Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Saturday September 28 2019, @01:44AM   Printer-friendly

Submitted via IRC for SoyCow9427

Microsoft: New Nodersok malware has infected thousands of PCs

Thousands of Windows computers across the world have been infected with a new strain of malware that downloads and installs a copy of the Node.js framework to convert infected systems into proxies and perform click-fraud.

The malware, named Nodersok (in a Microsoft report) and Divergent (in a Cisco Talos report), was first spotted over the summer, distributed via malicious ads that forcibly downloaded HTA (HTML application) files on users' computers.

Users who found and ran these HTA files started a multi-stage infection process involving Excel, JavaScript, and PowerShell scripts that eventually downloaded and installed the Nodersok malware.

The malware itself has multiple components, each with its own role. There's a PowerShell module that tries to disable Windows Defender and Windows Update, and there's a component for elevating the malware's permissions to SYSTEM level.

But there are also two components that are legitimate apps -- namely WinDivert and Node.js. The first is an app for capturing and interacting with network packets, while the second is a well-known developer tool for running JavaScript on web servers.

According to Microsoft and Cisco reports, the malware uses the two legitimate apps to start a SOCKS proxy on infected hosts. But here is where the reports diverge. Microsoft claims the malware turns infected hosts into proxies to relay malicious traffic. Cisco, on the other hand, says these proxies are used to perform click-fraud.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Informative) by Bot on Sunday September 29 2019, @12:05PM (1 child)

    by Bot (3902) on Sunday September 29 2019, @12:05PM (#900268) Journal

    Antizionism is not about denial of a God given land, which is either a post facto rationalization or the prerogative of the supernatural entity. It is rather questioning why oh why you are substituting the Messiah with a piece of land that has already been delivered. If you consider Jesus as the Messiah it has also not been lost, at least until the menaces posed by of Islam and Zionism itself, but this of course is OT.
    If I were an Israelite I would be very wary of this substitution, after 2 millennia of diaspora. Finally I would also question ADL's blanket accusations of antisemitism to people who question one specific issue, the relationship between Zionism, financiers of nazis, Shoah and the 6 millions prophecies, because a cold hard look at the situation makes Adolf the real father of Israel, and the current treatment of Palestinians would be in continuity with the treatment of the Jews who did not escape/want to move to the promisedtwiceland.
    (The faint buzz you might be hearing right now is the keywords alarm for this post...)

    --
    Account abandoned.
    Starting Score:    1  point
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  

    Total Score:   3  
  • (Score: 2) by jmichaelhudsondotnet on Monday September 30 2019, @04:49PM

    by jmichaelhudsondotnet (8122) on Monday September 30 2019, @04:49PM (#900858) Journal

    You might enjoy this:

    https://jmichaelhudson.net/important-definitions/ [jmichaelhudson.net]

    full list of defined terms is at the bottom of the page. Please share widely, I put a lot of work into it and continue to do so.

    For the record, I do not deny the holocaust, anarcho-socialist anti-war activists like me were some of the first to go.

    I do prefer not to use the word though, there is no reason to hold one genocide higher or lower than another. In my mind, the holocaust is always the one happening right now.

    And the one happening right now is a palestinian and syrian one, and a uigur and a falun gong one.

    And maybe a hong kong one if we let it happen. And others about which I am not aware, its not like CNN is going to tell us if there are any valuable mine deposits to be found in the area.