Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Bug

Clever New Windows Worm 621

Posted by CmdrTaco from the well-isn't-that-clever dept.
freakboy303 sent in linkage to a new worm that will no doubt be cluttering our inboxes soon. Clever bits include running its own SMTP service to increase chance of success, as well as using a bunch of spaces to disguise the true extension of the executable. No doubt countless copycats will soon follow and our inboxes will be cluttered by countless copies of the thing. Not that there's a problem with windows security.
This discussion has been archived. No new comments can be posted.

Clever New Windows Worm More

Clever New Windows Worm

Comments Filter:

  • So (Score:2)

    by xercist ( 161422 )
    it runs an SMTP server and has spaces in the file name. This is suppoosed to make it "clever"? None of this is original.

    • Re:So (Score:3, Funny)

      by bn557 ( 183935 )
      no no no,

      see, people have either used a local smtp server OR used spaces. This is obviously the work of a professional. No script kiddie could be THAT good. This guy probably has an AMD [dal.net]

      Pat

      (link is to a funny article)

      • Re:So (Score:4, Funny)

        by Tower ( 37395 ) on Thursday December 20, 2001 @06:28PM (#2734633)
        Hmmm, I thought there was already a patent for that. Something like:

        Method and Apparatus for delivery of a self-replicating bytestream through use of a square port number and excessive white space.

        Couldn't find it on the patent search site, though ;)

  • More Slashdot demagoguery? (Score:3, Interesting)

    by Wire Tap ( 61370 ) <frisina AT atlanticbb DOT net> on Thursday December 20, 2001 @05:51PM (#2734314)
    Not that there's a problem with windows security.

    Why do the editors of Slashdot ALWAYS put their unproductive, derogatory, flaming, two cents at the end of _every_ story regarding something "AWFUL" Microsoft has done? Either they are really insecure about "their Linux," and can't get fullfillment from any other means than bashing the competition, or they really don't believe in what they advocate so much. I'm sick and tired of hearing it! Come ON Slashdot! There are countless posts in previous stories that sound just like this one - all in reponse to the crap you guys put in the Microsoft stories. Get the picture: no one wants your bias. Bias makes for unreliable, untruthful, and slanted news.

    With that being said, of course there are problems with Windows security. There are security problems in EVERY OS. Stop pointing the relentless finger at Microsoft every chance you get.
    • is that we don't PAY for the privilege of having a secure OS.

    • Ancient Troll (Score:3, Insightful)

      by Chris Burke ( 6130 )
      Not a bad one, either, judging by the reaction. But seriously, if this wasn't a troll and you really have these complaints you wouldn't be reading /. anymore, would you?

      At least the people who bitched when Taco first used the Bill Gatus of Borg icon they had a legitimate reason.

    • Really!?! Show me the Email client that launches an executable simply by double-clicking on it.

      What? You can't find one. Perhaps Microsoft will write one so that Linux can be unsecure as well.

      Yes, there are security problems in every OS, but Microsoft goes out of its way to create security problems. Regular users can delete, update, or change system files in the default setting What the heck sort of security is that? Microsoft has even blurred the line between data and executables by creating documents that can launch macros with hooks into the entire operating system. What was Microsoft thinking? At the very least Microsoft should have created a sanbox for these VBA macros.

      The fact of the matter is that Linux + StarOffice is an order of magnitude safer than Windows + Office and would be even if Linux had the greater market share.

      • Show me a soccor mom that can pick up Linux+StarOffice and use it.

        Show me an average person that can learn how to open up attachments with one of your "safe" email programs.

        The graph you are now picturing is "User Friendliness" vs. "Security".
        The market will show you which one is in higher demand.
        Not that I agree with it, just telling you the way it is.
        • if it came pre-installed like windows does?

          no problemo.

        • Good points. Of course, my response had nothing to do with ease of use. The original poster intimated that Linux had these same sorts of problems, and I pointed out that it doesn't.

          Personally I think that if the question were spelled out as bluntly as you have said it that many organizations would opt for Linux's slightly lower user-friendliness, and much higher security.

          Then again, I think that we are very likely to see StarOffice become popular due to its much lower price. In my opinion Windows, StarOffice, a decent email client that doesn't allow you to launch executables by double clicking, and a good virus scanner hits the sweet spot between usability and security.

          Most users would still be able to do all of the stuff they currently do (including run all of their Windows software and open most of their Office documents), and yet they would be infinitely safer from viruses, trojans, and other malware.

          Until it comes pre-installed Linux isn't likely to be a good fit for most folks.

    • Re:More Slashdot demagoguery? (Score:4, Offtopic)

      by FortKnox ( 169099 ) on Thursday December 20, 2001 @06:12PM (#2734509) Homepage Journal
      I'd prefer it if they just wouldn't post anything about MS unless its related to Linux. Fact is, bad publicity is still publicity. If they wanted to be mature about MS vs. Linux, they wouldn't post this stuff.

      The key word is in the above paragraph is "mature". Its like I always say about elitests and linux. They like being able to put other OSs (in this case) down, that is why you find people bashing Linux newbies instead of helping them out. Cause if everyone used Linux, they wouldn't be "special" and be able to insult the "average man".

      Remember, the men behind /. are kids fresh out of school, without any business tact (not that I've shown much, but I'm not being paid to be here...).
      • I'd prefer it if they just wouldn't post anything about MS unless its related to Linux. Fact is, bad publicity is still publicity

        I, and I would think others, don't mind reading about Windows vulnerabilities here. I just see through the bias statements. One thing's for damn sure, I'm not about to start reading some Windows site for good details on the hole-of-the-week.

        If you don't want to read about Microsoft here, just turn it off in your preferences.

      • no, knowledge to help. (Score:4, Interesting)

        by Erris ( 531066 ) on Thursday December 20, 2001 @09:52PM (#2735434) Homepage Journal
        Remember, the men behind /. are kids fresh out of school, without any business tact (not that I've shown much, but I'm not being paid to be here...).

        Let's see, I'm 35 and work for a US national sized company. They have not fired me yet, so I must have some tact.

        I'm interested in all the windows worms and I'm glad that Slashdot documents them. Here disasters that cost companies that trust M$ millions of $ are treated rather cooly, exept by folks like me. You see, here I get to scream my head off about how stupid, irresponsible and incompetent the exchange group is. You don't think I'd actually tell anythig to the moron "standardized" on Exchange then got clobbered by all this? I mean, they tried very hard. They spent all the company money on all the band-aid virus checkers, comercial mail filters and what not. Heck, they are still trying very hard to recover all the contacts, email, calender events, daily journals and what not that contained the characters "hi" in them? Nah, they might get their feelings hurt if they learned how badly the company they trusted let us all down. Here I can scream it all out loud, share laments with others who suffer and more important, learn exactly why such things happen and why they will always happen when you do things the M$ way. Slashdot is teaching me with good and bad expamples of how to do things. Shame on M$ for the way they do things. Here I can gloat and bitchslap trolls like you in a way that would get me shitcanned at work. When I'm finished learning good conceptes and taking out my frustration on loosers like you, I can gently suggest things to my co-workers that might improve the place I work. I don't have to gloat about new viruses, the NAV packs and viruses themselves do that for me.

    • I agree with you there, but I'd like to get some opinions on something I think I've noticed, but can't be sure of:

      Is it me, or are the comments under the stories actually getting less anti-microsoft? Seems to me like a year or two ago very few people would be willing to defend MS (or decry anti-MS sentiment), but nowadays people are a little more level-headed about it it seems (at least in the comments section; the /. editors still like to tear into them). Is that because slashdot is becoming more mainstream, or because MS software actually is pretty decent these days (I find XP a lot less irritating to use than X), or am I just coming out of left field here?
    • because it's their site

      go somewhere else if you don't like it.
    • Why do the editors of Slashdot ALWAYS put their unproductive, derogatory, flaming, two cents at the end of _every_ story regarding something "AWFUL" Microsoft has done?

      Because to a programmer/architect/sysadmin, the mere existence of these worms is mind-boggling. Imagine the largest-selling American car manufacturer building all of their models with the gas tank right behind the front bumper, or some such idiocy. Now you, as an automotive columnist (with some professional understanding of auto design), are forced to report every time one of these Hindenburgs ends up as a firey wreck.

      It'd be bad enough if this happened in one model of car, but to see it happen year after year, when the company should know better, has to be somewhat irritating. I'll let MS slightly off the hook when a "legitimate" bug is found-- that is, one that might not have been directly anticipated when the product was being designed. But each of these worms exist as a result of MS's ongoing, dunderheaded ignorance of basic security issues. Windows scripting on as default? Minimal security in their email software? Preview panes that can automatically execute scripts?

      So yes, the Slashdot editors' scorn is thoroughly justified in these cases. If you're looking for more objectivity in your reporting, there are other places to go. If you stuck to the reports I've seen in reputable newspapers, you wouldn't even have to suffer the notion of Microsoft as a responsible party. If you think that's the case, choose your news sources differently. Slashdot is run (and contributed to) by people who take this sort of stuff a little bit personally.

  • Chances are that this has already had a patch released, I am sure. Chances are also that there are an awful lot of unpached machines out there. I have to say the social engineering on this one is pretty clever. Who hasn't gotten a message like that? I mean in Outlook.

    Now for the usual run of blame: hackers for writing it, MS for releasing Outlook, users for not patching. For the real solution, see my sig.

  • Re: (Score:2, Interesting)

    by account_deleted ( 4530225 )
    Comment removed based on user account deletion
  • If the W2k virus is "Bassed on NT Technology", where NT stands for "New Technology", will the next patch recursivly contain the previous "uber" patch. The New Technology Technology Uber Uber patch?
  • So I check the link to see what I can do to stop this worm before virus defs are released, and the best I can find is to drop .txt.pif ? Ok, that's nice, but I don't like to rely on extensions..

    Where is the link to all the detailed meaningful info about this worm?
    • Based on previous posts in the last week, there's not much reason not to rely on extensions - after all, IE and Windows do.

      The reason the thing is treated as an executable is because the the .pif extension... there's no really good reason for anyone to want to send you a PIF file these days - they are more or less a DOS/Win3.x hangover. Block *.pif.

      [agreed that useful info about the worm would be good too]
      • Block *.pif.

        Already done, but the issue isn't the name, it's the code. We don't run OutLook, but if this thing was renamed before being sent, it could still potentially be damaging...Especially since the writeup at the link is so...sparse.

    • Outlook Express 6.0 has some checking already built-in to say "hey this might be a virus" before you open attachments with .pif extensions as well as some others (I don't remember which).
  • ... who hasn't gotten a single one of these worms? I think the only one I got was the "I send you this file in order to have your advice" thing like 6 months ago. No Nimda for me, no Sircam, no other elite macro viruses. Are the people I converse with in email just cooler/smarter than everyone else, or is this whole email virus thing more hype than reality?

    - A.P.
    • I've never gotten any virus of any nature through e-mail. Either no one likes me or no one I know is stupid enough to open e-mail attachments.

    • Re:Am I the only one...? (Score:5, Funny)

      by Tackhead ( 54550 ) on Thursday December 20, 2001 @06:02PM (#2734424)
      > Are the people I converse with in email just cooler/smarter than everyone else

      At the risk of stroking the collective /. ego, yeah, they are.

      Canonical example - someone who got Sircammed at work, came to me and said they were having trouble opening up this attachment someone had sent them, and they wondered why someone sent it to them in the first place.

      I did my best "All your base!" voice and said "I send you this file to have your advice!"

      Cow orker said "Yeah, hey, how did you know that? Are you reading my mail?"

      Another admin and I spent the next hour disinfecting 0wn3d box3n from other cow orkers who had done the same thing.

    • I actually asked a friend who got SirCam to send me a copy so I could say I got it. :)
    • There are several factors to consider. The first is you mail provider. If they are quick to block out the newest viruses at the server, you obviously will not get it.

      The other is how much your email address is out there. Some of the viruses would go through the web cache and grab email addresses from there. If your email address is out there a lot, you are going to get more viruses. 99% of the SirCam, Nimda, and so on that I got (probably a couple hundred) came from people I did not know.
    • Am I the only one...who hasn't gotten a single one of these worms?

      ...

      Are the people I converse with in email just cooler/smarter than everyone else, or is this whole email virus thing more hype than reality?

      My personal mail accounts tend not to see any of this traffic. Although some of this may have to do with the systems on which my accounts live. And I'm sure its also got something to do with my usual lists of correspondents.

      Still - these things certainly exist and they're a pain for some. I do infosec consulting and see it all the time with my clients and in conversations with friends and peers in the industry.

      As a side note - it never ceases to amaze me how some businesses manage to continue functioning with all the crap dumped on to, and floating around, their insecure networks. Especially smaller businesses who's resources are usually a lot tighter than their larger counterparts.

      I'm just glad I can escape it all to the (relative) safety of my own little home network once in awhile. :)

  • Without Outlook? (Score:5, Funny)

    by krony ( 213134 ) on Thursday December 20, 2001 @05:54PM (#2734343) Homepage
    "The worm utilises it's own SMTP engine so it does not depend on Outlook for e-mail sending."

    Not even a virus can depend on Outlook anymore...

    :-P

  • There's a few differences (Score:5, Informative)

    by BadDoggie ( 145310 ) on Thursday December 20, 2001 @05:54PM (#2734346) Homepage Journal
    Differences:

    • 1) "Legitimate"-looking Subject line.
    • 2) Legitimate-looking warning message straight out of Outlook.
    • 3) Good social engineering
    • 4) Own SMTP engine, so an Outlook script to warn that there's mail w/ attachments going out is useless.
    • 5) New "method" of hiding file extension which is harder to see even if extensions are displayed.

    We were all talking about this a week or two ago, but I'm too busy trying to get this pinball machine on eBay, so no time to search through old articles.

    woof.

  • Windows == spammer? (Score:2, Interesting)

    by pdqlamb ( 10952 )
    Since this installs its own smtp, does this mean any Windows machine can now become an open relay for some random spammer?

    Gag, I hope I didn't understand that correctly...

  • Get a Mail FIlter Already!!! (Score:5, Informative)

    by seigniory ( 89942 ) <bigfriggin&me,com> on Thursday December 20, 2001 @05:55PM (#2734359)
    Mail worms/virii/sausage - whatever - can be unbelievably contained with a simple attachment checking process - after Melissa, I implemented Mail Essentials (www.gfi.com) at my company - one server - 200k+ messages a day capacity - extention filtering ON.

    Since then, we got hit with evey major email worm, but got infected by none - 1,000's of messages per incident blocked at the server - none made it to the internal Exchange box... they all get blocked at the "mailman" (block EXE, VBS, PIF, whetever)

    The sender gets a "kindly" message saying "Sorry, we don't accept this extention type - try again".

    It'll even scan for uncertified macros in Office Docs, filter spam (i.e. GREP searches), autorespond, basically a nice .procmail GUI. Works with any SMTP server.

    It's amazing how a small company like us can spend the $1,500 to protect our mail system, while larger ones (i.e. employers of my roommates) would rather lose 4 hours of mail to one of these buggers.

    It makes no sense NOT to use a simple filter - when will people learn. Until then, I'll just laugh.

    • Mail Filter == BandAid, nothing more. I'm glad that it protects your small company for now, but you have to realize that the filter is only as good as the filter set, and someday someone will get past it and you'll have another worm outbreak. The only way to be really safe is to fix your users' email programs so that they don't easily execute things that the users are sent. Fix the root of the problem, not the symptom.

    • Re:Get a Mail FIlter Already!!! (Score:3, Funny)

      by Anonymous Coward
      It makes no sense NOT to use a simple filter - when will people learn. Until then, I'll just laugh.

      Unless, of course, you have a Mac, which asks me very nicely what I would like to open happy99.exe with: Photoshop, or TeachText. :-)

    • Re:Get a Mail FIlter Already!!! (Score:5, Informative)

      by ralmeida ( 106461 ) on Thursday December 20, 2001 @06:42PM (#2734718) Homepage
      Put this in your server's /etc/procmailrc:

      #LOGFILE=/var/log/procmail
      #VERBOSE
      VIRUSDUMP='/var/spool/virus'
      GOTCHA=`formail -xTo:`

      :0
      *^Content-type: (multipart/mixed|application/octet-stream)
      {
      :0 HB
      *^Content-Disposition: attachment;
      *filename=".*\.(vbs|wsf|vbe|wsh|hta|scr|pif|com|ex e|js)"
      {
      :0 fhwc
      | (formail -r -I"Precedence: junk" ; echo -e "Our mail server refuses e-mail messages with suspect attachments, like: \n\n vbs, wsf, vbe, wsh, hta, scr, pif, com, exe ou js.\n\nYour e-mail was not delivered.\n\nPlease contact webmaster@host if you have any questions.") | $SENDMAIL -t
      :0
      ${VIRUSDUMP}
      }
      }
  • With all of these Microsoft worms running rampant (can worms run?), I can't say I'm surprised to hear about another one. It's not even news any more. It's like reporting that the sun rose this morning (provided you live at a reasonable latitude.)

    The nice thing about this one is, it's just hitting e-mail. When Nimda and Code Red were wreaking havoc on the internet, they made it impossible for me to play games on my cable modem. I had so many incoming requests on port 80, I couldn't do anything.

    How many times does this have to happen before Microsoft starts putting security in front of the user experience? I can't see how having to remove viruses from your machine on a near-daily basis inproves the user experience.

  • I wonder how long it will be before... (Score:5, Insightful)

    by mrroot ( 543673 ) on Thursday December 20, 2001 @05:57PM (#2734371)
    Viruses get sophisticated enough that they look at subject lines in your current "Sent Items" folder and use the same subject and text, just adding the attachment, or if they find an email you previously sent that had an attachment and replace it and re-send the message.

    Its only a matter of time. Its amazing how even a dumb virus can fool so many people.
  • These mail viruses have all been evolutionary steps. The big one will run straight from the preview pane, will send e-mails with no real signature, and will mimic other emails sent by that user.

    As a simpler step, these viruses should be hiding themselves within attached .EML files. That would get around the filters many companies have set up.

  • Not a bad virus... (Score:5, Insightful)

    by Pete (big-pete) ( 253496 ) <peter_endean@hotmail.com> on Thursday December 20, 2001 @05:59PM (#2734402)

    Most sensible organisations will already be blocking .pif files in mail - this virus is already known by McAfee as W32/Shoho@MM [mcafee.com] and they have detailed it as a LOW risk worm.

    On another note, I hope Slashdot isn't going to run a story on every new virus that gets released...

    -- Pete.

    • warning from McAfee, as look at the file listing that is attempted to be deleted (according to McAfee):

      Files being Deleted on an example (win9x) system:
      - c:\WINDOWS\1STBOOT.BMP
      - c:\WINDOWS\ASD.EXE
      - c:\WINDOWS\CLEANMGR.EXE
      - c:\WINDOWS\CLSPACK.EXE
      - c:\WINDOWS\CONTROL.EXE
      - c:\WINDOWS\CVTAPLOG.EXE
      - c:\WINDOWS\DEFRAG.EXE
      - c:\WINDOWS\DOSREP.EXE
      - c:\WINDOWS\DRWATSON.EXE
      - c:\WINDOWS\DRWATSON
      - c:\WINDOWS\DRWATSON\FRAME.HTM
      - c:\WINDOWS\EMM386.EXE
      - c:\WINDOWS\HIMEM.SYS
      - c:\WINDOWS\HWINFO.EXE
      - c:\WINDOWS\JAUTOEXP.DAT
      - c:\WINDOWS\Kacheln.bmp
      - c:\WINDOWS\Kreise.bmp
      - c:\WINDOWS\LICENSE.TXT
      - c:\WINDOWS\LOGOS.SYS
      - c:\WINDOWS\LOGOW.SYS
      - c:\WINDOWS\MORICONS.DLL
      - c:\WINDOWS\NDDEAPI.DLL
      - c:\WINDOWS\NDDENB.DLL
      - c:\WINDOWS\NETDET.INI
      - c:\WINDOWS\RAMDRIVE.SYS
      - c:\WINDOWS\RUNHELP.CAB
      - c:\WINDOWS\SCRIPT.DOC
      - c:\WINDOWS\Setup.bmp
      - c:\WINDOWS\SMARTDRV.EXE
      - c:\WINDOWS\Streifen.bmp
      - c:\WINDOWS\SUBACK.BIN
      - c:\WINDOWS\SUPPORT.TXT
      - c:\WINDOWS\TELEPHON.INI
      - c:\WINDOWS\W98SETUP.BIN
      - c:\WINDOWS\Wellen.bmp
      - c:\WINDOWS\WIN.COM
      - c:\WINDOWS\WIN.INI
      - c:\WINDOWS\WINSOCK.DLL

      That would seem to be pretty destructive to me... Also strange that we can only get a beta DAT file and there is no mention on McAfee's virus alert pages that this thing is out there... tisk tisk how many people will think this is a hoax and run it fscking up their systems...
  • Ouch, another one.

    Anybody got some good regexps I can put in the header check MailMan does for me?

    And/or a procmail recipe I can use to filter out this junk?

  • Is it just me or is slashdot slowly turning into bugtraq here? Do we really need to hear about every single fscking Windows bug and exploit found?

    I see two stories concerning an Outlook virus and an XP exploit within two hours or so of each other, with one new story in between.

    Can we move along to some real news for nerds, some real stuff that matters? Or at least add an option to ignore the damn Outlook virus updates and other nonsense.

    J

  • Oh, stop with the Windows security remarks already (Score:3, Insightful)

    by Junks Jerzey ( 54586 ) on Thursday December 20, 2001 @06:01PM (#2734415)
    Worms and virii are being written for Windows/Outlook, because:

    (A) 98% of all people using PCs to read email are running Windows.
    (B) There are a lot of cracker-types full of concentrated angst about Microsoft, Bill Gates, Windows XP, etc.

    If that 98% referred to Linux/KDE or MacOS X, you can be _damn_ sure that there would be severe security exploits for those systems as well. All it takes is _one_ small hole to give a virus writer leverage, and in any system with hundreds of thousands of lines of code behind it, there are going to be small holes. Arguably things would be much worse if everyone used Linux, because Linux is more daunting for users to administrate than Windows. So anyone not keeping up with security issues would be vulnerable. Most people fall into that category, even intelligent people.

    As for (B) above, what can be said except that it's pretty sad.

    • I agree to some extent, but there's a little more intrinsic security in *nix ... stuff like permission checking; anybody can do anything on a Windows box but only root can do the really nasty stuff on a *nix box.

      You have to be a measure more clever to find a root exploit before applying your trojan payload ... in fact maybe it's a good thing that Windows has low security; most crackers probably take the path of least resistance and leave *nix alone ...

      • Uh, no.

        It really makes me sick when linux people automatically refer to Win9x. In NT, you need to be an Administrator to do that kinda stuff. Not a User. And, yeah, if you live in a cave, WinNT ACLs are a far more advanced permissions system than *nix ever dreamed.

    • You don't get it (Score:5, Insightful)

      by Frank Sullivan ( 2391 ) on Thursday December 20, 2001 @06:15PM (#2734538) Homepage
      Apache has a veto-proof majority of the web servers out there. Where are the Apache worms? Why is IIS, with far less market share, getting them? It's because Apache is secure and IIS is not, period.

      Linux and OSX are both based on the Unix security model, a fundamentally sound design refined by two decades of real-world practice (dating back to the RTM worm in the early 1980s). It's not a matter of the virus writers aren't looking... it's a matter of a lack of exploitable holes. Name ONE Unix email client stupid enough to auto-execute code. Just one!

      Yes, there are still exploitable holes here and there in Unix/Linux. But they generally require real mastery to find. Windows macro viruses can be written by 14 year old boys. My wife, a technical writer, doesn't know enough programming to write heapsort (do you?), but she knows enough to write a macro virus in VBA.

      Get it through your head... the number of viruses and worms today is not a function of popularity or attention. It is a function of poor design and poor implementation, combined with security by obscurity (a technique discredited everywhere but Microsoft).

      Really, learn about it. Don't just whine because Microsoft is getting a richly deserved spanking, and you don't want to hear how bad your favorite OS sucks.

      • Re:You don't get it (Score:2, Interesting)

        by cscx ( 541332 )
        IIS IS secure.

        It just ships in a default configuration that is about as tight as a gay man's asshole.

        IIS is an excellent piece of software. I've used it before, and I'll use it again. Remember Code Red, et cetera? Guess what? I didn't have to patch my servers because they were IMMUNE. IIS "flaws" are NOT part of IIS itself, but part of different addon modules that should be easily removed by any knowledgeable sysadmin. Anyone knows that running script modules for everything in the world that you're not using is asking for trouble. IIS just ships that way for ease of use for the consumer. I can easily make IIS just as secure as Apache --- it takes about the same knowledge required to set up apache.

        So quit the FUD.

      • Re:You don't get it (Score:5, Insightful)

        by rlp ( 11898 ) on Thursday December 20, 2001 @07:42PM (#2735002)
        I agree with your basic thesis. However, it should be noted that Unix design and Windows design started with different premises. Unix was derived from Multics which was an early time-sharing system designed to be (relatively) secure. As a multi-user system, mechanisms had to be built-in to protect a users environment from other users. Windows is descended from DOS (and CP/M) and came from an environment that assumed one machine / one user. Hence their were no protections built in.

        Unix was built by developers for developers. In many cases the system administrators were also the system programmers. System administration problems tended to be solved by code. For example, in the early 80's Unix did not limit the number of processes per user. At Bell Labs, whenever the Intro. to Unix Programming class got around to the 'fork()' system call, machines started crashing. This was soon fixed by a kernal change. Linux has continued (and expanded) on this tradition.

        In contrast, Microsoft has focused on ease of use for the average user. This focus has been rewarded with market share. Security has been an after thought. Prior to mass adoption of the Internet - this was not an unreasonable approach. Now, of course, it's a disaster.
  • Welyah isn't pulling up anything.

    Neither is Winl0g0n.exe

  • Looks like a hoax (Score:5, Funny)

    by sphix42 ( 144155 ) on Thursday December 20, 2001 @06:07PM (#2734453) Homepage
    I didn't see any misspelled words in the sample email at that link...this is an obvious hoax.

  • When will we see the real worms? (Score:5, Interesting)

    by tuxlove ( 316502 ) on Thursday December 20, 2001 @06:10PM (#2734494)
    Windows is so easy to write worms for that we see a constant influx of simple stuff. Simple VB scripts, etc., can do a great deal of damage, and worm authors don't seem motivated to try a harder because they don't have to. This new worm seems like a step in a scary direction, towards real sophistication. Depending on system services to propagate will not be easy forever, and I expect to see more worms with their own protocols (like SMTP) built-in.

    The "optimal" worm is one in which all it needs is a thread of execution and access to basic OS APIs like sockets and elementary file access. You're not going to stop a worm from calling the most basic APIs, so the key to stopping worms (once all the fundamental holes are patched in Windows, if ever) seems to be not letting them have that thread of execution in the first place. Of course, there will always be lots of users willing to run unknown executables, but the less automatic, the better. Patching buffer overflows in IIS, etc., will only go so far because there will always be users ready and willing to execute email attachments. Until focus comes to bear on ways to keep unsophisticated users from doing this sort of thing, there will always be a cornucopia of devastating worms.

  • Duplicate (Score:2, Troll)

    by "Zow" ( 6449 )

    Hey, CmdrTaco, what's with having another duplicate story today? You just reported about the new windows vulnerability two hours ago.

    Oh, wait. . .

  • I understand that the narrowcasting [salon.com] strategy has changed significantly here to attract Microsoft haters but in all honesty, what could Microsoft do to stop the viruses/worms? Short of completely disabling internet connectivity there just isn't anything to stop them completely on any OS.
    • 1. Stop auto-execution of content within Outlook. Ideally, make it impossible to execute content from a mail reader.

      2. Stop designing operating systems where the default user account has write access to system binaries. Make it easy enough to do basic administration without formal administrator access that users don't run with administrator access by default (NT, W2K, XP desktop use).

      3. Build bounds checking into Visual C++, at least as an option. Require programs under development to be tested with bounds checking on in order to detect buffer overflows.

      I could go on, but you get the picture. No, you can't stop all security problems completely. However, you can make a very good dent in them. Just because a burglar can break your door down or pick the locks doesn't mean you shouldn't lock the doors to keep out the less skilled or ambitious.

  • This is funny. (Score:4, Interesting)

    by JeremyYoung ( 226040 ) on Thursday December 20, 2001 @06:16PM (#2734542) Homepage
    From the AP on Yahoo [yahoo.com]:
    Just last week, Microsoft's corporate security officer, Howard Schmidt, expressed frustration about continuing threats from overflows. ``I'm still amazed that we allow these things to occur,'' he said at a conference of technology executives. Schmidt is expected soon to resign from Microsoft to work for President Bush's top computer security adviser.
    Funny that SOMEONE at Microsoft is finally, publicly, admitting that there's a pattern to Microsoft vulnerabilites.
  • I can't find this listed on Symantec's site or Trend Micro. Has anyone seen any real info about this worm?
  • I have found that my system is not infected with virii when I use the following command to read my mail:

    $ /bin/vi /var/spool/mail/myusername

    That is, until someone finds a vulnerability in vi.
  • I find it tremendously amusing that a Windows worm was written in Visual Basic, of all things.

    Training wheels for small children's bicycle for sale. Buy now and get a free shotgun.

    • Re:Visual Basic? (Score:3, Interesting)

      by snake_dad ( 311844 )
      It's funny allright. However there is an explanation that 5 years ago this was less feasible.

      Earlier we used to be suspicious only of very small executable attachments. Often that would be a virus. If someone mailed you a large executable attachment it would probably be a legitimate file. However after all the legitimate funny files that are sent to friends (you know, those cartoon like programs, or sheep floating on your desktop) nobody is surprised anymore about a rather large attachment.

      There have been so many 'harmless' funnyfiles that people don't believe you anymore when you say "never open executable files!". Not to mention the fact that it's allways "safe, because a friend sent it to me". Oh well...

  • Quite a large list of offending extensions (Score:5, Interesting)

    by mclearn ( 86140 ) on Thursday December 20, 2001 @06:31PM (#2734651) Homepage
    See here [spconnect.com] for a discussion on the experiments of a particular fellow on finding a list of offending Windows extensions that are not unhidden even if "Show all extensions" is used.

  • Okay... so we can't fix the software or the users. (Score:5, Interesting)

    by pi_rules ( 123171 ) on Thursday December 20, 2001 @06:39PM (#2734707)
    It's still mind-boggling to me that companies don't have better policies in place for handling these situations. As another poster mentioned using mail filters to strip attachments w/ dangerous file types is nice and all, but it isn't going to be 100% effective. George Guninski released an example a while ago where filename.txt.{some big guid here} would look just like filename.txt on the desktop, but when opened you'd find it was HTML w/ an IE exploit inside. So... now you have to add a rule to your filter script to catch those, and hope that you knew about it before an expoit in the wild. Not 100% safe.

    Why are companies letting people thrash the mail system inadvertantly and go on like nothing happened? This is a social problem, albeit one that has been made more prevalent by bad technology. So what if Outlook took out the double-click-run-and-destroy feature for attachments? Trojan's would get mailed along w/ instructions on how to safe to your disk and run the program. And some idiot would do it too.

    I'd much rather see corporations making their employees responsible for breaking things on the network. If the admin fscks up the entire system he'd be up to his knees in shit -- but the "users" are allowed to do it because they can claim ignorance? No thanks. Draw up some strick hard-line rules for your employees and get this crap taken care of. My personal suggestions would be:
    1. No using IE at work -- Netscape/Mozilla/Konq only. Far fewer vulnerabilities.
    2. No Outlook/Outlook Express for mail. Use Outlook -only- for calendering functions. I'd personally like to see corps going back to how my old university did it. One Unix box w/ pine on it for users to read their mail. Use SMB to attach the user's /home dir to the Windows machine and let them save attachments that way. No HTML email viruses, no buffer overflows. Plain jane simple email.
    3. Running an attachment sent via email should be punished just as if the user walked in w/ a virus on a disk and ran it from home. And make them -work- to get that attachment to run.
    4. Forgo the use of the .doc format entirely. What's so bad with RTF? Do you -really- need to spend all this extra time authoring up nifty documents for internal use only? Sure, use .doc to interface with clients but keep it's use limited.

    Sure, it's a bit drastic. But is productivity really benefiting from wreckless use/abuse of insecure software? Must your employees use Outlook so they get that warm fuzzy feeling of being able to fiddle with all sorts of buttons on their screen? Why can't the computer be viewed like another other tool? If you don't know how to use it why in the world are you using it at work? I wouldn't dream of putting joe-schmoe on a fork life w/out some training, why put people w/ no training on a computer? If joe-schmoe runs the fork-lift into a wall you bet he'll get some heat for it. Run a virus though? Nah, everybody does that.. let it slide, let IT clean it up.

    • Re:Okay... so we can't fix the software or the use (Score:5, Interesting)

      by leonbev ( 111395 ) on Thursday December 20, 2001 @08:26PM (#2735162) Journal
      You've never done corporate IT support, have you? Even if you could convince the pointy-haired bosses to accept these draconian security restrictions, the employees would attempt lynch you for it. Business people don't like being told what they CAN'T do! They aren't like apthetic college students, who usually care less about the rules (unless it affects their precious beer supply).

      If a manager (Or a sales guy, or an accountant, whatever) is used to using IE at home and sending e-mails with pretty fonts and pictures attached, they'll demand that they can do it at work. They'll want to be able to read Word attachments from outside sources, and share files with their co-workers. If you say no, they'll just keep complaining louder to your manager and your manager's managers until someone forces you to cave in to their demands. Most of your changes will get shot down, and you'll put up with a lot of grief in the process.

      Most users don't give a rats ass about security, they just want to be able to do their jobs as quickly and easily as possible. If you try to get in their way, they'll fight you on every change until you get frustrated and give up.

      That's why it's important to make SMALL security improvements, and make them slowly. Start by blocking certain attachments on the server side, and continously remind people not to click on unknown files. Make sure that your virus software runs automatic scans, and updates itself automatically. The users aren't going to do it for themselves, or at least not until they are already infected. Warn constantly, but never try to FORCE anything on your users unless it's absolutely necessary. The nastier you get, the more that they'll start ignoring you.

      • Re:Okay... so we can't fix the software or the use (Score:4, Interesting)

        by freeweed ( 309734 ) on Friday December 21, 2001 @01:05AM (#2736058)
        If a manager (Or a sales guy, or an accountant, whatever) is used to using IE at home and sending e-mails with pretty fonts and pictures attached, they'll demand that they can do it at work.

        If any of these employees wore a bathrobe to the office, and sat all day watching television, I'd fire their ass in no time flat. Yet they do this at home all the time.

        I don't mean to come off as a flame, as I agree for the most part with your post, but employees are paid to do a job, and to do as *I* the employer says with *my* equipment. A huge problem with email viruses is that because they're computer related, we somehow feel we shouldn't be able to hold employees accountable for their actions. If an employee doesn't want to lock his house door, fine. If he leaves my office door unlocked after hours, he's gone. When I tell an employee "DO NOT open email attachments" and they do, I'm sorry, but the employee is at fault.

  • Proper Egress Filtering (Score:5, Insightful)

    by Gothmolly ( 148874 ) on Thursday December 20, 2001 @06:46PM (#2734741)
    Egress filtering at the firewall will block the spread of this. Simply don't allow anything but the mail server to make SMTP connections out. Done. Same thing with all of those "home firewall" products.

  • The reason this doesn't affect *nix (Score:3, Insightful)

    by WeaselGod ( 145056 ) on Thursday December 20, 2001 @06:50PM (#2734765)
    The reason that the various *nix OSes are immune to virii/worms of this type is because the vast majority of users use windows and MS products, not because of any superior security on the nix part. I am forced to use MS products at work and I have never been infected by a worm/virus because I know better. The average user doesn't know better. If they were on unix it would probably be an even worse problem because they would have even less of an idea of whats going on. I think Microsoft has made some bad decisions in its time, but I blame the worm/virus proliferation on the vulnerability of the users, not the vulnerability of the operating system.

  • Irradiate the mail (Score:4, Insightful)

    by filtersweep ( 415712 ) on Thursday December 20, 2001 @07:47PM (#2735019) Homepage Journal
    The post office has taken steps towards irradiating mail. Maybe more ISPs need to "irradiate" email.

    The consumer-level answer (repeated like a mantra) of course is to use anti-virus software, and I find it interesting (and conspicuous) that MS has stayed out of the anti-virus racket- but I suppose one cannot integrate AV software into the OS.

    It still boils down to individual "responsibility"- at home I run no AV software on my windows box, and I've never had a problem. I'm no windows apologist, but the fact remains that most people treat their PCs as if they are leaving their keys in the car, garage door unlocked, etc... I mean, it certainly is more "convenient" to ignore any security precaution in actual life (think airport)- but is it safe? And is it at all convenient to clean up after a security breech?

    Windows *has* most of the tools for a reasonable level of security if only people educate themselves and use them. The widespread problems people experience, such as this, boil down to NOT opening unknown attachments- which is email 101. This STILL boils down to an .exe attachment... it is boring. Show me an actual .txt file that can do some damage and I'm interested!

  • Credit Card Processing (Score:4, Interesting)

    by Anonymous Coward on Thursday December 20, 2001 @08:03PM (#2735069)
    A Credit Card Processor, CCBill has been hacked and credit cards were stolen. No mention of it on Slashdot. Is it because the site runs Apache/PHP?

  • Slashcode another victim? (Score:3, Interesting)

    by SilentChris ( 452960 ) on Thursday December 20, 2001 @11:06PM (#2735713) Homepage
    "as well as using a bunch of spaces to disguise the true extension of the executable"

    You mean the same way some trolls are now hiding Goatsex links by putting a popular site in the front of the url (like Yahoo), having it show [yahoo.com] on Slashdot, then redirecting the user to Goatsex?

    Windows isn't the only one with flaws...

  • Still waiting for the LEGAL virus. (Score:4, Funny)

    by Restil ( 31903 ) on Friday December 21, 2001 @04:10AM (#2736411) Homepage
    Imagine if you will....

    You get an email with an executable attachment.

    The attachment executes automatically, because we WANT it to do that.

    Upon execution, a EULA pops up, with a "licence agreement" that states the following:
    - The program being executed will automatically forward itself to a significant number of people using a variety of means
    - Some type of modification will take place to your file system.
    - By clicking OK you AUTHORIZE this to happen, and claim full responsibility for any damage that
    is caused as a result.

    And most importantly, if the cancel button is pressed, the program won't execute.

    Chances are good that 90% of the people who would be affected by an illegal virus will just as happily click OK without reading anything. The fact of the matter is, the virus will cause the same amount of damage, but the author could probably plaster his name all over it and not fear any legal repercussions.

    Of course, there's always the issue of intent. Bottom line, authorized or not, the INTENT of the program was to cause havok of the same nature as a virus. But in the end, it would sure make an idiot out of anyone who spread it.

    And maybe, just maybe, it MIGHT result in people actually READING the EULA's. Yeah.. I know.. I'm dreaming.

    -Restil

  • The great Outlook patch that nobody uses (Score:5, Informative)

    by Mr_Silver ( 213637 ) on Friday December 21, 2001 @07:17AM (#2736778)
    Since this submission was rejected by the editors, I think that here is going to be as good a place as any for it.

    Have a read of this article [wired.com] at Wired entitled "The Great MS Patch Nobody Uses". (brief extract below).

    A free, downloadable update that transforms Microsoft's Outlook into a significantly more secure e-mail application has languished virtually ignored on Microsoft's website for more than a year.

    Although the majority of recent viral attacks have come compliments of worms that don't rely only on e-mail to spread, the Outlook E-mail Security Update (OESU) can stop or greatly lessen the impact of most malicious code, such as BadTrans and SirCam, if only people would download and install it.

    OESU blocks the receipt and transmission of most of the e-mail attachments that typically can contain virus or worm code. The update also stops malicious code from spreading by blocking unauthorized access to Outlook and its address book. Many viruses and worms spread by surreptitiously e-mailing themselves to e-mail addresses culled from an infected computer's system files.

    Funny how if the other 99% of people had this patch then virus spreading would drop drastically.

Slashdot Top Deals

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Close