Hacker News new | past | comments | ask | show | jobs | submit login

> Once you know that 1e100.net is Google you never have to look it up again.

Actually, you should be careful about that.

There is malware floating around that connects to 1el00.net, le100.net, etc. (replacing the numeral 1 with the letter L, which looks virtually identical in the lower case you find in netstat etc.). I don't know what data it exchanges with those servers.

This is actually a really clever move on the malware-author's part. All of the "OMG! I have a virus." and "Don't worry it's Google" threads you see online add significant confusion.

Moreover, they seem to have used their bot-net to bury information about the malware in search results, as you can see by searching for "1EL00.net", etc.

The creators of this malware were actually pretty clever about it (there are more layers of obfuscation at play). I encountered an infected machine and once I saw the layers of trickiness involved, I went for the nuclear option and completely wiped the machine. They seemed to be smarter than me (and for that matter, existing AV software) about this.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: