ZeroPaid.com » exploit

What countries have the riskiest websites?

soulxtc — Thu, 15 Mar 2007 16:03:14 +0000

One of the world’s leading security technology companies breaks down the world’s countries that have the most number of web sites with malicious downloads, browser exploits and spam.

McAfee recently announced the results of its SiteAdvisor research report which created a global road map of the riskiest, and the safest, places to surf and search on the internet.

It analyzed and ranked 265 top-level domains like Japan (.jp), France (.fr) and Commercial (.com) based on McAfee’s Web safety tests for spyware, spam, exploits and scams.

The report is called “Mapping the Mal Web,” and unsurprisingly reveals large differences in safety from one domain to another. It estimates that each month, internet users make more than 550 million clicks to “risky” Web sites and that even relatively safe domains like Germany (.de) or the United Kingdom (.uk) account for millions of risky clicks.

“With this report, McAfee has created a guide book to the Web’s most dangerous top level domains,” said Mark Maxwell, Senior Product Manager, McAfee Consumer and Small Business. “When it comes to safety, it turns out that the Web is no different than the physical world. There are safe neighborhoods and safe Web domains, and then there are places no one should ever visit.”

In compiling its report, McAfee’s Site Advisor added an intuitive red, yellow, or green ratings to sites and search results based on proprietary tests of millions of Web sites representing more than 95% of the trafficked Web.

Red ratings were given to risky sites that fail one or more of McAfee’s tests for adware, spyware, viruses, exploits, spammy e-mail, excessive pop-ups or strong affiliations with other red-rated sites. Green- rated sites passed each of these tests. Lastly, Yellow ratings were given to sites which passed McAfee’s safety tests but, which still have nuisances, such as excessive pop-ups, which thereby warrant a user advisory.

Key Findings?

The incidence of red and yellow sites varies dramatically across top- level domains, ranging from a low of 0.1% for Finland (.fi) to a high of 10.1% for the tiny island of Tokelau (.tk). Overall, 4.1% of all sites tested by SiteAdvisor are rated red or yellow.
Some Web activities, like registering at a site or downloading a file, are significantly more risky when done at certain domains. For example, giving an e-mail address to a random .info domain results in a stunning 73.2% chance of receiving spammy e-mail.
The most risky large country domains are Romania (.ro, 5.6% risky sites) and Russia (.ru, 4.5% risky sites). These country domains are also the most likely to host exploit or “drive-by-download” sites.
“.info” is the riskiest generic domain, with 7.5% of its sites rated as risky. .com is the second most risky generic domain, with 5.5% of sites rated as risky.
“.gov” is the only frequently tested domain for which SiteAdvisor has found no risky sites. .gov is only available to United States government agencies.
A consumer is almost 12 times more likely to encounter a drive-by-download while surfing Russian domains as Columbian ones.
Registering at a Web site in India results in a 4.3% chance of getting spammy e-mail. Taking the same action with a domain registered in China yields a 7.2% chance.
5.2% of Vietnamese Web sites have risky downloads. Just 0.5% of Singaporean sites host such files.
2.7 million times every month, casual Web surfers visit risky Dutch Web sites. Even though Hong Kong has approximately the same percentage of risky Web sites, those risky domains receive just 52,000 clicks each month.
Four of the five least risky country TLDs(top level domains) are Nordic countries – Finland (0.10%), Norway (.no, 0.16%), Sweden (.se, 0.21%) and Iceland (.is, 0.19%). Ireland (.ie, 0.11%) rounds out the top five least risky country TLDs.
Even though the Netherlands (.nl), Germany (.de) and the United Kingdom (.uk) are all relatively safe TLDs, ranking 31st, 33rd and 51st most risky, each of their TLDs account for more than 2 million clicks to red and yellow sites every month. Likewise Japan (.jp) is ranked 57th most risky and yet red and yellow rated .jp sites receive an estimated 1.6 million clicks each month.

Risk by region?
Asia/Pacific

The countries of China (.cn) and South Korea (.kr) were found to be the riskiest major country domains in the Asia/Pacific region, with 3.7% and 2.6% of their sites rated as risky, respectively. Japan and Australia (.au) are overwhelmingly less risky, with just 0.4% and 0.2% risky sites, respectively.

Europe and the Middle East

Romania and Russia are considered to be the most risky domains in the Europe/Middle East region, with 5.6% and 4.5% risky results, respectively. By contrast, Germany, the region’s domain with the most tested sites, has just over 1% risky sites.

The Americas

Here in my own backyard, Latin American and South American countries are somewhat safer than countries in other regions. According to a recent study Internet penetration rates in Latin and South American countries are modest. 19.8% of Argentineans, 18.6% of Mexicans and 11.3% of Brazilians are online. By comparison, 70.5% of South Koreans and 63.6% of Americans are online.

McAfee apparently found that economically motivated scammers seek out the largest Web audiences possible in order to maximize their profit potential.

At 2.1% red and yellow, the United States (.us) is the riskiest TLD in the Americas, while Venezuela (.ve) is the riskiest TLD in Latin and South America, with 1.5% of sites rated as risky. Brazil (.br), Mexico (.mx) and Argentina (.ar) are all relatively safe domains, each with just under one percent risky sites.

Riskiest for Downloads?

Of those sites with tested downloads, Somoa (.ws), .biz and Bulgaria (.bg) are the riskiest. 14.0%, 11.4% and 9.9%. In other words, among the ese country’s TLDs you have at least a 1 in 10 chance of downloading from a risky site.

Riskiest for Spam?

An astonishing 73.2% of the more than 6,000 .info sites that McAfee tested for e-mail practices are rated risky, meaning that SiteAdvisor registrations at these sites resulted in the receipt of high volume e-mail, spammy e-mail or both.

Russia and South Korea trail the .info TLD with 21.7% and 19.6% respectively. While less risky than registering at a .info domain, consumers who provide their e-mail addresses to randomly chosen Korean or Russian domains have a 1 in 5 chance of receiving high volume e-mail, highly commercial e-mail or both.

Riskiest for Exploits?

You are more than 5 times as likely to encounter an exploit site while browsing a .nu or .ru based site than while surfing .com TLDs. In fact, the tiny island of Niue and the massive Russia vie for the domain most frequently used to launch an exploit or drive-by-download type attack. While rare – just 0.45% and 0.43% of sites tested, respectively – exploits are arguably one of the most dangerous kinds of threats that Internet users face today because successful exploits can lead to permanent computer failure and identity theft.

Which Domains are the Safest?

Four of the five least risky country TLDs are the Nordic countries: Finland (0.10%), Norway (0.16%), Sweden (0.21%) and Iceland (0.19%). Ireland (0.11%) rounds out the top five least risky country TLDs.

McAfee feels that the reason these countries have the safest TLDs is due to the fact that their governments have stricter regulations of these domains. Registrations in Norway are limited to companies registered with the government. Prior to 2003, Finland and Sweden had similar requirements.

“.gov” is the only frequently tested TLD for which SiteAdvisor found no risky sites. “.edu” is also apparently quite safe, with just 0.3% of sites rated risky. It makes sense in both cases since there are strict registration requirements which obviously limit who can operate sites with these domains.

Which Domains are the Riskiest?

Seven TLDs (.com, .info, .net, .biz, Tuvalu (.tv), Cocos Islands (.cc), and China (.cn)) earn the dubious distinction of ranking in the top 20 riskiest for each of the four risky facets we examined.

Of these seven domains, .biz and .info are the overall worst domains with highly risky rankings in each of the four categories:

“.info” ranks 2nd in overall risk, 1st in spam, 10th in download risk, and 12th in exploit risk.

“.biz” ranks 6th in overall risk, 6th in spam, 2nd in download risk, and 5th in exploit risk.

Conclusions?

I think it’d have to be the fact that once again, NEVR, EVER DOWNLOAD anything from sites you either don’t know or are from a suspect location or domain.

For example, thinking of purchasing an item from a site located in Russia and they are requesting your credit card info? Probably not a good idea to say the least. Is it unfair to legitimate Russian sites? Yes but, I don’t think the legitimate Russian sites will exactly line up in droves to help you fix your credit or repay lost money if a site steals your credit card info or fails to send you an item as promised. It’s called “street smarts.”

Furthermore, when it comes to spam an unwanted e-mail its best to have what I call a “dump mailbox,” an e-mail account that you use only for the purposes of registering or activating site memberships, promotions, or other online activities that involve sites that you never want to hear from in a million years.

Moreover, an ounce of prevention is worth a pound of cure, and simply avoiding unknown sites or shady sounding deals can go a long way towards keeping you and your PC safe.

digg_url = ‘http://digg.com/security/What_countries_have_the_riskiest_websites’;

SOULXTC: “walkin’ the streets of P2P”

Greedy Torrent – “The Survival Kit for a Leech”

soulxtc — Wed, 14 Mar 2007 18:25:32 +0000

There’s another bad boy on the block and his name is GreedyTorrent.

Following in the footsteps of RatioMaster and the like, GreedyTorrent is the latest and greatest ratio cheating software program to shake the BitTorrent community.

The freeware software program that pledges to help you boost your BitTorrent upload ratio was developed by Alex N J, a freelance software and web developer, based in India.

GreedyTorrent was developed in C++ using wxWidgets 2.6.3 library http://www.wxWidgets.org), to make porting to different platforms easier in the future. It was compiled using MinGW+MSYS and the installation package was created using Inno Setup.

How Does it Work?

GreedyTorrent is implemented as a proxy for the BitTorrent tracker protocol. Once installed, it sits in the system tray and waits for the BitTorrent client server to make a request to the torrent tracker. Once the BitTorrent client server is connected and attempts to report the uploaded quantity, GreedyTorrent modifies the upload ratio to report the results according to your predetermined preferences.

GreedyTorrent advertises the ability to be in control of your upload ratio, which you can set to be increased as a multiple of either your download or upload speeds. For example, to maintain a 1:1 ratio for a poor uploader, a multiple of 1 times the actual download would be enough. This has the advantage that the torrent file you download always maintains 1:1 ratio, no matter how poor your actual upload speed is. Suppose you have a fair upload speed and you just want to double your upload ratio. You can select a multiple that is twice the upload.

Features and advantages?

Unlike many other utilities out there, GreedyTorrent is set-once-and-forget type software. You do not need to configure settings each time you queue a torrent file to download.

No complicated options to configure. The default installation of GreedyTorrent is configured to provide you 5 times actual upload, enough for the survival of a normal ADSL user. Also there is no need to manually find the hash values or to set tracker URLs, GreedyTorrent takes care of them automatically. GreedyTorrent was developed with a novice user in mind, with an easy to use interface.

Unlike many other utilities, GreedyTorrent generates no additional traffic. GreedyTorrent does not run or emulate an “extra torrent client”, and thus does not waste your precious bandwidth.

Only one set of client identification and upload ratio are reported to tracker. Clients that emulate an extra BitTorrent client server have sometimes the disadvantage that two sets of ratio and client identification are reported to tracker, one from the utility and another from your actual bittorrent client.

You dont need to stop using your BitTorrent client server while using GreedyTorrent. This has the advantage that you can download 24×7, while GreedyTorrent automatically maintains the specified upload ratio.

The upload values reported by GreedyTorrent are no different than what an actual high speed uploader would generate. For instance, some utilities can increase your upload ratio dramatically by reporting a very high upload, lets say in the order of gigabytes in just one instance. However, this discrete abnormal value is easily detectable by an administrator. It remains as a contradiction to yournormal upload, and is likely to result in an account ban. When it comes to GreedyTorrent, even if you are setting the upload as 50 times your actual upload, the ratios reported are consistent and continuous in nature — it can only be inferred by the administrator as a high speed upload.

GreedyTorrent does not generate any extra client identification, thus it cannot be banned by the tracker. You can use your favorite Bittorrent client server along with GreedyTorrent, the client identification generated by it will be preserved and reported without modification.

Ethical?

I don’t know. We’ve had this debate many times here at ZeroPaid and I think it’s really up to the individual to decide that on his own.

In some ways it’s good as it can help force overzealous BitTorrent tracker site admins to be a bit more lenient in their ratio enforcement strategies. For in some cases users who have yet to progress high enough to be amongst the first peers in a torrent swarm get penalized in the end by not being able to upload nearly as much as others. These folks are then oftentimes forced to either limit themselves to what they can reasonably afford to grab, a download “diet” if you will, or seed content for an unreasonably long time. In these circumstances I think GreedyTorrent has justification for usage.

On the other hand however, it can also undermine the health of the BitTorrent community as a whole if everybody is hoarding their upload speeds and thereby falsely seeding content. If you download 1GB it’s only fair that you upload a 1GB in kind.

**GREEDYTORRENT**
digg_url = ‘http://digg.com/software/Greedy_Torrent_The_Survival_Kit_for_a_Leech’;

SOULXTC: “walkin’ the streets of P2P”

KTorrent exploits revealed

soulxtc — Wed, 14 Mar 2007 03:33:31 +0000

For you Ubuntu users out there, it’s just been revealed that earlier versions of the KTorrent BitTorrent client server are vulnerable to attack. A malicious remote peer could send specially crafted messages to overwrite files or execute arbitrary code with user privileges.

It has been reported that versions of the open-source BitTorrent client server KTorrent earlier than 2.1.2 are vulnerable to a pair of hacker attacks.

According to the bug report on the Ubuntu site, the first vulnerability can enable a hacker to cause the application to crash, and also allows them the ability to inject executable code onto a system.

More specifically:

chunkcounter.cpp in KTorrent before 2.1.2 allows remote attackers to cause a denial of service (crash) and heap corruption via a negative or large idx value.
CVSS Severity: 7.0 (High)
Range: Remotely exploitable
Authentication: Not required to exploit
Impact Type: Provides unauthorized access, Allows partial confidentiality, integrity, and availability violation , Allows disruption of service

The second vulnerability is reported to allow the deliberate overwriting of arbitrary files on a user’s system. The problem apparently occurs because the KTorrent BitTorrent client server does not correctly validate the destination file paths or the HAVE statements sent by torrent tracker peers. Inserting the string sequence “..” into the torrent filename is said to be all that is needed to break out of defined directories. A malicious remote peer could send specially crafted messages to overwrite files or execute arbitrary code with user privileges.

More specifically:

Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.2 allows remote attackers to overwrite arbitrary files via “..” sequences in a torrent filename.
CVSS Severity: 5.6 (Medium)
Range: Remotely exploitable
Authentication: Not required to exploit
Impact Type: Provides unauthorized access, Allows partial confidentiality, integrity, and availability violation , Allows disruption of service

In any event, KTorrent version 2.1.2 has been released and addresses both of these critical issues.
digg_url = ‘http://digg.com/linux_unix/KTorrent_exploits_revealed’;

SOULXTC: “walkin’ the streets of P2P”