Handle With Linux

The other day a friend came to me with a problem, he had been surfing the internet for information about the conficker worm virus. As he misspelled the name as configer virus, he didn't find a lot of real information on the virus. What he did find, were a lot of links, to sites which were indicated by google as harmful to your computer. You know the kind. Where google says near the link:

This site can harm your computer.

Curiosity kills

Curious about what would be on the site, he did some investigation. He searched google for the url of the site. What came up was someone stating it was just an annoying flash movie, displaying a fake virus scanner. The site installs a fake virus scanner on your computer, and after that the fake virus scanner annoys you with a lot of pop-ups.

False sens of security

This guy runs Linux on his computer, so he is not afraid of anything harming his computer. This false sense of security, combined with to much curiosity, made him access the site anyway.
After watching the funny site, which displays a fake virus scanner, scanning a windows system which is intended to look like it's your own system (Which is very funny if your sitting at a Linux box), he just clicked on some pop-ups to see what would happen. And the site did indeed try to install some windows executable.

Blocked request

After laughing about it a bit, he went on to his own website, to try and post some interesting stuff.
At the moment he tried to post something to his own site, he got a message from the hosting provider on his screen, saying that his request was blocked due to trying to upload some known malicious code, which could be used to crack websites. This scared the hell out of him! And it was good it did.
This was definitely a case of a malicious site attempting some cross site scripting.

No fear

My friend felt a bit to secure, by his use of the Linux operating system. As many people do. He wasn't afraid, because he knows there are second to none active Linux viruses around. Which is a good thing. But he also had the feeling of being immune, which is a very big risk factor.

No virus scanner

This guy had no firewall and no virus scanner on his computer. So now he got really paranoid.
When he came to me we first booted his computer from a live cd and scanned his harddisk for malware. While it is true there are not much (general)viruses which we have to be afraid of, there's a lot of malware like worms and backdoor trojans, which are also detected by virus scanners. This is the reason why you should still be running a virus scanner on Linux.
As we didn't find any malware, we proceeded by installing a firewall, something every internet connected device should be running. As a simple misconfiguration can provide a worm a way in to your system. Furthermore if anything tries to contact something on the internet on a strange port, like irc for instance (if you don't use it) it would be nice to notice this happening. These things run with almost no overhead on Linux and their benefit is great. It can be a slight inconvenience sometimes. But my friend now knows, how inconvenient it can be, if you don't even dare to start your computer anymore.

Malware scanning

After we did all this, we first scanned his site with an online malware scanner website. This site found no problem, so we downloaded his complete website to a local system and scanned all contents for malware/viruses.

Investigation

To be completely sure about what the site did I did a little investigation. I downloaded the index file of the site on the command line. This was a very interesting file, which had an obfuscated forward to another site. I did notice these guys are being very smart, they use an url which starts with vvwvv instead of www and if you read it fast it seems to be a completely different link. It appears to be the www. subdomain of an url forwarding website. While it is a completely different site.

The site

First it seems to forward you to a site in Russia, and then again to another site, which hosts the malicious script and the fake virus scanner. I downloaded the last sites contents on the command line and I found out it was indeed only a few javascripts. One of them contained a download link which tries to make you install a .exe file. This is most definitely a windows trojan. The rest was just crafted to do the cross site scripting attack. I'm pretty sure we can assume this was a site aimed at windows users, so my friend can sleep again.

The guidelines

So if your one of these people feeling secure, think about this next time your go online. There is no bigger security hole than the one between chair and computer. This site was rated insecure, and this person has a good hosting company and he was using Linux. Think about what could have happened if things would have been different.
So if you don't want your site to be hacked, don't want to have your personal information stolen, don't want to get robbed and don't want to provide a means for criminals to do this to others, I have some tips.
Use a firewall, use a virus scanner, be careful on the internet, don't click on those links marked as dangerous(I know it sounds obvious), watch out with pop-ups and last but not least: don't use windows

want to read more by J00p34? The Blog root is here