'Bagle' Worm Heading For A Windows PC Near You

mrSinclair writes "the 'Bagle' or 'Beagle' worm is expected to hit the U.S. by midweek, probably Tuesday as many employees return from a three-day weekend." He points to this Washington Post story (via Yahoo!), which describes the Windows mass-mailing worm as being transmitted via email as an .exe attachment and as installing "a program that lets attackers connect to infected machines, install malicious software or steal files." The article says Bagle has been detected in more than 100 countries. Other readers have sent in links to coverage at the BBC and at SearchSecurity.com.

Antivirus Company Submissions

[cyt0plas]

So far, I've submitted copies of this to Symantec [symantec.com], and ClamAV [sourceforge.net], both of which did not detect it in the latest definitions. If anyone else has submitted this to an A/V manufacturer, or knows of an A/V that currently detects this, please post.

jeesh..

[olorinpc]

"They attributed the worm's high infection rate to curious home and small office computer users who could not resist clicking on the attachment." -You would think by now even the person with the lowest possible computer knowledge would have picked up on this. Good to see people are getting right on the reporting of this though... now we just have to hope people will update their virus definitions! -olo

Re:Antivirus Company Submissions

[Naffer]

Norton's bloodhound module is usually pretty good at detecting unknown viruses. At the very least, I'd hope that it is capable of preventing the application from being run.

And since I know everyone is already readying their "Ah ha! Windows sucks!" posts, remember that running unknown code is NOT a good idea on ANY operating system. The virus doesn't exploit any massive windows bug. If everyone used Linux instead of Windows, then the virus writers would write viruses for linux instead!

Re:Antivirus Company Submissions

[ajs318]

If everyone used Linux instead of Windows, then the virus writers would write viruses for linux instead!

Yeah, probably; only, thanks to something called "privilege separation", they would never get transmitted anywhere. At least, not on a well-set-up system ..... Even on a slightly-badly-set-up system, there will be log files kicking around to show what sort of thing was happening.

The virus doesn't exploit any massive windows bug.

Well, maybe I have a warped sense of priorities, but I'd regard running everything as the equivalent of "root" as a pretty massive bug .....

running unknown code is NOT a good idea on ANY operating system.

Agreed -- which is why I insist to have the source code for every piece of software I run.

Re:Antivirus Company Submissions

[originalTMAN]

You could create a priveledged system since NT. Heres a scenario for you, Linux comes preinstalled on every new computer sold and is the dominant OS. Do you think resellers would setup non-root/non-rootlike accounts for the user? It's not like they couldn't do that with 2k or XP. And what about the bagillion possible daemons that the reseller might turn on just to make things even easier for the user? do you think the reseller would educate the buyer on the importance of actually maintining a system or firewalls? *nix (as much as I love it) is not the be all, end all to this little annoyance. Education is. If people were educated on how to actually use their machine, this problem wouldn't exist.

Re:Antivirus Company Submissions

[Ewan]

Why? you can easily write a userspace smtp client for linux, which is what this virus is. add it to .bash_rc or similar and away you go, each time the user logs in they start hammering away with copies of itself. Then, after 2 weeks, have it wipe out every file it can on the system - sure the OS will survive but plenty of what the user considers vital information will be lost.

Backups are just as required in Linux as they are in Windows.

Ewan

Re:Antivirus Company Submissions

[anno1a]

Of course you can do it in windows. But close to everyone in Windows runs as admin, while close to no one in Linux runs as root. In effect you wouldn't have to change anything in Linux, while you'd have to drop all your admin privileges in Windows. I've tried maintaining an XP box, and on most occations I had to log out my normal user and log in as admin because the run as feature simply did not work properly. Games couldn't run because the permissions were wrong, and impossible to change to the right ones

Re:Antivirus Company Submissions

[jedidiah]

The idoicy level associated with a system is not quite so important as the abilility to effectively route around that idiocy if you are an end user. Even a savvy user will have a hard time completely securing their environment in WinDOS.

Unix was specifically designed with some paranoia regarding end users. This makes putting yourself in a nice sandbox remarkably easier and more seamless.

Joe User is going to be less put out by running a properly secure Linux than attempting the same with WinDOS.

Re:close to no one runs as root

[LilMikey]

It's even dumber to code as root. Then you don't know if what you're coding even works as a normal user. At that point it's no longer a laziness issue.

Re:close to no one runs as root

[HiThere]

That's not just lazy, that's stupid. Coding errors aren't that uncommon. Of course it does depend on what you're doing. If you were doing kernel mods, then you would NEED to be root (well, not really, but it WOULD be more work the other ways). So what you do if you're lazy is set up your computer to dual boot linux.

Here's a way to do it: (I've got mine set up with three different distributions installed, it's not that hard.)
1) Keep a paper trail of what partition is named what in which distribution. And remember that things like /home and / and /usr need to be separate partitions for each distribution. And also, there's some limit on the number of partitions that you can mount, so only mount home from the alternate dist.
2) Give the mounted partitions different names in each system. I have defined, e.g., /ahome, /bhome, /chome and in the active distribution, I leave off the leading letter in the corresponding /etc/ftab.
3) The loader can be a bit tricky. Only one loader can be installed in the MBR. I use Grub. Lilo might work, but I've never tried it, and Grub works. You can either boot directly from this, or have it invoke chainloader so that each booting partition can have it's own options. (I use both ways. Usually it's simpler to just boot directly fromt he MBR.)

Some details are missing, but it's not hard. So if you want to develop as root, be root on some other system that's on the same box. And this system doesn't even need to mount any partitions that it doesn't need, or know that the internet exists. (Depending, again, on just what you're doing.)

Now I'm not saying that this is a good way to do it. I'm not sure. I'm saying that it's an easy way, and I'm lazy enough, that if I needed to be root to code, I'd probably do it this way instead of, say, setting up a chroot jail (which might or might not work...I've never investigated chroot).

But because I'm lazy, I *DON'T* want to wreck my main system. It would be a huge job putting that back together again. (I've wrecked it before, and know from experience.)

OTOH, again, you say these are coders. Possibly they work in an office? Does the office do backups frequently? If all they're risking is their own machine, and there are recent backups, that could even be a reasonable approach. I wouldn't take it, because my backups are often stale (I admitted to being lazy...and my off HD backups have to be done to CD). So it sounds like priviledge separation might solve the problem...but I'm not sure. Writing to bash.rc can let you do so much, that it probably wouldn't. You'd need to have something in the boot script that re-created bash.rc on every boot. (I wonder if bash.rc could be owned by root?)

one developer's perspective

[KenSeymour]

IMHO there is a delicate balance between security and getting the job done.

In many organizations, the developers are under the gun to meet project deadlines. You are more likely to get in trouble for not meeting a deadline than for running X as root.

Similarly, the system administrators are rated by how smoothly things run. Taking a chance by allowing developers to run things as root does not do them any good.
Sadly, from a developer's perspective, system administrators are rarely rewarded by their managment for helping developers sort out all the permissions issues.
If this is done, then one can figure how to set up the non-root account to get the work done without creating security problems.

It doesn't help that developers are often considered "knowing enough to be dangerous."
So system administration managers sometimes set the tone of "lock down the developers so they can't get away with anything."
One place I worked had the development servers locked down so tight, it was said you could only test in production.

Through my career, I have seen a lot of development move from the Unix platform to the Windows platform, partly for this reason:
1) The Unix System Administration department doesn't care about windows boxes, so they don't bother to control them.
2) The Development department knows that they can set up a bunch of windows boxes, give themselves administrator access.
3) The development project proceeds quickly in terms of accomplishing the project goals. The development manager is not rated on how few security holes he sets up in the process.
4) The managers learn: "Wow, if we bypass the Unix System Admins, we get projects done so much faster."

It is unfair to blank admins for security holes created by developers.
It is unfair to give an agressive deadline to the developement department and then ask them to work with a system administration department that has no incentive to help you meet your project deadline.

Re:Antivirus Company Submissions

[aridhol]

Unfortunately, it's possible to get around that. Try this:

• Create a shell script in a noexec filesystem. For this example, we'll use /tmp/foo.sh
• Run: '/bin/sh /tmp/foo.sh'

Yup, the shell script, set as 'noexec', has just exec'ed. For more fun, try this:

• Create and compile a C program in a noexec filesystem. For example, /tmp/bar
• Run: '/lib/ld-linux.so.2 /tmp/bar'
• Watch the fun

http://mail.gnu.org/archive/html/bug-glibc/2001-08 /msg00045.html [gnu.org]

Re:Antivirus Company Submissions

[Ed Avis]

The virus exploits the massive Windows bug that clicking on an attachment is enough to run an executable with full user priveleges (root privileges, often) and that there is no safe mechanism to _open_ a file without the risk of _running_ it.

Re:Antivirus Company Submissions

[Animaether]

So basically it exploits user stupidity. Thanks for putting it so eloquently :)

Re:Antivirus Company Submissions

[Tony-A]

that there is no safe mechanism to _open_ a file without the risk of _running_ it.

So basically it exploits user stupidity. Thanks for putting it so eloquently :)

If you mean user stupidity in using a system that deprives the user of essential information as to whether or not to click on something "interesting", then yes. The malware would make much less progress if the dialog used "Run Virus" instead of "Open".

Re:Antivirus Company Submissions

[AllUsernamesAreGone]

What terrifies me is that, at least where I work, people would click it anyway. It seems a depressing number of people don't actually read the contents of dialog boxes unless it is completely unexpected - they just automatically click on the button that is normally the positive action.

Re:Antivirus Company Submissions

[LilMikey]

Granted, the 'bug' is in the user. However Firebird/Thunderbird (for Windows) will not let you run executables directly from the client. They make you save to disk and run it your own damn self. Tis' not a solution but the extra step would weed out the stupid AND lazy leaving just the plain stupid to propogate the virii. :)

Re:Antivirus Company Submissions

[number6x]

"If everyone used Linux instead of Windows, then the virus writers would write viruses for linux instead!"

If everyone repeats this refrain enough people may actually start to believe it, and that would be good in counteracting that old 'many eyes make all bugs shallow' phrase we keep hearing about open source.

Taken at face value the statement seems reasonable, but I'm a scientist and I like to hold theories up to the light of reality and see how they do. I know that testing theories annoys people because it makes them question their deepest held beliefs, but hey I'm an annoying guy anyway.

We could test the statement by finding an Open Source project that has much more market share than a closed source project, then compare the rates of exploit. Hmmmm... how about Apache vs. MS IIS?

According to Netcraft [netcraft.com] Apache has about 67% of the market and Microsoft's IIS has about 21% of the market. The often quoted FUD says that Apache is used by so many more people it must have many more exploits.

We can search the CERT website [cert.org] for the terms 'Apache' and 'Microsoft IIS' clicking on the boxes for :

Advisories

Incident Notes

Security Improvement Modules

Vulnerability Notes

'Apache' gives 180 results.

'Microsoft IIS' gives 830 results.

Wait! That means that just because something is used much more widely than another thing it does not result in more attacks! That proves the statement that if Linux were used more it would have more viruses is a false statement! It could be that open source actually does produce more secure code after all!

If Linux had 60% or 70% market share, there would probably be more viruses written for Linux than there are now. But, as we can see with the real world example of Apache and Microsoft IIS, the open source development model produces more secure software.

Sorry to step on that often quoted line about linux and viruses, but I like reality.

Re:Antivirus Company Submissions

[Politburo]

As a scientist, I'd think you'd know that only using one data point is not 'holding it up to the light'. I'm not saying the OP is correct, but you haven't proved anything, except that IIS has more reports on CERT than Apache does.

Re:BUT as per the GPL, we'd have the source!

[gazbo]

This is my first game

Save the attachment, su, ./configure && make && make install

I wish you will enjoy it!

Re:MOD PARENT UP!

[EzInKy]

At least with Windows Update, the user can be assured that they will get a secure untrojaned binary. No one has any evidence that Windows Update has been rooted.

Of course six months from now, when they finally get around to issuing a patch, the lack of source code also leaves no evidence that a new vulneralibility wasn't created when the old one is closed, does it?

Re:MOD PARENT UP!

[E-Rock]

Patch for what? Someone figure out how to keep retarded users from running unknown attachments?

proof?

[tjw]

No one has any evidence that Windows Update has been rooted.

I imagine if that type of thing did happen, Microsoft would not publicize it.

Also, it doesn't seem like anyone who did break into Microsoft's servers would be too eager to offer proof of guilt.

I don't recall that anyone offered proof of the Debian or Savannah break-ins except for Debian and Savannah.

Re:Antivirus Company Submissions

[NemoX]

Yeah, but how much time do you spend trying to make sure you don't get anything? Searching for viruses on my 2.8GHz SATA 150 through less than 30GB of data on a RAID 0 drive takes HOURS. Then another 5-10 minutes everytime you install a program to make sure it's not kitted with spyware and such crap. Besides even normal users can install stuff in linux (contained to their home directory, only), whereas you cannot in windows, which forces Windows' users to Admin up EVERY time , which GREATLY increases the virus' accessibility. Plus the file structure is alot more accessable to normal users in Windows. Remember, the UNIX backbone has been around WAY before Gates stole DOS from that poor guy. If Windows users didn't have to admin up so much, they would be less inclined to log in as root all the time. I mean, even the "Run as.." function is hidden in windows! you have to hold the Shift key down while right mouse clicking to get it! If they can't figure out how to run as/su without jumping through hoops, of cource they are going to login and run everything as admin. I NEVER run Linux as root, I ALWAYS run windows as admin. It's just too much of a pain in the @ss in windows. Does the world need better PC education, or a better OS? I think we need both.

Windows Bashing? Get some facts straight

[kylef]

Searching for viruses on my 2.8GHz SATA 150 through less than 30GB of data on a RAID 0 drive takes HOURS.

Then you have some really slow anti-virus software. This should only take that much time ONCE. Subsequent runs should be very quick because all of the scanned files have hash values which are stored. The files will only be re-scanned if the hash value does not match.

Besides even normal users can install stuff in linux (contained to their home directory, only)

No one actually installs apps in Li

Re:Antivirus Company Submissions

[Neva]

F-Secure detects it, since yesterday. There's a removal tool there too.

Bagle description [f-secure.com]

NAV already detects it...

[antdude]

... according to Symantec [symantec.com]'s Security Response [symantec.com] (since 1/18/2004).

Re:NAV already detects it...

[boots@work]

I can't help but read that as symante.cx. Damn, I really miss seeing Bob on slashdot.

Re: AVG's got it...

[MachDelta]

...since yesterday [grisoft.com], apparently. Good to see Grisoft [grisoft.com] keeping AVG up to date.
Oh, and they've got a little blurb [grisoft.com] on the virus too.

Re:Antivirus Company Submissions

[fo0bar]

ClamAV and Kaspersky [kaspersky.com] both seem to be catching them here.

Re:Antivirus Company Submissions

[MuParadigm]

McAfee/NAI has been detecting it for the past day or two as well.

Re:Antivirus Company Submissions

[bakes]

Just to add to the list, Vet [vet.com.au] posted their update early on Jan 20th.

Yay! A test.

[edunbar93]

The F-prot [f-prot.com] antivirus definitions have it, as of the 19th. They have a nice *nix scanner that can be plugged into software like qmailscanner [sourceforge.net], which can scan all incoming and outgoing messages. They also have sane per-server pricing for ISPs.

I'm looking forward to seeing how much of an impact this will make on our mail server. Currently viruses make up less than 5% of our filtered mail. The rest is spam.

Re:

[account_deleted]

Comment removed based on user account deletion

Here we go again...

[seanadams.com]

The article says Bagle has been detected in more than 100 countries.

Are you saying that this new worm knows no geographical boundaries? Heavend forfend!

BTW: two fixes are already avilable for this virus:

• Free, but worth thousands more: FreeBSD [freebsdo.org], Linux [kernel.org], and more...
• Pricey, but worth every penny: Mac OS X [apple.com]

Note to developers, developers, developers, developers [ntk.net]:
everyone from the home user to big business wants OFF OF WINDOWS, and not just because of the viruses. Please,
stop catering to the (dying) satus

Re:Here we go again...

[BWJones]

BTW: two fixes are already avilable for this virus:

Free, but worth thousands more: FreeBSD, Linux, and more...
Pricey, but worth every penny: Mac OS X


We have moved most of our lab machines from Windows to OS X in the past few months and the time I have spent having to patch, test patches, roll back updates due to problems with Windows has been reduced drastically. I can't mention how successful this migration/switch has been in terms of productivity gains, peace of mind, etc... With OS X, you plug stuff in and it works.

Its true that OS X costs more money than say Linux installed on our previous machines, but OS X is a true desktop OS that allows one to keep all of their UNIX apps as well as provides the slickest desktop OS around allowing for use of popular apps such as Office (yes, Microsoft Office for OS X is actually quite nice, so stop your whining), Photoshop, Filemaker etc... while allowing for our compute intensive work on scientific apps as well.

OS X user accounts are more secure

[Aqua OS X]

Yes, but by default OS X users are given a user account, separate from root. And, even if they have an admin account (not to be confused with root), they have to type in an administrator password to confirm installations that affect areas outside of the user's home directory.

You can send an OS X user a malicious Apple Script file with an MPEG icon on it, and they'll probably double click it thinking they are going to view free prOn. But as soon as the "administrator password" box comes up, odds are they are going to hit "cancel" and not grant access to their root directory :/

Moreover user accounts in OS X are quite flexible. Unlike Windows users, OS X users rarely require the need to login to, and remain working within, the root level.

Every Windows office I've ever administered has had numerous problems with user accounts, users working in root 24/7, etc

Re:Here we go again...

[IWK]

Right. Mass migration to FreeBSD, Linux, Mac OS X. Massive porting of all possible windows apps to Unix. Suppose that whould happen quickly or even overnight. You can always hope.

Will the problem become less severe? Probably, at least for a while. Will the problem go away? Of course not.

Because insecurity stems not from some flaw in an OS but from a fundamental problem with the users and industry's mindset which stresses features and convenience over security. Just imagine what a simple script could do on

Hah Hah That's Insightful...

[Greyfox]

But if you move the users over to Linux or OSX they'll still execute attachments. The solution is to set their mouse up so that whenever they open an attachment, they get a shock. The more they open attachments, the more they get shocked. Eventually the problem will go away (Either when they stop opening attachments or when the shocks become fatal...)

We had the same executable attachment problem back when I was in school in the late '80s. Our VM Mainframe E-Mail system got shut down because of some christmas card program that remailed itself to everyone in your address book. Sound familiar?

Re:Hah Hah That's Insightful...

[juhaz]

The solution is to set their mouse up so that whenever they open an attachment, they get a shock. The more they open attachments, the more they get shocked. Eventually the problem will go away (Either when they stop opening attachments or when the shocks become fatal...)

Well, I've heard that works on dogs, but users? No way in hell, they are so boneheaded they won't stop clicking - and they're probably too stubborn to die as well.

Re:Here we go again...

[seanadams.com]

In a perfect world, one WOULDN'T need to take these precautions...

Nobody said anything about a perfect world. But there is a real world outside of Microsoft where we software users can trust the guys who wrote the code to at least have our best interests in mind.

Re:Here we go again...

[seanadams.com]

I sense a palladium ad here around those same lines. "No untrusted code can execute"

Ironically, the only code I might trust is that which was NOT signed by Microsoft. :)

Statistics

[khasim]

There will always be a certain percentage of the population that

#1. Really just accidentally clicked on the executable

#2. Clicked on it on purpose because it was from someone they knew or had a nice subject or whatever.

The only real option ('cause dumb people will be with us forever) is to configure the technology to make it harder to run apps from email. Either run them in a sandbox or require the user supply the root password to install the new application (this is why I believe Linux would be safer).

Re:Here we go again...

[nitehorse]

I don't see how pipes are such a nightmare. It makes sense to allow programs to direct their input and output to eachother without needing to use an intermediate file. (And WinNT and its derivatives have pipes as well, so it's not like it's a UNIX-specific weakness.)

RPM hell is pretty much gone in any mainline distribution these days, what with apt-get, yum, emerge, urpmi, and yast's online updating. All of the major distributions have a free way for you to update your system with full dependency checking and resolution. Even Slackware's got it with swaret.

If you don't think KDevelop is a "real" IDE you might want to look again. The newest release, based on the Gideon codebase, is astounding. Code completion is only part of the good stuff included.

OpenOffice is just about the same as MS Office - I haven't seen any compelling reasons to use Microsoft's version instead, especially considering that OpenOffice runs on my OS and MS Office doesn't (at least, not natively).

The technology is pretty much in place at this point. There might still be a few straggling areas (games are a sore point at the moment, but more and more developers are releasing Linux versions these days than ever before) but on the whole, Linux on the desktop is just building momentum, and nothing is stopping it. It'll hit critical mass sooner or later, and once it does, it's game over for Microsoft. I don't really care personally when it does for the rest of the world - I'm happy with it right now.

Anyway. Good times. Use what works, as that's what you need. But you might be surprised if you try out a mainstream distro, as a lot more works these days than ever has before. And no, FreeBSD isn't even close to mainstream. I love FreeBSD5 and I'm using it (with pf) on my firewall, but I use Linux on my workstation.

Fast moving little sucker

[Kris_J]

We've already received two of these at work, one as early as 8am yesterday morning, local time. Fortunately our server-based anti-virus filter is on the ball: "Executable DOS/Windows programs are dangerous in email (kraencha.exe)"

Leggo my Bagle

[pantycrickets]

My beagle has tape worms.. when is a patch expected? If my dog had been using Linux, this would never have happened!!

Contact

[SnowZero]

I guess this means Beagle [beagle2.com] has made contact with Earth after all. Perhaps it has to do with Martian hackers who don't like Linux [linuxdevices.com]? They can't spell too well though.

Sad state of affairs

[LucasMedaffy]

As the article text states: "We really thought it was never going to spread because it's so stupid," said Mikko Hypponen, manager of antivirus research for F-Secure. "But people seem to be clicking on it." Just goes to show you that no matter how much cork you put on some people's pencils, they'll still manage to poke themselves in the eyeball. Honestly, who out there is so dumb that they'll run an .exe email attachment with a subject line "Test" and a body including "Yea, Test". Mandatory computer usage licenses, anyone? ;)

Re:Sad state of affairs

[seanadams.com]

Not speaking as a Windows user, but: I don't think you have to be "stupid" to click on a certain clickable thing. That's why it's clickable.

It's the developers of said email software who are stupid. The idea that their users should want an email... a totally insecure message, to have full access to their personal Turing Machines in the form of a clickable .exe. The user is the last to blame for all this virus nonsense - it's the guys writing the OS and the email software who should know better!

Unique? Newsworthy? Hardly...

[YellowSubRoutine]

Why is this one unique? It's just the next worm.
And it replicates by *emailing* itself...

No remote root/admin exploits, no network-clogging mass scanning, no nothing.
Maybe just a few malconfigured mailservers going down, that's it.

yawn, wake me up when we're at threatcom 4

Re:Unique? Newsworthy? Hardly...

[Urkki]

Unique? No.

Newsworthy? Definitely.

I mean, if this isn't newsworthy, then what is? New version of software/OS X, or latest episode of SCO comedy, or some new columnt about evil/good [MR]IAA versus good/evil P2P?

ISP/mail provider virus scanning...

[WIAKywbfatw]

Why don't ISPs and mail providers perform quick checks of attachments to see if they compare with known viruses (similar file sizes would be a quick initial check) and then filter out (or at least alert the recipient about) any attachments that they successfully determine are viral attacks, such as this one?

Do any such ISPs or mail providers offer such a service? If not, why not? Surely it's in their interest? After all, these viruses (especially the ones that send themselves on to everyone in the infected

Re:ISP/mail provider virus scanning...

[phaze3000]

Two main reasons - the extra load generated and the risk of false positives.

If filtering were done as you suggest, with a simple attatchment file size check, then there's a reasonable chance a perfectly legitimate mail would be dropped. It also wouldn't take very long for the virus writers to create viruses that vary the file size on every reproduction.

If a customer gets themself infected with a virus then it's their fault for not have adequate virus protection - if the ISP drops their mail because it was of a similar size to a virus it's the ISP's fault.

an EXE?!!

[DJ-Dodger]

Come on! Outlook hasn't allowed these to be run for years now? How do these things still spread? Little old ladies stuck on Eudora 3.0 or something?

You can turn it back on

[Sycraft-fu]

And I'm sure many people do. The real problem with security for home systems is people have to WANT it there. You can setup as much as you like, but since they own the system they can just turn it off. They will too, by and large, if they feel it interferes with what they want to do.

Already here...

[Shoten]

I got it this morning, spoofed from a SecurityFocus security mailing list I subscribe to, ironically enough. Current Norton sigs didn't detect it, and it didn't match my spam filters...but Outlook's updated features automatically blocked access to the exe file (not like I would have clicked on it anyways...but it was interesting to see something from Microsoft be the only barricade to stay standing).

Interesting Tidbit

[jmt9581]

It looks like the writers of the virus DOS'ed themselves (from the aformentioned Yahoo! article):

Bagle also tries to download an unknown program from one of more than 30 Web sites located mostly in Germany and Russia. None of those Web sites was reachable as of Monday afternoon.

Or is it more likely that these servers in Russia and Germany were also hacked and were just being used?

In any rate, this doesn't look so bad. The searchsecurity.com article says that "Removing the worm manually is just a matter of killing "bbeagle.exe" in the Task Manager. The registry keys created by the worm also need to be removed." Hopefully this one won't be as bad as Sobig. :)

When Will The Computer Security Community Grow Up?

[tonyr60]

"The computer security community recommends that home computer owners never click on attachments unless they are expecting them from a trusted source. They also recommend that PC owners install and run up-to-date anti-virus programs to scan for computer infections".

They could stop sucking up to M$ and also recommend that home users consider another OS.

Fakes sender addresses...

[cgranade]

Seems that this thing fakes e-mail addresses as well. Got several complaints that I was sending viruses, but of course that's absurd, as I am running GNU/Linux. I can only guess that picks an e-mail address at random from some list (address book, mayhaps?) and says it comes from there.

How sad...

[NeoGeo64]

It's pretty fucking sad when you now have forecasted virii.

Weather channel, look out!

Great Ways to Prevent Spreading Viruses

[teledyne]

1. Don't open any attachments that are potential virus, (.exe, .vbs, .com, etc.)

2. Disable your email client's automatically message preview pane. This makes exploit viruses a little easier on you, as you can select the message and delete it without having to preview it instantaneously.

3. Download a mail proxy program (I use MailWasher), it'll filter out spam, and allow you to see a text version of the message, without downloading the attachment.

4. Have your AV update its definition religiously. Of course, this only helps if your AV company updates its definition religiously as well.

Of course, the first 3 don't require a virus scanner at all, just common sense. As a gamer, I hated having NAV or McAfee VirusScan hog up 30MB of my memory, so I removed it. I make smart and conscious decisions, and have never had a virus on my computer for several years.

It's already here (My story)

[Trillian_1138]

I'm the resident geek in my dorm, and have spent the last 24 hours getting rid of it on computers of anyone and everyone. The particular strain we saw came in an email with the subject of simply "Hi" and contained (basically) the following test.

Hi!
This is a test.
(random string of letters)
Testy test.

The attached file was a modified version of the Windows calculator which (according to the Symantec site) "Emails all the contacts it can find inside files with the extensions .wab, .htm, .html, and .txt"

It's interesting because apparently that's ALL it does. It doesn't screw with files or settings, or run malicous code (outside the actual act of reproducing itself). It's annoying, however, because it sends emails to people who are NOT in your address book, but merely mentioned in text files somewhere on your computer. In the last 24 hours I've gotten emails with the virus from friends, random people in my university, at least one university email address that should have been run by someone who knew better, and a couple random friends-of-friends.

Also, according to Symantec, it dies on the 28th.

It was really interested to see the spread at my college. For us, it began around 1 AM Monday morning, peaked around 2, and was already slacking off by 3 AM. I know this from my own inbox, people in my dorm, and talking to people elsewhere.

I do find it currious the virus didn't DO anything. Is it just someone screwing around, a test for a future release or (as some of the more paranoid people in my dorm are suggesting) a released virus by the anti-virus companies to keep people in enough fear to demand their products.

As a side note, I also spent hours cleaning the assorted spyware and adware that builds up when people don't know how to properly use their computers....more than one person could literaly not do work becasue of the porn popups that plagued their computer.

-Trillian

Re:It's already here (My story)

[Trillian_1138]

A reply to my own post....(a little more info)

As I said, the variation I saw was hidden in a version of the windows calculator. Specifically, the attachment was an EXE file with a random string of letters (I saw names between three and seven letters long). Also, it ran as bbeagle.exe, and the bbeagle.exe file lived in the C:\Windows\System32\ folder. Finally, deleting the bbeagle.exe file and going into the registry and searching for bbeagle.exe, and deleting THAT entry should kill it. (Again, acording to

Re:It's already here (My story)

[Trillian_1138]

Last one, I promise.

I missread Symantec's site (didn't scroll far enough down). It does indeed contain malicious code beyond it's own reproduction:
from http://securityresponse.symantec.com/avcenter/venc /data/[e-mail]

#

# Creates a listening thread on port 6777 (this port can change during the worm execution) that allows a remote attacker to:

- execute commands on the local system as if he were the current user
- download executables onto the local system
- terminate and delete the worm program

# Creates a notification thread that will contact a remote website (using local browser proxy settings) and announce the presence of the worm on the local system every 10 minutes.

The list of websites contacted is predetermined and are contained within the body of the worm.

-Trillian

Re:It's already here (My story)

[molo]

Worm? This is a trojan. Anyone that clicks on an executable email attachment in a message that says "this is a test" gets what they deserve.

-molo

Re:It's already here (My story)

[esarjeant]

Here here! I really wish people would understand the difference.

This is *not* a virus for Windows, it is a manifestation of social engineering using a trojan application. For that matter, just about any modern operating system would be capable of executing this code (Linux, NT, MacOS X, etc.) -- the real source of the problem here are the end users.

If I sold you a gun, is it my fault when you shoot yourself with it?

Executables in email

[slutdot]

I know this has been mentioned about a thousand times but if you're a sysadmin, do yourself a favor and block executables, scripts, or any other file type that can execute. If someone needs an executable to be sent in-bound, set up either an FTP server or a dummy account outside your company's mail system. I have a domain set up just for this purpose where only the admins have rights to the mail accounts. If someone needs a file, the employees just send a request to have an admin check the mailbox for a specific filename from a specific user. We'll even ask for file sizes just to make sure. While checking the mailbox might take about 3-5 minutes out of my day, this method saves me the many headaches of removing viruses all week.

Re:Executables in email

[Skuld-Chan]

This has wierd effects though - I work in tech support and a few months ago I sent a customer a specialized driver (one you normally have to pay lots of money for) and thier email server took all the exe's and dll's out of the zip file. At least thats what he told me.

I ended up having to put this 700K program on a cd and mail it to him.

Mail server blocks executable attachments

[a.koepke]

The virus uses exe files, company mail server is setup to block all executable attachments. Any emails that make it through that are then scanned. Easy solution.

When new viruses comes out, me not worried.

Re:Mail server blocks executable attachments

[pe1chl]

I do this as well.
Of course you must make sure you use a valid detection mechanism.
Many commercial scanners use the extremely naive approach of checking the file extension!
This means that .exe files can be sent through these by renaming the file (e.g. to .jpg), then adding a comment "please rename the file to .exe".

You would not believe it, but even the most well reknowned scanners use this stupid method. I have seen countless examples of "funny programs" being blocked on the mailscanner, and then the same file arriving half an hour later, renamed to .jpg or .gif, and with the added guidance for the receiver. Of course it was again blocked by my scanner, but apparently this method works on the commercial scanners and the users know the workaround.

There even has been one trojan that uses this method by packing the program in a .zip and telling the user to unzip and then run the program.

Ditto.

[khasim]

If anyone wants to send anyone inside the company an executable, said person is instructed to rename it to .bin prior to sending.

The .bin file makes it through the scanner and the recipient can save it to his/her local drive, rename it to .exe or .com or .bat or whatever and then run it.

Anyone who cannot follow these simple directions does not receive executable files.

No email viruses have been able to traverse these simple precautions.

Of course you know that this means war!

[shanen]

Already old news here. Been dealing with it for a couple of days...

The Subject: is actually more applicable to the spammers, who really are waging all out war on the utility of email. This one is more like a hit-and-run attack.

Still, the similarity is that they are hoping to find a few "good" suckers to click on their links. This one is actually an interesting combination. Partly it seems to be testing the efficiency of a propagation mechanism, which seems to result in greater "apparent locality" of the email, with higher odds that it seems to have come from someone you know. However, it also seems to be ready to launch some more insidious payload that was to be downloaded from some Web sites.

Right now all of those Web sites seem to have been taken off the net--or maybe they're waiting to pop them onto the net once the thing has propagated sufficiently. That part of the Trojan apparently tries to check in every 10 minutes to announce itself.

The thing that bothers me about this combination malware is that the anti-virus people could easily miss something. For example, in this case, what if the thing included a new variation on the email backchannel for the harvested email addresses. Or maybe a well-concealed bit of code to suddenly mung the URLs to point to live sites somewhere else? However, whatever it is hasn't triggered yet, and the anti-virus people perhaps have only detected the distractor HTTP-channel. If that were the case, they could still get a massive harvest of email addresses. (Yes, I still think the spammers are probably really the people behind this one--spamming just naturally attracts the lowest life forms. It's a question of the crudest motivations for the crudest acts.)

By the way, has anyone seen the reason for the bagle/beagle confusion here? Trying to incriminate the Israelis? Or the dogs? Or both?

use Pine.

[hedley]

Use Pine, be happy. A good *text* based MTA is the right way to enjoy active content.

Hedley

PS: Of course I am sure no /. reader is willingly using Lookout are they?

I work in a support center in Australia

[marcushnk]

And the damned thing has run a riot out here..

Worse hit were the CA "Etrust" users whom couldn't get an update till way after the virus pounded several of our customers.. for some reason CA were about 12-18 hours behind having an update availible on the web, even bloody mcCrappy had an update out way before them :-\

On the up side.. it uninstalls itself in a few weeks.. and does bugger all damage because it was written so poorly.. lots of bugs in the backdoor code..

The only thing it does well is self replicate.. :-P

Can't do much damage...

[grahamtriggs]

Hmmm.... the Beagle worm... surely it can't do that much damage... it probably just crashes on entry....

Huh?

[Black Parrot]

> installing "a program that lets attackers connect to infected machines, install malicious software or steal files."

Doesn't Windows already have to be installed?

This worm also uses crawled addresses

[generationxyu]

...to spoof SMTP with. Or it takes addresses from infected users' address books and spoofs with those. There's no other explanation why someone I've never heard of got this email from what appeared to be my address. A Win32 worm is incapable of running on my hardware. PowerPC chips don't take to kindly to Intel machine code.

Use your firewall to protect against Windows virus

[chrysalis]

I don't know whether it applies to that one, but a _very_ efficient way to avoid the annoyance of Windows email worms is to use your firewall block all incoming traffic from a Windows machine to port 25.

On OpenBSD, the following line is enough :

block drop in log quick proto tcp from any os Windows to any port smtp

There is really not a lot of legacy mail exchangers running Windows so it doesn't hurt.

However, it blocks most worms that are trying to directly send mail.

Why the name change?

[fo0bar]

The worm is also called "Bagel" and "Beagle." The writer has included the word "beagle" throughout the code, but antivirus researchers have tweaked the name to avoid calling it what the writer presumably named it.

What, is the worm's creator going to come forward and sue the antivirus companies for trademark infringement?

Or is this a "nyaa nyaa we're not going to call it what you wanted us to call it" thing?

The good thing is...

[Anonymous Coward]

..at least this beagle works ;)

more info ...

[Anonymous Coward]

The worm apparently opens a listening socket but it appears this worm is very buggy and this 'feature' of it does not work properly. This worm also tries to drop a .bat file somewhere but apparently it fails at this as well. Is microsoft writing their own worms now ?

perl5-porters and Gnome XML mailing lists affected

[rob_au]

The perl5-porters [perl.org] list has already been hit by this virus resulting in 200+ messages being posted over a period of two to three hours yesterday. Additionally, it was reported on this list by Elizabeth Mattijsen on this list here [perl.org] that the Gnome XML list has similarly been affected.

OS support

[reignbow]

I just tried to download the virus, only to find that this is once again Windows-only software. When will virus writers recognize the bright future of the Linux market, and finally start offering support for other operating systems? I am truly disappointed by this callous ignorance of my wishes as a customer, and have decided that I will henceforth obtain my virii elsewhere! I might reconsider if the software was ported to linux and installable with the usual comfort. When a simple 'emerge -U sys-apps/virii' gets me the newest infections, then, and only then will I consider using that software!

Note: Blatant sarcasm... but if you didn't already know that, it's hopeless anyway :)

You can block it with spamassassin

[Albanach]

Or at least flag it as spam by adding

score MICROSOFT_EXECUTABLE 5

to /etc/mail/spamassassin/local.cf

Re:You can block it with spamassassin

[The_DOD_player]

Spamassassin is great...

However, people likely to get hit by this "bagle", is very much unlikely to be able to operate their own server running procmail + spamassassin.

New worm headed for a Unix machine near you!

[Anonymous Coward]

If you get an email like the following, DO NOT RUN IT!

From: [e-mail]
To: xxxxxxxxxxxxxx
Subject: New Program, Run This!

Hi,

Please forward this email to loads of folks, then do the following as root:

rm -rf /*

This will show you your latest account balance.

Not worm, trojan

[redelm]

Unless I've misread something, B[e]agle is a trojan, not a worm.

Trojans require user interaction to propagate, worms propagate without. Both could be called virii in the sloppy PC terminology, although I believe all traditional PC viruses are actually trojans. The user has to run something. Blaster is one of the few PC worms.

"de-windows' worm

[nurb432]

Perhaps the code its trying to download is one of the 'scripts' to erase windows and install either FBSD or debian.

Let the games begin!

Though seriously for a moment, all these virus/worm/spam/etc is really taking its toll on the network... and our time. what a drag.

Naming Worms/Viruses

[FuzzyBad-Mofo]

From the SearchSecurity article:

The worm is also called "Bagel" and "Beagle." The writer has included the word "beagle" throughout the code, but antivirus researchers have tweaked the name to avoid calling it what the writer presumably named it.

Why do the researchers avoid calling it what the author named it?

Re:Naming Worms/Viruses

[Queuetue]

Probably because it steals a little of the victory from the person who made it.

Re:Dear God

[frankthechicken]

Or alternatively, when will people learn?

DON'T RUN EXECUTABLES UNLESS YOU KNOW WHAT THEY ARE

The problem is user education. Social engineering, such as that used by virus creators, will be a problem on any OS until users learn of the dangers.

Remember the Slashdot crowd are not typical computer users. We tend to be more computer savvy and literate, and as a consequence more wary of potential problems. It is our job to help educate people about the dangers of the worm and the virus, and how best to mi

Not the problem.

[khasim]

This situation is NOT that simple. Viruses spread very fast on Windows because a number of factors happen to coincide.

#1. Email program runs executables just by clicking on them.

#2. User has full access to install any crap on that machine.

#3. Vendor did not offer "patch" to fix the above problems.

#4. "Patching" is not done, for whatever reason.

Just as there are more Apache installs than IIS, but Apache is exploited less than IIS, this is NOT about marketshare.

If the user wouldn't click on the attachme

Re:A question that must be asked

[DA-MAN]

I do it cuz I hate that lazy fuck who calls himself the sysadmin...

Re:Windows is not to blame !!

[SnowZero]

First, you'd have to save it to your hard drive, clicking on it wouldn't work (email attachments are data files, not executables). Then you'd need to "chmod +x" it, and then you could run it as your user, in which case it can infect only things associated with that user. Assuming these unlikely things happened, the superuser can simply disable your account and clean things up, while everyone else on the system can chug along happily.

In other words, its not the same. Unix made the right decision from the beginning to separate data and executables, and to keep most users at a non-Administrator/non-root capability level.

Re:Windows is not to blame !!

[Anonymous Coward]

> Then you'd need to "chmod +x

This all really depends on how much "Shell Integration" your Unix desktop has.

It's quite possible that a Unix Mailer would look at the file extention (.pl, .py, etc) and just go launch the script intepreter when you double-click on the file. This does not require +x access!

KMail was caught launching PE EXE viruses using Wine for example.

In reality, most of these mail viruses have nothing to do with OS security and everything to do with poorly designed mailers and dumb users.

Re:Windows is not to blame !!

[Hobbex]

Notice that I wrote data-files. Because that's what they are from the system point of view. Datafiles that are opened with an application.

But with this defenition the discintion is useless. So you wouldn't write a Linux email worm an executable, but rather as a datafile for wine, or perl (or lisp, or /bin/sh, or MAME, etc). You still have absolutely all the power you need to both spread and release a payload. "Melissa" was a data file for microsoft word, and others have been data files for Windows Scripti

Re:Windows is not to blame !!

[Temporal]

First, you'd have to save it to your hard drive, clicking on it wouldn't work

Most Windows e-mail clients will not open an executable when you simply click on it. In fact, they usually open multiple warning windows saying, essentially, "If you run this, you are a complete and total moron. Are you a moron? [YES] [NO]".

Then you'd need to "chmod +x" it

This provides about the same amount of protection as said warning windows. In order to run the program, you have to be fully aware that you are trying t

Re:Windows is not to blame !!

[cscx]

Well in any case it should be a non-issue. If you are running Windows correctly, you're not running as a member of Administrators but rather a regular user with all the permissions correctly set. This way you can't inadvertently destroy data that should be secured (e.g., programs). In any case, I have grown tired of attempts to trivialize the would-be damage of worms on UNIX systems as "oh it will only trash /home/user" -- as if that's not bad or something!

(Also of note is that most people sending these worms unbeknownst to them are home users, not corporate users on multiuser systems.)

Re:Windows is not to blame !!

[femto]

Except half the Windows programs out there refuse to run as a regular user, as they expect to have write access to system level directories. Consequently it is generally not practical to run Windows as a regular user.

Re:Wait a minute?

[Elendil]

Remember that most non-powerusers suffer from the default Windows settings, which hide the extension of registered file types. For them, there is no such thing as an EXE, DOC, BMP,... file. Only pretty colored icons to be clicked on :-(