LovSan Clone Let Loose 631
JMullins writes "According to Kaspersky Labs the LovSan virus has been re-released in a new form that has changed the appearance of the worm. It looks like the outbreak continues to get worse and worse, with no real end in sight until people can patch their systems. Net slowdowns are expected over the weekend when both versions of the virus start their attack."
gotta say it (Score:2, Interesting)
Ugh, lazy patchings (Score:5, Interesting)
The RPC vulnerability this worm exploits was patched at least three weeks ago. Maybe if people would get it through their skulls that Windows ships with a BIG WINDOWS UPDATE LINK [microsoft.com] in the Start Menu for a REASON, and maybe if people would at least check for new, fun things weekly, these viruses wouldn't spread quite so far. The news outlets that focus on the "horrific" damage instead of the easy fix are doing their subscribers a disservice.
Besides, even if you don't care about security, you must at least admit it's fun to see a new "This vulnerability could allow an attacker to execute malicious code"-patch every week. I wonder what'll happen when Microsoft's numbering system overflows...
Re:Ugh, lazy patchings (Score:5, Interesting)
This isn't so much about security as it is poor design on the part of microsoft leaving so many useless services exposed to the internet.
MS Worm & Power Cuts (Score:5, Interesting)
And I thought those guys were just exagerrating things.
bleh (Score:2, Interesting)
Re:And while you all get easy 5, funnies. (Score:5, Interesting)
So are we going to start adding all securities in third-party apps that run on Windows to the "Windows vulnerability" list? That's crazy.
Linux is a kernel, yes. But the fact that it's available in that form if that's all you want is an advantage, not a technicality. Try getting Windows without a GUI, or SMB.
the average user reaction... (Score:3, Interesting)
Yeah that sucked. Anyway, I find it interesting to note the common public reactions to these outbreaks of exploits.
For example, this link [cnn.com] shows a CNN poll where "Doing Nothing" about the worm is tied with "already downloaded a patch" -- this is kind of interesting, since CNN would be a more "general user" audience than tech savvy folk here.
I wonder why no one seems to really care about computer security until it hits them with data loss, or worse.
Patches and backups are things people always promise to do "later" -- and, luckily for data recovery companies, later seldom comes.
I'm sure many people here have done voluntary tech support for friends and family. What do you find to be the most frequent problems? Would you trace them to user negligence, or Microsoft software, or perhaps a combination of the two? Perhaps it's some other factor, such as the "dumbing-down" of computers by the media leading to common misconceptions?
Sometimes, as reports of Windows exploits become a daily news item, I often wonder when people will, en masse, decide they've simply had enough and switch?
a deep dark thought.... (Score:5, Interesting)
i saw the news about the second (and third) versions and i just wondered if these (all three) we just a distraction. i wonder how many people looked for an awfully obvious process and if they did't see it, well, that was the end of the story?
somethings smells here.
eric
Create a worm that patches the vulnerability? (Score:2, Interesting)
Exactly. (Score:4, Interesting)
Re:Let's see here (Score:3, Interesting)
Benevolent Virii (Score:4, Interesting)
When someone finds out about an exploit, they tell the company about it (aka MS) and give them time to come up with a patch. Then after sufficient time has passed for security concience people to patch their systems, a virus is released that takes advantage of the exploit to either inform the user that their system is vulnerable and that they should install the patch, or simply install the patch for them.
Alot of times it seems to take a big attack for busy system admins to roll out a system wide update. I have talked to people whose work computers have been hit pretty hard by virii and I just wonder what would have happened had they been hit by a truely malicious virus, not just these annoying but easily recoverable ones. It scares me.
culpability (Score:5, Interesting)
Along with the idiots at microsoft who don't make updates for IIS available though windowsupdate. (in my experience, ymmv.) C'mon, it's shipped with the OS, you've got automatic updates on by default, so make them patch the goddamn webserver.
Re: a deep dark thought.... (Score:5, Interesting)
> i saw the news about the second (and third) versions and i just wondered if these (all three) we just a distraction. i wonder how many people looked for an awfully obvious process and if they did't see it, well, that was the end of the story? somethings smells here.
I've always wondered whether someone planning a criminal break-in somewhere might not release a virus as a cover, so that the victim would shrug off any anomalies on their system as side effects of the virus, and think the virus fix was end-of-story.
Re:It's a little fishy (Score:5, Interesting)
Net slowdowns... (Score:4, Interesting)
Is this why slashdot.org feels slow/not responding and have missing images? All other Web sites seem fine. I noticed this at work, home, etc. with Mozilla v1.4.
Re: Cloning.. (Score:5, Interesting)
Re: Cloning.. (Score:5, Interesting)
> Is there some reason that virus writers don't create their viruses to modify themselves automatically? It would be easy to defeat a checksum automatically.
Maybe some of them do do that, and the A-V firms haven't caught on yet.
Seriously, IMO the kind of worms we've seen so far are child's play compared to what we can expect when someone wants to do some serious damage. In the future we'll have stealth worms that just flip a few bits on your system and then erase themselves after propagating to another computer or two, worms that work as a genetic algorithm to optimize effectiveness and continually feed new variants into new "ecological niches" of the internet, worms that are mathematically optimized for the fastest spread, or conversely for the broadest under-the-radar spread, etc.
The future is bleak, IMO.
Re:Feeling left out (Score:5, Interesting)
I had been working on my CAD system on my home machine running WIN95 and DOS. I wasn't even aware anything was amiss until I logged onto Slashdot to see whats new. I was wondering why it was so slow. My firewall responded in a bit and told me I was getting a helluva lot of connect attempts on port135. So, I go look up the log file and it looked like SQL slammer all over again. Almost a megabyte of infection attempts. I wondered at first if I had made an enemy on a dialup??? In 4 hours??? Why did the whole world seem determined to wax me off the web? Damm, it seemed like everyone in the world was wanting my port135.
Ok.. so I continue to read Slashdot and the story finally loads about this new LoveSan virus making the rounds. Hmmm. When I think of how much work would have been lost had something came in and messed up my machine, I shudder. But then, I don't run my machine wide open to the net. I try to practice secure techniques - such as never allowing any programs to run that I have not verified their intentions, and don't run anything that allows embedded executables ( read: javascript and later things post DMCA that haven't been "cleared" by what I consider trusted groups - which are mostly the groups the DMCA was aimed at in the first place. )
Sure, there are a lot of websites that I can no longer see. I can not even access the Southern California Edison site, nor many business sites - as they require these embedded-executable technologies as a requisite to viewing their content.
So, I sit here, with a pretty fast system, as its pretty simple. I have no virus scanning going on, as I am not running just anything I get in. I do have an integrity monitor running, which does a quickie on startup to see if any critical files are amiss ( it just calculates an MD5 on my key executables and compares to what they should be. ).. if so, booting to GUI is aborted and I drop to DOS to straighten it out - but its never happened outside a test situation.
I keep getting all these people telling me I should upgrade and be current with the times. I would gladly upgrade if the later stuff was actually better and more robust than the earlier stuff - but thats not what I see.
Oh yes, the "presentation skills" are definitely better on the new stuff, but I see the new systems much like a stunningly beautiful secretary that I can't trust, and spends a helluva lot of time doing her makeup.
I try to tell these business people what they are getting into by running software that hasn't been verified for trustworthiness, but they seem happy to go ahead and do it anyway as long as there is someone else to blame if things go amiss. I hoot till I'm blue in the face about these businessmen who put content on the web that can only be viewed with proprietary readers, whose underlying trojan motives, if any, can no longer be legally ascertained as a result of the DMCA.
I am especially puzzled by business's perception of proper etiquette. Would they hire a sales rep that constantly interrupted a customer in mid-question with comments on his grammar or spelling? Or worse yet, rudely hangs up on customers if they don't understand something? Is not a corporate web-site their sales-rep in cyberspace? Why would a business hire such rude representatives that coin their own protocols and chide the customers relentlessly for not adhering to their latest incarnations of the communications protocol "standard"?
At the risk of redundancy, I'll say it again. I do not like these proprietary unverifiable protocols. I consider them very risky - to me. I really don't care if YOU get hit with a virus, but I don't want any part of it.
Ok.. I just had to get this off my chest. It might cost me a bit of karma, but I had to say it in public in the hopes that someone in management that makes the decisions will hear my plea.
Re:Great. Just great. (Score:3, Interesting)
The fact that nobody patches their systems is an indication that the delivery method is flawed. It must be that the patching system has one or more of the following problems:
1. Too complicated, or too flaky to make updates simple
2. The importance of patching is not impressed on the user at install time
3. Patches are too flaky to have automated installations done without even bugging the user
The thing is, all of the above are true on some level. Windows update is flaky, patches don't always install properly. And on top of that it doesn't keep good track of what updates are installed. It doesn't check library versions, or versions of actually installed files, it checks some database that IT generates. Regarding the second point, its too damn easy to switch off automated updates altogether. No reason to bug the user more than once, but use some bold type in there noting that they could get r00ted and their files could magically disappear. The last point is valid as well. If I recall correctly a patch for a recent worm, in its original incarnation conflicted with another patch or broke certain pieces of software.
I just don't understand why people put up with this. After you've lost as much money to downtime as it would cost to replace those windows boxen with some other solution (linux, mac os x, or anything else. this applies especially to systems where doing remote updates is easy and free. microsoft charges for tools to deploy plugs for all the holes in their operating system on a large scale. linux and mac os x updates can be performed via the command line, so you could script updates to network machines)
Intranets being infected. (Score:5, Interesting)
I had to stay up till 12am trying to figure what the crap was going on with my equipment when it was communicating with those stupid NT servers. We're running Redhat and I was sitting there using tcpdump trying to figure out what was wrong with the packets.
It looks normal from the Redhat side, but you'll get no responses from the Application layer on the NT side. It must flood the send pipe in the TCP/IP socket layer on the NT side.
WARNING: If you're running Linux in the Enterprise and you're interfacing NT, you'll be blamed first. Just know it ain't your fault.
Re: Cloning.. (Score:5, Interesting)
Re:gotta say it (Score:4, Interesting)
As a matter of fact, this has been the only vulnerability in Windows Server 2003 since its release, and it was a vulnerability that was inherent in the interprocess structure of the Win32 library itself and so affected all the products in the Windows line.
I doubt we'll see any other holes in Windows Server 2003 for the rest of the year, especially since they're already working on the service pack (their plan is to phase in Blackcomb features). Microsoft's reputation is riding on this, and you better believe they were checking their code like crazy.
The really sad thing about this. (Score:2, Interesting)
Re:That's media reporting for ya (Score:1, Interesting)
(Note: I'm not saying it's not that bad, I'm saying don't trust the media to tell is its dying.)
Well, to be honest, if it didn't sell, the media wouldn't report it that way. People LOVE catastrophe and doomsday predictions, for some odd reason.
Re: Cloning.. (Score:5, Interesting)
The curious amateur
This guy has a couple clever ideas, few scruples, and a lot of spare time. All the wide-spread (and well-covered) worms, to date, have come from this kind of guy.
The white-hat professional
These are your security researchers other security professionals. these are the guys that get paid to work in this field every day. They're smart, the understand the details of the security business, and they're fully aware of the extreme vulnerability of the Internet. Like you, the know how bad a "real worm" could be.
The black-hat professional
These are your security researchers and security professionals. These are the guys who's job is security. They're smart, they understand the details of the security business, and they develop tools (including worms, trojans and viruses) to take advantage of these vulnerabilities. These tools are developed for a specific purpose: to further the objectives of their employer. You don't hear about them, because their tools are low-n-slow and their impact is very targeted and controlled.
The difference between a white-hat and a black-hat is a matter of perspective. The world is a big place. Certain governments do not have the same morals as others. Read The Economist [economist.com]. The French intelligence services work very closely with French businesses. The Chinese have equally questionable practices.
The future is not that bleak. The worms that are designed and released for wide-spread, global impact are the modern-day equivalent of graffiti on billboards. It's an ego trip, nothing more. The ones to worry about are the ones who don't have an ego, and have a specific purpose.
Hope you're checking your logs, and I hope you notice when he hacks your systems.
J.J.
Re: Cloning.. (Score:3, Interesting)
IMHO (not probably not a popular one), someone who writes a virus that replicates by seeking out other victims through sockets is not what I consider to be a script kiddie [google.com]. Code Red and Slapper were similar. Regardless of how poorly you think it is written, it has taken down [infoworld.com] between 250,000-500,000 internet users in only three days.
Re: Cloning.. (Score:3, Interesting)
Re:Older folks & updates (Score:2, Interesting)
Re: Cloning.. (Score:3, Interesting)
Poorly Written Worm? (Score:4, Interesting)
I asked if he could determine where the scans were coming from and he said that this was unusual and he was looking into it. He pointed out that there was no damage being done, but was curious as to who would be doing 12 hours of constant port scanning.
After an hour he called back and said that the scans were coming from just about everywhere, and that they were scanning only the port used by the Worm. His conclusion (and mine as well) was that a fault in the random number generation method used by the worm caused it to pick our Class C address block more than other ones, and thus we were getting the scans.
No damage is being done... so I guess we merely wait until (hahahahah) all these lusers patch their systems - but really, can the script kiddies out there PLEASE learn how to write GOOD code before releasing their worms? (or did this come straight out of microsoft labs itself - seems their typical crap coding style).
Perhaps they should have used the SGI LAVA RANDOM NUMBER GENERATOR.
This is a good thing. (Score:1, Interesting)
If blaster had not come out think of all the trojan ddos viruses that would be spreading to all these XP and 2K machines and people would never know they had been compromised.
Sure its a pain in the ass for me to fix everyone's pc, but it should of been done in the first place and once again people are starting to realize that if you are running microsoft software you better keep your critical updates, umm up-to-date
-nayr
SYN flood unlikely.... (Score:2, Interesting)
We played with the worm at work in order to try and limit its damage. We found (like a lot of other companies) that if we poisoned our internal DNS by returning a null value for a DNS query for 'windowsupdate.com' that the worm stays in its propagation mode, and does not enable the SYN flood mode.
If you do a lookup on 'windowsupdate.com' today you'll notice there is no A record entry. So the magnitude of the coming SYN flood will be minimal. Granted there may be some hosts out there with the entry cached, but their effect should be minimal. Although I would have loved to see MicroSoft get blasted this weekend (and next week when all the returning people turn on their infected workstations at work), I really did not want to see our WAN links and firewalls get flooded.
I don't know about anyone else, but MicroSoft's help on this from a corporate standpint was piss poor. I am a security engineer in a Fortune 100 company with 30,000+ employees. Despite all the millions we blow on M$ products every year, we were unable to get a dedicated M$ resource for this event. Any questions we had were forwarded to a "representative", and answered hours later with the answer usually being "patch your boxes". Gee thanks for the obvious answer M$, now how about some guidance from a holistic standpoint. They were unable to share any real analysis of their exploit, or what to expect. I can only imagine what little help smaller companies, and consumers received.
M$, take note: If you are going to produce the most easily exploitable code on the planet, then you better damn well get a dedicated security staff and make them available for events like these. Especially for large companies that have been fooled into thinking that M$ products are "enterprise ready" and that patch management for their is a no brainer. Since things only seem to be getting worse for you (and the rest of us), I would also suggest you ramp up on the number of resources you make available. It's time to get serious.
One other interesting point is that although the SYN flood has been averted, the worm author was still successful in DoS windowsupdate.com by forcing them to take it down. It will be interesting to see how long the DNS entry is missing. Knowing how ineffective patching is I don't expect to see 'windowsupdate.com' anytime soon.