Malware and pirated ebooks

[ownedbycats]

Originally Posted by jackm8

I don't think that it's about rar files at all. If I read this right, there's a shortcut that looks like a book file (kamasutra.epub.exe), that then installs this trojan.

Originally Posted by DiapDealer

How does kamasutra.epub.exe look like a book file? Surely even the most novice potential book thief knows that ebooks aren't executables.

People aren't opening kamasutra.epub.exe, they're opening kamasutra.rar and extracting it not knowing that it also extracts hidden malware. The user opens the shortcut thinking it's the book but instead it goes to the hidden malware.

The unacev2.dll vulnerability was also used tp extract hidden malware, except it was able to sneak it directly into the Windows startup folder.

[ownedbycats]

edit: delete, merged

[Quoth]

Originally Posted by DiapDealer

How does kamasutra.epub.exe look like a book file? Surely even the most novice potential book thief knows that ebooks aren't executables.

MS decided that windows by default would hide file endings.

So kamasutra.epub.exe shows as kamasutra.epub

Also perhaps unwise was allowing multiple spaces, or spaces at all, such as in email attachments or zipped files:

kamasutra.epub                                                          .exe
important.doc                                                             .exe

Scroll right!

etc, never mind macros in actual real MS Office files.
Or stupidity of ActiveX in Explorer browser.
uPNP (aided and abetted by stupid router defaults)
autorun
3rd party javascript in adverts that are 3rd party sites...

There is no shortage of stupid.

[DiapDealer]

Originally Posted by Quoth

There is no shortage of stupid.

Agreed. But why would anyone care about that sort of stupid getting themselves in trouble (through means only very loosely associated with ebooks) by downloading from pirate sites? Ebooks aren't causing them problems. Their proclivities and stupidity are.

[JSWolf]

Originally Posted by PeterT

Remember that by default Windows does not display file type.... So after expanding the archive they will see kamasutra.epub in the folder....

If Windows is set to show no file extensions then the filename should be kamasutra.exe. That way it will only show as kamasutra and the person will think it's an eBook, click on it and the computer will be well and truly infected.

I've always had file extensions visible. But the other thing to not that obviously gets missed is the icon. If I have ADE installed and it owns .epub, then the icon should be the ADE icon. Even in WinRAR you see the icon at a rather small size.

[JSWolf]

Originally Posted by Quoth

MS decided that windows by default would hide file endings.

So kamasutra.epub.exe shows as kamasutra.epub

Also perhaps unwise was allowing multiple spaces, or spaces at all, such as in email attachments or zipped files:

kamasutra.epub                                                          .exe
important.doc                                                             .exe

Scroll right!

etc, never mind macros in actual real MS Office files.
Or stupidity of ActiveX in Explorer browser.
uPNP (aided and abetted by stupid router defaults)
autorun
3rd party javascript in adverts that are 3rd party sites...

There is no shortage of stupid.

I've read of plenty of "adverts" that contain some sort of virus/malware. It's when site use shoddy 3rd party sites to get the adverts from that they end up infecting users.

[ownedbycats]

Being able to see the file extension doesn't matter in this case - people don't see kamasutra.epub.exe (it's hidden), they're seeing 'this opens the ebook.lnk.'

[JSWolf]

Originally Posted by ownedbycats

Being able to see the file extension doesn't matter in this case - people don't see kamasutra.epub.exe (it's hidden), they're seeing 'this opens the ebook.lnk.'

If I was downloading an eBook, I would just get the eBook out of the archive and leave the rest of the files there. I would also check the code before trying to view it.

[Quoth]

Originally Posted by ownedbycats

Being able to see the file extension doesn't matter in this case - people don't see kamasutra.epub.exe (it's hidden), they're seeing 'this opens the ebook.lnk.'

That ought to make people suspicious, but of course it probably doesn't.

Reminds me of the very obvious scam emails. Apparently some security researchers think they are meant to look obviously dodgy to most people. The scammers only want the naive and gullible to respond because the next stage takes up human time.

Long ago malware was simply about messing up your computer, but now it's either criminals making money or "state actors" attacking infrastructure. So maybe this isn't meant to be clever or subtle. What is the purpose of this alleged malware (which it does sound like it's a less likely route)? I mean it's hardly likely to be Revenge of the House of Random Penguins against copyright violation.

[ZodWallop]

Originally Posted by JSWolf

...But the other thing to not that obviously gets missed is the icon. If I have ADE installed and it owns .epub, then the icon should be the ADE icon. Even in WinRAR you see the icon at a rather small size.

Yeah, I agree. I have Sigil set to open ePubs. If I have a 'book file' that isn't displaying the Sigil icon, something is wrong.

[Quoth]

Originally Posted by JSWolf

If I was downloading an eBook, I would just get the eBook out of the archive and leave the rest of the files there. I would also check the code before trying to view it.

Somehow though I can't imagine you are their target.

[theducks]

Originally Posted by Quoth

That ought to make people suspicious, but of course it probably doesn't.

Reminds me of the very obvious scam emails. Apparently some security researchers think they are meant to look obviously dodgy to most people. The scammers only want the naive and gullible to respond because the next stage takes up human time.

.

I had not considered that when I got a pretty obvious scam mail.

[haertig]

Originally Posted by DiapDealer

In my mind, anything that might possibly make people think twice about downloading illicit versions of ebooks from pirate sites (or gets their computer trashed for being ignorant/arrogant enough to do so) is a good thing.

It is possible to end up on a pirate website when not intending to. This I expect would be extremely rare, but it can happen. It happened to me once several years ago. I don't remember the book I was looking for, but I did a simple Google search on the title. Somehow I ended up on "that big pirate site that had it's domains seized a few years ago" (I'm sure we can't/shouldn't name it here). At the time, I had never heard of this site, but I was suspicious once I got there. I was not expecting to find the book I was searching for as a free download. I think I might have even posted a question on a forum (here?) asking if the place was legit.

I would say shut down the pirate sites, but don't poison-pill them with malware as a deterrent to pirates. You're bound to get an innocent every now and then. And I'm willing to bet that most pirates are well aware of the dangers they face in their trade, and don't do stupid stuff like running .exe files from places that they know are pirate sites - places that they actively seek out.

[crich70]

Originally Posted by Sirtel

Seems to me that the ebooks themselves don't contain malware, the archives do. Why should anyone want to run an unknown executable from a random rar archive when they actually wanted an ebook is beyond me, but people are capable of doing some very stupid things.

It goes to prove that you are really very unlikely to really get something for nothing (if you go about it the wrong way). There are plenty of legitimate sites with legitimate free books (both Public Domain and otherwise) out there. Why take the risk of having your system corrupted just to get a (potential) freebee?

[Sirtel]

Originally Posted by crich70

It goes to prove that you are really very unlikely to really get something for nothing (if you go about it the wrong way). There are plenty of legitimate sites with legitimate free books (both Public Domain and otherwise) out there. Why take the risk of having your system corrupted just to get a (potential) freebee?

I expect most folks who download pirated books want specific books from big publishers, the legal versions of which are neither free nor cheap. I'm also pretty sure that those who are used to pirating and have done so for years know how to avoid such dangers; it's only an occasional naive newbie who gets the malware, because they don't know any better.