New OS X trojan injects ads into pages in Chrome, Firefox, and Safari

http://thenextweb.com/insider/2013/03/21/new-os-x-trojan-injects-ads-into-pages-browsed-by-chrome-firefox-and-safari-even-targets-apples-website/

by recoiledsnake • 13 years ago

37 15 13 years ago

thenextweb.com

JagMicker• 13 years ago

Will people ever learn to not install random codec packages? KaZaA / K-Lite, anyone?

Lightning• 13 years ago

Those were the dark days. Then VLC showed up.

mrcharles• 13 years ago

I would love to see stats on how many infections happen per platform based on this virus, since it's on both Windows and OS X.

I would expect to see a higher penetration on Macs, since I assume people using Macs don't have the higher level of paranoia that has been engendered in Windows.

X-Istence• 13 years ago

I don't think any of this has to do with higher level of paranoia. The same reason Windows machines are vulnerable to social engineering attacks are the same reason OS X is vulnerable to it.

---

Hey, I want to watch this video/movie/clip/trailer but I need to download and install this tool first, alright, click click click, hey, my trailer didn't show up. On to the next website I go.

---

There is no good way to stop crap like this either, the user is willingly installing it themselves, people hate the walled garden that iOS has become, and that OS X is becoming with the App Store, yet that is one of the ways that the OS can be secured. You have people up in arms about it being closed off or being inaccessible because of these new restrictions, but at the same time people want to be able to install whatever they want.

Whitelisting is the only real secure way to make sure that the wrong app doesn't run. Blacklisting means you are always chasing the ball and the target.

Samuel_Michon2• 13 years ago

"people hate the walled garden that iOS has become, and that OS X is becoming with the App Store [...] You have people up in arms about it being closed off or being inaccessible"

'People' say a lot of things. I've personally never heard a non-geek complain about Apple's 'walled garden'. Mac and iOS device sales are higher than ever.

weirdcat• 13 years ago

I'd love to see a program that blocks any new installs until approved by a "family geek". When your mother clicks that INSTALL NEW TOOLBAR! link, it emails you with details on the software to be installed, and only after you approve it, your mom is able to proceed with the installation.

Kronopath• 13 years ago

So, Gatekeeper?

It won't send you any emails, but it will prevent rogue software from being installed.

m_d• 13 years ago

I would definitely pay for something like this. The ability to approve installs remotely would be amazing.

cube13• 13 years ago

It would be nice if OSX's security model was extended to require the root password for any application or plugin installer that isn't handled directly within a process.

Samuel_Michon2• 13 years ago

You can set the security preferences in OS X to only allow installation of Mac App Store applications. That minimizes risk greatly.

http://support.apple.com/kb/ht5290

dmix• 13 years ago

Only about 20% of the apps I use I've ever downloaded on Mac app store. But I imagine for some non-tech savvy users this could work.

JonnieCache• 13 years ago

That's a really good idea. Maybe hacking it into the OS like that is going a bit far, but automating the "hey, does this look ok to you?" process is definitely a goer IMO.

scrrr• 13 years ago

Can't the benefactor of this malware not be traced back using the ad-codes he spreads rather easily?

gailees• 13 years ago

I actually had this happen on my windows laptop a few months ago. I initially thought it was Facebook rolling out ridiculous ads haha

https://news.ycombinator.com/item?id=4558985

geocarncross• 13 years ago

I've seen Yontoo for a while now(aka PageRage aka Sambreel), and they're not the only one doing this.

It's trivial for publishers to detect Yontoo's technology, and alert people when it's happening. Something as simple as:

    try{if(new ActiveXObject("YontooIEClient.Api"))found=!0;}catch(e){};
    try{found=!!localStorage['y2LocXML'+location.pathname];}catch(e){};

New OS X trojan injects ads into pages in Chrome, Firefox, and Safari

Related Stories