Three key paragraphs sum up the issues and the balancing act between preserving consumer privacy and allowing fair commercial use of information that the Congressmen are struggling with:

“There is no dispute that the reasonable collection and use of consumer information offer benefits to businesses, consumers, the marketplace, and society generally. Companies must collect information to process transactions and conduct day-to-day operations. Moreover, authentication, fraud prevention, and background checks are all activities that rely on consumer information. In addition, marketing databases help companies identify new sales leads, improve customer service, develop new lines of products, and make marketing more efficient.

“However, numerous consumer groups, privacy advocates, academics, companies, and others have raised privacy concerns about the collection and use of consumer data. Most recently, 17 consumer groups outlined their concerns and renewed their call for a comprehensive consumer privacy law in a letter to the Federal Trade Commission (FTC) on July 14, 2010. Privacy concerns range from being subjected to unwanted marketing to being denied goods or services based on a profile. In addition, the sale of targeted customer lists that characterize consumers as risk takers or gullible may expose consumers to increased risks of fraud. The use or misuse of sensitive information such as health information also could embarrass consumers, impact their employment, or lead to other problems. Other concerns have also been raised that consumers will unknowingly be “boxed” into categories based on past behavior and that their choices, and the information presented to them, will be limited as a result.

“Transparency is another issue raised by many stakeholders. Data collection practices are complex, varying from entity to entity. Even when choices are offered to consumers, they may be difficult to use, require the payment of fees, or only partially address the collection or use of information.”

The hearing process has just begun for these two. Stake holders on every side of the issue have been contributing to the discussion. The next step will be a new draft or drafts with revised wording reflecting the compromises. We’ve seen no estimate of how long that might take.

The bills:

— The Best Practices Act (HR 5777), introduced July 19 by Rep. Bobby L. Rush (D-Illinois). (Text here.)

— A discussion draft of a bill that would “require notice to and consent of an individual prior to the collection and disclosure of certain personal information relating to that individual” submitted May 3  by Congressman Rick Boucher (D-Va.) and Cliff Stearns (R-Fla.). Boucher is Chairman of the House Committee on Energy and Commerce Subcommittee on Communications, Technology and the Internet and Sterns is Ranking Member. (Text here. )

Summary memo here.

Earlier Sunbelt Blog coverage here: “Is there a privacy law in the making for the U.S.?”

Tom Kelchner

Privacy bills in U.S. Congress in brief

Congressional staffers have posted a very well-written summary of the two Internet privacy bills working their way through the U.S. Congress. It provides a nice birds-eye-view of what the two bills are trying to accomplish without the usual reams of supporting information and point-counterpoint verbiage.

The memorandum was prepared by the staff of the Committee on Energy and Commerce subcommittee on Commerce, Trade, and Consumer Protection, which held hearings last week on the two.

Three key paragraphs sum up the issues and the balancing act between preserving consumer privacy and allowing fair commercial use of information that the Congressmen are struggling with:

“There is no dispute that the reasonable collection and use of consumer information offer benefits to businesses, consumers, the marketplace, and society generally. Companies must collect information to process transactions and conduct day-to-day operations. Moreover, authentication, fraud prevention, and background checks are all activities that rely on consumer information. In addition, marketing databases help companies identify new sales leads, improve customer service, develop new lines of products, and make marketing more efficient.

“However, numerous consumer groups, privacy advocates, academics, companies, and others have raised privacy concerns about the collection and use of consumer data. Most recently, 17 consumer groups outlined their concerns and renewed their call for a comprehensive consumer privacy law in a letter to the Federal Trade Commission (FTC) on July 14, 2010. Privacy concerns range from being subjected to unwanted marketing to being denied goods or services based on a profile. In addition, the sale of targeted customer lists that characterize consumers as risk takers or gullible may expose consumers to increased risks of fraud. The use or misuse of sensitive information such as health information also could embarrass consumers, impact their employment, or lead to other problems. Other concerns have also been raised that consumers will unknowingly be “boxed” into categories based on past behavior and that their choices, and the information presented to them, will be limited as a result.

“Transparency is another issue raised by many stakeholders. Data collection practices are complex, varying from entity to entity. Even when choices are offered to consumers, they may be difficult to use, require the payment of fees, or only partially address the collection or use of information.”

The hearing process has just begun for these two. Stake holders on every side of the issue have been contributing to the discussion. The next step will be a new draft or drafts with revised wording reflecting the compromises. We’ve seen no estimate of how long that might take.

The bills:

— The Best Practices Act (HR 5777), introduced July 19 by Rep. Bobby L. Rush (D-Illinois). (Text here.)

— A discussion draft of a bill that would “require notice to and consent of an individual prior to the collection and disclosure of certain personal information relating to that individual” submitted May 3  by Congressman Rick Boucher (D-Va.) and Cliff Stearns (R-Fla.). Boucher is Chairman of the House Committee on Energy and Commerce Subcommittee on Communications, Technology and the Internet and Sterns is Ranking Member. (Text here. )

Summary memo here.

Earlier Sunbelt Blog coverage here: “Is there a privacy law in the making for the U.S.?”

Tom Kelchner

Malware removal alliance begins organizing effort

We just got an email from Dave Mook who is part of an effort to organize the Alliance of Qualified Malware Removal Boards (AQMRB).

Alliance membership will be free. Members will be reviewed every six months.

Boards in the alliance will have the right to display an official AQMRB badge:

Aqmrb_member

Groups seeking membership must:

– Have been in existence for at least two years.
– Have an acceptable use policy and/or terms of use agreement
– Be on a paid hosting account.
– Have fully equipped/dedicated malware removal help and support section readable to all users and guests.
– Have malware removal staff who are trained by or have graduated from an acknowledged malware removal school or university
– Offer malware removal help free of charge for non-commercial users.
– Provide assistance to customers within 24 hours.of their post for help.
– Display no web links to illegal or copyright-protected software.
– Host no ads which will lead to malicious content.
– Not serve pop-ups or pop-under ads.
– Fill out an application and include a complete list of malware removal staff, including a list of the schools or universities where the staff received training.

Requests for alliance membership may be directed to the secretary of the alliance here: applications &lt at &gt aqmrb &lt dot &gt com.

Tom Kelchner

Malware removal alliance begins organizing effort

We just got an email from Dave Mook who is part of an effort to organize the Alliance of Qualified Malware Removal Boards (AQMRB).

Alliance membership will be free. Members will be reviewed every six months.

Boards in the alliance will have the right to display an official AQMRB badge:

Aqmrb_member

Groups seeking membership must:

– Have been in existence for at least two years.
– Have an acceptable use policy and/or terms of use agreement
– Be on a paid hosting account.
– Have fully equipped/dedicated malware removal help and support section readable to all users and guests.
– Have malware removal staff who are trained by or have graduated from an acknowledged malware removal school or university
– Offer malware removal help free of charge for non-commercial users.
– Provide assistance to customers within 24 hours.of their post for help.
– Display no web links to illegal or copyright-protected software.
– Host no ads which will lead to malicious content.
– Not serve pop-ups or pop-under ads.
– Fill out an application and include a complete list of malware removal staff, including a list of the schools or universities where the staff received training.

Requests for alliance membership may be directed to the secretary of the alliance here: applications &lt at &gt aqmrb &lt dot &gt com.

Tom Kelchner

Imageshack spam leads to Zbot infection

Over the weekend, spam started appearing in mailboxes that claimed to be Imageshack registration notification.

fake imageshack mail

That’s great, but I hadn’t registered – and certainly not with that username / password combination. A quick Google for the Forsight domain (pre compromise) reveals it to be an art gallery, so it is unfortunate that either by accident or design the bottom of the spam mail says the following:

spam mail

Visiting the link in the mail would bring end-users to the following fake “install to continue” message:

please update...
Click to Enlarge

Installing the file would land the unsuspecting victim with a Zbot infection, not the best way to spend your weekend. Detections for this particular file are good (39/42 on VirusTotal) – the site owners have apparently removed the executable, but there’s still some iframe activity taking place so it’s probably best to avoid the URL for the time being.

One final thing to note – the “Please update your flash player” graphic the attackers are using? They’re serving up an image from the Coca Cola website.

update your player image
Click to Enlarge

The text in the box seems to match the overall stylings of the Coca Cola website – it’s unlikely they’ve been compromised and had this graphic placed there, but we’ve reached out for clarification anyway and will update should we hear anything back.

We detect this file as Trojan.Win32.Generic!BT. While coverage is good for that particular file across most AV products, there’s a good chance we’ll see updated “Imageshack” mails going out with fresh links, files and exploits so please: if you don’t remember signing up to something, don’t let curiosity get the better of you and simply delete the email.

Christopher Boyd

Some tragic news

(Picture credit – AP)

Readers of this blog may recall Julie Amero, the substitute teacher who narrowly escaped four felony charges.

Now, things have certainly taken a turn for the worse. Her husband, Wes (pictured above), is diagnosed with terminal lung cancer. Wes is a really good man — one of the many quiet, caring men that shoulder the burdens of this world with stoic and sometimes tragic courage. He has stood by Julie through thick and thin and it’s just horrible to see this happening.

A recent benefit netted some cash, which is helpful. But it’s cancer, and it’s pretty devastating on the finances…

He recently sent me this email and gave me permission to post it:
I wish I could be sending this e-mail on a cheerier subject, but that isn’t the case. It’s always harder to tell bad news to the ones you love the most. As you have heard, I have terminal cancer with an original life expectancy of about one more week ( at best ). But following true to course, I never listen to anyone or anything when it comes to something that I don’t want to hear. I’ve never backed down from a good fight in my life and I’m not about to start now. I am going to beat this horrible disease.

I’m feeling like I’ve been run over by a bus, but hey, even some of them survive. The doctors and some good friends are making me comfortable with lots of drugs, but sometimes I feel like Alice in Wonderland, you know the song – ( one pill makes you larger and one makes you small, but the ones that mother gives you don’t do anything at all) . I’m down to fighting weight now (195 lbs), I’ve lost almost 50 lbs and everyone says I look good, and I figure that they are saying that in the context for a guy that’s supposed to be dead now. Their words of encouragement help me through some of the the really tough times because I need to stay alive for Julie, I don’t think she will last long when I’m gone even though she seems to listen to me when I tell her that she must continue to live on in the aftermath of my death. She is handling this like a trooper, but there is only so much she can handle. She can never work again, and we are in the final stage of appealing her social security case, but that will only go so far when and if she gets it. Her spirits are middling and the benefit that Herb is putting on will help ease her mind about being left behind with a ton of hospital and doctor bills.
I haven’t posted a new blog or opened up a new PayPal account, they just have not been on the top of my list of things that HAVE to be done. Herb has worked very hard on putting this benefit together and I might add ALL on his own. The money he will raise will most certainly help out with the bills, but I doubt very much that a meal at $10.00 dollars a head will generate the kind of funds that are needed to settle these hospital and doctor bills. I talked with him last night and again this morning. He said that you are doing something on your end, but that you needed a PayPal account and a blog. The only PayPal account we have is Julies, and there is still an icon on her blog page about half way down that works. The link is below, and any and all contributions would be graciously accepted and appreciated, and after all, the money will be spent to keep her solvent and not end up having to sell the house just to pay off my bills. I have saved enough money to pay off the house when I die, but I didn’t see this cancer thing coming.

Alex, I feel terrible about having to ask for money. I wasn’t raised that way, but I wasn’t raised to think about dying of cancer either. So if you have contacts that are still willing to contribute to Julie, please do what you can to help her out (again).
If you can contribute, please do. The original PayPal account for Julie’s defense fund is still active, and donations can be made here.

Alex Eckelberry

OMG Facebook spam becoming a genre

July 16 we blogged about Facebook spam that offers some amazing photo or video but instead lures you into some goofy “survey” that is aimed at collecting your cell phone number. Bottom line is a $9.99 charge on you phone bill for something you didn’t want. (Sunbelt blog piece: “OMG OMG don’t fall for Facebook spam” here.)

And, of course, every time someone falls for one of these and “likes” it, he posts it to Facebook, so the spam spreads:

OMG_2

Simple rule for Facebook: if your friend’s wall posting contains “OMG” and a URL, avoid it. If it wants you to “like” it, REALLY avoid it.

“OMG” Facebook spam has become a new genre.

Today’s load:

OMG_2_result

OMG_4_result

OMG_5_result

OMG_7_result

OMG_8_result

OMG_9_result

OMG_10_result

Tom Kelchner

Dell replacement server motherboards found with malicious code

Boards on new PowerEdge equipment and non-Windows systems not affected.

According to a note on Dell’s company support forum, a small number of PowerEdge R410 replacement motherboards have been found infected with spyware. The company is notifying customers who have purchased the equipment.

http://en.community.dell.com/support-forums/servers/f/956/t/19339458.aspx

Someone from the company posting under the name “Matt M” wrote in response to a question on the board: “As part of Dell’s quality process, we have identified a potential issue with our service mother board stock, like the one you received for your PowerEdge R410, and are taking preventative action with our customers accordingly.  The potential issue involves a small number of PowerEdge server motherboards sent out through service dispatches that may contain malware.  This malware code has been detected on the embedded server management firmware as you indicated.”

“To date we have received no customer reports related to data security. Systems running non-Windows operating systems are not vulnerable to this malware and this issue is not present on motherboards shipped new with PowerEdge systems.”

The company describes its Dell PowerEdge R410 as “a powerful and ultra-dense 2-socket 1U server that offers the performance of Intel Xeon processor 5500 and 5600 series, DDR3 memory, the availability of up to four hard drives (3.5” or 2.5”)…”

Tom Kelchner

Boring theoretical anarchist hacks Facebook

Use a strong FB password or “Laughing Man” will post drivel on your wall.

Someone (or hacker group) has discovered the joy of posting material on the Facebook accounts of people who apparently use weak passwords.

Laughing man2
(Click to enlarge)

A search on Facebook for the string “This is a video that’s been appearing on hacked Facebook profiles,” shows a load of accounts carrying it. Some Facebook users also appear to be voluntairly posting the link to the YouTube video as well.

The video features a man’s torso with face overlaid with various still photos. The sound track is a droning lecture about the evils of authority. The eight-minute video concludes with a scroll of meandering quotes from Immanuel Kant and the 19th century French anti-statist writer Frederic Bastiat. There’s also an audio conclusion that’s a bit less than a call to action: “I can’t tell you what to do.”

A manifesto it ain’t.

Thanks Wendy.

Tom Kelchner

Zbot/Zeus botnets aren’t going away

Sunbelt malware specialist Adam Thomas located a server being used as a drop for a Zbot/Zeus botnet. It contained over a gigabyte of text files of stolen information.

Yes, it is just another Zeus botnet and a relatively small one by comparison – 5,100 unique infected hosts – but, the list of affected organizations is a bit disconcerting.

Zbot_screen2

(1.1 gigabytes of recovered data in text format)

Most of the infected hosts appeared to be home users, he said, but there were a large number of infected hosts inside of state and federal government agencies; Fortune 500 and 100 companies; drug companies and even banks.

He said: “It has been almost four years since Zbot/Zeus reared its ugly head and unfortunately it is still going strong, holding a high position on our top-10 detected threats list – http://sunbeltsecurity.com/.

“Back in the early days, the bad guys were sloppy with their server configurations and security researchers were able to find and recover the data that had been pilfered by Zbot trojans. The criminals eventually caught on and actually began taking measures to protect the data that they were stealing.

“Every once in a while, however, we stumble on server misconfigurations where the miscreant has (apparently) accidentally allowed access to the collected stolen data. During the past few days, our research team has been monitoring just that.

“Of course, we’ve alerted law enforcement and are working to notify those who have been affected,” he said.

In November, police in England arrested a couple in Manchester in connection with a Zbot network. Zbot enables malicious operators to steal data, including bank passwords, credit card data, personal information and social networking site logins.

This “trojan” would be “Trojan-Spy.Win32.Zbot.gen.” In June it was the second most common detection in the Sunbelt ThreatNet system. ThreatNet consists of tens of thousands of VIPRE and CounterSpy users who have banded together to form an early warning system when a new malware outbreak is noticed.

The trojan isn’t hard to detect and Sunbelt Software offers a free removal tool here.
http://go.sunbeltsoftware.com/?linkid=1211

Thanks Adam.

Tom Kelchner

Toy Story 3: Woody’s Roundup of Scams and Fakeouts

Toy Story 3 is romping across cinemas Worldwide, and rightly so – it’s the best of the series by far. I thought it might be worth pointing out that being a product aimed at children doesn’t exclude it from internet shenanigans.

If you have young children online who are partial to searching for Toy Story material, you might want to warn them about some of the below scams. One of the most popular tactics is advertising the “full movie” on Youtube, but directing the end-user to a bunch of surveys instead:

toy story
Click to Enlarge

Toy Story

Toy Story
Click to Enlarge

Most of the surveys we see tend to ask a lot of questions that reveal plenty of information about the individual filling them in, and you probably don’t want your kids giving some random third party lots of information about Dad or whatever.

The Toy Story 3 game is also a juicy target for these scams:

Toy Story game
Click to Enlarge

I’m almost certain your child does not want to dine with Gordon Ramsay at Claridges, but what do I know.

Many of the sites promoting these online versions of the film seem to use advertising networks that are a little more adult than most. Let’s break it down:

1) Child goes looking for Toy Story 3.
2) Child finds site promoting Toy Story 3.
3) Child finds their eyeballs melting into the ground and people yell “Think of the children” while all of this pops up:

Toy Story advert fail
Click to Enlarge

Toy Story movie sites popups
Click to Enlarge

Click to Enlarge

The above funfest all launched from the same site – wegotbest(dot)com – with popups contained inside the Flash player, gambling adverts popping out of the website itself and eventually throwing up a survey after the site had been inactive for ten minutes.

Amazingly, the survey didn’t contain any nudity. So there’s that.

We’ll round things off with websites asking you to install programs. Thankfully it seems the scammers out there aren’t pimping infectious “Buzz Lightyear.exe” files just yet, but they’ll still try and make some installation affiliate cash regardless.

This site is another one offering up the Toy Story 3 game:

Toy Story 3 game
Click to Enlarge

What’s the gag here? Well, hit the download link and you end up with the below folder on your PC:

Toy Story files

That’s right – you have to install a toolbar from their frontpage, and after installation a magical message will appear and the fifth word will be the password to open up the zipfiles.

In practice, all I got was the below translation software and not a magic password in sight.

Toy Story install toolbar

Don’t you just hate it when that happens?

Anyway, those appear to be the most common scams where Toy Story 3 is concerned right now. Sites asking to install programs in return for the Toy Story game or movie should be avoided, along with any promises that sound too good to be true on Youtube. Ensure your children stick to those rules and your PC, personal information and sanity will hopefully remain intact.

Christopher Boyd