![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Worms Worms](http://a.fsdn.com/sd/topics/worms_64.png)
![IT IT](http://a.fsdn.com/sd/topics/it_64.png)
Kama Sutra Worm Could Make For A Bad Friday 317
mikey1134 writes "CNN is running a story about the Kama Sutra worm, a virus that is coded to overwrite files of the (potentially thousands of) infected computers. They provide some background on this viral outbreak and warn users to protect themselves" From the article: "And even for home computer users who have never taken such precautions before, security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free. Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."
Many Aliases and More Info (Score:5, Informative)
More on the worm [sans.org] and its permutations and statistics on spreading.
A very detailed analysis [lurhq.com] with all types of files that may be affected.
And, if it's worth anything to you, the Microsoft advisory [microsoft.com] which seems to tout that Windows Live Safety Center Beta [live.com] can protect against it. If you're in charge of computer security at your workplace, I would send out an e-mail instructing everyone to verify that they have the correct anti-virus definitions and to scan their computers before leaving tonight. Luckily, that's not my job where I work.
Re:Many Aliases and More Info (Score:3, Insightful)
Surely, there is a simple answer to this question:
if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?
where do i download the patch ?
if not, this surely demonstrates that the protection companies aint worth a tinkers damm
Re:Many Aliases and More Info (Score:5, Informative)
Possibly yes, but also possibly not. This virus wil disable many common AV programs. My reccomendation would be to use a specialized scanner such as the one from f-secure: http://www.f-secure.com/v-descs/nyxem_e.shtml [f-secure.com]. I just used that one myself.
Re:Many Aliases and More Info (Score:3, Interesting)
Re:Many Aliases and More Info (Score:5, Informative)
Probably yes. That's a big 99.9% yes...
Yes, the Worm tries to delete anti-virus program files. Yes, tries to stop anti-virus software running at reboot. But if it's managed to do that, there's no way you're scanning your PC tonight anyway.
Update your definitions and scan now. Inform everyone you know not to open email attachments they weren't expecting.
Which brings me to another point: Do people really get hit with these anymore? It won't make it though all the major webmail services. You haven't been able to open *.PIF or *.SCR files in Outlook for years now. You almost have to go out of your way to get infected by email worms these days.
Don't get caught up in the media hype. This isn't another Blaster.
Re:Many Aliases and More Info (Score:5, Informative)
Re:Many Aliases and More Info (Score:2, Insightful)
You don't -- there isn't one. This does not exploit a vulnerability in the OS. It exploits a vulnerability in those willing to click email attachments.
Re:Many Aliases and More Info (Score:3, Funny)
if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?
where do i download the patch ?
I just emailed it to you. Click on the attachment to open it.
Re:Many Aliases and More Info (Score:4, Informative)
So, while you scorn his 133t skillz... the point (which you missed) is legitimate.
Re:Many Aliases and More Info (Score:3, Insightful)
Re:Many Aliases and More Info (Score:3, Insightful)
Absolutely, and if you don't understand something, read the comments. Chances are pretty good someone else didn't understand either and asked. Or if that hasn't happened, post the question yourself. That's why the comments section is here!
Re:Many Aliases and More Info (Score:4, Funny)
Nah, nobody needs that voodoo stuff. The virus only overwrites files of certain types. All you need to do is to turn off "show file extensions" option in Explorer to totally confuse the virus
Sorry if I confused that option's name... I haven't touched a windows box in a while.
Re:Many Aliases and More Info (Score:2)
Last time I checked, I was not duped, thus I could only be a sarcastic person. But I wasn't sarcastic. There's a slight chance I could be wrong though - my grandmother just called me saying that she read my post and I could be wrong. She claims that my files haven't been overwritten only because the worm hasn't stroke yet. She also said that it's a scandal that her Ubuntu doesn't provide that ultimate security option.
Is this conversation actually happening? (Score:2)
muszek: How long are you gonna lead this guy on? His sarcasm detector is clearly out to lunch.
Re:Many Aliases and More Info (Score:2)
Timezones people... it was already 5 hours into "tomorrow" for New Zealand when you posted that message.
Apparently I'm not infected.. but then, I don't go around opening unsolicited attachments.
Re:Many Aliases and More Info (Score:2)
Obligatory Kama Sutra Comment (Score:4, Funny)
More Obligatory Kama Sutra Jokes (Score:5, Funny)
As long as you don't (Score:3, Funny)
Re:Obligatory Kama Sutra Comment (Score:2)
Your computer... (Score:5, Funny)
Re:Your computer... (Score:2)
You can renamed ".doc" to any non-standard name and not have to worry about virii like this deleting them.
For a larger organization, it's just a matter of changing filenames, file associations and perhaps most importantly: make sure the icon transitions with the name change.
It might be a PITA, but there's nothing simpler than security through obscurity. Anything you do to change the behavior of th
Re:Your computer... (Score:2, Informative)
Re:Your computer... (Score:2)
I always lock both, just in case some asshat comes by and tries to jiggle the doorknob.
A lock is only going to keep an honest person honest.
Write-once backups (Score:5, Insightful)
In the old days we backed up to tape and flipped a switch so the tape couldn't be overwritten. Today it's burn-once disks. Don't trust anything but physical protections from disk writes.
Re:Write-once backups (Score:5, Funny)
A destructive virus was when a sick person would start coughing so hard that they'd break tablets by knocking them over.
The cost of physical media was high & the write speed was slow. Back then, we went to a lot more effort to make sure that our backups stayed safe.
Re:Write-once backups (Score:2)
A destructive virus was when a sick person would start coughing so hard that they'd break tablets by knocking them over.
The cost of physical media was high & the write speed was slow. Back then, we went to a lot more effort to make sure that our backups stayed safe.
You forgot "And we were grateful!"
Re:Write-once backups (Score:5, Funny)
That should serve as a warning to everyone; always make backups. Especially with important clients like that.
Re:Write-once backups (Score:5, Insightful)
Then you have a bad setup (Score:2)
Re:Then you have a bad setup (Score:2)
For nightly backups, much of that data is only valuable if one copy is available. Do a full backup cycle or two and then start overwriting media. No need for last month's data (except the "month-end" backup), its out of date now.
Re:Then you have a bad setup (Score:2)
All media is destroyable. There are shedders that can easily handle disk platters, CD-ROMs, DVDs, etc. The shedders are smaller versions of circuit board shedders that have been common to firms doing defense electronics since the 1950's.
Re:Then you have a bad setup (Score:2, Insightful)
Re:Write-once backups (Score:3, Informative)
What I was saying was that LTO-3 stores 400G uncompressed, the tapes are less than $70 and the drives are less than $2500. Sounds like its time for you to buy a new tape setup.
Re:Write-once backups (Score:2)
Re:Write-once backups (Score:2)
Your response is something one of my old PHBs would have said.
Re:Write-once backups (Score:2)
Re:Write-once backups (Score:2)
Not if you read the CD from a CD-ROM drive, rather than a CD-R or CD-RW drive.
Oh yes, this (Score:5, Insightful)
And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?
Re:Oh yes, this (Score:4, Funny)
I'm sorry, our records indicate that this joke was used no less than 17 times in yesterday's thread [slashdot.org] about this same topic. You are in violation of the Stale Internet Joke Act of 2004. Please refrain from any and all AYBABTU references and report to UseNet for remedial training immediately.
Oh leave off it (Score:5, Insightful)
This "OMG MS won't patch t3h systems!!!11" stuff on Slashdot is getting old. No, they won't patch it because there's nothing to patch. Duh. They have decided to add it to the malicious software tool, which is a mini virus scanner akin to Stinger from Mcaffee, which scans for a limited subset of viruses, but that's not a patch. Windows OneCare, which is NOT a remote control system by the way, does find it because, well, it's a virus scanner just like any other. It catches it just like AVG, F-Secure, Norton, and so on, which is to be expected as it's a competitor.
So let's leave off the bullshit ok? There are two easy methods to prevent this from hurting your system:
1) Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice).
2) Get a virus scanner. Doesn't need to be MS's, there are many good ones out there. I recommend AVG, it's fast and free.
Re:Oh leave off it (Score:3, Interesting)
Super. That will take care of it. </sarcasm>
I use OWA and this is next to every single attachment: "Attachments may contain viruses that are harmful to your computer." Gee, thanks. When users see that next to every single word doc, PDF, and JPEG they get on a daily basis, they start ignoring it. If everything is a threat, nothing is a threat.
Re:The OS is working as intended -- vulnerably (Score:3, Informative)
Re:The OS is working as intended -- vulnerably (Score:3, Interesting)
They can't. When you try and open attachments you get a dialog that tells you it's a bad idea and the default response set to "Don't Open". Applications should not be able to edit the registry without warning the user.
How is the OS supposed to tell the difference between a legitimate registry change and a malicious one ?
Users should not need to run as Administrator to make their computers work properly.
I agree. B
Re:Oh yes, this (Score:2)
I recently had to format my hard drive and reinstall XP from a 1st-generation cd. When I tried to go to windows update, it demanded I upgrade both the Update program itself and set it to Automatic before it would allow me to get security pat
But but but we want a patch!!! (Score:5, Informative)
Half the articles i read yesterday about this said that the public was being screwed over becuase MS wouldn't release a patch.
The only patch for stupid is a swift boot in the ass.
Re:But but but we want a patch!!! (Score:3, Interesting)
"Hey, what happened to all my documents?"
"You opened a pr0n attachment in your email, you just got what you deserved."
"Boy, I'll never do that again!"
So, if these idiots are capable of any learning at all, this might work out to be a good learning experience for them. And if they're not, well, hey -- it's not my problem they're stupid.
Re:But but but we want a patch!!! (Score:2)
Patch? How about a brain patch! (Score:5, Funny)
How about a stupidty patch for opening up an attachment like the one described.
Re:Patch? How about a brain patch! (Score:2, Insightful)
Don't I wish (Score:5, Funny)
We setup a room. The door to the room says, in every language "Danger! Do not enter". Inside they'll be a cage you need to open, again with keep out warnings. Inside the cage will be a button that says "Warning: Do not push the button, death will result!". If you push the button, you die. We come in once a week or so and clean out the body.
My guess is any person likely to push the button is also the kind that'll open random attachments despite being told not to by us, the OS, their virus scanner, etc.
Problem solved
Better yet... (Score:2, Insightful)
i have a patch (Score:5, Funny)
Re:i have a patch (Score:3, Insightful)
turn you pc to an other os and leave it on tomorrow as well
Re:i have a patch (Score:3, Insightful)
Congrats, you use Linux. It's be great if more people did, perhaps. But now you're just jerking yourself off, and it doesn't seem particularly helpful.
Zip drives? (Score:5, Funny)
What is this, 1996?
Strange... (Score:5, Funny)
Even better (Score:4, Funny)
Hmm (Score:4, Funny)
Clue About How To Detect Whether You're Infected (Score:5, Informative)
It mentions some registry keys that the worm sets up.
http://www.sophos.com/virusinfo/analyses/w32nyxem
Re:Clue About How To Detect Whether You're Infecte (Score:2)
Using the REG utility in WinXP or Win2K Resource Kit, it's not too hard to write a script to scan your PC's registries for this key. Something like
for
echo %%i >>scanlist.txt
reg query \\%%i\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersi on\Run
)
then look in scanlist.txt for any 'hits'.
Re:Clue About How To Detect Whether You're Infecte (Score:2)
Re: (Score:2)
Re:Clue About How To Detect Whether You're Infecte (Score:2)
My linux system just rebooted....
*We* may not need to worry... (Score:2)
I feel sorry for all the people who aren't, though.
Go Ask Alice (Score:5, Funny)
"So while you might think it is coming from cousin Alice, most likely cousin Alice is not going to send you something that says 'Hey look at these pictures with naked people.' So that should be your first clue that a virus is propagating and you'd be well served to call cousin Alice to let her know that she is [unknowingly] sending out this type of e-mail," Sergile said.
Mr. Sergile, you obviously haven't met my cousin Alice [alicecooper.com].
Re:Go Ask Alice (Score:5, Informative)
It could be worse. Alice could be your dad [visit4info.com].
Searches Network Shares (Score:4, Interesting)
A lot of SMEs uses unsecured and passwordless network shares for sharing company data. Data that is stored in, you guessed it, *.doc *.xls, etc, etc files. This virus looks for shared drives such as this and will corrupt the files on them tomorrow.
If only one PC in the company is effected, I can see a whole lot of sore heads tomorrow at lunchtime.
I guess I should have paid more attention to this one.
Re:Searches Network Shares (Score:4, Informative)
I installed this virus on a test network last night. It was ugly to say the least. The test network was comprised of 5 clients, 1 DC, and 1 file server. When I ran the email attachment on a client, it immediately froze, consistent with the description on F-Secure. Upon rebooting with monitoring on, it launched numerous processes, and disabled Symantec immediately. Within 4 hours it had infected the other 4 clients & the file server.
We then flipped the switch on the DC & set the date to 2/3/06. Update.exe launched half an hour after login, and within 4 hours all
Note that this test was performed with out-of-date virus defs as a test.
Here's an idea for those in a corporate environment. Create a software restriction policy for the executables associated with the virus:
%systemroot%\system32\scanregw.exe
%systemroot%\system32\update.exe
winzip quick pick.exe
winzip_tmp.exe
We did this in our test environment and it halted the virus completely.
patching user ignorance (Score:2, Funny)
Isn't the purpose of this article to patch user ignorance?
If I were more creative, and funnier, I would come up with many witty and similar analogies to the phrase "patching user ignorance."
Anyone else calling in sick tomorrow? (Score:4, Funny)
Re:Anyone else calling in sick tomorrow? (Score:3, Funny)
CME-24 aliases, information, and removal tools (Score:5, Informative)
The honest story gives you links to tools for eliminating the threat: You can run this tool: W32.Blackmal@mm Removal Tool [symantec.com], which apparently removes all variants of the worm.
Here are manual instructions: WORM_GREW.A, Also known as: CME-24 [trendmicro.com]
Here is the list of names of the CME-24 worm, and links to removal methods: CME-24 aliases, information, and removal tools [mitre.org].
Ok guys, seriously there's an easy answer. (Score:3, Insightful)
Re:Ok guys, seriously there's an easy answer. (Score:2)
Clamav (Score:2)
Re:Clamav (Score:2)
The Kama Sutra (Score:2, Funny)
That's right. Once you get the Kama Sutra, you're fucked!
Oh this should be interesting (Score:2)
But I'm just waiting to see who the pervs are. This should be interesting when someone comes to me and says their files have been deleted. Hmmmm.. and what were you trying to look at.
Turn back the clock (Score:2)
Why not just wind back the clock?
I'm serious. I've fooled many a shareware program that locks the program after x days by setting the date back to when I first installed it (or even earlier, which makes for some funny notices.)
Unless the Kama Sutra virus is programmed in such a way as to store the date and time installed, and then keep track of every (milli)second that's past, and execute once enough seconds have passed to put
Am I safe? (Score:4, Funny)
Re:Will be a good thing (Score:2, Insightful)
Keep in mind all of those Dells that ship with time limited anti virus trial software. Even if people know they need virus protection, they may not know that it's expired.
Re:Will be a good thing (Score:2, Insightful)
Re:Will be a good thing (Score:4, Insightful)
Sure. But I reckon gradually corrupting small parts of them is still worse. You might only realise you were infected months later, when the quarterly financial figures come out totally whacked, and you'll spend the rest of forever in the company of accountants and auditors trying to track down the correct figures.
Fragging out a file all at once? Then the victim realises something's up, gets the machine fixed, loses some work. Imperceptibly corrupting the file? Victim keeps spreading the virus, and every version of every file he works on is suddenly untrustworthy...
Re:No patch!!!! WTF (Score:2)
Re:No patch!!!! WTF (Score:2)
Re:No patch!!!! WTF (Score:2)
Anyone infected is supposed to download a revolver and shoot themselves in the head for being stupid enough to open an unknown attachment.
Re:No patch!!!! WTF (Score:4, Insightful)
A stupid user is stupid user, the article summed it pretty well: "Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance,"
Re:No patch!!!! WTF (Score:2)
Actually there is a patch for user ignorance. It's called user education. The problem, of course, is that ignorant users are usually also ignorant on their own ignorance, and therefore don't apply this patch.
Re:No patch!!!! WTF (Score:2)
Re:No patch!!!! WTF (Score:2, Funny)
Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no "patch" that can be downloaded to ward off Kama Sutra.
"This is something that is not inherent in the operating system," Sergile said.
"Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance," he said.
I like to jump all over Microsoft for their lax security and gaping vulnerabilites as the next guy, but this
Re:No patch!!!! WTF (Score:2)
Learn a bit about security and limited user accounts. Make sure that normal users cannot write to directories like %programfiles%, %system% and %windir%. Don't allow users to work as administrator.
Install a service like TrustNoExe. Set it up so that executable programs are only allowed in %programfiles% and %windir% (and other directories that normal users cannot write, and that you use to
Re:Great reporting, CNN (Score:5, Informative)
As much as I appreciate your comment, hints on HOW to know if you're infected would have certainly helped.
So I don't get the same response to this comment, here's some links to Nyxem/Karma Sutra/MyWife (Whatever you wanna call it) removal:
- Symantec [symantec.com]
- McAffee [nai.com]
Haydn.
Re:God your stupid (Score:2)
I rest the case defined in the message heading as a case of Slashdot user self-flagellation, which is not a part of the Karma Sutra.
Re:Dupe?? (Score:2, Insightful)
As was this.
Re:SAMBA shares affected? (Score:3, Insightful)
It will *probably* walk the local network and affect nay shares it can access.
But - why take the chance? Always assume it will affect anything it could possibly write to.
Re:Best explanation ever: (Score:2)
I'm curious. If the "head of Macintosh products at Symantec" says that OS X hasn't had any viruses... what does he do? Why do they sell Macintosh AV software?
Do people pay for "peace of mind", and regularly download completely empty virus definition files? ;) I'm sure people would buy it if they did, but I'm assuming they do other things as well.
Re:Best explanation ever: (Score:2, Insightful)
Well no shit. My Ford has been impervious to every big, newsworthy Chevy recall in the past years.
Re:Mainstream media are catching on... (Score:2)
People need to be told that it's not a "computer virus," it's a Windows virus.
Re:Did we just slashdot AntiVir updater ? (Score:2)