{"id":3004,"date":"2010-07-09T15:07:09","date_gmt":"2010-07-09T22:07:09","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=3004"},"modified":"2018-01-30T11:12:55","modified_gmt":"2018-01-30T18:12:55","slug":"blog-comment-spam-points-to-drive-by-site","status":"publish","type":"post","link":"https://www.webroot.com/blog/2010\/07\/09\/blog-comment-spam-points-to-drive-by-site\/","title":{"rendered":"Blog Comment Spam Points to Drive-By Site"},"content":{"rendered":"

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"\"<\/a>I just want to take a moment to thank the malware author who posted a spam comment to the Webroot Threat Blog blog the other day. You guys make my job so easy<\/em>.<\/p>\n

The spam comment, which reads Hello. I the beginner. I wish to show to you,scandal story<\/em> and links to a drive-by download site, is a tremendous help to our researchers, who are always on the lookout for new threats.<\/p>\n

Of course, the malware distributor could have employed a more effective hook to convince someone to click a link than the one he used.<\/p>\n

The link claims to point to a page hosted on the free Blogspot <\/strong>blog site to a nude video — not of Paris Hilton, Venus Williams, or Erin Andrews — but of…Diane Sawyer<\/strong>, the respected, award-winning anchor of ABC’s World News Tonight.<\/p>\n

“Diane Sawyer Nude<\/a>” — seriously? News anchor porn? Whatever happened to malware authors touting nude photos of starlets <\/em>as an enticement?
\n<\/p>\n

\"\"<\/a><\/p>\n

The Blogspot page has a static image that looks like a streaming video player embedded in the page below a portrait of Sawyer, and the text Watch Diane Sawyer Nude: Click HERE<\/em>. Click the “video” and you’re instead redirected to a Javascript file on the Web site adultsvid.cn<\/strong>, which redirected my computer to a page on another Web site, metds.org<\/strong>. The Javascript appears to redirect users to different pages — 38 total, all named after slightly younger stars of stage and screen — presumably, depending on the subject of the comment spam.<\/p>\n

\"\"<\/a><\/p>\n

In this script, Sawyer’s name gave way to those of somewhat younger actresses, including Mila Kunis, Elisha Cuthbert, Kristen Bell, Eliza Dushku, Summer Glau, Zooey Deschanel, Sarah Chalke, and Tina Fey, and 30 others. There’s<\/em> the old, familiar social engineering we know and love<\/span> hate.<\/p>\n

\"\"<\/a><\/p>\n

You eventually land on a page for a Web site that calls itself Close Club Video<\/strong>, featuring another (entirely bogus) image that looks like another streaming video window.<\/p>\n

But it didn’t matter which celebrity strikes your fancy: Each of the redirections lead to the same destination, a page which tries to push a fake Flash codec download to visitors from the domain video-codec.co.tv<\/strong>. The download process begins after a slick, also-fake animation of an Adobe Flash Player update alert message slides down the screen.<\/p>\n

\"\"<\/a><\/p>\n

Click anywhere on the page, and you end up triggering the download of the fake codec:<\/p>\n

\"\"<\/a><\/p>\n

The fake codec Web page is actually pretty amusing to play with. Most of the content — an animated GIF of an Ajax “loading” spinner, the number of “views” of the video — is static and unchanging.<\/p>\n

But if you modify the query string in the URL, you can replace the text “Diane Sawyer sex tape” and get the page to display any text you like.<\/p>\n

\"\"<\/a><\/p>\n

Unfortunately, the payload of the page is significantly less amusing.<\/p>\n

The flash_video.exe<\/strong> payload (in repeat performances, the site delivered a file named flash_video_update.exe<\/strong>) was actually an installer of a file we classify to Trojan-DermoDNS<\/strong>, <\/strong>a modified version of the Trojan-Downloader-Dermo<\/strong> that downloads, in addition to an installer for Adware-Sabotch<\/strong>, a payload which modifies the DNS settings of the infected computer so it resolves IP addresses through a server in Russia instead of your local ISP—potentially giving the operator of that Russian server a way to subtly manipulate what appears in the browser on an infected computer.<\/p>\n

Existing bulk-detection signatures are able to squelch the DermoDNS and Sabotch payloads, and all but one of the domains involved in the attack were already blocked in the desktop product’s Communications Shield at the time we discovered the scam. We’ve added the new domain to our latest definitions set.<\/p>\n

But the best way to avoid an infection is to be smart about what you download and run. Refrain from running random applications. If you need to update the Adobe Flash player, head to the official Adobe download site<\/a> to download the latest version, and don’t trust an unknown Web site that claims to deliver Flash to your PC.
\n\"wordpress<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

I just want to take a moment to thank the malware author who posted a spam comment to the Webroot Threat Blog blog the other day. You guys make my job so easy. The spam comment, which reads Hello. I the beginner. I wish to show to you,scandal story and links to a drive-by download […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[4985,7179,7805,7803,4481,7423,7539,7187,7807,4525,18085,3919,23213,7813,4371,7809,7815,4071,4313,4621],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3004"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=3004"}],"version-history":[{"count":2,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3004\/revisions"}],"predecessor-version":[{"id":25847,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3004\/revisions\/25847"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=3004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=3004"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=3004"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=3004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}