Malware and pirated ebooks

[ownedbycats]

Originally Posted by jackm8

I don't think that it's about rar files at all. If I read this right, there's a shortcut that looks like a book file (kamasutra.epub.exe), that then installs this trojan.

Originally Posted by DiapDealer

How does kamasutra.epub.exe look like a book file? Surely even the most novice potential book thief knows that ebooks aren't executables.

People aren't opening kamasutra.epub.exe, they're opening kamasutra.rar and extracting it not knowing that it also extracts hidden malware. The user opens the shortcut thinking it's the book but instead it goes to the hidden malware.

The unacev2.dll vulnerability was also used tp extract hidden malware, except it was able to sneak it directly into the Windows startup folder.

[ownedbycats]

edit: delete, merged

[Quoth]

Originally Posted by DiapDealer

How does kamasutra.epub.exe look like a book file? Surely even the most novice potential book thief knows that ebooks aren't executables.

MS decided that windows by default would hide file endings.

So kamasutra.epub.exe shows as kamasutra.epub

Also perhaps unwise was allowing multiple spaces, or spaces at all, such as in email attachments or zipped files:

kamasutra.epub                                                          .exe
important.doc                                                             .exe

Scroll right!

etc, never mind macros in actual real MS Office files.
Or stupidity of ActiveX in Explorer browser.
uPNP (aided and abetted by stupid router defaults)
autorun
3rd party javascript in adverts that are 3rd party sites...

There is no shortage of stupid.

[DiapDealer]

Originally Posted by Quoth

There is no shortage of stupid.

Agreed. But why would anyone care about that sort of stupid getting themselves in trouble (through means only very loosely associated with ebooks) by downloading from pirate sites? Ebooks aren't causing them problems. Their proclivities and stupidity are.

[JSWolf]

Originally Posted by PeterT

Remember that by default Windows does not display file type.... So after expanding the archive they will see kamasutra.epub in the folder....

If Windows is set to show no file extensions then the filename should be kamasutra.exe. That way it will only show as kamasutra and the person will think it's an eBook, click on it and the computer will be well and truly infected.

I've always had file extensions visible. But the other thing to not that obviously gets missed is the icon. If I have ADE installed and it owns .epub, then the icon should be the ADE icon. Even in WinRAR you see the icon at a rather small size.

[JSWolf]

Originally Posted by Quoth

MS decided that windows by default would hide file endings.

So kamasutra.epub.exe shows as kamasutra.epub

Also perhaps unwise was allowing multiple spaces, or spaces at all, such as in email attachments or zipped files:

kamasutra.epub                                                          .exe
important.doc                                                             .exe

Scroll right!

etc, never mind macros in actual real MS Office files.
Or stupidity of ActiveX in Explorer browser.
uPNP (aided and abetted by stupid router defaults)
autorun
3rd party javascript in adverts that are 3rd party sites...

There is no shortage of stupid.

I've read of plenty of "adverts" that contain some sort of virus/malware. It's when site use shoddy 3rd party sites to get the adverts from that they end up infecting users.

[ownedbycats]

Being able to see the file extension doesn't matter in this case - people don't see kamasutra.epub.exe (it's hidden), they're seeing 'this opens the ebook.lnk.'

[JSWolf]

Originally Posted by ownedbycats

Being able to see the file extension doesn't matter in this case - people don't see kamasutra.epub.exe (it's hidden), they're seeing 'this opens the ebook.lnk.'

If I was downloading an eBook, I would just get the eBook out of the archive and leave the rest of the files there. I would also check the code before trying to view it.

[Quoth]

Originally Posted by ownedbycats

Being able to see the file extension doesn't matter in this case - people don't see kamasutra.epub.exe (it's hidden), they're seeing 'this opens the ebook.lnk.'

That ought to make people suspicious, but of course it probably doesn't.

Reminds me of the very obvious scam emails. Apparently some security researchers think they are meant to look obviously dodgy to most people. The scammers only want the naive and gullible to respond because the next stage takes up human time.

Long ago malware was simply about messing up your computer, but now it's either criminals making money or "state actors" attacking infrastructure. So maybe this isn't meant to be clever or subtle. What is the purpose of this alleged malware (which it does sound like it's a less likely route)? I mean it's hardly likely to be Revenge of the House of Random Penguins against copyright violation.

[ZodWallop]

Originally Posted by JSWolf

...But the other thing to not that obviously gets missed is the icon. If I have ADE installed and it owns .epub, then the icon should be the ADE icon. Even in WinRAR you see the icon at a rather small size.

Yeah, I agree. I have Sigil set to open ePubs. If I have a 'book file' that isn't displaying the Sigil icon, something is wrong.

[Quoth]

Originally Posted by JSWolf

If I was downloading an eBook, I would just get the eBook out of the archive and leave the rest of the files there. I would also check the code before trying to view it.

Somehow though I can't imagine you are their target.

[theducks]

Originally Posted by Quoth

That ought to make people suspicious, but of course it probably doesn't.

Reminds me of the very obvious scam emails. Apparently some security researchers think they are meant to look obviously dodgy to most people. The scammers only want the naive and gullible to respond because the next stage takes up human time.

.

I had not considered that when I got a pretty obvious scam mail.