Massive Spam Shot of "Storm Trojan" 260
jcatcw writes "Postini has already counted nearly 5 million copies of the spam in the last 24 hours, and calculated that the run currently accounts for 87% of all malware being spread through email. 'Expect this to grow much larger,' a Postini spokesman said; 'It should top out at 60 million messages within the next 24 hours.' It's the largest attack in the last 12 months, and more than three times the volume of the two biggest in recent memory: a pair of blasts in December and January. The spam carries a ZIP file attachment posing as a patch with subjects such as Worm Alert!, Worm Detected, Spyware Detected!, or Virus Activity Detected."
Re:Another day in the world of near-monoculture. (Score:5, Insightful)
If anyone should be sued, it should be the ISPs who allow zombies to sit there on their network. I don't like lawsuits, and would prefer to see some government incentive used to compel ISPs to remove the zombies.
Re:Another day in the world of near-monoculture. (Score:3, Insightful)
waaaait just one second... (Score:4, Insightful)
Out of curiosity... since this is a completely social hack, and is just a means to trick somebody into opening up a compressed file and running the included executable... why would a Mac or Linux user be immune? Cannot Mac and Linux users also run executable programs from their desktops? You're confusing the ability to run a program of your choice with the means by which someone is fooling you into thinking you should choose to run it, right?
Re:idiot (Score:1, Insightful)
No; this has nothing to do with Vista.
Re:New "Sledgehammer" virus (Score:2, Insightful)
Re:waaaait just one second... (Score:2, Insightful)
Sure, you could write a trojan targeted toward those OSs. And you could presumably trick users w/o regard to the OS they use. But it's far more likely that the windows user is logged in with full Admin privileges. The Linux and Max users are probably not, limiting the extent that the trojan can mess with their systems. You probably could trick the Mac and Linux users to log in as admin, to change the file mode to executable, and run the trojan. However, at each step, the user might just wise up and have second thoughts. Wouldn't stop all cases, but with something like this, it doesn't hurt to improve the odds in the good guys' favor.
Re:I saw one of these yesterday (Score:5, Insightful)
Don't think that would happen? You must be dealing with a better class of users than exist in the wild. Of course it would happen, and happen at such a frequency that it would be just another massive exploit.
Windows is targeted because of market penetration. Why bother with less than 5% when you can get 95% in a single effort?
.zip files! I don't need any stinking .zip files! (Score:1, Insightful)
Re:Another day in the world of near-monoculture. (Score:1, Insightful)
Too much privilege! (Score:4, Insightful)
Actually, there is a technical flaw, not just a human engineering one. The system allows users to install software, with global system implications, with no confirmation. My Mac confirms such things with me, and seems to get it right. My Linux box won't let me touch the global system configuration at all unless I su to root.
This has always been the problem. I recognize that there is incompetent Windows software out there that won't run without Administrator privileges, but that's another issue. If you really need privilege to do something (like change your password), others systems have ways of temporarily elevating privilege. Like suid on Unix.
...laura
Re:Another day in the world of near-monoculture. (Score:2, Insightful)
Re:waaaait just one second... (Score:5, Insightful)
But it doesn't matter.
The trojan/worm need not be an administrator to trash a user's computer, even with Linux. Let's use Ubuntu as an example. It can still send mail and propagate just fine as a regular user. It can also trash that user's documents and files (which are likely to be the only important data on the machine). It can use a crontab entry to start a daemon on a high-numbered port, which will run without user interaction, or without them even being logged in. That daemon won't be root, but it will still be capable of being a very proficient zombie.
After that, for good measure, it can just run gksudo and simply ask the user for root permission. Ubuntu users are absolutely content to enter their own password into gksudo whenever prompted, especially when performing updates and patches (as this claims to be). So, the trojan will readily then gain root and be free to run completely amock. Trashing or rooting the OS is the obvious next step, but it's probably not even needed after all of the damage and infiltration already accomplished as a regular user.
Seriously - just because it's not Windows does not mean that it's secure. As long as people are able to run arbitrary programs on their own computers, these types of things will continue to be a problem...no matter what kind of computer it is, and no matter if it has root/administrator priveledges or not.
High risk file types (Score:2, Insightful)
Source: http://support.microsoft.com/kb/925330/en-us [microsoft.com]
Re:Nope (Score:3, Insightful)
Re:Too much privilege! (Score:3, Insightful)
Why the fuck do people keep bashing the UAC? What the fuck is wrong with finally having a real "sudo" in windows? Instead of having to run as administrator all the time, you can now escalate when you want to. Microsoft finally adds better security, and all the whiners come out of the woodwork.
This sort of shit reminds me of my uncle, who thinks he's a computer person:
"I really miss windows 98. It was a simple, no-frills operating system."
"It didn't have a firewall."
"You can download a free one."
"It didn't have any kind of access controls."
"???"
That kind of thing. The hell of it is, the people who are moaning about the UAC must be running as administrator. This poses two questions. First, why are they running as administrator? Second, if it bugs them so much, why don't they turn it off?
I'm not a windows fanboy by any means, nor do I like Vista, but this hypocritical bullshit just drives me totally crazy. You wanted security, you got it. Go ahead. Surf the web as root, and get owned. But don't come back and whine about how windows is insecure. You don't know the meaning of the word.
If you want a reason to complain about Vista, complain about DRM. You can't turn that off in control panel, and its hooks reach deep into the display system. It's a deliberate attempt to lock you out of your own computer. They'd probably love it if PCs were like xboxes, with everything signed out to wazoo. Hell, it's happenning already with hd-dvd.
But no, you take the time to bitch about window's advantages.
Re:Too much privilege! (Score:3, Insightful)
One of the problems I had with early revisions of UAC (I haven't had the pleasure of trying out Vista's final version much) is that it couldn't figure out what the user was trying to do and anticipate it. When creating a new file, I first was asked if I was sure I wanted to create it, then I was asked if I was sure that I wanted to rename it. Hey Vista! It's a NEW FILE! I probably don't want your stupid default name! This sort of problem was all over the place in RC1, and not much better in RC2. I've heard that UAC didn't change much from RC2 to RTM.
Turn it off? Sure, but your average user won't know how to do that, and so they'll just be further trained to click Ok to do whatever it is they're trying to do.