Today we have a confluence of several mixed signals, amounting to a bit of confusion and a potential threat. Suppose you were searching Microsoft BingTM for a download of the popular browser, Google Chrome. You might get a screen like this:
 |
And that is just as you would expect it to look. Most people would click on the very top link, which is, as it says right on the page a paid advertisement. You would get redirected to a download page where you could get an immediate connection to download Chrome. This is where that link would take you.
 |
However, if you clicked on the Download button, which is the big blue one in the upper right hand corner, your Internet Explorer browser would interfere, telling you that this download is suspect of infection.
And if you would not pay attention to this, you’ll end up having an infected system. Trend Micro threat response engineer Kathleen Notario noted that once the file is downloaded, it is saved as chrome_11.0.696.68.exe (currently detected as TSPY_ONLINEG.MU) in the system. This spyware then drops cleanhtm.exe and cleanhtm.dll in the %Application Data% directory. These files have rootkit capabilities that enable it to hide its processes and files from the user. TSPY_ONLINEG.MU also modifies the hosts file by adding the following entries:
- {BLOCKED}.{BLOCKED}.118.187 www.google.com
- {BLOCKED}.{BLOCKED}.118.188 search.yahoo.com
- {BLOCKED}.{BLOCKED}.118.188 www.bing.com
This will eventually direct the user to the IP addresses owned by the perpetrators whenever the listed sites are accessed.
Funny that the ad server is not aware of threats the same as the browser. I am not pointing fingers, here. Expect a lot of similar ruses in the near future though: the world of Internet threats has become complicated enough that gaps in the fence are a regularly occurring security story.
Irony Supplement
So who exactly would be using a browser from the largest OS company, and their associated search engine to download a different browser from the largest Search Engine company who now makes an OS and browser with the same name as competition to Big Redmond?
The Point
We live in a developing world. Get all the protection you can stand, especially on your browser. The big boys are not always looking out for you. (BTW, Trend also blocks the site and identifies it as malicious and we have been in touch Microsoft’s security response team about this incident.)
Leave a reply
