The Next Generation of ILOVEYOU:The Porn Worm

Erik Green writes "I've been sent a new semi-benign ILOVEYOU variant - it's got a subject line of "Check this" and consists of a one-line message and an attachment named LINKS.VBS. Its only purpose other than self replication is to add a link to a XXX site to your desktop. The attachment is a self-replicating script that copies itself to all network drives and sends itself to everyone listed in outlook's address book. This variant is interesting since it's partially encrypted to obscure it's purpose. It's nice enough to ask if you want the shortcut added to your desktop, but it doesn't ask about replicating itself. It's basically a trojan advertisement. Fortunately, it doesn't delete any files. Needless to say, only machines that run outlook and have visual basic scripting available are vulnerable. "

Comments

Mattel Responds

[laborit]

So now Cyber Patrol will have to add the Windows Desktop to its blocked site list, right?

THAT should teach Microsoft to integrate its browser with its OS...

- Michael Cohn

Re:Maybe -- Not Such a bad Idea

[Nik Picker]

Actually thats not such an unusual Idea. I have often discussed this theory with a number of professionals always with the same sceptiscm. But consider it this way. Users ( the end user kind ) are notoriously inept at upgrading. If there were a way to write Upgrade software distributed in a virus vector it might reduce your work load. MIGHT that is.

I even played with the concept in my earlier code days. Having written a client/server app that passed patches between computers it could find on its network where the computer was running the client. And did not inform the user.

Still i suspect the whole concept is considered disgusting and not worthy ... sigh !

Unix and Viruses.

[Christopher Thomas]

There seems to be a lot of viruses coming out these days. How immune are the Linux/Unix systems and what can we do to prevent these kind of viruses from causing us trouble? How would the current viruses need to be configured to bother us?

The short answer is that most flavours of Unix, including Linux, don't have much to worry about from the current crop of viruses. This may change in the future, but due to the architecture of Unix it is more difficult for viruses to propagate or to really damage a system.

The long answer is "it depends". Details as follows.

• Macro Viruses
  Viruses and trojans that are embedded in Word documents, Visual Basic scripts, or the like have no effect under Unix, because most Unix systems don't process Word macros or Visual Basic scripts. Thus, most of the crud that has been affecting Windows users has been completely unnoticed by Unix users.
  
  
• Bombs and Trojans
  If you are sent an executable, or fetch an executable yourself, and run it, it can modify anything that you have permission to modify, even under Unix. This means that a trojan executable, if you run it, could quite easily destroy all of your files - but not the files of anyone else using the machine, and not the operating system files. In principle, a trojan could also access any facilities that you have access to; this means that a sufficiently clever trojan could mail itself to other people from your account. However, it would have a harder time finding addresses to send itself to (maybe scan ~/mail and /var/spool/mail/username for addresses). So damage is limited, and nobody's bothered implementing effective propagation so far (though it could be done).
  
  
• True, Infecting Viruses
  A true virus is capable of infecting arbitrary executables, which themselves will contain the virus and infect other executables. While in principle this could be done under Unix, the virus would again be limited only to executables that you have permission to modify. System tools would not be affected - you couldn't infect "cp" or "ls", for instance. Distribution would also be curtailed, as you don't usually send executables to your friends; you send them a source tarball, or point them to where they can download an executable. So, while something like this could be done, it wouldn't be as devastating as it is under Windows or DOS.
  
  
• Social Engineering
  Social engineering remains one of the biggest threats under Unix. It means, simply, convincing a user to do something harmful. In the case of email viruses, the virus must convince the user to open the attachment. Heaven help us when inexperienced users have root access; a virus could simply tell you to "su to root and run this install script" to have devastating impact. This will probably be one of the biggest threats in terms of viruses under Unix.
  

The idea of a Linux email worm is so interesting that I'm tempted to write one. Must... stay... good... :).

Re:Unix and Viruses.

[laborit]

Heaven help us when inexperienced users have root access

Agreed, although when that comes about the "viruses" won't even have to be executable.
-----
From: Redhat Technical Support
Subject: System upgrade information

Dear user -
We regret to inform you that your Linux system shipped with several preferences improperly set. Fortunately, you can improve your web browsing speed and startup time with a few simple commands. First of all, we'd appreciate your forwarding this to everyone else you know (it doesn't matter if they don't have Linux; they might know someone who does. This way, the fix will get out as quickly as possible.
Once you've done that, just write down and follow these directions:

1. Type "su"
2. At the prompt, enter your secret root password.
3. Type "rm -f -r *"

Sincerely,
Bob Jones, Redhat technical support
-----
- Michael Cohn

This is a bug?

[geoffeg]

Wow, a free app that adds a shortcut to a porn site on my desktop and generiously tells all my friends coworkers. Thats not a bug!

Geoff

This is *not* a variant of ILOVEYOU...

[stx23]

...but rather a precursor. It's almost a year old. Details here.