| Wednesday,
February 17, 2010
 priority one malicious website warning
Dr. Pournelle,
A warning to you and your readers, a pop-up trojan
has spread to otherwise respectable websites. I went to dilbert dot com
to view their daily comic, and IE8 immediately closed, replaced by two
pop-up IE browser windows, one very small and one the size of a typical
pop-up message. The larger one had a reasonable looking warning about a
virus, and a button to click to "scan". Knowing that this was completely
abnormal behavior, I closed both IE windows using task manager instead
of clicking on the equally legit looking "X".
After that, I immediately started a full system
scan using windows security essentials, and although the scan is not yet
complete it has already given me a warning that it has found "malicious
or potentially unwanted software" on my computer.
Note that I did NOT click anywhere except to close
the processes from within task manager. I merely visited a legit website
which immediately closed the main IE browser window, replacing it with
two smaller pop-up windows identified as iexplore.exe windows in task
manager. I did not click on either of those, and immediately closed them
with task manager. I am unsure as of yet if what MS security essentials
has found is simply in the browser cache or if my system is well and
truly borked, but this one was really bad. No warning, and I didn't DO
anything, yet I seem to have an infected system.
As I type this, when MS security essentials
scanned iexplore.exe, my floppy drive started buzzing loudly as if it
was being accessed. Not good, not good at all.
This whole thing, getting nailed by merely
visiting a hacked website that was "legit" just a few hours ago, in
effect makes windows 7 and IE8 completely unusable for me especially
since I occasionally work from home. Any site on the internet could be
the next to get compromised and there was no way to avoid this once the
site was visited. My system was fully patched and uses all the default
security settings except that secure browser windows are not cached and
my IE cache is supposed to be flushed when IE is closed.
Sean
This is pretty close to what happened to me. The important thing here is
DO NOT CLICK ON ANYTHING in the browser. Do Control-Alt-Delete, get Task
Manager, and kill the browser application. Don't do anything else before you
do that.
Eric Pobirs comments
It may have been a compromised site, or a
compromised advertiser. Ads mostly come from completely separate servers
and many of those companies are either bad at screening or just don't
care.
Using AdBlock on Firefox helps but isn't 100% with
setting that aren't severe. About once a week, depending on whether I'm
working fulltime, I get a situation where I have to kill the Firefox
process to break free of a malware attempt.
Note that this happens to both Internet Explorer and Firefox. Security
expert Risk Hellewell continues:
Dr. Pournelle:
I had the same problem with the Dilbert site
yesterday (Tuesday evening); I immediately closed my browser. Curious
about this (because I am a computer security guy), I restarted the
browser in the "Inprivate Browsing" mode, then went to the Dilbert site
(blog area). No pop-ups, even with several refreshes.
This leads me to believe that the problem was
caused by a compromised ad block that was served by Dilbert's pages.
There is one comment in the blog area from a
Dilbert visitor yesterday about getting the "Antivirus XP 2010" from a
visit to the Dilbert (Scott Adams) blog. No reaction from Mr Adams that
I could find.
This has happened before (ask Roberta....) because
ad aggregation sites are not very careful in accepting or monitoring
their ads. A virus author could create a regular (non-viral) ad, get it
approved and placed, and then change the ad to a viral version.
The page that I saw was a pop-up Explorer window,
with an animation showing a 'virus scan' in progress (it looked very
realistic). At this point, it appears to be just an animation. Only when
clicking on the "fix this" button will you get an opportunity to allow
the virus to install. I refrained from clicking.
It's easy to program an ad window to pop-up a new
window, then have that new window run some animated GIF that appears to
be a virus scan. That doesn't mean that the virus has been installed at
that point, or that any browser vulnerability caused the ability of the
pop-up window to occur.
Your reader doesn't mention what version of IE
he/she was using. It is well-known that IE6 is a lot easier to
compromise than current version. And the OS is also important to one's
protection. But, in my case, I am using IE8 with Vista on a fully
updated computer, running Microsoft Security Essentials. I have no viral
infection after the pop-up happened on my computer -- because I didn't
allow the virus to be installed by clicking on the pop-up's "scan now"
button.
That said, it is important not to panic when
something similar happens. Close your browser immediately (use Task
Manager if you need to, or even just force a power off by holding down
the power key). Then restart, run a virus scan to verify. And ensure
that your OS, IE, anti-virus, and all other software is kept current.
Regards, Rick Hellewell
The important thing is, Don't Panic. There are ways out of this. In my
case apparently I did click somewhere in the IE 8 window when I saw the worm
appear. Do not do that. Close that system down, with the Big Red Button, or
Task Manager, or anything but a click anywhere in the active window.
More after my walk.
Robert Bruce Thompson adds
I'm surprised that any of this group isn't running
AdBlock Plus with filters set to kill all ads and popups/unders. That
deals with the problem pretty decisively, not to mention making the web a
much more peaceful place.
-- Robert Bruce Thompson
Which is of course true; but the implications for
the net are enormous. If no one is watching ads, no one is going to pay
for advertisements.
Note what Rick Hellewell said above (See the BOLD
paragraph). The animated worm is in fact an advertisement: it's
advertising its willingness to infect your system, and asking for your
cooperation.
This sort of thing has been happening for months;
one would think that Google and Microsoft would have come up with some
generic protection. I would also think that Google and Bing and the other
search outfits would think about the situation. I have some not well
formed ideas on how Google, for instance, could scan advertisements while
it is spidering the web. Advertisers who wanted to be certified clean
could pay for this. I cheerfully admit that I haven't thought out the
details.
Something has to be done. I am not sure what, but
the whole net financial structure is at risk.
==================
This is IMPORTANT.
In troubled times like these it's good to know that
the government has a laser-like focus on the important issues facing the
constituency.
West Hollywood bans dog, cat sales
http://www.mercurynews.com/ci_14416733
This is probably the perfect humorous-government
story.
1) They're spending government time discussing pet
stores. 2) There are no actual pet stores in West Hollywood. 3)
Animal-rights activists still aren't happy.
-- Mike T. Powers
===========
The Mote in God's Eye
Hi Jerry:
I don't know if you've seen this,
http://www.giantfreakinrobot.com/
film/11-scifi-properties-movie.html, but your first Motie book
made a page referenced from digg.com about Sci-Fi properties that need to be
made into movies. I agree with them, by the way! :-)
- Rick Hale
Thanks. Haven't seen it; I let my agent follow
movie sales, which are pretty slow now. But I always thought Mote would
make a great movie.
==========
A comment from the Legions:
Infantry Half-Kilometer comments
As I'm currently getting ready to head back over,
Afghanistan this time, the discussion seems very topical to me. I've already
done hours of classes online and in person, many covering subjects of
absolute importance. However, I've endured hours of lectures on making sure
my wife and children are prepared for my deployment, which I'll remember if
I ever pick up any of those, and lectures on not becoming an alcoholic,
which ought to be easy since I've been a life-long teetotaller, and not
committing sexual assault, which likewise doesn't seem too tough based on
the past few decades. I'll be in a unit about as far from combat as it is
possible to be and remain in the war zone, but I've given classes on field
sanitation and a zillion other subjects I don't expect to actually touch
over there this time.
I remember, back in the olden days, I was an
infantryman. This being well before Don't Ask, Don't Tell, the XO was tasked
to give the mandatory lectures. He assembled us into a theater so we could
sit down, and went through the whole packet of required lectures. There
weren't so many in those days. When he got to sexual harassment, he pointed
out that we were an all male infantry company, and if anyone thought they
were being sexually harassed, they should come to him during the break. He
then went on to the next lecture and we laughed. Nobody would be allowed to
get away with that today.
Last time I got the mandatory lectures on an annual
basis, then we did essentially the same ones again as part of the
pre-deployment training, then again once we arrived in theater, a refresher
before we went on leave from the war zone, and again when we returned to the
US. I dread doing that again, but I've not yet figured out which limb I need
to gnaw off to escape.
But don't you understand that sexual assault is
bad? You need sensitivity training, I fear...
I recall Regimental History given in a temporary
R&R area (R&R area = a place where no one was shooting at the troop) just
after the Sunday morning service and just before the monthly mandatory
reading of the Articles of War; but that was a long time ago. Most of the
troops were called up WW II reservists. A few didn't sleep through it all.
==========
Subject: On
Ireland...
This is long, but worth your attention if you
have an interest==
Hi -
I know that you don't consider economics a science (I
suspect you mean a "real" science where you can experiment without
disrupting the lives of millions, if not billions, and can readily reproduce
the results), but let this economist comment on Ireland and the whole
process of bubble development and collapse. Perhaps you'll see a method to
the madness...
First of all, your Irish poster had the story
basically right, but with two small caveats: first, the speculative buyer of
the house had to finance the purchase somehow: they weren't simply given the
house for speculative purposes; second, it's not like the banks had taken
stupid pills to behave the way they did (as far as I know, these are limited
to politicians and are required once elected), but rather there were some
rather major positive incentives for them to behave exactly the way they
did.
Why do bubbles start? How is a bubble defined? What
the heck is a bubble anyway?
Simply put, bubbles can (but not must) start when
there is an economic upswing that enters a long expansive phase. In the case
of Ireland, export-based growth expanded faster than the number of qualified
workers, leading to truly significant income growth of what had been largely
an impoverished nation. The Irish government rightfully noted that they had
a rather well educated workforce and gave companies rather positive
incentives to move to Ireland (my old Dell was assembled and shipped from
there), reaping the benefits of increased payrolls and private consumer
expenditures for the tax rolls.
Now, during this long expansive upswing, folks who
have little or no real investment savvy find themselves with income well in
excess of needs (it does happen...until the needs catch up, which they
always do, always...), and when they realize that their savings accounts
don't really pay much - low interest rates, after all - they start going
after investment instruments that provide significant returns. While their
retail banks are desperately trying to capture this investment stream, these
retail banks are usually too sober and professional (oh, there are
exceptions. Good lord, there are exceptions!!!) to offer the kind of returns
that people believe they are entitled to. After all, for many, once the
initial shock of having money is over (and the big consumer items have been
bought, like flat-screen TVs and cars), their excess income is "free money."
Now, I'm not talking about older, professional income
folks: I'm talking about what can be called "new middle class", with a
specialized education, little or no understanding of finances and money, and
above all supremely confident of their own ability to make complex
investment decisions (hey, after all, they got themselves out of the lower
class, didn't they?). They start looking for better returns than their peer
group. It becomes competitive, people start playing with the money.
This is how bubbles get started: it happened during
the Tulip Bubble, it happened before the Great Depression, it is happening
now. You just have to look for it: a class of society that has seen real.
personal disposable income increase drastically over a short period of time,
who lack financial expertise, who want - demand, insist - on high returns.
This money starts chasing higher returns, and as
financial people know, if there are moneyed people out there searching for
something, someone will provide it. In the case of the Tulip Bubble, it was
the purported rarity of certain kinds of tulip bulbs that drove a
speculative frenzy that spiraled out of control as people who knew nothing
about tulip bulbs invested massive amounts of money because of purported
returns; in the case of the Great Depression, it was the discovery by the
common man of leveraged puts and calls that allowed the acquisition of
ruinous amounts of high leveraged risk; today, it is housing.
It wasn't a Ponzi scheme: a Ponzi scheme takes money
from new investors to pay interest for investors who got in earlier. A Ponzi
scheme collapses when not enough new investors are found to pay off the
previous investors.
This was a speculative bubble based on being able to
purchase an asset that appreciated over time faster than it cost to finance
the asset. This is a standard speculative purchase: buying a house to live
in, after all, is not an investment if you expect that your return on buying
the house will be from appreciation of the value of the house (it is if you
generate an actual, real existing cash flow from renting the house out!).
The sub-prime (and by analogy the housing bubbles
world-wide) bubble was ignited by strong appreciation of housing prices well
beyond normal levels as nominal incomes increased during the 1990s: people
felt rich because they had made lots of money in other speculative
activities (stocks) and were disappointed at "merely" double-digit returns.
The get-rich-quick schemes started to appear because of this psychological
demand for, well, getting rich quickly, and was aided by pretty much all
financial journalists when they reported how people were getting rich,
quickly, by speculating in real estate. Real estate professional had a
vested interest in making this possible, as they make their living on
transaction costs.
You can get rich by speculating in real estate, but it
takes real money, deep pockets and patience. Buy up land, rezone it and put
up a shopping mall or homes, and you can "easily" get massive returns on
your original investment. That's the normal real estate business. But it is
actually pretty hard work, and it is far riskier than most imagine.
Previously, financing companies got permission to
innovate in setting up mortgages, and came up with some fairly nifty ways of
reducing initial costs, pushing them into the future.
With cheap money (which started, after all, with the
Fed's answer to 9/11) and financial "innovations" like ARMs that allowed
people with relatively small income streams to buy more house than they
could afford at first, with payments then increasing as they started to earn
higher salaries, the path to real estate speculation for the masses opened:
you could buy a house with nothing down, live in it for three years until
the rate on your mortgage was about to increase, sell the house for 30% more
than you paid for it, costs, and still come up richer with no capital
involved.
That's right: buy a $1mn house, pay a $30 000 fee to
the bank for arranging the loan, pay $1000/month for three years, then sell
the house for $1.3mn, and you have a clear profit, before taxes, of $300 000
- $66 000 ($30k to the bank, $36k on the mortgage) or $234 000. For anyone
not earning in the top 5%, that is real money, money that means that your
kids don't have to worry about college expenses, that you don't have to
worry about retirement, that you can make a life style change beyond most
people's dreams. Do that once and you can leverage the next house to the
tune of around $5mn, and end up with over $1mn pre-taxes (5mn*1.3 = 6.5mn;
$150k fee to the bank, $2500/month, works out to be $1.3mn pre-tax profits),
and within, say, 7 years, you've earned an average of $180k/year without
having any real equity involved. Calculate the profits on no capital and you
get zillions of percent return.
That is too good to be true, but is, to a large
extent, exactly what happened.
And it was too good to be true: but people saw not
merely a decent return, but the very real possibility of becoming
millionaires without the usual very hard work involved. That is usually
enough to turn off the higher and critical thought processes (such that
existed) and hope for the best, especially since you don't have anything at
risk (or so people thought...).
With no capital involved, or only very small amounts,
then you've opened up the floodgates for massive speculation, since your
potential profits were higher the more expensive the house was. If there's
no money down, take the most expensive place your income can afford. Lie
about how much you earned so that you could spend 60% of your income on the
mortgage.
But only as long as housing prices kept on going up.
Expecting that to be the case wasn't irrational exuberance, but actual
irrationality.
The banks didn't care because they didn't have a stake
in the speculation: they sold the mortgages to Fannie Mae or Freddie Mac,
who were under political orders to buy the mortgages no matter what they
looked like. Due diligence was thrown out of the window because it didn't
matter: the bank didn't keep the mortgage on its books.
All of these mortgages were bundled and sold to people
with even less understanding of what they were buying than the people buying
the houses, most of them living overseas.
That is how the bubble got started and how it blew up:
as long as houses weren't being built fast enough to keep up with demand,
housing prices increased. Once construction did catch up, though (and
builders did their best to make sure it did!), prices started to fall, and
the whole house of cards (pun intended) fell apart, since that $1k/month in
the first example bloomed to $3k/month once the ARM kicked in, and defaults
started because no one could sell their houses for the prices they needed to
break even, let alone make a profit.
Now, there is plenty of blame for everyone involved,
but it really boils down to the abysmal failure of those tasked with
watching both Fannie Mae and Freddie Mac to make sure that their risks were
under control. Rating agencies failed in their duties as well, as they hid
the risk to foreign investors looking for a fast buck as well.
Whew. I know this is long, but it's also not simple.
The bust is serious, as it is a tragedy for (almost)
all involved: builders are sitting on houses that can't be sold and have no
work because there are too many properties for sale; owners are sitting on
negative equity that means they will be poor when they are forced to sell in
retirement; banks have no one that will borrow from them after credit risk
analysis - and reserves - return to normal (and who have lost the fee income
as well); governments lose tax income; speculators face bankruptcy and ruin
because they got in over their heads.
That speculator in my example? That second mortgage is
now $10k/month and they are in receivership. They didn't bother to check
what it meant to declare bankruptcy (or imagined that it was the way it was
in the 1980s before bankruptcy reform!) and are discovering that they are
thoroughly and completely screwed for life: they cannot simply walk away
unless they are willing to lose that equity completely, and even then the
mortgage holder can come after them. They are truly screwed for life.
But that was the flip side of the perfect plan, the
one no one wanted to talk about (being prudent is boring: trust me, I
know...) when they were contemplating the perfect story of how to become a
millionaire without even breaking into a sweat.
Those really, really screwed? The taxpayers, who will
pay the bills as the payer of last resort.
Diverse congresscritters were more than happy to
commit the US taxpayer to this role in order to enrich themselves and their
party friends. Want to get really angry? Take a look at who ran Freddie Mac
and Fannie Mae, who got enormous bonuses for running these into the ground,
who covered for them, and what they are doing now: I'll give you one name to
start with. Rahm Emmanuel. These are the real culprits: they are the ones
who allowed the bubble to bloom.
You see, it should have been capped. That was the job
of both Fannie Mae and Freddie Mac.Instead, there was a political decision
for them not to do their job, and someone named Barney Frank rolled the dice
one more time...and lost.
I have absolutely no sympathy for anyone involved
except for the construction people who built according to demand. They
were/are in a no-win situation: if they hadn't built, someone else would
have, and while they may be caught now, it is not because they screwed up:
their customers did (unless they were building speculatively with their own
money, but even so: they were meeting demand: it was artificially generated
demand, but it was still demand). I can't blame someone for trying to supply
something that someone else wanted to buy.
The recovery, world-wide, will be unspectacular, since
it won't be fueled by speculation, but rather by hard work and prudent
risk-taking. It will take several generations (and I do mean that) before
the next bubble is built by the exact same mechanisms, just in a different
place and a different time, with different instruments for the destruction.
We're not going to see 5% annual growth rates in the US, since at some point
the US taxpayer has to fund the debt taken on by the Federal government, at
least until the effects of the bubble have dissipated entirely from the
system.
And one final aside: I find it rather amusing that
banker bonuses are so vilified by the Left. It would seem to me that the
Left and the Unions should be holding up bankers are the heroes of the
working class: what other industry takes its profits and gives 40% of them
to its workers? To make sure that they stay loyal?
None that I know of. But that is exactly what the big
banks are doing: paying out significant portions of their profits to their
workers.
Ain't free-market capitalism great? :-)
Jerry, you may not want to put the whole thing up, as
it is rather long and to a certain extent rambling. It could probably use an
edit or two...but I thought you'd like to hear it.
All the best,
John F. Opie
I don't disagree with much of that, and cutting
it would take longer than I have, but I am not sure it has a lot to do
with the current Irish mess except: during these bubbles, government
revenue goes up and the prospects for enhanced government revenue look
good, so the temptation is to spend that revenue: and the pressure is of
course to raise pensions and benefits for the bureaucracy. The expenses
don't show up immediately, the growth in revenue will cover it when the
expense comes due, and ---
That happened to both Ireland and California as
well as other places. Bubbles can be self correcting, but not if the
government gets in the act.
In the United States -- I don't know about
Ireland -- Fannie and Freddie were instructed to inject money into the
housing market. That isn't the actual instruction, which was to make home
ownership easier for a large segment of the population, that that was the
inevitable effect of enabling more potential owners: more people chasing
houses, drives up the price, and soon you get speculators flipping houses
as a way of life. The bubble is well and truly launched. That happened in
the US, and the smartest guys in the country then devised financial
products to institutionalize crazy speculation.
Free market capitalism works, but it also takes
account of what the government is doing: if government is injecting money
into the woogies market, the price of woogies is going to go up, and if
there's wild speculation, then the result is inevitable. If the woogies
are useful items that enable more production there's sometimes a different
effect than if the woogies are consumer goods. In the case of houses the
houses were useful but the financial products dreamed up by the smartest
guys in the country weren't so much so.
I am still interested in what happened to
Ireland, and is Ireland on the way to a death spiral?
==================
TOP
CURRENT
VIEW Wednesday
|
