So, the Crashed Pips honeypot set up and ready, the first experiment took place. Using a certain search engine and a known supplier of malware.
The honeypot takes forever to boot - virtual machines are generally very slow and resource-intensive on the rest of the system. Windows took around ten minutes to get to a usable desktop.
The usable desktop, before the infectofest started. And now we bring you coverage of experiment #1 - how easy it is for an inexperienced computer user to infect their machine using only Microsoft’s own search engine.
Alarm bells should immediately start to ring at this point - in this case, an outdated version of Internet Explorer is being used, there is no antivirus software (see the system tray’s Windows Security warning) and the fictional user is now going to look, using Windows Live Search, for a screensaver for his/her new setup.
The first organic result here is for screensavers.com, which, according to a SiteAdvisor report, is a distributor of adware and spyware.
So, taking the position of the gullible computer user, here’s the download page for the Matrix screensaver.
‘Virus checked’ and ‘Spyware checked’ are visible below the ‘download’ link. Lies. Lies. Lies. As indicated by the next page:
Uh-oh! Starware is a known spyware distributor, and to an inexperienced computer user this would appear to be quite a good software package. Note that the installer (even without the toolbar) automatically dumps an ‘affiliate shortcut’ on your desktop (essentially an invitation for spam galore).
After the install is complete, you are offered these (seemingly good) options.
Not so. The search engine actually uses your searches to create an advertising profile that helps ads to be delivered (outside the browser) that you are more likely to respond to. It isn’t like Google or most other search engines, which use the search data to optimise the searches. These are used to make you easier to sell to.
And this was just the Starware toolbar that was actually installed.
Aha! The screensaver has finally been installed, after a magnitude of bogus free offers and all sorts of other junk. And we’ve now effectively opened up the honeypot to other spyware/adware etc.
