Comments on: Google and the Drive-by Download http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/ (blog 'DidierStevens) Fri, 21 Nov 2008 02:27:48 +0000 http://wordpress.org/?v=MU hourly 1 By: Didier Stevens http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-21108 Didier Stevens Wed, 28 Nov 2007 21:23:36 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-21108 Made what? Made what?

]]> By: naisioxerloro http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-21071 naisioxerloro Wed, 28 Nov 2007 15:42:20 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-21071 Hi. Good design, who make it? Hi.
Good design, who make it?

]]> By: Fellitmon http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-15920 Fellitmon Wed, 24 Oct 2007 01:22:26 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-15920 view view

]]> By: videomarketingcoach.com » A thousand pictures creates a story of a billion words http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-11388 videomarketingcoach.com » A thousand pictures creates a story of a billion words Wed, 18 Jul 2007 14:00:42 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-11388 [...] Stevens in his post Google and the Drive-by Download takes you step by step through the process of getting infected by a Drive-by [...] [...] Stevens in his post Google and the Drive-by Download takes you step by step through the process of getting infected by a Drive-by [...]

]]> By: Alex B http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-10076 Alex B Mon, 25 Jun 2007 08:28:43 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-10076 Just a heads-up, the upload of service32.exe to Virustotal seems to have failed -- the filesize is 0 and indeed d41d8cd98f00b204e9800998ecf8427e is the MD5 hash of the empy string :) Just a heads-up, the upload of service32.exe to Virustotal seems to have failed — the filesize is 0 and indeed d41d8cd98f00b204e9800998ecf8427e is the MD5 hash of the empy string :)

]]> By: Keys Corner » Blog Archive » One in 10 websites malicious http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-4970 Keys Corner » Blog Archive » One in 10 websites malicious Fri, 11 May 2007 21:01:28 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-4970 [...] there is a good short introduction for “non-techies” here. And here’s a report showing how easy it is to get infected if you don’t pay attention properly, just by googling for a plumber and clicking on one of the results [...] [...] there is a good short introduction for “non-techies” here. And here’s a report showing how easy it is to get infected if you don’t pay attention properly, just by googling for a plumber and clicking on one of the results [...]

]]> By: Didier Stevens http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-289 Didier Stevens Tue, 05 Dec 2006 10:12:29 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-289 I wrote "I’ve encountered ...", this doesn't imply I got bitten by this ;-) I wrote “I’ve encountered …”, this doesn’t imply I got bitten by this ;-)

]]> By: anonymous http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-288 anonymous Tue, 05 Dec 2006 05:41:10 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-288 Dear Mr Stevens, How come someone so smart about reverse-engineering is not so wise about firewalling and ad blocking? That totally blows me away. Funny thing is I found this thread from http://www.astalavista.com/index.php?section=directory&cmd=detail&id=6972 this thread. And didn't expect to see something like this. Out of respect for what you do, I highly suggest some basic tcpip understanding, and an external firewall like ipcop along with ad block plus, kerio, or any other proxy / ad blocking methods that fit your fancy. My only real CRITIQUE here is I hate to see someone say, "1. Start Internet Explorer." WRONG. DON'T RUN iexplorer.exe in fact RENAME IT to iexplorer.e (If you have to run it for a BANK of WHATEVER rename it again) Now my Value add to the discussion. I ain't no expert on security but it you want your windows box to run longer than 4 years. Personally, I do ipcop externally dedicated. With URL Filter, Banish (with some serious fsckin blacklists), and a couple little personally hacked up codes for it. Windows Boxes: kerio (The FULL ONE not the FREE ONE), then filter out with the ad block. ztree is "the shit" for tracking down bad files/virus's and code (I use it instead of a virus scanner) Okay, sometimes I run ewido... Sometimes I whip out some strange shit like proximotron. Sometimes others, sometimes wget only. Spampal+TheBat html=OFF (Files are backed up all the time) note: To all the *NIX freaks, There is a reason to run windows boxes! VIDEO PRODUCTION! cinelerra sux Linux Boxes: iptables + adblock + nice backup of the OS (I could care less about files, I burn disks all the time) midnight commander "mc" is the equal of ztree on linux. (fact there's a mc for windows out there too, nice for drive to drive grafting.) Got an linux extra box? Add a syslog, and etherape window. Boom your now kicking your home network's ass! Okay, hope you didn't take this wrong. The more I read the thread here, the more I realized I don't SEE Google Drive-By's, they're blocked or something. (I actually had to load that jpg3 or whatever to see what you were talking about) I analyze the network and my files probably too much, but I also keep my shit running for years not days then reformat. One thing I been looking for is a full windows XP registry backup. No utility I have seen yet does that. The closest I come to that is Doing an Acronis True Image of the whole drive to drive. It's far more important to be able to track down things than worry about blocking the latest unknown problem, in my opinion. Problems are going to happen, how you can deal with it is what matters. Sorry if I was wordy, and too chickenshit to post a real name / real handle, I probably typed this crap up in vain. Dear Mr Stevens,

How come someone so smart about reverse-engineering is not so wise about firewalling and ad blocking? That totally blows me away.

Funny thing is I found this thread from http://www.astalavista.com/index.php?section=directory&cmd=detail&id=6972 this thread.

And didn’t expect to see something like this. Out of respect for what you do, I highly suggest some basic tcpip understanding, and an external firewall like ipcop along with ad block plus, kerio, or any other proxy / ad blocking methods that fit your fancy.

My only real CRITIQUE here is I hate to see someone say, “1. Start Internet Explorer.” WRONG.

DON’T RUN iexplorer.exe in fact RENAME IT to iexplorer.e (If you have to run it for a BANK of WHATEVER rename it again)

Now my Value add to the discussion.
I ain’t no expert on security but it you want your windows box to run longer than 4 years.

Personally, I do ipcop externally dedicated. With URL Filter, Banish (with some serious fsckin blacklists), and a couple little personally hacked up codes for it.

Windows Boxes: kerio (The FULL ONE not the FREE ONE), then filter out with the ad block. ztree is “the shit” for tracking down bad files/virus’s and code (I use it instead of a virus scanner) Okay, sometimes I run ewido…
Sometimes I whip out some strange shit like proximotron. Sometimes others, sometimes wget only. Spampal+TheBat html=OFF (Files are backed up all the time)
note: To all the *NIX freaks, There is a reason to run windows boxes! VIDEO PRODUCTION! cinelerra sux

Linux Boxes: iptables + adblock + nice backup of the OS (I could care less about files, I burn disks all the time) midnight commander “mc” is the equal of ztree on linux. (fact there’s a mc for windows out there too, nice for drive to drive grafting.)

Got an linux extra box? Add a syslog, and etherape window. Boom your now kicking your home network’s ass!

Okay, hope you didn’t take this wrong. The more I read the thread here, the more I realized I don’t SEE Google Drive-By’s, they’re blocked or something. (I actually had to load that jpg3 or whatever to see what you were talking about) I analyze the network and my files probably too much, but I also keep my shit running for years not days then reformat.

One thing I been looking for is a full windows XP registry backup. No utility I have seen yet does that. The closest I come to that is Doing an Acronis True Image of the whole drive to drive. It’s far more important to be able to track down things than worry about blocking the latest unknown problem, in my opinion. Problems are going to happen, how you can deal with it is what matters.

Sorry if I was wordy, and too chickenshit to post a real name / real handle, I probably typed this crap up in vain.

]]> By: Update 3: Google and the Drive-by Download « Didier Stevens http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-263 Update 3: Google and the Drive-by Download « Didier Stevens Sun, 19 Nov 2006 09:18:21 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-263 [...] A few days ago I Googled again for Vanderelst Chauffagiste (Google and the Drive-by Download), I noticed the Spamdexing “R” Us site has disappeared from the SERPs. But it still exists. [...] [...] A few days ago I Googled again for Vanderelst Chauffagiste (Google and the Drive-by Download), I noticed the Spamdexing “R” Us site has disappeared from the SERPs. But it still exists. [...]

]]> By: Spamdexing “R” Us « Didier Stevens http://blog.didierstevens.com/2006/10/06/google-and-the-drive-by-download/#comment-180 Spamdexing “R” Us « Didier Stevens Mon, 23 Oct 2006 10:17:14 +0000 http://didierstevens.wordpress.com/2006/10/06/google-and-the-drive-by-download/#comment-180 [...] Still wondering how likely is it to land on a drive-by download page when doing a (Google) search, I analyzed the infamous AOL search data to try to answer this question. [...] [...] Still wondering how likely is it to land on a drive-by download page when doing a (Google) search, I analyzed the infamous AOL search data to try to answer this question. [...]

]]>