Full Disclosure mailing list archives
RE: MSN Webcam / Chat Spoof
From: "Richard M. Smith" <rms () computerbytesman com>
Date: Mon, 12 May 2003 10:09:32 -0400
The downloaded ActiveX file can be found at this URL: http://80.96.118.2/ac/mw/MSN_QTPieJess1.exe I ran a strings on the file and the control is called: TIBS Loader module and the ProgID is LoaderCon.LoaderCon. I can't find anything on the Web about this particular ActiveX control, but it wouldn't surprise me that it is part of some sort adult dialer scheme. The control appears to be more of a downloader program and not the adult dialer itself. My question: Why can't an Authenticode certificate present the following information to a user: - Company name - Street address - Phone number - Web site URL - Contact Email address - Company logo - Link to a product description page All this information can be verified when a company applies for a Authenticode signing tool. The current scheme is just plain silly as this MSN scam illustrates. There is simply no way to verify where a piece of software is really coming from. Richard -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Daniel Doèekal Sent: Monday, May 12, 2003 2:08 AM To: full-disclosure () lists netsys com Subject: RE: [Full-disclosure] MSN Webcam / Chat Spoof Browser Plugin is ADULT DIALER - it connects via modem to telephone service and you pay your sexy adventure through your telephone bill. In many cases, there are adult dialers committing fraud - they redirect your dial-up internet connection to very expensive number without your knowledge. -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Richard M. Smith Sent: Monday, May 12, 2003 3:40 AM To: full-disclosure () lists netsys com; secure () microsoft com Subject: RE: [Full-disclosure] MSN Webcam / Chat Spoof You missed the good part. If you actually go to the "MSN" Web site and press the "Connect Now" button, the site tries to download some questionable ActiveX control. Not to worry however: Just press YES in the dialog box when it appears. This operation is totally safe and certified by Microsoft Authenticode The control is signed by "Browser Plugin". I guess Thawte will give anyone an Authenticode certificate nowadays. I wonder who "Browser Plugin" really is?
Current thread:
- MSN Webcam / Chat Spoof morning_wood (May 11)
- RE: MSN Webcam / Chat Spoof Richard M. Smith (May 11)
- <Possible follow-ups>
- RE: MSN Webcam / Chat Spoof Daniel Dočekal (May 11)
- RE: MSN Webcam / Chat Spoof Richard M. Smith (May 12)
- RE: MSN Webcam / Chat Spoof Daniel Dočekal (May 12)
- RE: MSN Webcam / Chat Spoof Richard M. Smith (May 12)
- Re: MSN Webcam / Chat Spoof Valdis . Kletnieks (May 12)
- RE: MSN Webcam / Chat Spoof Richard M. Smith (May 12)
- RE: MSN Webcam / Chat Spoof Richard M. Smith (May 12)
- Re: MSN Webcam / Chat Spoof Steve Poirot (May 13)
- Re: MSN Webcam / Chat Spoof yossarian (May 13)