Slashdot Log In
ZOTOB Not Quite as Bad as Expected?
Posted by
CmdrTaco
on Thu Aug 18, 2005 11:05 AM
from the only-wrecks-a-zillion-computers dept.
from the only-wrecks-a-zillion-computers dept.
GuitarNeophyte writes "Although the worm hasn't been in the wild for very long, ZOTOB and its variants have already propagated on the internet. Many people have been giving reports that it poses risks of infection to almost all Windows Operating systems, but accorning to this article, the claims are a tad overzealous. FTA, 'The worm only spreads to systems running on Windows 2000, XP and Server 2003, and even then, the possibility of the worm affecting Windows XP and Server 2003 are minimal.' "
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
not minimal (Score:5, Funny)
Re:not minimal (Score:5, Funny)
Send me a list of your friends names and addresses, and I will get the problem resolved immediately.
-Bill G.
Parent
Re:not minimal (Score:5, Informative)
The reason the risk to XP and 2k3 are minimal is that they require authentication for the particular vulnerability to be exploited, where Win2k can be exploited using a NULL session.
Setting RestrictAnonymous=2 in the registry will disable null sessions and prevent infection on Win2k systems.
Parent
Re:not minimal (Score:4, Interesting)
Of course all your WinXP machines are screwed if you're using a Win2k domain controller... or whatever it is called now.
The worm has been a serious pain, but yeah, not catastrophic where I sit.
Parent
Re:not minimal (Score:5, Funny)
Parent
Re:not minimal (Score:5, Insightful)
Actually, they're not, although my understanding was that MS claimed they were.
One of my neighbours asked for help with her PC a few days ago. One of the problems turned out to be that she was running the original version of XP. I tried to service pack it, and it said the license key used was invalid, and therefore the service pack wouldn't apply.
Unless you have at least SP1, you can't get security updates anymore.
I'm sure there are tons of people in a similar situation.
Parent
Re:not minimal (Score:4, Informative)
Parent
Aren't all media reports of internet viruses (Score:5, Interesting)
WAZZUP (Score:4, Funny)
People wazzup arent creative like that anymore.
Parent
Re:Aren't all media reports of internet viruses (Score:5, Funny)
In fact, Jerusalem-b was my favourite virus. Sheer genius what a measly few hundred bytes of code can do. Virus writers don't know how good they have it today!
Parent
Re:Aren't all media reports of internet viruses (Score:5, Interesting)
Parent
Re:Aren't all media reports of internet viruses (Score:5, Informative)
Parent
"Turkey Virus" (Score:5, Informative)
I've found that [scenerep.org]...
> isn't the CRT physically designed to spread the electron beams evenly as to display a picture?
No, it isn't a TV set. The VGA cable is really controlling the electron beam. Well, it was... now there is some embedded electronic to do some adjustments and avoid to damage the tube (for example, using too high refresh rates).
Try xvidtune under X,
check the modeline doc in linux/Documentation/fb,
read that link [dell.com].
(Now assuming you've read the last link and understand porch times)
Your VGA cable basically sends five signals : red green and blue controlling the energy of the three beams, and two sync signals controlling "next line" and "next screen". Usually porch times are constant, so you're drawing in a rectangle somewhere.
Changing horizontal porch times will move the image to the left or right, or modify the image width.
Changing vertical porch times will move the image to the top or bottom, or modify the image height.
Constantly changing porch times result in waving effects (as reported in the first link).
Parent
Re:Aren't all media reports of internet viruses (Score:3, Funny)
I have yet to experience Zotob... (Score:3, Funny)
propigated (Score:3, Funny)
really... (Score:3, Informative)
Patch available? (Score:5, Insightful)
What's happened is that the bad guys have gotten faster at exploiting the vulnerabilities once they're disclosed. Meanwhile, the vendors have been trying to convince everyone to update as quickly as possible. That's why it's hard to argue against automatic updates (or at least semi-automatic, as in timing it so that an admin is on hand to fix any problems that pop up).
The story here is that a worm zoomed across the next less than a week after the hole it uses was patched. It's not the extent (which the media overstated) but the speed.
Parent
Re:Patch available? (Score:4, Informative)
Right here:
http://www.microsoft.com/downloads/details.aspx?f
Parent
Re:really... (Score:5, Informative)
Actually Windows 2000 does have a firewall. It just doesn't have a purdy gui.
http://online.securityfocus.com/infocus/1559 [securityfocus.com]
Anyhow, how does a firewall help one when an infected machine gets in the building (like a laptop)? You cannot block port 445 (which zotob uses) since that is what is used in part for file and print sharing.
While we didn't get hit where I work I can sympathize with companies that did. When you're working in a large environment it can take some time to test patches to make sure they work as advertised (esp. on mission ciritcal servers). One week lead time is really intense.
Parent
Re:really... (Score:4, Informative)
I blame it more on crappy IT administration.
And how! Almost all of my clients' machines are immune to this (though we patched anyways). Why? Because we disable anonymous connections (RestrictAnonymous registry key), which has been a recommended practice for YEARS.
See the tech advisory: "Windows 2000 systems are primarily at risk from this vulnerability. Windows 2000 customers who have installed the MS05-039 security update are not affected by this vulnerability. If an administrator has disabled anonymous connections by changing the default setting of the RestrictAnonymous registry key to a value of 2, Windows 2000 systems would not be vulnerable remotely from anonymous users."
http://support.microsoft.com/kb/q246261/ [microsoft.com]
http://www.microsoft.com/technet/security/advisory /899588.mspx [microsoft.com]
The same thing happened with Slammer. The MSSQL servers we setup were immune out of the gate because they were setup properly from the get-go.
Parent
not large penetration (Score:3, Funny)
this seemed funny to me. as if somehow not a significant portion of computers run those OSes
Re:not large penetration (Score:5, Informative)
Parent
August: Season of the crashes (Score:5, Interesting)
August 2003: Sobig
August 2004: Sasser
August 2005: Zotob
What's next?
Re:August: Season of the crashes (Score:5, Funny)
August 2004: Sasser
August 2005: Zotob
What's next?
I'm just guessing here, but... could "August 2006" be next?
Parent
Re:August: Season of the crashes (Score:5, Funny)
August 2004: Sasser
August 2005: Zotob
What's next?
4. ???
5. Profit?
Parent
Re:August: Season of the crashes (Score:5, Funny)
August 2006: Longhorn
Parent
Perhaps not as bad, but it still is a problem. (Score:5, Informative)
This type of traffic has the potential to knock over routers/firewalls. I've seen it before and I have seen it this time as well.
no big deal (Score:3, Funny)
Lucky Windows 3.0 users can be at ease.
Actually... (Score:5, Interesting)
In some ways, this was a bigger deal than Sobig.
Tim
Affects more than just windows machines (Score:3, Interesting)
Windows XP and Server 2003? (Score:4, Informative)
States that only Windows 2000 machines were affected.
F-Secure Writes: "The exploit uses fixed offsets inside Windows 2000 version of umpnpmgr.dll. This means that only Windows 2000 systems (SP0-4) are affected."
Surprisingly slow spread (Score:5, Interesting)
A modern worm should be able to spread extremely quickly -- sending out hundreds of infectious packets per second if the payload is small (Witty's was only 637 bytes). If only 1 in 10,000 machine is susceptible, then a worm spewing 100 randomly addressed packets per second should double the number of infected machines every 100 seconds. I'd wager that the number of zotob-susceptible machines was much greater than only 1 in 10,000, so zotob should have spread faster. If anyone ever creates a worm that can infect even 1% of IP addys, it would double every second and saturate the net within the first minute or so.
Why didn't zotob spread faster?
Re:Surprisingly slow spread (Score:5, Insightful)
I'll tell you why: NAT and RFC1918.
The worm (reportedly) only tries to spread to adresses with the same first 2 octets as the current machine. Even if it hit a machine through a static NATed public IP, once infected, it would detect only the private address of that host, and spread only within the company. It was poorly written to be able to spread quickly. It almost needs to be moved to another network manually! Witty went random, that's much smarter.
In fact, we're generally lucky that most virus writers are inept. Otherwise, we would have seen some MUCH WORSE infections already.
Parent
it's okay, guys (Score:5, Funny)
This outbreak hit media outlets (Score:3, Interesting)
Ofcourse it's not as bad... (Score:4, Informative)
Deletes the following registry values:
.
.
.
"MyWebSearch"
"WINDOWS SYSTEM"
"Zotob"
"MyWay"
"WeatherOnTray"
"Apropos"
"IBIS TB"
"TBPS"
"Toolbar"
"Hotbar"
"CMESys"
"NavExcel"
"ViewMgr"
"eZula"
"EbatesMoeMoneyMaker"
"Ebates"
"AutoUpdater"
"Gator"
"Trickler"
"QuickTime"
"GatorDownloader"
"eZmmod"
"Viewpoint"
"TkBellExe"
"180"
"WinTools"
"Real"
"QuickTime Task"
Early Bird Gets the Worm (Score:4, Insightful)
Now, even if MS hasn't created this worm, or released it into the wild, or deprioritized fixing bugs in W2K for it to exploit, or overhyped its danger to create "relief" that its favored W2K3/WXP products aren't at as much risk... don't you think the people over at the "W2K extinction department" in Redmond are very happy about this bad news? That's an incentive to neglect security. Like the sheepdog carpooling with the wolf [dogtimes.com.br].
Depends a lot on your point of view (Score:5, Interesting)
We ended up with a lot of problem because of this worm... less because it actually caused problems with the machines but more because we could see machines constantly trying to infect one another. It wasn't pretty. Our workstations were most at risk, being the largest installed base but also running Windows 2000 SP3 (not SP4 unfortunately). No patch has been generally released for SP3 WS's, but a custom patch IS available from Microsoft if you request it. Due to other factors in play, we have elected to upgrade to SP4 and install the appropriate hotfixes. This is not going to be pretty over about 10,000 workstations.
See, what some people miss when they say that any infection may be due to bad administration is simply that we're dealing with huge numbers of machines, both servers and workstations that are potentially vulnerable. Due to application compatibility and tested standardized platforms we often don't even get the option to keep stuff up to date. The only reason we even have Windows 2003 servers in place today is because we forced the issue with our Corporate guys when we implemented Active Directory; we informed them that we had a need for functionality not provided by Windows 2000 AD (which was true). There is a project currently under way to test Windows XP for rollout, but honestly chances are that Vista will be shipping by the time we even reach 50% rollout mark.
So, why the rant? Well, it must be understood that jumping on the latest patches is not always an option in the corporate environment. Also, jumping on the operating system bandwagon is rarely an option because there's a lot of regression testing that has to be done. Hell, there are some instances where we're having to push the application vendors to support Windows 2003 Servers in our Citrix environment because they've never tested it. Welcome to the realities of Corporate IT.
Are there solutions? Sure! However, none of them are acceptable to most corporations. Linux is not an option, neither is OSX. In both cases we come back to the legacy support issue. Citrix to share the applications? Great... but you're only redirecting the problem to the server farms, not eliminating it. Real world Corporate IT is not as black and white as people would like it to be, myself included.
This virus gained traction because most corporations work this way. It wasn't helped by the fact that McAfee and Symantec both waited two days after the virus was discovered to release a signature update that recognized it.
One positive thing though; this virus is forcing the management to finally listen to my department's complaints that we need to be more proactive about patch management, and this time stuff might get done. We've got a long way to go, but this should be the start of something better.
Re:Depends a lot on your point of view (Score:4, Interesting)
Parent
Re:Depends a lot on your point of view (Score:4, Informative)
Parent
Re:Warzone (Score:3, Funny)
Re:Flaw was patched days before the outbreak. (Score:5, Informative)
Parent
This may not be an accident (Score:3, Interesting)
It's striking how nice the virus writers are to the antivirus companies. Most viruses do just enough damage to require ongoing spending for antivirus tools and upgrades, but not enough to make users switch to, say, Linux. There are exceptions, like the virus that encrypts data on the hard drive and demands payment in E-gold, but those are very rare. Few viruses erase data. Few do things that would make removal impossible w
Re:This may not be an accident (Score:5, Informative)
Compare computer viruses to real world viruses and you'll see.
Ebola, smallpox take your pick from the fast acting, horrific and deadly viruses, very contagious and extremely deadly. With such a rap, why they it killed off everyone on earth yet. The answer why they haven't is simple, they kill their hosts before they have much of a chance to spread.
That is why HIV is such an evil bug, it takes it's time before killing its host, as well as taking plenty of time before an infection is apparent.
Computer viruses are the same, one that destroys a PC or locks down files isn't going to get very far, while one whose sole job is reproduction will spread far and wide and cause havoc only because of it's level of penetration and infection.
Parent
Re:"propigated the internet" (Score:4, Funny)
"Feed it a carrot!"
C-A-R-R-O-T
Parent
Re:Choose a side and get Protection (Score:4, Funny)
If there are factions, its just a bunch of 14year windows users that prefix their IRC nick with their clan name , e.g. [VWF]h4x0r is a member of [V]irus [W]riters [F]orever. They can't offer you an "expert protectionism", whatever the fuck that is, because they're too dumb. Have you seen the code to some of these things? Crap.
Again, there isn't any "viral factions", you need to unsubscribe to the space channel, any MMORPG's or other online games you own, burn your scifi books and get some fresh air.
Cheers
Parent
Re:Did you see that ridiculous CNN coverage? (Score:4, Informative)
The CNN coverage was probably due to CNN still using Windoze 2000, which we use here at NBC for all of our desktop computers.
Mind you, we also have high end workstations running Avid Newscutters and the DS that are based on XP but for desktop use, it's strictly 2000.
It is quite possible that news ops software, like Avid's iNews (a very necessary script-writing, show organizing and newswire access tool that almost every news organization uses) does not work or is not supported on XP. It may also be an issue that XP requires better hardware (highly likely) than 2000 and large, worldwide organizations like CNN, ABC, NBC, CBS, BBC and so on are highly dependent on that version of Microsoft's OS.
So, at least in their case, the hysteria at CNN may have been warranted.
Parent
Re:unpatched machines? (Score:4, Informative)
Parent
Re:Am I being stupid here? (Score:4, Insightful)
Take an idiot user with a laptop and Win 2000.
Idiot user gets infected off their home internet connection, takes laptop into work, connects it to the network and infects every other machine within minutes.
Parent