Despite the over-the-top nature of the letter, posting it here and picking on it started to seem more and more like kicking someone when he’s down. There was no larger message, no lesson to learn from the letter — just me making fun of someone who made an asshole of himself.

I deleted it. I don’t want to be that guy.

My house flooded on Friday, Saturday, and Sunday. I’ve already cleaned up twice; there’s mud on my floor right now, on Monday morning. In addition, we’re late on a big project at the office. I worked 11 hours on Saturday and 9 hours on Sunday.

And we didn’t accomplish the thing that we spent all weekend working to accomplish.

If it looks like it won’t rain for a while, I may mop my floor tonight and clean up the mud for the third time.

(Oh, and my up-hill neighbor built a sandbag dike that sent a WALL of water down past (and into) my house, knocking down a fence, covering my brick patio and a small grass lawn with a layer of mud, and killing the fish in the fishpond.)

python `python -c “import pimp; print pimp.__file__”` -i readline

Moral? If at first you don’t succeed, Google. If Google fails, try, try again.

Update: And to make forward-delete work, try this.

NOTE: I have only experienced this on the Vancouver Sun section of Canada.com. I’m currently out of different IP addresses to try. I’ll try again from home to see if the rest of Canada.com is infected.

How I found The Problem: I followed a link from Bynkii.com to a Vancouver Sun story that Bynkii discussed. My browser was immediately hijacked. I visited the site again, and found no errors. I then tried from a laptop connected to our company’s wireless network (completely separate from our internal network, and through a separate ISP) and saw the hijack again. That time I got screencaps. Visiting the site through the wireless again showed no problems, leading me to believe that this displays one time per IP address. Trying multiple browsers did not result in another browser hijack, and neither did clearing cookies, making me think it’s recording IP address and attacking once per IP address.

Details:

The first time you visit Canada.com, your browser will flash through a few redirects, and then the following popup will appear:

Note that hitting either Cancel or OK appears to have the same result — you can’t get out of there. Your browser will then appear to scan your hard drive for viruses. It’s all theater; it’s not actually doing anything at this point:

It will then pop up a message (in an Windows-style message box — not sure how it did that):

If you’re on a Macintosh, it will then offer to download an EXE file. I’m not sure if it will automatically download and run the file on a Windows machine, because I’m not about to try.

I uploaded the downloaded file to virustotal.com, and it found a variety of badness there, general consensus seems to be that this file isn’t so bad by itself, but will once installed download and install an additional slew of malware and trojans of unknown potency. (I was unable to find really definitive information about this file; I’m open to suggestions for better places to look.)

File Install-MnBhY2lmaWM-a2V5aW4-a2V5a received on 11.08.2007 03:28:07 (CET)

Antivirus	Version	Last Update	Result
AhnLab-V3	2007.11.8.0	2007.11.08	-
Authentium	4.93.8	2007.11.07	could be infected with an unknown virus
AVG	7.5.0.503	2007.11.08	Generic9.HLR
CAT-QuickHeal	9.00	2007.11.07	-
DrWeb	4.44.0.09170	2007.11.07	-
eTrust-Vet	31.2.5278	2007.11.07	-
FileAdvisor	1	2007.11.08	-
F-Prot	4.4.2.54	2007.11.07	W32/Heuristic-119!Eldorado
Ikarus	T3.1.1.12	2007.11.08	Virus.Win32.Renos.AE
McAfee	5158	2007.11.07	BraveSentry
NOD32v2	2645	2007.11.08	Win32/Hoax.Renos.PY
Panda	9.0.0.4	2007.11.07	Suspicious file
Rising	20.17.22.00	2007.11.07	-
Sunbelt	2.2.907.0	2007.11.07	-
TheHacker	6.2.9.119	2007.11.07	-
VirusBuster	4.3.26:9	2007.11.07	Trojan.Renos.Gen.2

Additional information
File size: 31288 bytes
SHA1: ef6fce7ad9a01d6cabb84bffc3bddee6f43bfe4e

I submitted this to the Internet Storm Center, along with a malware sample, and e-mailed webmaster@canada.com with a warning.

Update November 15, 2007: Wired just wrote about the issue; apparently it affects a number of different sites, as the hijack script was distributed via the Doubleclick ad network.

Update November 16, 2007: Wired wrote about the issue again, quoting me this time.

Here’s my bug report: (with e-mail addresses slightly mangled for publication)

WHAT I DID:
1) On Edit Profile -> Contact page, selected “Add / Remove E-mails.
2) Hit “Change” under “Contact E-mail.”
3) Select the “New Address” box and enter “root at sudosu dot net”
4) Click the “Change Contact E-Mail” Button.
5) Enter my password and click “Confirm.”

WHAT I EXPECTED TO HAPPEN:
1) I expected Facebook to e-mail a confirmation message to
root at sudosu dot net.

WHAT ACTUALLY HAPPENED:
1) Facebook responded with “Please enter a valid email address.”

WHY THIS IS A PROBLEM:
1) root at sudosu dot net IS a valid e-mail address, and is my primary
personal address. People searching for me will use that address, and
will not be able to find me.

And their response:

Hi John,

Unfortunately we do not support email addresses with generic
prefixes like the email you have listed (i.e. info@, webmaster@, root@
etc.). You will need to use a personal email address that does not
contain this type of prefix. Since email addresses of this nature are
typically used for organizations and businesses, we do not allow them
to be used for personal Facebook accounts. There are no exceptions
to this rule. We sincerely apologize for any inconvenience this policy
may have caused you.

Thanks for contacting Facebook,

Landon
Customer Support Representative
Facebook

So Facebook knows me by my jschofield at gMail address. I hope this doesn’t prevent people from finding me on Facebook.

I’ll be continuing this at the URL they suggested, and I’ll update this post.

There are two amazing things about this — first, that Apple’s support tech was incompetent enough to generate a label like this, and that DHL was smart enough to actually deliver it on time to the correct place.

(I won’t include his real name, but Jeff’s last name is NOT “Jones” and doesn’t sound anything like that. It’s pretty obvious the support rep just made up “Jones.”)

The actual address:

2121 Cloverfield Blvd.
Suite 205
Santa Monica, CA 90404

The address printed on the label:

2121, clover field , blvd
sweet 205 centre monca
COLORADO CA 90404

Umm. What?