Virus Warning - FOX News Website (possible firefox/noscript discussion within)

[Alan T]

I didn't see this mentioned anywhere here yet, so figured I would give a heads up. Some point late last week it was confirmed that there is a virus that is affecting people's systems when you visit the foxnews website.

Please note, FOXnews is not attacking people's systems, but instead some of their advertising on the page looks to be infected which when you visit the site and get that particular ad, your system will download an infected trojan (as well as possibly pop up a warning that your system is infected and encouraging you to buy some bogus anti-virus software).

People who use firefox with noscript correctly configured are safe from this attack (as long as you are not in the habit of hitting accept all on every page you visit). If you are against noscript, then this is just another reason why you should consider disabling javascript in your browser as that would also protect you from a site such as this.

Depending on which advertisement you get on this site, you could also get attacked with a more recent adobe acrobat vulnerability that it uses (but requires javascript to be enabled within adobe reader to infect you).

Anyways, this is a little late, but better late than never. If nothing else, just another reason why you need to use safe computing :)

[cartman]

Oh, I can already see the outrage when Google gives a warning that the Fox News website can damage your computer. That has happened with a few other sites where ads they serve have malicious content.

[flere-imsaho]

OK, I'm a bit behind on virus/trojan delivery systems. Are you saying that there are some ads that can install a virus on my computer without my intervention simply because I allow javascript to be run on my browser? No spurious popup to click, no warning from my built-in virus checker?

That would suck.

[Alan T]

OK, I'm a bit behind on virus/trojan delivery systems. Are you saying that there are some ads that can install a virus on my computer without my intervention simply because I allow javascript to be run on my browser? No spurious popup to click, no warning from my built-in virus checker?

That would suck.

Yes, if you do not block javascript in your browser (either as a whole or using an add-on like noscript to specifically block javascript from specific locations), you are at the risk of being infected by a virus without even clicking on anything at all.

This has been a big issue for quite some a time, and it seems common that advertisement for sites are often targets for this type of infection. (even a site like FOFC that has banner ads could be at risk).

Your antivirus could possibly detect it if it has a tie in to your web browser and can prevent you from loading a webpage when you hit a malicious one, but that is not common. Most antivirus software will detect if a file that is malicious is executed or downloaded instead. More recent anti-virus software has gotten better at detecting malicious webpages, but still you are at the mercy of the AV signature being up to date and having a detection pattern for the particular attack that you are encountering.

In order to steal from another hot topic discussion that I am sure people will hate.. this is actually making the internet to be much like sex. You can use protection (AV software) and it should cut out 99% of the viruses.. but the only way to prevent it outright is to just not do it. :)

[RainMaker]

OK, I'm a bit behind on virus/trojan delivery systems. Are you saying that there are some ads that can install a virus on my computer without my intervention simply because I allow javascript to be run on my browser? No spurious popup to click, no warning from my built-in virus checker?

That would suck.

Yeah, I believe in the past they've hit Facebook, Myspace, and other large sites.

[Alan T]

Yeah, I believe in the past they've hit Facebook, Myspace, and other large sites.

The statistics that I read from SANS last fall regarding the IFRAME attacks was there are 6000 new infected websites every day. Most likely anyone here has at some point visited one of the sites that at some point were infected.

[flere-imsaho]

You guys have made me a noscript convert (IE8 made me a Firefox convert).

[Maple Leafs]

Oh great, now we can have a thread that combines politics and firefox talk.

[Alan T]

You guys have made me a noscript convert (IE8 made me a Firefox convert).


I'm not a firefox fan at all. I hate many of the bugs that I find with it. I really would have liked to have used the Google Chrome browser to try it out some. Unfortunately noscript is the -ONLY- reason that I use firefox. If one of the other better browsers ever had that capability (to an effective level), I would switch in a minute.

I hear that the new IE browser is working on getting there, but I do not have enough experience with it to be able to say one way or another if they are there yet. (I haven't heard anything reputable that suggests they are).

If you do use noscript, make sure to disable IFRAMES in it as well. By default they are enabled. To disable IFRAMEs, go into noscript -> Options and click on the Plugins tab. Find the checkbox that says Forbid IFRAME and make sure it is checked. You want to forbid it by default.

A new user of noscript will initially feel more websites are "ugly" as they might look oddly formatted, but after a while you get used to that.

[Alan T]

Oh great, now we can have a thread that combines politics and firefox talk.

Just wait till I start the thread where someone pirates firefox software!

[flere-imsaho]

I really would have liked to have used the Google Chrome browser to try it out some.

My experience with Chrome began and ended with the realization that it wouldn't work with the Google Toolbar (and thus the integrated bookmarks).

Which seemed odd.

[Maple Leafs]

Just wait till I start the thread where someone pirates firefox software!
As long as the pirate is also a Patriots fan.

[sterlingice]

As long as the pirate is also a Patriots fan.

Who just had a gay marriage and an abortion?

SI

[DaddyTorgo]

i use noscript, but i must admit that i'm guilty of allowing all on some pages. i make myself feel better by saying that i'm just allowing the base page (say operationsports.com and not all of the scripts on the page).

[Alan T]

i use noscript, but i must admit that i'm guilty of allowing all on some pages. i make myself feel better by saying that i'm just allowing the base page (say operationsports.com and not all of the scripts on the page).

If you specifically allow operationsports.com and don't allow all, you'll protect yourself from possible infected banner ads or other offsite infections.

Most often when a site is infected, the attacker doesn't load the malicious code onto that server, but instead they inject a line into the html code to point the browser to some other infected site.

So if you were to hit foxnews and got one of the infected banner ads, your no-script would have the option to allow foxnews.com plus some other sites, some of which are the malicious sites.

So I wouldn't go and allow every site that you go to willy nilly, but most of the time you should be ok if you need to allow say operationsports.com (so the private messages show up for instance) if you only choose that site and don't allow all. I wouldn't allow sites just because they seem like a good site. Only take that risk if there is some functionality that you actually need.

[DaddyTorgo]

If you specifically allow operationsports.com and don't allow all, you'll protect yourself from possible infected banner ads or other offsite infections.

Most often when a site is infected, the attacker doesn't load the malicious code onto that server, but instead they inject a line into the html code to point the browser to some other infected site.

So if you were to hit foxnews and got one of the infected banner ads, your no-script would have the option to allow foxnews.com plus some other sites, some of which are the malicious sites.

So I wouldn't go and allow every site that you go to willy nilly, but most of the time you should be ok if you need to allow say operationsports.com (so the private messages show up for instance) if you only choose that site and don't allow all. I wouldn't allow sites just because they seem like a good site. Only take that risk if there is some functionality that you actually need.

phew

i assumed that that was the case, but it's good to hear someone with more knowledge of the subject back me up. yeah...anytime i allow a site it's because i need to allow the base site to get some functionality (like say PM's)

[Maple Leafs]

Who just had a gay marriage and an abortion?
Like there's any other kind.

[SackAttack]

And for some reason people STILL look at me weird when I tell them I won't let Flash or Javascript run in my browser.

[johnnyshaka]

I was under the impression that installing the latest java (6.13, I believe) should sort this out, no?

[SackAttack]

I was under the impression that installing the latest java (6.13, I believe) should sort this out, no?

"Yeah, I accidentally cut your husband's penis off when I was trying to perform surgery on his leg, but I PROMISE I've got it under control this time!"

[Alan T]

I was under the impression that installing the latest java (6.13, I believe) should sort this out, no?

Not really. There are exploits of javascript security holes that got fixed, but there are completely different security holes in other applications (such as adobe reader) that simply uses javascript to execute and are to be fixed with a future adobe update for example.

[cartman]

I was under the impression that installing the latest java (6.13, I believe) should sort this out, no?

Java and javascript are two separate and independent things. There are not related to each other in anyway, except for both containing 'java' in their names. That has been a major point of confusion since javascript came into being.