![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Communications Communications](http://a.fsdn.com/sd/topics/communications_64.png)
Skype Worm Infects Windows PCs 127
walterbays writes with news of a worm spreading to Windows PCs through Skype's IM. The worm is variously called Ramex.a and Pykspa.d. A poster on a Skype forum explains how to remove it. "After hijacking contacts from an infected machine's Skype software, it sends messages to those people that include a live link. Recipients who blithely click on the URL — which poses as a JPG image but is actually a download to a file with the .scr extension — wind up infected."
Worm? (Score:5, Insightful)
I'm sure I won't be the first to point out that such an attack vector is not a worm [wikipedia.org].
Re:Worm? (Score:5, Funny)
Re:Worm? (Score:5, Funny)
I applaud the gp's modesty, and four dimensional thinking. I think we should all be a little more considerate of our resources, both natural and produced, in light of the fact that they may belong to someone else before us, in the future.
Re:Worm? (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Look how many keystrokes are in that baby!
You'd have to be a ninja to say all that and still be first.
Re: (Score:3, Funny)
There, fixed that for ya.
Thank god this is /. (Score:1)
Re: (Score:2)
Microsoft's fault? (Score:4, Informative)
Re:Microsoft's fault? (Score:5, Insightful)
Hiding the extension is a very most annoying thing though, it's the first setting that I change on a new install of Windows.
Re:Microsoft's fault? (Score:4, Informative)
Re: (Score:3, Informative)
In OSX it's no different. But for some reason Steve's reality distortion field is so strong Mac users don't seem to care about it much.
Re: (Score:3, Insightful)
I fail to see how a 'non-techinically proficient user' would notice the appropriate extension...
Re: (Score:2)
What's really boneheaded is having to worry about clicking on screensaver links at all.
Re: (Score:2)
Any other email/im could be a vector for it.
FIXED (Score:5, Funny)
"blithely" (Score:1, Funny)
Re: (Score:3, Funny)
blithely: [webster.com]
1- of a happy lighthearted character or disposition
2- lacking due thought or consideration
110% of them (Score:4, Funny)
Lovely (Score:2, Interesting)
No mention of if this is just piggybacking a windows exploit or is it purely the result of Skype being craptastic. Also, gotta wonder how/if it effects a properly patched wi
Re: (Score:1)
Re:Lovely (Score:5, Informative)
Re:Lovely (Score:4, Informative)
Heh, I am Eyal. I admit I was "infected". Basically I clicked the "scr" link because I foolishly trusted the source of the message to be who it was, did not read the contents before clicking, I don't really give much of a damn about this Windows box, and I forgot that the "scr" extension was executable, and not just an image file (which is typically a less likely attack vector).
I assumed that since the Explorer.exe was unmodified, but explorer.exe is respawning the virus/worm's executable, that it modified Explorer's behavior in some way, perhaps by code injection. It was just speculation, ofcourse and obviously there are simpler ways to get explorer.exe to respawn your process, but it really is an unimportant detail.
Re: (Score:2)
Re: (Score:1)
Also, gotta wonder how/if it effects a properly patched windows xp machine and/or vista.
I do not update or patch WindowsXP SP2. I do shut down unneeded services, I use SpybotSD to immunize Internet Explorer and I do tweak windows not to do this or that. I use the firewall to control programs, and have no resident virus scanning programs. I never use the Internet Explorer or Outlook.
I use skype every day. Yesterday I have been spammed on pure geek English from my non English speaking friend to open some links like www.fakeit.org/somethig/~blahblah/funny.jpg while he was DND. I know that he w
F-Secure info (Score:5, Informative)
The malware terminates a list of 534 processes. (Score:2)
Re: (Score:2)
Re:The malware terminates a list of 534 processes. (Score:4, Funny)
Anyone who can make $money honestly could make N * $money dishonestly.
How do you think corporatism works?
Skype itself is blameless (Score:5, Insightful)
Naming it a worm is a minor overstatement as well.
It propagates by user incompetence, not by a technical flaw...
These sort of malware executables circulate on email lists (and I daresay, other IM networks) already, so it's no surprise that Skype has "joined the club" of being big enough to attract unwanted attention...
Re:Skype itself is blameless (Score:5, Insightful)
If the last 8-10 years have taught the IT industry nothing else, we should at least be well aware by now that basing your security on "user never does anything stupid" is a pretty effective way to ensure that the user's system will be emailing everyone and his dog adverts for Geniun Vigara!!!111 (sic) by the end of the day.
Don't blame me. (Score:2)
I haven't been proven wrong, yet.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
So what solution do you propose to stop stupid users from hurting themselves, but without severely restricting or inconveniencing their activities? I mean, it's fashionable to bash the IT industry, but can you come up with a solution?
Why develop a solution for a non IT problem? The problem is that everyone and their dogs are running Windows as administrators. The solution is simple: educate the masses about NOT running their boxes as administrators. The security framework is already in Windows.
There, I solved your problem.
Re: (Score:2)
There is still a fair bit of software which requires you run it as an administrator. Or if it doesn't, it doesn't exactly make life easy for those who'd like to run it as a non-admin account.
There is also the Windows XP (don't know if Vista does the same thing, but I doubt it... finally) "feature" where it prompts you to create a user account at install time, explaining that this is "good practise". And then it immediately g
Re: (Score:2)
That is not really a solution. What if the user wants to install programs that legitimately need admin access(Eg. Virus scanners, graphics drivers, etc) ? And don't mention badly written apps and games that need admin access to run with no reason. With your solution they will have to logout and then login as an admin, which they won't put up with.
Microsoft already tried to solve this in Vista. Even administrators run with user credentials until they need Admin access at which point they are hit with a U
Re: (Score:2)
2. Double click on the clock to get the calendar / analogue clock
3. Call the Administrator to find out why you don't have permission to open the clock !
4. Listen bemusedly to the Administrator tell you that you can't look at the calendar because you don't have permission to change the system time.
5. Complain that you don't want to *change* the time, just look at it!
6. ???
7. Non-profit
Re: (Score:3, Insightful)
We've got to start looking out or we will have our shiney metal asses bitten.
Re: (Score:2)
We've got to start looking out or we will have our shiney metal asses bitten.
I know. Bloody wonderful, isn't it?
The best bit is that every time someone points out that Linux having no viruses does not make it immune from malware, they're silenced by being modded and shouted down as a traditional "file-infector" type virus cannot and does not thrive on the platform.
I'm going to pre-empt that here and now. I'm even going to shout it in the hope that it will get the point across.
THE TRADITIONAL "EXECUTABLE F
Re: (Score:1, Troll)
Lunix is insecure be design.
Root is a design fault.
That's why it got removed in the next version [bell-labs.com].
Re:Skype itself is blameless (Score:5, Insightful)
Re: (Score:3, Informative)
The saddest part about Slashdot is that people read the summary or sometimes a misleading articles, assume things and then comment away which is modded up by moderators who don't have much clue either. Then you see someone picking out holes in the summary and article and usually getting modded up(a good thing!). And then one looks at all the modded up wrong comments and thinks "WTF were these people thinking up when they were posting/modding up this crap?"
All Skype does is auto link URLs and make them
Re: (Score:1)
Re: (Score:2)
Though the best fix could come from Microsoft not allowing arbitrary untrusted code to be run..
The second that there is even a hint of MS doing that, everyone on Slashdot would cry wolf about MS and DRM blocking access to what the user wants. That is exactly what happened with Trusted Computing. And who gets to decide what is trusted code and what is not? Will small software vendors have to pay to get their code certified? And will I be prevented from running code that I or a friend made?
Re: (Score:1)
> who gets to decide what is trusted code and what is not? Will small software vendors have to pay
I like the security model of Java Web Start (disclaimer: I work for Sun) where you decide who you trust, and they can earn your trust by paying for a security certificate from a trusted commercial issuing authority, or they can self certify with a certificate from Thawte and earn your trust in other ways. I could imagine a PGP style web of tr
Amazing (Score:2)
Re: (Score:1, Informative)
ClickMe.sh
For instance, could hose up your home directory and data pretty badly, if say, KDE's shell ran shell scripts when clicked.
Re: (Score:3, Informative)
ClickMe.sh
chmod a+x ClickMe.sh
Even the GUI version of the above requires at least 5 clicks in Gnome, and I guess about as much in KDE.
Re:Amazing (Score:4, Informative)
Re: (Score:1)
Also, most versions of windows I have used(since 95) ask before opening executable files(even .SCR)
You clearly don't remember the Outlook Midi exploit.
Re: (Score:2)
Two things. Firstly, MIDI are not "executable" files, like .EXE, .COM, .SCR, or .PIF
Second, I meant to say browsers in the versions of Windows(this is what TFA is about) and not other apps like Outlook. But, point taken.
Re: (Score:2, Interesting)
Ehm, you really don't remember, do you? There was functionality in Outlook that allowed emails to run midis, except it didn't check the MIME type and ran whatever declared itself as being a midi, including EXE, COM, SRC and PIF. So, the person opening those emails got infected by "just opening the email"
That was back in the day that we computer scientists were laughing at those "open an email and get virus emails". We didn't count with Outlook.... *sigh* That was a long time ago...
Re: (Score:2)
Then there was auto-executing HTML with embedded ActiveX controls and other documents.
Checking the MIME Type is hardly a security measure, it's just a header.
The only way to test a file is to process it with the application. Rememeber the recent MS image opening ownage.
Re: (Score:2)
Actually, technically the first dialogue is a UAC dialogue as well. The "sandbox mode" is really just another privilege level; just a really low one -- much lower than standard user -- so the normal "sandbox dialogue" is an elevation request from "really low" to "standard user".
Incidentally, that's another reason why it's a bad idea to turn off UAC.
Skype's revenge (Score:4, Funny)
blithely (Score:3, Funny)
Is there any chance this is related to outage? (Score:3, Interesting)
An aquaintance of mine was hit by this today, he only ran Skype ever with his wife and daughter -- it seems hard to imagine how bad guys got ahold of his address, unless perhaps somebody downloaded the whole database.
Thad Beier
Re: (Score:2)
Re: (Score:1, Troll)
Re: (Score:1)
And the wife and daughter don't have other contacts? I guess this is just a standard address book trojan - six degrees of separation and all that.
Sweet merciful Jesus (Score:1)
Re: (Score:2, Funny)
Poor Skype... (Score:2, Flamebait)
Interesting that Microsoft is, yet again, directly or indirectly, responsible for their misfortune.
Re: (Score:1)
Re: (Score:1)
I guess some would say it's MS' fault because they allow malicious code to run. Personally I think trying to hold them accountable for that kind of thing just makes subsequent versions of Windows even more restricted and unusable without properly "breaking them in."
Re: (Score:2)
Interesting that Microsoft is, yet again, directly or indirectly, responsible for their misfortune.
Indeed. Just as interesting as how oxygen is, yet again, directorly or indirectly, responsible for their misfortune.
Social Engineering at its best (Score:2)
Re: (Score:1)
Someone set them up the bomb.
Yet Again... (Score:4, Funny)
(I kid. I hate Skype passionately (for getting everybody on a proprietary solution when open protocols exist) and would never go through any amount of trouble to get it installed on my computer.)
Re: (Score:2)
It is a lot better then any other voip service Linux can offer. Ekiga sucks compared to Skype voice. Gtalk might be able to beat it in the future but the apps just arn't there and stable right now to support it out of the box. I found Ekiga which comes in a default Ubuntu install to be too quiet and doesn
Re: (Score:2)
Why people use Skype (Score:1)
Re: (Score:2)
Sorry. I'm bitter. Feel free to ignore me.
I've seen this "worm" with my own eyes! (Score:1)
BTW, I was asked by Firefox whether I want to download those files. A
Re: (Score:2)
Same stupidity-driven "worms" with end users to blame (and, to lesser extend, windows is also to blame since it executes the files without asking, where is chmod +x when you need one...).
Windows does not execute downloaded binaries without prompting.
Further, having to chmod +x would add an additional step, but anyone silly enough to download and run some random binary from an IM is hardly going to be slowed down by that - just look at how many people fell victim to the trojan that arrived in a *password
Re: (Score:1)
interesting thing was, that on my windows box it closed ethereal, never to allow run it again.
Forbidden extensions? (Score:2)
Re: (Score:2)
We're still living with
I blame Apache and it's "let's map uri's straight to filenames" idiocy
Re: (Score:2)
I meant links like this: <a href="virus.exe">innocent-looking-pic.jpg</a>
Re: (Score:2)
innocent-looking-pic.jpg [slashdot.org]
Not a skype worm... (Score:2)
Re: (Score:2)
Re: (Score:2)
But if we're going to call it a 'worm' or 'virus', we've got to accept the vulnerability being exploited: The human.
Re: (Score:2)
I can only think of two valid reasons for them to stay away from it. One is that they're being lazy and going after lower hanging fruit. The other is that hackers probably all love using Skype because they love having
Assume (Score:2, Funny)
Re: (Score:3, Insightful)
Yes, we do. Because for a start, every time we don't, Linux/BSD/Mac/FreeDOS/Solaris-x86 fans complain that it's not "PCs" that are vulnerable, it's Windows. Which is true. Also, since the article says Windows PCs, the /. summary is just quoting that. It's also a good thing that the article states this, because the less technical crowd who might read it may notice that it's only Windows PCs that a
Linux support? (Score:3, Funny)
Also could you post the link so that I can try porting the
Re: (Score:1)
Open source alternatives (Score:2)
Unix outlook (Score:2)
Re: (Score:1)
If you listen very very carefully... (Score:2)
Re:Software diversity is a good thing. (Score:4, Insightful)
Re:Software diversity is a good thing. (Score:5, Insightful)
Where's Skype to blame if someone gets a link sent and clicks it without even trying to see what's behind it?
Re: (Score:1)
But please try this "exploit" in Firefox. It will not let you run the .scr, it will ask if you want to save it to disk or cancel. You *cannot* run in from Firefox. In Linux the .scr would be saved as non-executable. I'd imagine the same happens in Windows.
Re: (Score:2)
Hmm... starts with "MZ", has a DOS-Stub, has a PE-Header, has PE-Sections... Yup, is a PE-Executable. I'd say, Windows would run it.
Snide comments aside, Screensavers ARE executables in Windows. That's what makes SCR such a popular extension for malware, nobody'd expect that. More important, screensavers are fun in and by themselves, so people will readily click them where they might not with a normal executable unless there's a goo
Re: (Score:2)