View Full Version : "Typosquatting": Beware how you Google

Monday, May 2nd, 2005, 09:30 PM
A simple misspelling of Google's domain name could lead to a Web surfer's worst nightmare.

In a new twist to the old practice of "typosquatting," virus writers have registered a slight variation of Google Inc.'s popular search-engine site to take advantage of any users who botch the spelling of the google.com URL.

The malicious site, googkle.com, is infested with Trojan droppers, downloaders, backdoors and spyware, and an unsuspecting user only has to visit the page to be at risk of computer hijack attacks, according to a warning from Finnish anti-virus vendor F-Secure Corp.

When googkle.com is opened in a browser, two pop-up windows are immediately launched with redirects to third-party sites loaded with scripts. One of the sites, ntsearch.com, downloads and runs a "pop.chm" file, and the other, toolbarpartner.com, downloads and runs a "ddfs.chm" file, F-Secure said.

"Both files are downloaded using exploits and they contain exploits themselves to run embedded executable files. One of the Web pages of the 'toolbarpartner.com' website downloads a file named 'pic10.jpg' using an exploit. This JPG file is actually an executable that replaces [the] Windows Media Player application," the warning reads.

The typosquatters also launch a steady stream of pop-up Web pages with different .exe files.

One batch of exploits loads a malware package that includes two backdoors, two Trojan droppers, a proxy Trojan, a spying Trojan and a Trojan downloader.

It is not yet clear if the attack vector takes advantage of an unpatched version of Microsoft Corp.'s Internet Explorer. Redmond officials could not be reached for comment.

According to F-Secure's alert, the attack scenario also includes a separate Trojan dropper that copies itself to the Windows System folder with a random name and drops a DLL that modifies the HOSTS file to block connection to several anti-virus Web sites.

Another executable also drops a DLL file into the Windows System folder and prompts a fake virus alert on a desktop. The fake alert warns the user about a computer infection and prompts the user to yet another malicious site promising virus protection.

The Web site offers links to several different sites offering anti-virus and spyware cleaners for download. Those downloads all turn out to be a "toolbar.exe" file that is actually an adware installer, which installs a spyware toolbar known as "Perez," F-Secure said.

The practice of typosquatting was first spotted in the late 1990s and was a common tactic for pornography sites, used to generate traffic from misspelled Internet addresses.

Check out eWEEK.com's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog.

from: Yahoo News (http://news.yahoo.com/s/zd/150820;_ylt=Ahkprqa9wO3p0SEnn_OceMAjtBAF ;_ylu=X3oDMTBiMW04NW9mBHNlYwMlJVRPUCUl)

Monday, May 2nd, 2005, 09:34 PM
Finnish anti-virus vendor F-Secure Corp.


Monday, May 2nd, 2005, 09:39 PM
:) seems the Finns are always on the ball, technologically speaking. Ahh where would I be without Linux?

Monday, May 2nd, 2005, 09:43 PM
I've been using F-Prot since the early 90s, when it came on a single 1.44MB Disk!

Those were the days.

Thursday, May 12th, 2005, 06:02 PM
F-Prot has always been the architecturally most secure solution to virus problems.

To avoid spyware:

(a) use firefox browser
(b) install kerio personal firewall
(c) in browser, disable ActiveX, java/javascript, and do not install flash player

You can visit any website in the world with those settings and you will have no problems :)

Also, Nordic browser Opera is quite secure, but they charge $starofdavid$ for it.