We’ve identified a new Blackhat SEO campaign today which targets President Obama as the 2009 Nobel Peace Prize winner among a thousand or so other search terms. Clicking on a malicious search result yields the typical Rogueware campaign.
Search result:
Rogueware site:
The complete list of targeted search terms can be found here.
The criminals behind Rogueware attacks are becoming increasingly aggressive in their approach to make money. We recently stumbled across a sample (Adware/TotalSecurity2009) which uses a ransomware technique to improve its sales. Once the computer becomes infected, Total Security forces the victim to purchase it before it will allow any files from being accessed on the system. When attempting to open a file, a message pops up in the notification area claiming that the application was blocked due to infection. The pop up recommends activating the "antivirus" software, which costs $79.95.
This would be a devistating blow to any user and would likely force the victim to purchase it, so we went ahead and cracked the sample to reveal all of the valid serial numbers. We're hoping that victims can find this blog post before shelling out any hard earned cash to these criminals.
Watch the video to see it in action:
Valid serials for Adware/TotalSecurity2009:
WNDS-TGN15-RFF29-AASDJ-ASD65
WNDS-U94KO-LF4G4-1V8S1-2CRFE
WNDS-6W954-FX65B-41VDF-8G4JI
WNDS-G84H6-S854F-79ZA8-W4ERS
WNDS-TTUYJ-7UO54-G561H-J1D6F
WNDS-A1SDF-6AS4D-RF5RE-79G84
WNDS-A1SDF-RY4E8-7U98D-F1GB2
WNDS-5SRTS-AEHUF-YA54S-D6F35
WNDS-P9685-4H41A-DSW3A-2R64T
WNDS-2AE32-1VFC2-B6894-G67YU
WNDS-4TS8R-D6F5D-4JH8T-U4JK5
WNDS-FGS5D-649RG-4S53D-412SF
WNDS-452S3-ER00F-TSE35-S8FSD
WNDS-SERFH-2642S-F04SD-64FG1
WNDS-F40SA-1ER5H-4FG5D-F8412
WNDS-5D1V2-XB0D5-JT1TY-97DS3
WNDS-4BGY2-JY4KO-IT98Y-7HJ43
WNDS-G8FB6-1V87S-DRT1S-63SRG
WNDS-HFVDR-9844O-U54DA-5TBSC
WNDS-89OF7-7324R-5SAD4-TG68U
WNDS-JUYH3-24GHJ-HGKSH-FKLSD
You can download a free trial to completely remove the infection once the ransomware feature is removed.
Special thanks to Sherab Giovannini for extracting the serials.
You might have heard of the new experiment Google is running for its homepage, showing only logo and search box (and apparently search buttons, at times) unless your mouse moves over the page. To join this prototype, you can go to google.com and type the following into the address bar, then hit return and reload the page:
I'm making this my Google homepage for now to see how it goes, I kinda like it (in my browser I often hit Ctrl + N, type google, hit Ctrl + return, then enter some search string, and hit return again).
Kudos go to JEShack for tracking this cookie!
Please comment in the existing thread.
Update: And thanks to Techcrunch, here's the bit needed to trigger the version that doesn't have search buttons, either:
[Thanks Luke!]
[By Philipp Lenssen | Origin: Join the Minimalist Google Homepage Prototype]
Google has launched Street View imagery for Canada and the Czech Republic. Above are snapshots from Montreal and Prague.
[Thanks TomHTML and Jeffrey!]
[By Philipp Lenssen | Origin: Google Street View for Canada, Czech Republic | Comments]
Joen created a JavaScript bookmark snippet that turns any normal links to PDF files into links that will point to Google’s online PDF viewer. Adobe’s PDF viewer tends to freeze browsing, and Joen finds Google’s viewer “far outshines” it. (Would it make sense to turn this into a Greasemonkey script, too? This would help with the occasional surprise effect when you click on PDF links.)
On a related note, in the Blogoscoped forum when you post a link to a PDF, it will automatically be turned into an embedded, expandable Google Docs PDF viewer gadget (with a secondary link to the actual PDF source). You can give it a try by adding a comment if you like.
[Thanks Joen!]
Update: Turns out there is indeed a Greasemonkey script to do this. [Thanks Branco!]
[By Philipp Lenssen | Origin: Bookmarklet Converts PDF Links to Be Viewed W ... | Comments]
Powered by WordPress