# Presentation: 070765

## Joe Klemencic  2005

## 

80%+

 Number of machines on the Internet infected with Spyware

* source: TechNewsWorld

- 80%+
-  Number of machines on the Internet infected with Spyware
- * source: TechNewsWorld

## 
28 Items

Number of Spyware items on average

**28 Items**
**Number of Spyware items on average**

- * source: IntranetJournal

## Slide 4

**Notes:**
Look familiar?

## Order of 1 lamp for John Doe submitted.

- Cookie:John Doe ordered 1 lamp

- John Doe likes lamps

- John Doe likes lamps

- While searching for Star Wars items, we noticed that you also like lamps.

**Notes:**
Very high level flow of 3rd party cookies.

## Slide 6

## Slide 7

**Notes:**
You can also get Spyware/Malware from P2P programs, running unknown programs and installing these ‘Web Browser Enhancements’.

## =

**Notes:**
Clicking = $$$ in the Adware/Spyware/Malware authors pockets via ClickThru techniques.

## Slide 9

**Notes:**
Read the EULA!!!!!

## If this is a REAL Windows dialog box, use the ‘X’ to close –OR- use your browsers BACK button.

- if INSTALL_BUTTON is clicked{
- 	install malware.exe
- }

- if NOTHANKS_BUTTON is clicked {
- 	install malware.exe anyway  // Bwhahaa!!!
- }

**If this is a REAL Windows dialog box, use the ‘X’ to close –OR- use your browsers BACK button.**

**Notes:**
Remember, the coder has control over the actions of a click! Are you sure nothing got installed when you clicked the No/Cancel button?

## In this case, the entire dialog box is really a Graphic image. No matter where you click, it will install malware.

- if MOUSECLICK {
-     install malware.exe
- }

**Notes:**
An image that looks like a window!

## Phishing

## Identity Theft:

**Identity Theft:**
- Not limited to relatives or physical theft of personal information (drivers license, credit cards). Most Identity Theft occurs NOT from your on-line transactions, but rather from locally installed software watching your computer OR from compromised machines at the various merchants and banks.

- Just because a web site uses SSL or states it is a ‘Secure Server’ does NOT guarantee your data is safe. All it means is that the communications between your machine and the web site is encrypted (or at least is supposed to be).

***Many banks will NOT honor their fraud policies if the ID theft was due to Phishing.***

## Slide 14

**Notes:**
You can also get infected via email attachments and following Phishing scam links.

## PHARMING(Hijacking Hosts/DNS)

- c:\windows\system32\drivers\etc\hosts or /etc/hosts
- 206.65.183.18  www.microsoft.com
- 206.65.183.18  www.google.com
- 206.65.183.18  www.paypal.com
- 206.65.183.18  www.ebay.com
- 206.65.183.18  home.msn.com
- 206.65.183.18  www.yahoo.com
- 206.65.183.18  mail.yahoo.com
- 206.65.183.18  www.cnn.com
- 206.65.183.18  www.bankone.com
- 206.65.183.18  www.citibank.com

## Cleanup and Prevention

## Slide 17

**Notes:**
Many different SpyWare removal tools. None are 100% effective, so try a few out.

## Slide 18

## Slide 19

**Notes:**
Upgrade to XP SP2 and consider using alternate browsers.

## Don’t click on everything that pops up in front of you and READ the messages!!!

- If unsure, visit a different site.

**Notes:**
Dive into your browsers settings and configure the zones and other scripting handlers.

## Hijack your own windows\system32\drivers\etc\hosts file:
127.0.0.1 www.doubleclick.net
127.0.0.1 ad.doubleclick.net
127.0.0.1 ad.preferences.com
127.0.0.1 ads.doubleclick.com
127.0.0.1 ads.infospace.com
127.0.0.1 ads.msn.com

- 127.0.0.1 www.doubleclick.net
- 127.0.0.1 ad.doubleclick.net
- 127.0.0.1 ad.preferences.com
- 127.0.0.1 ads.doubleclick.com
- 127.0.0.1 ads.infospace.com
- 127.0.0.1 ads.msn.com

- Make your hosts file Read Only:

## Spyware and Phishing Resources

- Current Phishing Scams:
- 	_[http://www.antiphishing.org/](http://www.antiphishing.org/)_
- Spyware Discussions:
- 	_[http://www.spywaremanagement.org/](http://www.spywaremanagement.org/)_
- E-mail Hoax:
- 	_[http://hoaxbusters.ciac.org/](http://hoaxbusters.ciac.org/)_

## Slide 23