Windows Users Fear Korgo Virus 533
An anonymous reader writes "A new virus is on the prowl that can infect your Windows XP/2K system and record every key you hit on your keyboard. The keys are then sent back to the virus creator where he/she can steal your passwords and credit card information. The virus named, Korgo, started showing up in the last week of May but it now has at least six different variants. To protect yourself from this nasty virus, Microsoft is urging all users to download the KB835732 Security Update. As with the Sasser worm, you'll get the Korgo virus without even knowing it. It does not arrive by email, but simply by being connected to a network or to the Internet without having a patched machine or a properly configured firewall."
Details: (Score:5, Informative)
Main details from top of SARC page: Happy cleaning.
Re:Details: , Issued: April 13, 2004 (Score:5, Informative)
Security Update for Microsoft Windows (835732)
Issued: April 13, 2004
Updated: May 4, 2004
Version: 1.3
Re:Details: , Issued: April 13, 2004 (Score:5, Informative)
Re:Details: , Issued: April 13, 2004 (Score:4, Insightful)
Where'd you get that number
Re:Details: , Issued: April 13, 2004 (Score:3, Funny)
Re:Issued two months ago--why was that not mention (Score:5, Informative)
I run RH 9 and FreeBSD 4.9. I looked at the list on the front page, and none of the issues put me at risk.
There are two reasons a person can be unaffected by the vulnerability if they don't patch. One is they don't have or run the affected software. Gnome users that never use KDE aren't impacted by KDE runtime vulnerabilities. The other is that their network is protected enough to render the vulnerability useless (firewall, local IP security, chroot, NAT, etc.)
The only vulnerability I've seen announced this year that I've had any concern about was the CVS one. Fortunately, though, I have yet to open up my firewall for outside access to CVS. When I do, I plan to use SSH, in which case the vulnerability wouldn't have impacted me. Thus, so far in 2004 between the two operating systems I have had no true vulnerabilities.
Sure, you could say the version of MySQL I'm running has the symlink vulnerability. But, if an attacker can't get local non-chroot'd shell access, then what relevance is a symlink vulnerability?
Contrast it to Korgo and Sasser, which hit Windows ports that are opened by default. I can't tell you how many times I see ports 135 and 445 in my daily logs of packet rejections. Plus, the infecting the processess using those ports gives the attack complete control of the sytem.
Windows is plauged by REMOTE vulnerabilities to MICROSOFT software. Linux distrubutions mostly have LOCAL vulnerabilities with the independent APPLICATIONS that are packaged with them, not the operating system itself. Most of these vulnerabilities require LOCAL access and most of this software runs on Windows as well (e.g., Apache), so the vulnerability usually applies to both operating systems, but appears on the linux security alerts simply because they are one of the thousands of optional programs being included on the FOSS CDs. You have to download Apache if you have Windows because Microsoft is not going to include it, and Microsoft isn't going to send you a patch for it, or even post an Errata, just because you are running it on Windows.
I've also administered Windows servers for many years, using Windows 3.1, Workgroups, NT 3.5/4.0, 2000 and XP, and used just about all their software, including Visual Studio, InterDev, IIS, and COM/DCOM. I still run 2000 and XP in addition to RH 9 and FreeBSD. I've developed my opinion from experience securing production servers in both Windows and Linux, as have other people posting on /.
Re:Issued two months ago--why was that not mention (Score:5, Insightful)
Windows is indeed a larger target, but the fact that Windows gets hit more often is its the easier of the two, virus writers are just like the rest of us, lazy. These flaws in Linux differ from those in Windows in that its so much easer to exploit the Windows ones.
Windows has a larger attack area, but whomever is the first to successfully attack and damage Linux in the same way is going to go down in history, whereas who cares about who writes these, there's no skill involved.
Re:Issued two months ago--why was that not mention (Score:4, Insightful)
Now while an exploit that runs on Sparc wont run on MIPS or x86, the flaw itself is there, and thanks to cross compilers, it wouldn't be much of a problem to recompile a tool to take advantage of any problem.
The part of the story Slashdot didn't report (Score:5, Insightful)
This vulnerability is the LSASS Buffer Overrun Vulnerability, already patched way back on April 13. Slashdot probably had at least two or three articles on it back then as well if you wanna do a search for "sasser."
If you haven't patched after two months, you're just the same as all those people who got hit with Blaster, which was also already patched beforehand. Linux distros issue security patches for their vulnerabilities [linuxsecurity.com] weekly and nobody complains, but when Microsoft releases a patch, suddenly it's this huge issue to run a tiny executable that plugs security flaws, and then people bitch at Windows two months later when a virus comes out to exploit it...
Just saying. How can one criticize their security if they won't apply their security patches? Almost all major software is gonna require a patch eventually. I don't get this steadfast need to avoid patching Windows boxes while freely recompiling Linux kernels on a whim for production servers when a minor point release comes out.
Re:The part of the story Slashdot didn't report (Score:3, Insightful)
But IMO, part of the problem is that these people are just "aware" that they have to do updates. I can't count the number of people I've told to go to WindowsUpdate to keep up to date and I get the most clueless looking face I've ever seen...
I think Windows is at the very least, doing an admirable job of patching it's flaws, but you can't force people to update. It's another good step to include the Automatic Updating with Windows now, but it's not automatically turned on.
Re:The part of the story Slashdot didn't report (Score:5, Insightful)
For someone sitting at their pc, the risk of a patch is low, but some people cannot afford to risk their systems on haphazard patching.
Re:The part of the story Slashdot didn't report (Score:3, Insightful)
Re:The part of the story Slashdot didn't report (Score:3, Insightful)
Yeah, except that some patches are known to break other programs. (generally badly programed software, but not always) They almost always require a reboot to install (forget about mission critical 24x7 servers). They don't always install correctly. (this last is my fault for running 2000 with "only" 64mg of ram, but what else can I do when a DIMM gets bad memory?)
Thats ignoring new systems which don't come patched from the factory. The only [easy] way to get patched is to connect to the Internet wh
Re:The part of the story Slashdot didn't report (Score:3, Insightful)
What about those who just bought a new PC that was shipped at tha factory (just) prior to this patch becoming available? Who even guarantees that HP or Dell ship their boxes with the patch on it already?
Or what about someone like me, who is about to reinstall the entire Winblows mess from scratch after a disk crash? Yes, this system had the patch installed within a day of the latter becoming ava
Re:What didn't they report? (Score:3, Funny)
I had to deal with this not long ago. I just thought it was bad plumbing, but now I know it's those damn 133t 5kR1p7 k1dd13 h4x0rs again! If only American Standard didn't make such an insecure product! Anyone, absolutely anyone in the house, can just go into the bathroom and leave any kind of shit they want in my toilet and there's not a single security feature to stop them!
And does AS ever release security pa
Re:Details: (Score:5, Insightful)
113: auth
3067: unknown
The first two, at least, are service ports (Why else would something exploit them) So the question is really, "why are they open by default?"
I expect this will be fixed in XP SP2.
The next time I boot into windows, I reckon I'm gonna be destroyed... I haven't updated in ages, so anything that zonealarm misses is heading straight for me.
Re:Details: (Score:3, Informative)
Re:Details: (Score:3, Interesting)
Well, at least you have zonealarm. My clueless neighbor just recently asked me to check his computer, since he had some "problems" with it. I checked, he had XP w/o any firewall/virus/spyware on it. His computer would reset itself every 7 minutes (I guess some kind of worm) every time he connected to internet.
So, I installed zonealarm and ad-aware from my external HD. When connected to internet I was surprised by how many attempts to conne
Re:Details: (Score:5, Interesting)
When you turn the firewall on, it blocks a ton of ports, which may or may not include ports it should block (telnet). Needless to say there isn't any way to configure which ports. It's all or nothing.
I've got it on, but god knows if its doing any good, as its behind 2 better firewalls.
Hmmm. Lol. Okay, I just portscanned myself, and despite my setting it to dump ALL non established incoming tcp/ip, it doesn't block a bunch of ports (below), including IIS and 445, though it does block SSH and telnet (then again, those services might not be available for my version of windows, so who the hell knows?)
In conclusion, it sucks, and it won't protect you from this virus.
7/tcp open echo
9/tcp open discard
13/tcp open daytime
17/tcp open qotd
19/tcp open chargen
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
1025/tcp open NFS-or-IIS
1026/tcp open LSA-or-nterm
1027/tcp open IIS
5000/tcp open UPnP
Re:Details: (Score:3, Informative)
Not quite. Turning the firewall on in XP blocks almost all ports EXCEPT those you specify in the "allow" listbox provided. Want telnet's port unblocked? Just look in that list box and check "telnet" as an allowed port.
"it doesn't block a bunch of ports...including IIS and 445"
Many of those ports you mentioned it actually can block if you go to the last tab in your firewall setup dialog. Uncheck the options like "allow inc
Re:Details: (Score:5, Funny)
Just use a random number generator.
Oh wait.....
Re:Details: (Score:5, Informative)
Re:Details: (Score:5, Informative)
KB835732 (Score:5, Interesting)
Re:KB835732 (Score:5, Insightful)
At work we do the releases in steps, first the IT dept, then the superusers. And then we take the rest in steps to prevent too much trouble.
But it just not install the patch on 2000 machines as soon it comes out.
A good rule of thumb... (Score:3, Informative)
You're assuming that someone out there in the world is going to install, test and have somewhat of a similiar environment to yours. In other words, you're hoping someone else will do the work for you.
I think a better rule of thumb is to have a
Re:KB835732 (Score:3, Insightful)
Now granted I've got closer to 500 machines (But I'd do the same thing if they gave me 2000, or even 20,000) but I still patch every single one of them the moment Microsoft spits it out.
One day, one fine day Microsoft is going t
Re:KB835732 (Score:3, Interesting)
How nested can that go?
Hmmm.... (Score:5, Informative)
For those that have just come out from their rock, here is a removal tool for this latest worm [symantec.com]
And IIRC, shouldn't any good (read: non-XP) firewall automatically be blocking these ports (or atleast 445) right out-of-the-box?
Re:Hmmm.... (Score:5, Informative)
Re:Hmmm.... (Score:5, Informative)
Re:Hmmm.... (Score:3, Insightful)
Not exactly. Any system administrator (which I assume he is -- . . .
Why on earth would you assume that? The guy was helping a relative, not some user at work, reinstall Windows.
He didn't do that, he didn't run a firewall... he didn't take any sensible protection.
If I were visiting my relatives, a thousand miles from my home, and had to reinstall Windows on one of their computers, I'd have to take the chance since there wouldn't be much choice. It would be the same advice you'd get from MS tech sup
Re:Hmmm.... (Score:3, Interesting)
only AFTER do I connect with IE (setting IE's homepage to http://windowsupdate.microsoft.com) and get the rest. Also setting their computers "automatic update" feat
Not surprising. (Score:5, Insightful)
Like it or not, they want their PC to work like their television. As much as you or I don't like it, they are the people that are keeping Windows suppport folks employed.
I can't say how many times I've helped with someone's machine, and they've had multiple virus infections, spyware and general crap on their machine because they don't know any better. It's a fact of life that Microsoft is going to have to own up to if they want to stay on top. They raised the beast, now they need to teach it the rules.
Re:Not surprising. (Score:3, Insightful)
OK, would you tell me how an operating system that's not giving the user write priviliages to anything other than their home directory would have the same amount of viruses as one where by default the user has write privliages to everything composing the operating system?
Re:Not surprising. (Score:3, Informative)
The problem is, a lot of Winblows software won't run without admin priviledges. Also, XP doesn't encourage setting up user accounts. Many people don't even know they exist.
Re:Not surprising. (Score:5, Insightful)
Ummm.... no.
The output of 'netstat' on a default Mac OS X box: G'head. Try to remote exploit.
- Tony
Re:Hmmm.... (Score:5, Insightful)
Despite the default config of 2k/XP to inform you that updates are available, we've been fixing hundreds of machines infected with Sasser, and even Blaster. Users simply ignore the update warning, or outright refuse to run it. One user mentioned "Why would I need to run that?"
Even Microsoft can't prevent ignorance.
Re:Hmmm.... (Score:5, Interesting)
Forgive my ignorance, but shouldn't the lightweight consumer-grade routers (Linksys and such) with NAT be effective as well at blocking this sort of thing?
Re:Hmmm.... (Score:3, Insightful)
With NAT routers being so inexpensive, I believe that everyone should have one of these. Even if it is simply 1 box connecting to the internet.
-Grump
Re:Hmmm.... Don't count on router stopping worms (Score:3, Informative)
Routers won't help with email-borne issues. It will only stop a remote-connect worm from getting through.
Re:Hmmm.... (Score:5, Informative)
Or, you know, so I've heard.
Re:Hmmm.... (Score:5, Interesting)
Needless to say, isntalling individual hotfixes like these is a PITA.
THANK GOD! (Score:3, Informative)
Re:Hmmm.... (Score:3, Informative)
Re:Hmmm.... (Score:3, Funny)
What if I have Windows XP unemployed dumbass edition?
The difference between the two versions... (Score:3, Informative)
That's the only file that's at all different between both editions. So just copy the CD to the HD, change the line in that file that reads
Pid=XXXXXYYY (where XXXXX is the first five digits, and YYY is the last three) to
PID=XXXXX270 (so we are keeping the first five digits, and changing the last 3 to "270")
Also, make sure to call the V
Re:Hmmm.... (Score:3, Informative)
If the correction came today, mass confusion! If not, they may have just confirmed it.
Re:Hmmm.... Most pirated windows machines... (Score:3, Informative)
The reasoning was it was better than having umpteen zillion unpatched boxes out there DDoS'ing their website.
Advisory (Score:5, Informative)
You know... (Score:4, Insightful)
Re:You know... (Score:3, Informative)
So you do all routine maintenance right? (Score:5, Insightful)
It's easy for us to say that, we're computer users who (presumably) know what we're doing. But if one is to condemn non-patchers in that way - I assume you also change your oil every 3000 miles, go to the dentist every 6 months, floss daily, get an annual physical, clean the lint filter in your dryer after every load, eat 6 daily servings of vegetables, rotate your tires every 20,000 miles, have all your car's factory recalls done, change the air filters in your heater monthly, and perform all the other mindless routine maintenance you're supposed to do.
The bottom line is, no one on earth outside the most anal retentive person alive does all that stuff. Not doing any of them could have consequences, but people simply don't have time to do all this shit.
So yes, I do blame microsoft. One shouldn't have to constantly check symantec's web page just to keep your computer usable. Computers are appliances now. They should just work, dammit.
Re:So you do all routine maintenance right? (Score:3, Interesting)
You're absolutely right. I have a friend who was completely anal about a lot of things. His car was his favorite toy. He's 30-something now, and has started becoming more lax. He hasn't been rotating his tires, or even taking a good look at them. He was occasionally glancing at the outside edge, seeing the tread looked ok, and assumed all was fine.
A couple weeks ago, on a wet road, he slid off the road, and his car ended up in a lake. Why? Because his alignm
Re:So you do all routine maintenance right? (Score:4, Insightful)
Both my parents are quite intelligent and can work a computer for what they need (word processor/quicken/email/browser) fairly competently. The problem, IMHO, is that computer users view a computer as any other appliance, it should just work, and think if they follow some common-sense (such as not opening strange attachments) they wont have problems. People don't understand why it's important to patch a computer or even how to do it, so they don't.
Re:So you do all routine maintenance right? (Score:3, Funny)
I rotate my tyres every single mile I drive. It kind of happens automatically with this whole 'wheel' thing.
Morbo? (Score:4, Funny)
Re:Morbo? (Score:5, Funny)
Re:No, Torgo (Score:3, Funny)
Worm vs Virus (Score:5, Informative)
Re:Worm vs Virus (Score:4, Informative)
VIRUS: File infector, Self-Replicating A virus will insert it's own code into another _pre-existing_ file. It also replicates automatically every time it's run.
WORM: Self replicating
A worm self-replicates liek a virus, but it does not infect pre-existing files. A worm will create a whole new file that is pure viral code (usually with a spoofed name like iexplorer.exe as opposed to the legit file iexplore.exe)
TROJAN:
A trojan is also it's own file of pure viral code, but does not self-replicate (However, they frequently facilitate remote control of the Trojan that can be used to replicate it)
Symantec has a document on this, the link is... What is the difference between Viruses, Trojans and Worms? [symantec.com]
Why is this .gt. 1 month old update news? (Score:4, Insightful)
As For Me (Score:4, Funny)
Okay, you got me... (Score:3, Interesting)
Damn, I gotta rtfa *grin*
Seriously though, even though I check for new updates religously and try to keep all the users on my network up to date, I guess I'm still a little gun-shy.
Hey! How come the Microsoft Site (Score:5, Funny)
updating (Score:3, Interesting)
Figuring so, a lot of people could get screwed.
Re:updating (Score:3, Insightful)
Committing theft takes away your right to be upset about such things, IMHO.
Not Exactly... (Score:5, Informative)
I take care of the place while the master is away (Score:4, Funny)
Keystrokes: transmitted in the clear? (Score:3, Interesting)
As a side benefit, the system would also catch insecure site logins - seeing which websites are asking for unencrypted sensitive data such as passwords.
Securing a password detector (Score:3, Interesting)
Your point is a very good o
Easy fix (Score:5, Funny)
Remember Passwords (Score:5, Funny)
Gee (Score:4, Funny)
Good thing I'm not dumb enough to type anything important of my own on a Windows box. I guess if I'm infected at work, they'll get the company's code, and if I'm infected at home, they'll found out that I like to cast "Magic Missile" in conjunction with "Flamestrike" when facing strong magic users to disrupt their concentration then hit them with a heavy blast while my warriors move in for the kill.
I'm sure that latter piece is exceptionally valuable information...
Finally name that can spread some fear! (Score:3, Funny)
Not quite fear-of-god inducing, but whatever.
Off-topic punctuation nitpick (Score:5, Funny)
The virus named, Korgo, started showing up . . .
I highly recommend that the submitter (Anonymous User) immediately head over to his/her favorite online book retailer and purchase Eats, Shoots and Leaves [eatsshootsandleaves.com].
Re: Off-topic punctuation nitpick (Score:3)
(Some of us would have properly capitalised 'English', too...)
computer maintenance (Score:3, Insightful)
I have a lot of relatives who used to use computers but have mostly given up on them. What with spam, and viruses, and worms, and trojans, and spyware, I can't blame them. Unless they give you a whole lot in return, they're not worth the hassle.
short lived? (Score:3, Interesting)
I've always wondered about this sort of thing... doesn't that make the creator pretty easy to catch?
Maybe Microsoft should hire the virus writers. (Score:3, Insightful)
If SP2 does not fix these holes like Microsoft claims it will then they should be libel for the money that business lose due to badly written software. Microsoft needs to change the way it updates its software. Instead of releasing a service pack and charging for it when it does come out they should step to releases every month or two, like the way OS X does.
As a matter of fact Microsoft seems to be in the same state Apple was in before Jobs came back. Lost and clueless developing products that they were not good at and had a directionless system software development. This far into WindowsXP MS should have had nearly all of the framework for longhorn laid out and most of the coding done, yet we hear of announced features being dropped because it won't meet their deadline which is two years off. Something is wrong in Redmond and now is the time for Linux and OS X take advantage of it, if they don't do it now they may not have another chance. Unless of course longhorn is the worst mistake they have ever made.
"Windows Users Fear Korgo Virus" (Score:5, Funny)
And it doesn't look like the situation is going to get better any time soon.
One bearded Linux coder, who refused to be identified publicly, confessed "we just don't have the selection -- or quality -- of viruses on our platform that is available to Windows users free of charge. And it's tearing us up inside knowing that the battle is over, and Microsoft has clearly won." Similarly, a guy with an Apple logo shaved into the back of his head admitted the following once we turned off the cameras. "I don't mean to break ranks and insult our software selection," he whispered furtively, "but usually if we DO manage to get a virus that will even install on OS X, it's not that great, and we're left... disappointed, realizing that if we had simply stuck with the unwashed smelly masses, we too could be enjoying a daily barrage of free software delighting us by installing itself on our computers as a surprise gift. Instead, I'm stuck with the weak consolation prize of 40 Academy Awards for my work on Lord Of The Rings. But it's not the same. No amount of awards or million dollar paycheques can heal the feelings of neglect or massive abandonment issues this whole thing has given me."
"Is this the reason so many people choose Windows?", his innocent young son, Moof, asked me, looking like the kid off the Dave software box. [thursby.com]
"What do you think, little one? Look at the Windows dominance in the virus field, then look at the marketshare of Windows. That ain't no coincidence, Moof. The other guys just can't keep up with the Microsoft Juggernaut. Microsoft is fighting hard to keep themselves Number One, just like the Titanic was the biggest and bestest ship, or the Hindenberg was the coolest and most flammable Zeppelin, or the dinosaurs were the toughest animals ever. How do you compete with that?"
=============
Yes, sitting here at my desk 16 hours later, WindowsXP Restore Disks in hand, I can't help but let a little smile shine across my face. Those poor fools, I think, using a non-Microsoft OS really does take away most of the joy of computing and replaces it with all that productivity and recreation crap. And where's the challenge in that?
Please insert Microsoft Windows XP Restore Disk 2
Ahhh, I sigh contentedly. It's gonna be a long night.
Re:Sent back to creator? (Score:5, Informative)
"Sent back to the creator" means data is dumped into an IRC channel, newsgroup, or possibly some zombied machine. There's little way to track the person behind the bot, so to speak.
Of course, a little way is all it takes to pinch some angsty German teenager...
Re:Sent back to creator? (Score:4, Insightful)
modified backend code from the virus to flood the channel
with junk data.
Or better yet, spike it with legitimate-looking data that
will help catch the originator (root passwords for honeypit
machines, special "arrest this customer" CC numbers, etc.)
Re:Sent back to creator? (Score:3, Interesting)
Re:Sent back to creator? (Score:3, Informative)
Re:Older versions (Score:3, Funny)
Yeah, but why would you want to play a game that acts like the Windows Operating System game?
Re:Older versions (Score:4, Insightful)
Security through obscurity!!!.... Or at least old age...
Re:Older versions (Score:4, Informative)
This might be true in some obscure legal system where companies think they can write their own laws.
In Europe it is generally accepted that once you bought it it is legally yours and you can do with it as you please. (like re-selling)
You own the right to run 1 copy of software product X and that is it.
There is no significant difference between the OEM or the full retail versions of the product so the differentiation Microsoft makes lives entirely in their own fantasie.
The GPL is a different matter as it *does* fit in an existing legal framework
Re:Older versions (Score:5, Funny)
yes, it's a shame, very few virus writers are supporting win98. please upgrade to win xp for the latest viruses. ;-D
Re:Darwinism (Score:5, Interesting)
Re:Darwinism (Score:4, Insightful)
How can people NOT know. God, they click "yes" on enough spyware/malware/whatever email crap, but when windows update comes up to tell them there's a new patch for a bad virus, they're clicking no?
Are people really this daft?
Re:Darwinism (Score:5, Funny)
Yes. Welcome to reality, enjoy your stay.
Re:Darwinism (Score:5, Funny)
Re:Darwinism (Score:3, Interesting)
If your toaster had a recall on it, and for whatever reason caught fire in the middle of the night and burnt your house down, you'd be suing the manufacturer. Well, if you didn't, your insurance company would. They don't like giving away money, they like to get it back from somewhere else.
What's different in a product which simply exists in a larger product? Would you be checking for recalls on the radio in your car? Probably
Re:Another? (Score:4, Insightful)
The patch is six weeks old. At what point does it cease to be Microsoft's problem and become the PC owner's?
It is not Microsoft's responsibility to make sure you have installed the latest patches and are exercising proper precautions.
Re:Another? (Score:4, Insightful)
actually, if they advertise it as idiot proof and secure(even for idiots) it kind of becomes their problem.
Re:Another? (Score:3, Insightful)
This is a red herring. It is their responsibility to manufacture a product that, if used by an average person, can be maintained by an average person. There is absolutely nothing intuitve about the Windows patching regimen. If they simply pulled themselves out of the cave on this one issue, many
Re:I'm tired of this (Score:3, Informative)
Except of course that the update for this came out almost two months ago.
Re:Does Windows Update handle hotfixes? (Score:3, Informative)
The security update for this issue is a month old even though this particular exploit is just hitting the news. If you're not sure, windows update has "View installation history."
Look for "Security Update for Windows XP (KB835732)"
Re:Does Windows Update handle hotfixes? (Score:4, Informative)