Goodness gracious, great Chinese 'Fireball' malware infects 250m systems worldwide A strain of Chinese browser-hijacking malware dubbed Fireball has infected 250 million computers. The malware takes over web browsers and turns them into zombies, security firm Check Point warns. Fireball is capable of executing any code on the infected machines, resulting in a wide range of actions from stealing credentials …
From the article, IIUC, the infection is performed as part of the install of a downloaded program that the user has chosen to install, so the infection vector is similar to the pre-ticked "yes I want Yahoo Toolbar" option we see with other, legitimate installs, except in this case you don't even get asked. This strongly implies that the installer has to be able to execute on the target OS.
It isn't. We can thank Yahoo, Google and (perhaps worst of all, given their line of business) AVG for training end-users to believe that this sort of behaviour is acceptable.
(BTW: still waiting for the AV product that has the balls to correctly identify drive-by installs of these as malware, and quarantine them accordingly.)
(AND: you can add Java updates with their wretched Ask toolbar to the list as well.)
Thanks Reg, as usual for ensuring us stressed sysadmins are aware of these threats to our users & livelihoods. However I'd have ask to what priveledge level is required for execution here? Is this an admins only issue? Or does this leverege the user's write access to AppData, like a chrome install? Any known bundles? Which OS' ?
Also I heartily agree with previous commenters when drawing likenesses with AVG, Yahoo and Google for Thier shiteware. Much like iOS, adware isn't illegal, but clearly immoral.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
