Slashdot Log In
Anti-Santy Worm Patches phpBB Flaw
Posted by
michael
on Fri Dec 31, 2004 11:25 AM
from the whether-you-like-it-or-not dept.
from the whether-you-like-it-or-not dept.
sebFlyte writes "Interesting Santy worm story -- there's now an anti-Santy worm proliferating, which spreads the same way as a normal worm, but rather than killing machines or taking control of them, it gives them security updates..." We mentioned the Santy worm about ten days ago.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Not very benificial (Score:5, Informative)
Re:Not very benificial (Score:5, Insightful)
What I see is a company saying we are first to report but we wont say anything that can be good for our "enemy". There is nothing difficult about testing its efficiency but it is not in their interest.
I am not saying this worm is good, but that if they wanted to verify it would be easy.
Parent
Aren't... (Score:5, Funny)
hohoho (Score:2, Funny)
I can imagine explaining this... (Score:5, Funny)
White Worms (Score:3, Interesting)
Re:White Worms (Score:3, Interesting)
Re:White Worms (Score:5, Funny)
Parent
Re:White Worms (Score:5, Insightful)
Parent
Re:White Worms (Score:2)
Re:White Worms (Score:2)
Re:White Worms (Score:4, Insightful)
Parent
Re:White Worms (Score:4, Insightful)
If I have the choice between havoc caused by a patch and havoc caused by a hostile breakin into the system, I'll pick the havoc caused by the patch, that at least doesn't leave any hidden backdoors behind.
Parent
Re:White Worms (Score:3, Insightful)
What kind of sewed vision of the world do you have that would allow you to make such a comment?
If a person is intelligent enough to patch their system, then they need not worry about the worm, as they will have patched their systems against it! Those not intelligent enough to patch their systems will get infected, and then have their system patched, its win-win.
It is a similar concept to those bar code scanners we have at work: The letters of t
Re:White Worms (Score:3, Interesting)
Re:White Worms (Score:5, Insightful)
Of course, such machines aren't the ones likely to intersect common worm spread vectors...
Parent
Re:White Worms (Score:5, Interesting)
"If a site is infected, the worm causes a huge amount of traffic and slows down the site. I don't think it's possible to write a beneficial worm."
Parent
Conundrum (Score:2, Interesting)
Holes they use should never be left unpatched, even if the worm's patches are not applied.
Consider: If there was a benign strain of HIV out there that immunized you to Herpes upon infection, would you give up condoms?
Re:White Worms (Score:2)
Not that there's anything wrong with that....
Re:White Worms (Score:2, Insightful)
Re:White Worms (Score:2, Funny)
If, somehow, you get infected by a worm, or maybe Juiblex, remember to use a unicorn horn immediately, or eat some euc
Re:White Worms (Score:2)
Re:White Worms (Score:5, Insightful)
I disagree.
I very nearly wrote an anti-code-blue worm a few years back, and got to the point of payload (patch) deployment when the glaring flaw came to me: any time that you or a program that you made does something unexpected, or makes a connection to another machine, YOU are liable for what happens. Given that heterogeneous computers and networks exist, can you test for 100% of all possible cases? Likely not.
It's not so much that I disagree with the sentiment, you see, but I find it impossible to ever run into the case that a white worm is done correctly and can be certified as such.In the example above, for instance, all that an attacker would have to do would be to infect a netblock with Code Blue, point them at my anti-blue worm launcher, and then watch the fun as I "cause" a DDOS with all the network traffic that will go spewing back and forth between the two sites. The attacker has now been able to effect the Availability of two sites in one go. Not exactly something that I'd like my name attached to, hence the reason that no anti-code-blue-worms have been released into the wild from me.
Parent
Re:Well, in that case... (Score:5, Funny)
Sure, and thanks! I appreciate it. My ip is 127.0.0.1. Let me know if you find anything worth patching!
Parent
Re:Well, in that case... (Score:5, Funny)
Parent
Re:White Worms (Score:3, Funny)
Concealed ends? (Score:4, Insightful)
Re:Concealed ends? (Score:2)
Re:Concealed ends? (Score:4, Funny)
Even better, if it managed to infect MS source then Windows would become GPL!!
Parent
In my mind (Score:2)
Choice, the problem is choice.
Satisfaction Guarantee? (Score:2, Interesting)
Wasn't there a Welcha worm that cleaned up Blaster, and once the path was clear, it just gave you another virus?
A bit uneasy... (Score:2, Interesting)
Re:A bit uneasy... (Score:3, Insightful)
Here's my take on these types of worms:
I have evidence which leads me to strongly believe that your kitchen faucet is leaking, badly. This will no doubt cause flooding and damage. Instead of warning you about it, I (a random citizen) will now fix this problem for you.
Of course, since I don't know your home, I may break something unrelated to your current problem. But don't wor
Still illegal (Score:4, Insightful)
Re:Still illegal (Score:4, Insightful)
Note: My reply is entirely US-centric.
Although both your examples in the quoted passage are examples of the system screwing up, not vigilantes screwing up, I think I do recognize the tone you're trying to take -- that vigilantes can make errors. I interpret your message as carrying an underlying tone that this is a reason to avoid citizen level responses. You weren't explicit about this, so feel free to correct me if I got it wrong. Proceeding on that assumption, though:
That, and more, can be said for the formal justice system as well. The only difference is that the mistakes are made by someone who represents "duly constituted authority and power", rather than someone who took authority and power for themselves.
Look at the facts. Judges and juries put innocents behind bars on a regular basis. (Witness the recent DNA exoneration of those folks on death row and the subsequent removal of all prisoners from death row by the governor, a man who I frankly consider a hero for this action.) Citizen's supposedly inviolate rights are trampled, and hard, by the courts. Every day. Guantanimo. Registration. Double jeopardy. Freedom of speech. Freedom from unreasonable search. Restrictions on travel. Government support of religion. Etc., ad nauseum. Reparations for errors in prosecution and punishment are minimal or non-existant, and of course for capital punishment, impossible. "Mommy" laws that should never become law are inflicted on us left and right, and at times with terrible social and personal consequences (drug laws are the poster child for this one, though they are hardly isolated in either "mommyness" or inherently being agents of harm.)
The fact is, you should not trust the system to "do right." It hasn't, doesn't, and will not. The evidence is right there before your face each and every day. So the issue of citizen response naturally arises because of pressure from the system.
Turning to our network experience, consider spam. I don't know about you, but spam has cost me a lot of hours. Not just on my desk, but interfering with my business (asswipes using our domain names as return addresses for spam is one way, there are others.) What has the government done about it? Not a #$%^#$%^ thing in practical terms. In fact, with the CAN-SPAM act, they basically climbed right in bed with the spammers. Should I sit there like a turnip and not respond when the spammers screw with my life? The government isn't addressing the problem, so what is the correct course of action? Bending over?
Consider software piracy and shrink wrap licensing and software patents. At the legislative level, these issues have been well and truly fumbled, though that surely under-describes the problem. Should I sit there like a turnip and not respond when the pirates steal my software? The government isn't addressing this problem either, so again, what is the correct course of action? Still bending over?
Viruses and worms -- again, we're supposed to bend over and take it without lube or even a reach-around, right? Because... well, why? Why should we? Why? Most people have been doing just that, and what do we have to show for it? I'll tell you -- we have a bumper crop of viruses and worms, that's what we have.
It all comes down to one thing: If you trust and wait for the duly-constituted authorities to "do what is right" then you are simply naive. They're almost certainly not going to. They rarely do.
It turns out that the correct course of action becomes very clear when you think about the important things in your life, and what is actually best for society.
For instance, i
Parent
If the anti-Santy worm... (Score:5, Funny)
Nice, but at what cost? (Score:4, Insightful)
Security update? (Score:5, Insightful)
- Sites that have been attacked by the anti-Santy worm are defaced with the words: "viewtopic.php secured by Anti-Santy-Worm V4. Your site is a bit safer, but upgrade to >= 2.0.11."
If I break into your house and clean your bathroom you could call me beneficial, but you might get a little upset if I used spray-paint to write "This house is a bit cleaner, but buy some Lysol" on your front door.Re:Security update? (Score:5, Insightful)
Parent
Good Worms, Bad Worms (Score:4, Funny)
Re:Good Worms, Bad Worms (Score:2)
Personally, I'd rather keep my buying habits to myself and deal with random spam. Better yet, I'd rather not deal with spam at all.
Anti-IE worm... (Score:5, Interesting)
No such thing as a white worm (Score:5, Interesting)
Re:No such thing as a white worm (Score:3, Insightful)
This sounds really great in theory. Unfortunately, I know too many people who politely explained to someone that that had a security problem, just to have an embarressed admin turn around and claim that the person pointing it out must a hacker breaking into the system.
I even know a case where a person explained that the password on windows 95
What? That doesn't exist! (Score:5, Funny)
Fiorello: "Ha-ha-ha-ha-ha. You can't fool me...there ain't no Sanity Clause."
Survival of the fittest (Score:4, Interesting)
Perhaps the next phase will be a virus or worm that follows genetic theory. The genetic features that would have to be modelled would be:
1) it is considered beneficial
2) it can reproduce
3) it can mutate
The successful entities would then survive, and the unsucessful mutations would die out. Survival of the fittest?
which brings up another question... (Score:4, Interesting)
The Code (Score:5, Informative)
This is the code of the worm extracted from a vulnerable box.
# asw: anti santy worm
# this worm will try to fix any viewtopic.php on local box
# will use this box for 1 day to search other buggy phpBB forums, and end.
etc...
Good Worms Bad Worms. When can we QOS these things (Score:4, Interesting)
I need a router/switch/filter that recognises worm/virus traffic for what it is and sets QOS down (or out) on such traffic. Better yet, I want my internet provider to have one. So the neighbor next door's got twelve sessions of Butt Trumpet running on his PC and more broadband in Mbps than he has brain cells to rub together, doesn't mean the pipes I use outta here need to be effected.
Niceties would be an ability to recognise interactive traffic and flag it for regular service. Not an original idea, by the by, was first mentioned in sf by John Brunner some years back.
Another project I will never get round to.
This is the end of the rant. We now return you to your regularly scheduled
Re:White Knight Viruses/Worms? (Score:3, Informative)
IIRC, this caused as much damage as a normal worm. It crashed systems, destroyed windows installations, etc. etc.