Making Light :: Fun, Making Of Own :: comments

Fun, Making Of Own

Well, folks. Some filmmakers are in town. They're making a movie up in Pittsburg. I can make some guesses about...

Fun, Making Of Own -- comment #1 from xeger

Tue, 16 Jun 2009 17:23:41 -0500

They spent their days trying to translate between Unix and Windows, and grew ever stranger and more peculiar, until one night ...

]]>

Posted June 16, 2009 5:23 PM by xeger

Fun, Making Of Own -- comment #2 from Lee

Tue, 16 Jun 2009 17:59:35 -0500

Not to my taste, thanks. But it looks like it should be decent for horror fans.

]]>

Posted June 16, 2009 5:59 PM by Lee

Fun, Making Of Own -- comment #3 from MichaelC

Tue, 16 Jun 2009 18:05:27 -0500

Um. The making a movie site link triggered my browser's fraudulent website warning and directed me to a Google Safe Browsing diagnostic page, which reported the following:
"The last time Google visited this site was on 2009-06-16, and the last time suspicious content was found on this site was on 2009-06-16. Malicious software includes 143 trojan(s), 48 scripting exploit(s), 27 exploit(s)."

FYI, here's the address of the Google page to which my browser directed me:
http://google.com/safebrowsing/diagnostic?tpl=safari&site=91.212.65.148&hl=en-us

]]>

Posted June 16, 2009 6:05 PM by MichaelC

Fun, Making Of Own -- comment #4 from Jim Macdonald

Tue, 16 Jun 2009 18:10:49 -0500

Here's their MySpace page.

(I'm not getting Google alerts, nor are any of my AV programs popping up warnings....)

The site does have annoying music....

]]>

Posted June 16, 2009 6:10 PM by Jim Macdonald

Fun, Making Of Own -- comment #5 from Jim Macdonald

Tue, 16 Jun 2009 18:15:52 -0500

91.212.65.148 seems to be located in Russia. I'm pretty sure that yellowbrickroadthemovie.com isn't hosted there.

]]>

Posted June 16, 2009 6:15 PM by Jim Macdonald

Fun, Making Of Own -- comment #6 from Dave Bell

Tue, 16 Jun 2009 18:20:55 -0500

Avasti AV gives me a warning on that site.

A quick check on a Linux box shows a site very dependent on Flash, apparently with no way past the the opening page without using Flash and scripts.

I'm not curious enough to take chances.

]]>

Posted June 16, 2009 6:20 PM by Dave Bell

Fun, Making Of Own -- comment #7 from Dave Bell

Tue, 16 Jun 2009 18:25:21 -0500

I tried to check the MySpace page and my eyes fell out.

]]>

Posted June 16, 2009 6:25 PM by Dave Bell

Fun, Making Of Own -- comment #8 from Jim Macdonald

Tue, 16 Jun 2009 18:46:01 -0500

A totally safe site:

http://www.granitestatenews.com/Articles-c-2009-06-10-148766.113119_Horror_on_Main_Street.html

]]>

Posted June 16, 2009 6:46 PM by Jim Macdonald

Fun, Making Of Own -- comment #9 from James D. Macdonald

Tue, 16 Jun 2009 21:53:29 -0500

I'm back home now. Yellowbrickroadthemovie.com is at 67.228.235.94

91.212.65.148 is indeed somewhere in Russia. I dunno how that popped up.

The official site is pretty darned Flash-heavy.

Here are the sub-pages:

http://www.yellwobrickroadthemovie.com/CONTACT.html

http://www.yellowbrickroadthemovie.com/TRAILER.html

http://www.yellowbrickroadthemovie.com/LEGEND.html

http://www.yellowbrickroadthemovie.com/EXPEDITION.html

http://www.yellowbrickroadthemovie.com/MESSAGE.html

The trailer doesn't seem to exist. (Seeing as the principal photography hasn't happened yet, this isn't surprising.)

]]>

Posted June 16, 2009 9:53 PM by James D. Macdonald

Fun, Making Of Own -- comment #10 from Steve Taylor

Tue, 16 Jun 2009 22:59:48 -0500

I don't have a knee jerk reaction against Flash - it's great for games, interactive artworks, video and music players, visualisation tools...

But why why why is someone using it to navigate through what are basically a set of pages of text with still pictures? Oh well...

Drifting back on topic, I love seeing my city (Melbourne, Aus) on film. I even rented Queen of the Damned (don't!) just to play "look for the Melbourne locations".

]]>

Posted June 16, 2009 10:59 PM by Steve Taylor

Fun, Making Of Own -- comment #11 from xeger

Tue, 16 Jun 2009 23:53:16 -0500

Steve Taylor @ 10 ...
I do have a knee-jerk reaction against flash. When it's used appropriately, it's almost invisible -- but it's so often used inappropriately that my first reaction is inevitably "not -that- again" followed by closing the window.

]]>

Posted June 16, 2009 11:53 PM by xeger

Fun, Making Of Own -- comment #12 from Steve Taylor

Wed, 17 Jun 2009 00:03:01 -0500

xeger at #11 writes:

> I do have a knee-jerk reaction against flash. When it's used appropriately, it's almost invisible -- but it's so often used inappropriately that my first reaction is inevitably "not -that- again" followed by closing the window.

I admit I do use the Firefox "FlashBlock" plugin in self defence. I just wish there was a setting to not animate animated gifs without my permission. But then I've got to defend myself against javascript and dhtml based animation as well. Why can't people just play nice?

]]>

Posted June 17, 2009 12:03 AM by Steve Taylor

Fun, Making Of Own -- comment #13 from Lee

Wed, 17 Jun 2009 00:20:07 -0500

Jim, #9: I didn't have any trouble with your original link (which does indeed go to yellowbrickroadthemovie.com), and the trailer was there when I clicked on it. That's what prompted my post #2, was watching it.

]]>

Posted June 17, 2009 12:20 AM by Lee

Fun, Making Of Own -- comment #14 from James D. Macdonald

Wed, 17 Jun 2009 01:08:16 -0500

Ah yes, I see. There is a trailer. It just takes forever to download.

]]>

Posted June 17, 2009 1:08 AM by James D. Macdonald

Fun, Making Of Own -- comment #15 from Duncan J Macdonald

Wed, 17 Jun 2009 10:26:53 -0500

My Norton 2009 is popping "Bloodhound.Expolit.196" which it identifies as a heuristic virus. The warning showed up as soon as I connected to the site.

]]>

Posted June 17, 2009 10:26 AM by Duncan J Macdonald

Fun, Making Of Own -- comment #16 from zoanne

Wed, 17 Jun 2009 11:34:17 -0500

yep, I got a trojan horse and a dropper virus from that site :-(

]]>

Posted June 17, 2009 11:34 AM by zoanne

Fun, Making Of Own -- comment #17 from Zack

Wed, 17 Jun 2009 12:44:43 -0500

Yeah, when I loaded that site, it tried to redirect me to a PDF containing javascript that tries to exploit heap-overflow bugs in Adobe Acrobat. It's quite a bit less obfuscated than the last time I saw this, and has amusing comments in it like

//so the exploit jumps actually to 0x90909090. Place a very long 'AAAA' at the second param to go to 0x41414141 ;)

and

//adobe reader 8 works also with app.setTimeOut?

Should contact the owners of the site and tell them they need to clean it up. I've saved the malicious PDF and the decoded javascript in case anyone wants to see them.

]]>

Posted June 17, 2009 12:44 PM by Zack

Fun, Making Of Own -- comment #18 from Earl Cooley III

Wed, 17 Jun 2009 12:45:43 -0500

Steve Taylor @12, in the Firefox about:config page, you can set "image.animation_mode" to either "none" or "once", or reset it back to "normal".

]]>

Posted June 17, 2009 12:45 PM by Earl Cooley III

Fun, Making Of Own -- comment #19 from Lee

Wed, 17 Jun 2009 13:22:51 -0500

Okay, you guys have got me all paranoid now. I didn't have anything pop up on me, but I'll get my partner to run a full virus sweep while I'm off at the dentist.

]]>

Posted June 17, 2009 1:22 PM by Lee

Fun, Making Of Own -- comment #20 from Zack

Wed, 17 Jun 2009 13:50:36 -0500

Following up to myself to say that I can't actually find any contact info for the people responsible for that website. Neither CONTACT.htm nor CONTACT.html actually exists, there doesn't seem to be contact info anywhere else on the site, and their whois listing points to a very large hosting provider, midphase.com. I have emailed that provider's technical contact address, but I doubt that will have any effect.

]]>

Posted June 17, 2009 1:50 PM by Zack

Fun, Making Of Own -- comment #21 from Dave Bell

Wed, 17 Jun 2009 14:02:36 -0500

Jim, if you have actually seen these film-makers, maybe you'd better pass on the malware warning. Somebody on the website side has been either careless or malicious.

If you haven't, do they even exist?

]]>

Posted June 17, 2009 2:02 PM by Dave Bell

Fun, Making Of Own -- comment #22 from James D. Macdonald

Wed, 17 Jun 2009 15:37:10 -0500

I'm just back from spending the day with them. They're nice people. I'll let 'em know.

]]>

Posted June 17, 2009 3:37 PM by James D. Macdonald

Fun, Making Of Own -- comment #23 from James D. Macdonald

Wed, 17 Jun 2009 15:47:40 -0500

I've disabled the link until the virus situation is resolved.

]]>

Posted June 17, 2009 3:47 PM by James D. Macdonald

Fun, Making Of Own -- comment #24 from James D. Macdonald

Wed, 17 Jun 2009 16:42:51 -0500

FWIW, I'm running Firefox with NoScript.

]]>

Posted June 17, 2009 4:42 PM by James D. Macdonald

Fun, Making Of Own -- comment #25 from abi

Wed, 17 Jun 2009 16:46:35 -0500

Jim @25:
The three infected files are all copies of "Trojan horse generic 13.BEGH"

And the random irreverent part of me pictures a large white horse, with a bar code on its side just below the word HORSE in sans-serif lettering.

]]>

Posted June 17, 2009 4:46 PM by abi

Fun, Making Of Own -- comment #26 from James D. Macdonald

Wed, 17 Jun 2009 16:48:07 -0500

TrendMicro give a completion time of 21 1/2 days. This might just take some time....

]]>

Posted June 17, 2009 4:48 PM by James D. Macdonald

Fun, Making Of Own -- comment #27 from abi

Wed, 17 Jun 2009 17:06:11 -0500

I did not hallucinate Jim's comment about that generic Trojan horse. Did not.

]]>

Posted June 17, 2009 5:06 PM by abi

Fun, Making Of Own -- comment #28 from Mary Aileen

Wed, 17 Jun 2009 17:20:08 -0500

abi (27): We believe you.

]]>

Posted June 17, 2009 5:20 PM by Mary Aileen

Fun, Making Of Own -- comment #29 from James D. Macdonald

Wed, 17 Jun 2009 17:40:38 -0500

You didn't. But I removed it because it might give the wrong impression. Further checking through the AVG files told me that they'd entered the Virus Vault on April 9, when I was out looking for updated video drivers.

]]>

Posted June 17, 2009 5:40 PM by James D. Macdonald

Fun, Making Of Own -- comment #30 from James D. Macdonald

Wed, 17 Jun 2009 18:25:30 -0500

TrendMicro is down to saying just four days. Things improve.

I've long considered that the existence of computer viruses is proof of the existence of original sin.

]]>

Posted June 17, 2009 6:25 PM by James D. Macdonald

Fun, Making Of Own -- comment #31 from Steve Taylor

Wed, 17 Jun 2009 19:28:53 -0500

Earl Cooley III at #18 writes:

> Steve Taylor @12, in the Firefox about:config page, you can set "image.animation_mode" to either "none" or "once", or reset it back to "normal".

You star! My life is now slightly better.

All good things come from Making Light.

]]>

Posted June 17, 2009 7:28 PM by Steve Taylor

Fun, Making Of Own -- comment #32 from Zack

Wed, 17 Jun 2009 19:50:01 -0500

James: NoScript would totally block this attack; if you don't execute javascript it doesn't even get as far as reaching out to 91.212.65.148 to grab the malicious script that grabs the malicious PDF.

]]>

Posted June 17, 2009 7:50 PM by Zack

Fun, Making Of Own -- comment #33 from James D. Macdonald

Thu, 18 Jun 2009 07:52:54 -0500

Their contact address is info[at]yellowbrickroadthemovie[dot]com

]]>

Posted June 18, 2009 7:52 AM by James D. Macdonald

Fun, Making Of Own -- comment #34 from Serge

Thu, 18 Jun 2009 09:23:01 -0500

abi @ 27... Thought you were having a George Orr moment, eh?

]]>

Posted June 18, 2009 9:23 AM by Serge

Fun, Making Of Own -- comment #35 from albatross

Thu, 18 Jun 2009 10:46:58 -0500

It's worth finding a non-Adobe PDF viewer, so you're not 100% part of the monoculture for which the virus writers are adapted.

One thing that would be really useful is a setting or add-on for my browser, that would push the PDF file being opened off to some remote PDF-to-HTML server. Anyone know of any such thing?

]]>

Posted June 18, 2009 10:46 AM by albatross

Fun, Making Of Own -- comment #36 from David Harmon

Thu, 18 Jun 2009 10:50:49 -0500

albatross #35: Well, Google can do the conversion, so you could potentially just use them to look up the PDF's original URL.

]]>

Posted June 18, 2009 10:50 AM by David Harmon

Fun, Making Of Own -- comment #37 from Jim Macdonald

Thu, 18 Jun 2009 22:02:30 -0500

Eric, the producer, thanks us for informing them that their site was hacked.

]]>

Posted June 18, 2009 10:02 PM by Jim Macdonald

Fun, Making Of Own -- comment #38 from Lee

Thu, 18 Jun 2009 22:29:55 -0500

My virus scan showed no problems. Very likely the attempt was blocked by my Hosts File From Hell.

]]>

Posted June 18, 2009 10:29 PM by Lee

Fun, Making Of Own -- comment #39 from James D. Macdonald

Fri, 19 Jun 2009 09:50:44 -0500

Sequential scans by TrendMicro Housecall, Malwarebytes, SuperAntiSpyware, and AVG, found a total of four tracking cookies.

I don't think I caught anything.

]]>

Posted June 19, 2009 9:50 AM by James D. Macdonald

Fun, Making Of Own -- comment #40 from James D. Macdonald

Fri, 19 Jun 2009 10:17:48 -0500

The post at the bottom of the thread here at BleepingComputer.com (from quietman7, Jun 9 2009, 06:22 AM, contains a ton of links to Antivirus resources.

I'm told that the movie guys were working on restoring their website. Could someone with greater ability than me take a look and see if it's (currently) clean?

]]>

Posted June 19, 2009 10:17 AM by James D. Macdonald

Fun, Making Of Own -- comment #41 from Zack

Fri, 19 Jun 2009 12:35:11 -0500

As of about ten minutes ago, the site is not clean: there is still a Javascript fragment on the top-level index.html that pulls malicious code from 91.212.65.148. It is obfuscated to look like it has something to do with Google Analytics, but if you actually decode it it proves to be nothing of the sort.

I also see a very large number of spam links in /LEGEND.html, and further obfuscated Javascript that may also wind up triggering virus attacks (it is not as easy to decode as the stuff in index.html, so I haven't bothered).

The other HTML pages that are reachable from index.html (EXPEDITION.html, MESSAGE.html, NEWS.html, TRAILER.html) do not appear to contain any malicious code. They do have other problems: broken links (including not a few references to files on the website designer's local hard drive), and use of Javascript instead of CSS :hover styles for image rollovers (breaking the site for people who turn JS off).

As noted, the site is very Flash-heavy. I don't have the tools or skills to inspect Flash files for malware.

]]>

Posted June 19, 2009 12:35 PM by Zack

Fun, Making Of Own -- comment #42 from Clifton Royston

Fri, 19 Jun 2009 12:50:44 -0500

It could have been whacked via the hosting server. My employer had a problem a while ago where their web site got on the Google-sponsored malware list, again due to weird stuff inserted in framing code. When I searched the forums there, I found that a couple other sites on the same IP address (i.e. hosted on the same physical server) had been reported with the identical problem. I suspected the web server machine was cracked or had outdated software on it; I ended up getting the company to move hosting providers.

]]>

Posted June 19, 2009 12:50 PM by Clifton Royston

Fun, Making Of Own -- comment #43 from Vince

Fri, 19 Jun 2009 20:55:32 -0500

I managed to get Bloodhound.Exploit.196, several trojans, as well as the dreaded Spyware Protect 2009. It has taken me three days to clean up the machine, since Spyware Protect wormed its way into both the registry and the System Restore files.

Ah well. It's good to know that a trailer for a horror film creates actual horror. Somehow this seems right, in our post-digital age.

]]>

Posted June 19, 2009 8:55 PM by Vince

Fun, Making Of Own -- comment #44 from James D. Macdonald

Wed, 04 Nov 2009 09:27:34 -0500

The film is Yellow Brick Road. It has an official trailer, now, that you can see at http://www.youtube.com/watch?v=RfX78jrrmi8

At IMDB it's http://www.imdb.com/title/tt1398428/

And they have a MySpace page at http://www.myspace.com/yellowbrickroadthemovie

Later on, maybe, I'll tell you about my two days as set medic.

]]>

Posted November 4, 2009 9:27 AM by James D. Macdonald