Windows Virus Takes Out Gov't Agencies in MD, PA

Zolzar writes "Looks like the Md. State Motor Vehicles Administration is the first government agency reporting a failure of their systems due to the recent virus." This is a more specific story about the outage. And the city of Philadelphia has suffered as well.

Has to be said...

[Anonymous Coward]

In Soviet Russia, government agencies take out you!

Newsflash!

[ackthpt]

Government officials for the first time discover computers infected with Windows.

C'mon, this is getting so old ... but I guess that's the really pity, isn't it? Gives cities like Munich the last laugh.

Best news all day

[raider_red]

Bringing down the DMV may be the best use anyone's ever found for a virus.

We Got Hit

[Snoopy77]

We discovered we got hit when our Sonicwall connections hit the limit every 10 minutes. It took us two tries to clean it all up.

And who was it who brought it into the office? The CEO. He thought he had a virus but connected to the network anyway. Mod that funny if you will but try being part of our network support team.

Windows rules.....

[scottp]

Good ole, trustworthy, reliable, secure, best OS, Winblows.....how can it still remain on 90%+ of PC's? That should be on unsolved mysteries.....

Re:Thanks for nothing.

[Gherald]

When they find the Linux users who did this I hope they lock them up and throw away the key.

So all someone has to do is dislike Gates and Microsoft, write an Windows virus, and they are automatically considered a Linux user?

Cool.

Re: Best news all day

[Black Parrot]

> Bringing down the DMV may be the best use anyone's ever found for a virus.

Yeah, everyone's always complaining that the lines aren't slow enough already.

So are you implying

[Gherald]

..they are an "ordinary asshole," as opposed to an asshole "trying to get people to switch to Linux" ?

Re:We Got Hit

[Kenja]

I keep 13 inches of sharp folded steel in a glass case above my desk with a sign that reads "break in the event of user error". I never have those kind of problems.

Re:I don't pity them

[Gherald]

Three weeks isn't that long for a patch to be out. Many organizations actually test patches out on non-production machines before randomly installing software that Microsoft says is ok.

But if you are going to trust a closed source operating system, you may as well trust all updates from the owners of the code. I mean, who else is qualified to release patches...?

As they say: In for a penny, in for a pound.

I run Windows update on all my employer's servers and workstations within 48 hours of a security patch being released. I figure that is enough for a billion dollar company to retract a patch that has gone bad.

Re: A good arguement for...

[retto]

I wonder if this will eventually become a regular segment, like the weather

I can see it now... a fat bald guy standing in front a colorful map of the US pointing at little cardboard cut outs of 'hax0r' and '0wn3d' talking about an 'outbreak of DDOS across the midwest' and a 'hacker front coming up the eastern seaboard.'

There could also be a five-day patch forecast, and to wrap it all up he could say happy birthday to really old sysadmins and shoutouts to servers with really long uptime.

Dear SAN,

[Letter]

Dear SAN,

I just want to say LOVE YOU SAN!! billy gates why do you make this possible ? Stop making money and fix your software!!

Love,
Letter

Virus taking out government computers?

[EGSonikku]

It's SkyNet! SkyNet is the virus!

*makes some popcorn and waits for the nukes.

British Columbia banking is screwing up now!

[ratfynk]

The debit machines in British Columbia are screwing up big time right now August 12. A Safeway employee told me it is because of server outages. Boy this is starting to cost big dollars. At least ./ still runs. You guys cash my check? At least I can still rant on line.

Virus?

[Flakeloaf]

No problem, Sir. We'll just switch our AI on and squash this thing. Skynet is ready to go live.

Re:Yes

[TedCheshireAcad]

This is unfortunate, as the most entertaining worms/virii are those that contain broken English. Example:

VERY JOKE! See US President and FBI Secrets!

However, to the dismay of many a sys-admin, this worm is not VERY JOKE. Sigh.

From my hotel to work

[mhoover]

Here is a little something that you may or may not find slihgtly hilarious:

Word of fore warning - I am typing on a ONCOMMAND keyboard (hotel web TV) that is probably covered in beer and man glaze.

I had a mysterious reboot one night when tyig to access the "High Speed Suck-O-Net" That they try to charge $10/night for. After 13 hours of updati MS systems at work I wrote it off as "one of those things". Now I am starting to have second thoughts.

I can't use the internet in the hotel on my computer because everytime I do I get the "NT Authority/System RPC service terminated unexpectedly" then my Windows XP laptop (wasn't it supposed to be more secure?!?) shuts itself off. Not only taht the phone stoped worknig next to the bed, the receptionist downstairs thinks I am crazy for bitching about worms (how can worms get on the tenth floor?), this keyboard sucks and my coputer is infected with a DAMNED VIRUS that has already cost me $10 for the initial infction! I would like to find the ASSHOLE that wrote this POS and give his ass an unexpected termination!

Seriously though,
Why can't someone right a virus that get's into these ONCOMMAND systems (run on MS (P)OS) and tell it give everyone free porn? I would pay for it but I am afraid my TV will shut off half way through due to some bug and I would have to make the rest up!

I probably would have been able to respond to the 15 minutes of warning had I not had been patching other vulnerabilities these bastards keep finding.

BTW - I proudly run OSS for several of my (stable) servers but I am not in MY ofice, I am in a pure MS network. I will now be infesting it with a new "virus" according to the all knowing MS. it's a little thing calld Linux, anyone heard of it?

Well I supose I should get some sleep as I will have a couple hundred machines to clean at 6 AM and it's now 12:30. Off to bd where I shal dream of worms crawling htrough my head!

Re:People should start taking note

[bninja_penguin]

Blah blah, don't use MS, blah blah. That's just not an option for 90% of the world.

WTF??? Is 90% of the world running Autocad? As far as I know, thats about the only thing that's really stuck to running on Windows (of software available to the general public.) Even MS Office can run fine on an alternative platform (Macintosh.)
Also, 90% means nine out of ten. So, what you are saying, when you say That's just not an option for 90% of the world , is that nine out of ten aboriginals or rain forest indians have no option but to use MS? Good God, man, I'm not even sure that nine out of ten people in the world have electriciy or running water. So, before you start spouting off about "options for 90% of the world", how about you tone that down to what you really mean, and say,
"Blah blah, don't use MS, blah blah. That's just not an option for 90% of the anonymous cowards who post to /."!!!

Re:Our system

[Tumbleweed]

One thing to note is that is crashed the RPC service on a couple of fully patched clients, but for most of them it had no effect. On the ones that it did infect (IE, the ones that weren't patched), it disabled file copying through the GUI (both drag&drop and copy&paste). It also disables a number of odd things, mostly dialogs, like IE's "Find (on this page)" Between those two I suspect it infected at least one system DLL. Something it did didn't agree with Word, which would popup up an error on creating a new document, saying that the document could not be registered, so other documents would not be able to link to this one.

Hmm, that sounds about right for normal operation - are you sure the systems are infected? ;)

Re:Yes

[hobbesmaster]

Nobody will die if your hospital loses all billing records. Well, the accountants might have heart attacks, but I digress...

Re:The writer has an obvious agenda.

[Rob Simpson]

This [nausicaa.net] San? Clearly, the feds just have to look for a guy riding a red elk...

Yay, Employment!

[Splat]

So, as a Philadelphia area resident can anyone get me a list of infected business/departments so I can fill the positions of the soon-to-be-fired IT Staff?

Yes - I am partly serious.

Re:Our system

[Oscar_Wilde]

More interesting, I thought, is that it stops IE from opening pages in new windows. So all those sites that popup ads and all the pages where the links open in new windows dont work (oh for Mozilla and middle clicking on all computers). Also, drop down combo box menus wont work (which I noticed while trying to use phpMyAdmin).

If nothing else this worm will stop people from having to put up with pop-ups for a few days... Might almost be worth it.

Re:Yes

[tuba_dude]

Is it just me? I read that as meaning "OpenBSD has opinions." I'm not saying that's bad or anything, but HAL was not a fun computer.

Re:WMW: Whatever McDonald's Worker!

[Stevyn]

The ability of ms programmers should be commended. Like clockwork they ensure people must update their software every week and upgrade it every couple of years.

This business strategy of having your customers depend on you to prevent these pathetic hacks works well for them. What other company in these times has $50 billion in cash?

The only thing that can help or even fix this is competition. We all know that's not going to be from apple anymore, so maybe linux.

Re:People should start taking note

[minus9]

Yes obviously Linux will be solely used by hobbyists until there are more Motorola propegation simulators, it makes much more sense now.

Re:You just described my vision of hell

[Hektor_Troy]

Nothing personal, but I'd never consider Windows 2000 secure enough to bet my life, or anyone else's life on it.

Well, I wouldn't mind it if Bill Gates, Steve Ballmer et al were dependent on the stability and security of Microsoft's products.

Re:Yay, Employment!

[Zarf]

So, as a Philadelphia area resident can anyone get me a list of infected business/departments so I can fill the positions of the soon-to-be-fired IT Staff?

The note I just got said those jobs are being outsourced to India. Sorry you're still out of luck. :(

Re:Yes

[RMH101]

perfect! perhaps we could run it on a commodore amiga, and make sure that only one person knows how it works. then we could staple their lips together and cut off their hands.

you stop software installs and removable media through good security policy, not by running your mission critical stuff on an obscure OS that you can't support and your vendor won't support either.

Pshaw!

[eap]

This virus talk is rubbish. I'm typing this on a Windows computer right now and everything is working fi

Re:Want to see the code?

[Anonymous Coward]

Very interesting, I read this at Microsoft Security Bulletin MS03-026 that I found through your link.

RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly execute code on a remote system. The protocol itself is derived from the Open Software Foundation (OSF) RPC protocol, but with the addition of some Microsoft specific extensions.

and

There is a vulnerability in the part of RPC that deals with message exchange over TCP/IP. The failure results because of incorrect handling of malformed messages. This particular vulnerability affects a Distributed Component Object Model (DCOM) interface with RPC

So basically, if they had respected the original RPC spec provided by the Open Software Foundation this wouldn't have happened, AFAIK DCOM isn't part of RPC but rather just one of those infamous Microsoft specific extensions.

Re:What make Windows 2003 so secure?

[StormReaver]

Let's not forget that Microsoft -always- claims that whatever it's currently selling is the best and most secure version that it's ever made.

NT was the most secure Windows ever made.

95 was the best Windows ever made.

98 was the best Windows ever made.

2000 was the best and most secure Windows ever made.

XP was the best and most secure Windows ever made.

2003 is the best and most secure Windows ever made.

And all those claims could be defended, as each successive Windows fixed past vulnerabilities (with subsequent service packs sometimes reactivating the same vulnerabilities) and made some minor improvements.

However, no version of Windows has come even remotely close to being secure, even if you disable all network services configurable by users.

Having never used Win2003, I can confidently assume that it will be little, if at all, more secure and reliable than any past version of Windows. Keeping logs telling you that you've been screwed rather than taking steps to keep you from being screwed in the first place is not an improvement.

I live in MD

[Ogre332]

The MVA doesn't need a virus to slow it down. It crawls just fine on its own.