276791 - site installs spyware without user interaction

Status: RESOLVED WORKSFORME

(Firefox :: General, defect)

Description

[hotaru]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.7.5) Gecko/20041107 Firefox/1.0

this site installs spyware on windows computers without user interaction in firefox.

Reproducible: Always

Steps to Reproduce:
1. go to http://www.lyricspy.com/ in firefox (1.0, default settings)
2. watch as spyware is downloaded and installed without user interaction

Actual Results:  
SPYWARE! ON MY TEH COMPUTER! AND A NICE BLUE SCREEN! YAY I GET TO REINSTALL WINDOWS!

Expected Results:  
not installing spyware would be nice...

i'll try to analyze the site later to find out how it works...

Comment 1

[Hermann Schwab]

Did you use Windows Media Player?

Risk Your PC's Health for a Song?
Ads and adware have a new way to get on your computer--through files that appear
to be music and video.
http://www.pcworld.com/news/article/0,aid,119016,00.asp


Read about the trick to install adware below the caption

DRM Loophole

A loophole in the Windows Media DRM process allows companies to create ersatz
media files and link them to adware.....

Comment 2

[OstGote!]

Nothing happens for me at this page. No embedded object or plugin. No download.

Comment 3

[John Collins]

Bad news for all who went there without antivirus....upon visiting the site,
norton discovered a nice High Risk trojan (Trojan.ByteVerify)

Norton AntiVirus 2004's report info:
Source: javainstaller/InstallerApplet.class 
Description: C:\Documents and Settings\[deleted]\Application
Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\javainstaller.jar-3c936701-1c093ecc.zip



Wouldnt visit that site without proper Antivirus, and id disable any java from
running (NB: NOT javascript)

Comment 4

[John Collins]

By the way....

Does anyone know if anything can be done to secure firefox against such viruses
from downloading automatically, given that its through java?

Comment 5

[godsfantasy]

Attachment: Screenshot of warning that Firefox 1.0.2 displayed.

This seems to be done via Java (the installing of the program).
Firefox 1.0.2 successfully defended itself against this attack.
I have Java. 1.5 Update 2 installed on my computer.

Comment 6

[Chris Blore]

-> WORKSFORME

Feel free to reopen should you find the problem to continue but there appears to
be now problem using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2)
Gecko/20050521 Firefox/1.0+.

Comment 7

[Hermann Schwab]

(In reply to comment #6)
> -> WORKSFORME
> 
> Feel free to reopen should you find the problem to continue but there appears to
> be now problem using Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2)
> Gecko/20050521 Firefox/1.0+.

Chris, do you have Java installed and enabled?
Did you test with Java and JS enabled, Adblocker disabled, Popups enabled, flash
not blocked?
 

Comment 8

[Chris Blore]

 > Chris, do you have Java installed and enabled?
> Did you test with Java and JS enabled, Adblocker disabled, Popups enabled, flash
> not blocked?

Yes on all counts. Could not reproduce at all using the latest nightly build.