Malware and pirated ebooks

[ownedbycats]

Originally Posted by jackm8

I don't think that it's about rar files at all. If I read this right, there's a shortcut that looks like a book file (kamasutra.epub.exe), that then installs this trojan.

Originally Posted by DiapDealer

How does kamasutra.epub.exe look like a book file? Surely even the most novice potential book thief knows that ebooks aren't executables.

People aren't opening kamasutra.epub.exe, they're opening kamasutra.rar and extracting it not knowing that it also extracts hidden malware. The user opens the shortcut thinking it's the book but instead it goes to the hidden malware.

The unacev2.dll vulnerability was also used tp extract hidden malware, except it was able to sneak it directly into the Windows startup folder.

[ownedbycats]

edit: delete, merged

[Quoth]

Originally Posted by DiapDealer

How does kamasutra.epub.exe look like a book file? Surely even the most novice potential book thief knows that ebooks aren't executables.

MS decided that windows by default would hide file endings.

So kamasutra.epub.exe shows as kamasutra.epub

Also perhaps unwise was allowing multiple spaces, or spaces at all, such as in email attachments or zipped files:

kamasutra.epub                                                          .exe
important.doc                                                             .exe

Scroll right!

etc, never mind macros in actual real MS Office files.
Or stupidity of ActiveX in Explorer browser.
uPNP (aided and abetted by stupid router defaults)
autorun
3rd party javascript in adverts that are 3rd party sites...

There is no shortage of stupid.

[DiapDealer]

Originally Posted by Quoth

There is no shortage of stupid.

Agreed. But why would anyone care about that sort of stupid getting themselves in trouble (through means only very loosely associated with ebooks) by downloading from pirate sites? Ebooks aren't causing them problems. Their proclivities and stupidity are.

[JSWolf]

Originally Posted by PeterT

Remember that by default Windows does not display file type.... So after expanding the archive they will see kamasutra.epub in the folder....

If Windows is set to show no file extensions then the filename should be kamasutra.exe. That way it will only show as kamasutra and the person will think it's an eBook, click on it and the computer will be well and truly infected.

I've always had file extensions visible. But the other thing to not that obviously gets missed is the icon. If I have ADE installed and it owns .epub, then the icon should be the ADE icon. Even in WinRAR you see the icon at a rather small size.

[JSWolf]

Originally Posted by Quoth

MS decided that windows by default would hide file endings.

So kamasutra.epub.exe shows as kamasutra.epub

Also perhaps unwise was allowing multiple spaces, or spaces at all, such as in email attachments or zipped files:

kamasutra.epub                                                          .exe
important.doc                                                             .exe

Scroll right!

etc, never mind macros in actual real MS Office files.
Or stupidity of ActiveX in Explorer browser.
uPNP (aided and abetted by stupid router defaults)
autorun
3rd party javascript in adverts that are 3rd party sites...

There is no shortage of stupid.

I've read of plenty of "adverts" that contain some sort of virus/malware. It's when site use shoddy 3rd party sites to get the adverts from that they end up infecting users.

[ownedbycats]

Being able to see the file extension doesn't matter in this case - people don't see kamasutra.epub.exe (it's hidden), they're seeing 'this opens the ebook.lnk.'