Slashdot Mirror
Massive DDoS Attack Brewing?
Quite a number of people wrote in with the news that CNN is reporting that a Back Orifice-like program masquerading as a movie clip is infecting thousands of computers worldwide. The prediction is that it's being setup for a DDos - but the technical details, are shall we say, "sketchy".
Now that is an interesting point. And a very good way to set up a DDOS, by creating such a file, would be to send it to all your friends and yourself, then when the attack commences you all say "oh, but someone sent it to me and it started itself". And, of course, send it to a few Government agencies (they're bound to download it) so they can all join in. Heh heh.
Put the blame on meme
Just by the stats of guns vs gun violence I would say a pretty small percentage. Especially if we are just talking handguns.
Finkployd
Actually, this sounds more like a "Download this hot pr0n movie now!" type of thing. In theory it's damn simple, take one small pr0n movie, add a player with a BO trojan, stick it on a server(s) or Usenet somewhere, and you're set.
Most people who are gonna download this thing are gonna be looking for porn, so they won't care if "it needs a special file player", they'll download it and run it so then can see the action.
At least, that's my theory.
Syllable : It's an Operating System
Just start scanning the rr.com domain
"Help me Obi-/.-Kenobi,your my only hope!" -$
Since I posted this, other people have posted explanations of how the file gets executed while appearing to be a movie. But you gotta love how Windows by default hides the actual extensions of your files...
You are in a maze of twisty little relative jumps, all alike.
What a load of crap. I pay my ISP for straight juice, no filtering, no caching, nothing but juice. If they started forcing me to use a filtered service, I'd be gone in a flash. Now, as an option - that might be nice for some users, but you can't just go around filtering ports at the ISP because they might be used by a trojan. All that'd do is make the authors use more common ports for their apps...
Think outside the... Hey, where'd the friggin' box go?
If we wanna be anal compulsive about this:
it's means "it is", its is the possesive. Its a shame that you can't use it right. In this case, it also is unclear, but I don't give a damn.
THE GROUP OF COMPUTERS combines into an unclear pronoun. Whatever that is.
And your last sentence is a fragment.
To hell with it though, cause I'm be a hick and I ain't here to speak english, and I'm be a tired of reading along and finding this crap.
We don't need no Net Explorer We don't need no Thought control
keep reading comments and you'll soon learn that its an .exe file made to look like a movie to the untrained I. e.g. pornmovie.mpg.exe
If you have a door that is insecure, this IS your fault. But what if someone goes in your appartment and turns on the gas at the stove to bomb the house? Is it your neighbours fault too?
Same thing is it with insecure OS. If you have security holes in your OS and someone installs a trojan to destroy your data or so, this IS your fault.
But let's say someone uses the security flaws of your OS to install a trojan that launches a DDoS-Attack against MY host, is it my fault too?
I doubt that.
--- If OS were buildings, then the first woodpecker to come around would erase 95 % of civilization.
"the Register story you referenced"
I didn't reference a Register story, I referenced a Linux Today story and the comments on it.
I accept your correction on the ASF script files.
I don't spread "rabid pro-Linux FUD". I simply reported on information I saw elsewhere.
I'm not entirely sure that tobacco is "freely chosen." The tobacco companies do their damnedest to get children addicted. I'm not confident that many of these kids are mentally/emotionally mature enough to make free choices about a lot of their actions.
Which isn't to say that it absolves them of the consequences of their actions. Not in the least.
But to say that it's "free choice" and dismissing the causative role of the tobacco companies in creating a situation in which children wish to smoke is disingenuous at best.
The tobacco companies manufacture a product that is harmfully addictive, and go out of their way to promote that product to populations that are poorly informed regarding the consequences of their peer- and self-worth influenced choices.
They should not be let off the hook by the casual statement of "hey, free choice, man!" any more than any other company that creates hazardous situations for their workers, the general public or their specific consumers.
--
--
Don't like it? Respond with words, not karma.
well... my linux distro didn't come with solataire, and rebooting is kina a pane....
I don't know, and chances are very few people know, but does the backdoor "phone home" to say it's ready and waiting?
:-)
Apparently it puts the IP address of the machine it's running on in an IRC channel somewhere, where i'm sure there's a bot gathering the info. Pretty smart way of avoiding being traced
--
OK, so it's a trojan that opens a port to listen for arbitrary instructions, and broadcasts the port it's listening on on an IRC channel. Does it authenticate the instructions it receives with public key crypto?
If not, what's to stop us listening on the channel as well, and connecting to each advertised IP address, sending instructions which deactivate the trojan? Raises interesting technical and ethical issues, but it seems to me like the ultimate in "white hat cracking"...
--
Xenu loves you!
Both of them.
The little guy just ain't getting it, is he?
I'm going to have to say that Symantec may be playing this thing down, but they certainly aren't providing a wealth of detail why. It looks to me like the typical "if we didn't find it first, then it must not be a real threat" attitude that most anti-virus vendors take.
The link to the advisory on www.netsec.net is here, has more technical info than the cnn article.
--- Boox
It was a huge project, took me around 8 hours to do, and was a huge pain in the ass. Subseven is a damn scary trojan, only has limited flooding abilities, but it can gather a lot of information and can redirect most anything. this would allow a cracker to gather personal information, bounce a web request off of it to use a stolen credit card, or ping flood some ip.
I hope to god they manage to catch these guys and that they don't pay much attention to the news.. heh.. i'm betting they are just using subseven to bounce off a client anyway, so their ip might be diguised. all I know is that 250 of these clients are no longer around because of me, and that makes me feel a little safer.
If anyone is involved in the clean up of these clients, please get in contact with me. I might be able to provide you with operational knowledge.
--
Gonzo Granzeau
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty
You can get things like that (ie: Netopia), but it's much cheaper for the provider to use a bridge instead of an intelligent routing device. I got a 3Com "No Customer Maintence" DSL bridge, but I use a BSD box for NAT and IPF.
Ah, sarcasm.
I like sarcasm. But raw text, devoid of subtle body language and foreknowledge of the author, has probability 1 of being misinterpreted. So if you care what people might say, one must be very careful with sarcasm on the internet.
The polite thing to do seems to be to add a smiley for the humor-disabled, so as to aid their faulty recognition. That, or use HTML like tags to indicate <SARCASM> and </SARCASM>. Except both of those seem to dumb down everything for the lowest common denominator, and generally ruin the joke.
More illustrations of the dangers of sarcasm can be found in this article.
Duhh! They're not even MPEGs. Problem is, there are so many dumb people out there mindlessly clicking on any old .exe file that flies into their mailboxes.
Pete C
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
I dunno, Solitaire can be pretty damn adictive. Why do you think Microsoft included it in Windows?...
Syllable : It's an Operating System
No, it's possible to embed an icon in a file, that's how windows displays icons for different exe's with the logo of said game or whatever. This is a common tactic for BO trojans.
"I'll be your huckleberry" - Doc Holliday - Tombstone
The problem, detected by a security firm that works for the Justice Department
NETSEC, founded by two alumni of the National Security Agency and Department of Defense, provides computer emergency services to the Justice Department.
This is simply nothing more than a soft form of the word Echelon
No but seriously. What we're seeing here is Department of Defense working closely with the Justice Department. While you and some other people might think something along the lines of "big deal", I'd like to conjure up a few memories of each of these department's history.
First of all, in the United States, the military is not to be used in the policing of Americans. Their resources are off limits to police agencies, and their personnel are prohibited from engaging in law enforcement activity outside the bounds of their property (ie Military Police on Military bases).
And for very good reason is this division. First of all, look at the Branch Davidian incident in Waco, Texas. This was a USDOJ/USDOD joint activity. We're just now beginning to realize to what extent the DoD was involved.
I honestly think this is the beginning of a new policy where America's military will continue a mission of American policing. That is unacceptable, as the consequences are staggering.
I mean, is it just me, or is Janet Reno REALLY going against what America has stood for in the past two hundred years?
Everyone says they knew it was coming, heres my tale of why i thought something was a foot.. About 2-3 weeks ago, a friend of mine sends me a file called "blahblah.exe" and says "I found this running in the background? No idea where I got it". Running strings on it yielded it was a combo irc client/program launcher. For example, it connected for a certain "large popular irc network" (yah.. that one). Once connected it checked if some other .exe(s) were available, then msg'd someone indicating one way or the other. i think it joined a channel and did some other nonsense once on irc. It also used an .ini file containing 25-30 lines of encrypted text. You couldnt even tell which irc server it was going to connect to. After nullrouting myself and running, it attempted to connect to that "big irc network" on multiple servers, thus shutting down its route outbound to modify itself is fairly tough because it isnt fixed on one point of download, its got quite a few. Of course none of my win32s virus scanners cared about this "blahblah.exe" file either. It attempts multiple ports for irc as well, so those that filter 6660-7 are still vulnerable. Antivirus companies routinely take credit for discovering virus even though it was reported to them by someone like ourselves, that is why i saw no need to assist them in pointing out this new creature. This is also why I did not list the actual .exe or .ini file names and have been rather vague about all this, let them earn their supper like the rest of us. To make a long story short.. "I had a feeling this would happen".
If the clip is repackaged as a .exe. Most Lusers have no clue about the difference between an .mpg, jpg, exe, doc, ...
I work with profs who still don't ken the difference after working with these file extension associations for the past decade.
:wq
Password: admin
Oh yeah? Well, the password for @Home's support mode on their netdiag tool is:
login: athome password: athome
Just create a shortcut to the tool with the entry "netdiag.exe mode=support" at the end of the directory address.
Have Fun!
Friends don't let friends use multiple inheritance.
Maybe somebody can help me with this. I have been hearing it a lot from the media, but can find no technical basis for this. How does having Cable or DSL make you more volnurable? I mean there is always users shareing their hard drives, but that is just the same on the modems.
... the article mentions 'special software' that needs to be used to make your Cable modem secure. I am wondering if somebody is going to paddle something like Cybersister or some other senserware that (now possible that will filter out napster as well) under this excuse.
... how cold they possible know the 'handles' of the the people who probed them ?! This is CNN trying to get better rateings. "Hackers gathering their armies" to strike when you sleep. UGH ...
And a little note of caution
And one more thing
My girlfriend and I watched a movie clip about a massive back orifice once. She denied me her services for a week and a half. which half? the top half.
grunties, leave your inner ear alone.
ow my eye.
I guess, then, the question would be - for an "average" gun, how many people is it used to injure (either on purpose or accidentally) during the course of its lifetime?
.1%.
Rounded to the nearest tenth of a percent?
Zero.
Even if you count military-owned weapons. Even if you just count handguns, or just count miltitary-appearing semi-automatic weapons, or pretty much whatever anybody feels like banning this week.
Hell, even if you just count handguns used by citizens in the actual prevention of an actual attempted crime, it is less than
America's supposed gun violence problem is a myth, manufactured by the media for the purpose of scaring people; because scared people watch the news.
Tobacco kills over 400,000 people a year. Guns kill about 35,000 Americans a year, and over 2/3 of those are drug traffickers killing each other.
And as for accidental gun deaths; there are about 200 per year. That's less than three times as many as caused by lightning, and it's been going DOWN steadily (as a percentage) for decades.
Hell, more people (302) die of falling down in the state of Colorado than die from gun accidents in the entire country!
There are something like 2,500 deaths by drowning in the US every year. If you want to save lives, outlaw swimming pools.
More people under 24 die in traffic accidents every year than the TOTAL of all ages who are killed by firearms, accidentally or on purpose. Make the legal driving age 24 and you'll save more lives than by outlawing guns, even if you could make all the guns disappear!
If you take out drug-related murders, guns are used to kill about 11,550 people a year, plus another 200 that die by accident.
11,750 people seems like a lot, but it's less than die from falling down in their homes! It's twice the number who die in workplace accidents, and we don't hear about an epidemic in that!
And when you factor that against the number of times guns are used to prevent a crime, whether you accept 500,000 or 2 million for that number, one starts to wonder where exactly the hysteria is coming from?
It's certainly not coming from the tens of thousands of women who protect themselves from rape each year with a handgun.
A media facing declining ratings made the whole thing up.
--
The Conspiracy Theorist inside me that hasn't had
his tea yet today says, "The Feds have implanted
a controlling computer virus in Symantec's software, which will then be distributed world-wide in the mad rush to update virus checkers by every vulnerable user in the world."
Must have tea. Mmmm. Tea.
Well, apparently, you only have to fool the majority of people for a little while.
If this is true, why aren't the files named "foo.exe" rather than "foo.mov.exe" so they look more like movies.
(I think I know the answer, which a lot of people are not going to like: the answer is that "icons" are bunk, the letters ".mov" despite their cryptic nature, are far more compelling than any image to even novice users)
But if anybody has any better answers please tell me.
Also, are they able to make the icon an exact copy of the .mov icon by changing the icon embedded in the .exe? I recommend that MSoft at least show a generic .exe icon if this is the case.
right, sure, we believe you!
Hmm ... so when they say that "drivers" of "cars" are affected by "gas" price hikes, are they sleighting drivers of diesel-powered cars? Please. Car means to most people a gas powered automobile just like computer means to most people to a desktop machine, which for most people runs Windows. Linux is still a third class operating system for most people. Quit your whining.
Government intervention is obviously the solution. You are so correct -- what were all we free-thinking privacy advocates thinking? It should have been clear to us all along that there's less potential for harm with government intervention & contl than with security-smart sysadmins doing their jobs the right way. Duh.
I am, therefore you think.
Okay. In reply to this and the earlier posting threatening to come after me with a hockey stick (re. NetBIOS comes back on with no provocation), I certainly agree with you all that Windows is a security problem, which is a big part of why I'm working my ass off to become familiar with Linux.
I don't expect Linux to be easy to learn; but I do have enough cross-platform experience to feel that at least installing it should be easier than it is.
There's no shortage of people who hate Microsoft and distrust their products. But there is a shortage of useable alternatives.
It doesn't matter that the world's greatest webserver is available for Linux if an average user can't get through the installation. Shit, an average user is very unlikely to even try to install Apache.
And let's face facts: high speed internet access appeals to us because we like computers, we play with them for fun, we administer networks at the office, we're in it because we like it. But most people just see it as a means to an end: they want the computer to hit ebay, to check out their e*trade portfolio.
These users want applications with which they're familiar, running on an operating system that is stable and easy to install.
Well, Windows isn't stable; just about anything beats it. Certainly the OS stability achieved through open-source development is incredibly impressive.
That's the difficult part, and it's done. So, why not be a part of the solution and work instead at improving the installation sequence and building more apps to ensure a bigger user base?
I hate to think this: I chose Red Hat 6.0 because it is, in my understanding, the best distribution for a new user. I researched it before I picked it up. It's got the best support, the best documentation, the best installer. And, while I lack the Linux/Unix skills that a lot of fellow Slashdotters have, I am a veteran assembly language programmer. That alone should be a testament to my comfort level with computers.
Installation should have been a breeze for me. For anyone who expects things to work out of the box, it would simply have been impossible.
If I only owned one machine, I would have formatted the drive, attempted to install Linux, then sworn off it with the hell I went through. While I like playing with computers, I also need them as tools, and if I didn't have the luxury of a spare (old) system, I would have been screwed. Sure, I could have repartitioned the drive and kept Windows up, but the LILO partition size bug would have still stopped me in my tracks. Expecting that new Linux users are going to try it out on old computers before migrating their main systems over, the support for older systems should be phenomenal. But it isn't.
The problem is that, because it's open source and written on a voluntary basis and peer-reviewed, it's easy for those programming to forget how difficult installation can be. One doesn't code for a sophisticated operating system without having a detailed knowledge of that operating system, and the focus is therefore distracted from what should be of prime interest to all involved: getting this thing to be more of an accepted replacement for Windows.
For all the bad things you can say about Microsoft, at least they actually get users (not programmers) to test the installation processes that their customers will have to endure after they stick that CD in the drive. Stick a Red Hat CD into an average user's hands, and watch what he goes through installing it. Take notes. Then start looking for solutions. Because you're not going to get alternatives to Windows out there unless they're installable.
So, instead of bitching about it, fix it. Take proactive steps to reduce the numbers of high-speed Internet users who are, out of necessity, continuing to run an operating system that puts the entire Internet at risk.
Or, sit back, do nothing, but don't blame me when it takes six months of diverting time away from my busy schedule to play with Linux before I can actually get the system to do something useful for me. And, be grateful that I'm trying to be a part of the solution.
Fire and Meat. Yummy.
The part about people jumping up a shooting a family member is right on the money.
One thing that bothers me is when people here stories about this kind of thing (however uncommon) they assume it is an indication of the dangers of guns, when it's simply a case of a misused tool by someone not trained properly. I can misuse plently of common household tools and kill someone accidently. That doesn't mean they are bad or that everyone misuses them.
Finkployd
1) Get modem and NIC manufacturers to modify the ports on their products so that they can eject a connecting wire under program control.
Oh yeah. With a feature like this, DoS never has been easier to do.
BTW: This exists already for some modems and is called "ath0ping". Some modems do not wait the obligatory second before and after the escape-code (+++) but return instantly to command-mode. So when you send the host a ICMP-Packet containing the string +++ATH0, it of course pongs this string. Due to this design-bug, the modem treats the string as a command and... (TADAA!) hangs up.
This bug is mostly found in el-cheapo modems. My USR Sportster is invulnerable however.
--- If OS were buildings, then the first woodpecker to come around would erase 95 % of civilization.
This is more corporate and government sponsored hysteria. This NETSEC company wants attention, so they issue a big press release at a time when all the major media outlets just eat up virus and DDOS stories. And the government wants to exploit this hysteria to pass stupid anti-encryption laws and gain broad wiretapping powers. Two great tastes that taste great together...
I dunno, maybe I'm too cynical but don't the names "Serbian" and "Badman" sound just a little corny? Almost like they were made up by someone who read a few glossy articles about the computer underground and then decided to write some FUD that would get people's dander up? Can anyone not involved in the promotion of this exciting story confirm that these guys really exist and that they're not more than a couple of kids being l33t on an irc channel?
It just seems so convenient...
Why do you call it a virus when it's obviously a trojan?
:-)
Answer: not everyone is 100% clued in about everything... yet we get along
I wonder what the news media would do with a really foul-named virus... Wouldn't you just love to hear Tom Brokaw reporting on the "**** You In The *** With A ******** and a ****" Virus? (Use your imagination!)
Or if something used language that was not particularly vulgar but had a bad connotation when put together. "The Angry Shaved Gerbil" Virus... Hee hee...
Random Musings at Rum Smuggler
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
In Canada the dangers of cigarette smoking have led to the legislation of very large and extremist 'warnings' covering roughly one-third of a cigarette package - perhaps what is required is a similar gov't-mandated warning on all shrinkwrap and clickwrap copies of M$ software: "Warning: Using this software makes you vulnerable to 17,000 different security holes, trojans, macro viruses, etc, etc. Use at your peril!"
Is for someone to do this, but instead of launching a DDoS attack, to set up people's firewalls to prevent this from happening again. Possibly the only good use of 0wning someone's box...
---
Jon E. Erikson
Jon Erikson, IT guru
win.com, you troll. =p~
It is pitch black. You are likely to be eaten by a grue.
I don't think a manufacturer of widgets that resulted in 1 out of 3 people being injured (or say, hypnotized against their will) would be allowed to be sell their products for very long. Exceptions include: tobacco, guns, software... Why?
Uhm, sorry; exceptions just include tobacco.
Guns and software don't injure 1 out of 3 of their customers.
Guns injure something like 1 out of 278,000 of their customers. For software, even Microsoft's crap, it's even lower.
Bicycles have a worse "injures their owner" percentage than guns.
--
They're referring to the specific file that the virus is trying to download, http://www.lomag.net/~ryan1918/MySissy.mpg.exe. That's the file that's no longer available. Sure, somebody probably has it mirrored somewhere, but the virus isn't programmed to download it from other locations.
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Don't let your elitism show quite so much. Most computer users probably fall into your "moron" class, and they really aren't "morons" if they don't know any better. Lots of people drive without knowing the fine details of their cars, and doing a good job of computer security requires a knowledge of computers at the same detailed level. What kind of computing education would you like to require?
In the case of having mostly relatively uneducated users, it's not unreasonable to ask why the infrastructure doesn't do a better job of preventing unwanted security exposure. No, I won't accept a MSBob view of computing either, but we should be able to develop an approach that gives us security without comprimising convenience. That includes not letting mail programs blindly execute programs that can directly modify the computing environment (both the mail program and the operating system are at fault here).
...phil
...phil
"For a list of the ways which technology has failed to improve our quality of life, press 3."
To prevent this DDoS from happening I think that everyone should start turning off their computers. Anyone that works at an ISP should go to the server room's and shut everything off. Not only will this stop *this* DDoS right in its tracks, it will save power.
shutdown -h now damnit
Geoff
What technical reasons do they have for feeling that its purpose is going to be a DDoS? If it's a BackOrifice type program it's probably just for some script kiddies enjoyment...
Refrag
I have a website. It's about Macs.
If their so sure that the movie file is a trojan horse, why didn't they name the file?
I find all of this somewhat hard to swallow, given the lack of details given. Does anyone know of another article with cold, hard facts?
Eric
The articles mention DSL and cable setups which is a good topic. I think you'll see a huge boom in the security software (BlackIce) and hardware (NETGEAR nad LinkSys NAT boxes) markets very soon, even larger than it is now. It just begs the question why aren't these companies doing this now? It wouldn't be hard to ship every cable/dsl modem with integrated NAT and have it enabled unless the customer specifically requested otherwise. It would be much more secure than just an open connection. People try to hit my cable modem ALL day long.
With the extensions turned off, you're forced to rely on the icon to tell you what the file is...
You are in a maze of twisty little relative jumps, all alike.
Why on earth do these sources always talk about 'computers' without being more specific ? As if computer == 'a PC running DOS'. I smell a rat here (even though I'm sure CNN doesn't run their web servers under Mega$lob software, be that operating system-wise or application-wise)
Imagine the following press release:
REUTERS -- Somewhere.
A major car company has decide to issue a callback on one of their models. Under certain conditions a particular safe-critical part of the car might fail. Although the total cost of the recall is purported to be high, officials at the company were confident that it would not influence their quarterly results, due at some point.
This is a trivial maneuver.
Make some neat looking cartoon like porno movie clip, distributed only in Windows executable format. When it executes, it sets up a DDoS client. You could easily have enough high bandwidth machines for a massive DDoS in a short period of time. It seems many Windows users do not even think about running untrusted binaries with their security model.
Your statistics sound like you pasted them from some NRA info pamphlet. I notice that you didn't include statistics of suicide-by-firearms, which by the statistics @ http://www.suicidology.org/suicide_statistics.htm, account for 43,240 deaths in 1997 alone.
I will grant that a big chunk of those people committing suicide by firearm would most likely have found another way of killing themselves if the firearm had not been available, however the fact that you did not include their deaths in your "statistics" makes your argument considerably less persuasive.
BTW, I'm hardly an activist either way - I regard widespread gun use as the result of a "prisoner's dilemma"-type situation: I think the world would be better off if NO ONE had the ability to kill each other easily, but the moment at least one entity gains that ability, then the other members of the society will have to figure out how to nullify that power, either by defense (try to get back to no one having ability to kill each other easily) or offense (mutual assured destruction), in order to prevent that 1st entity from dominating the society. Unfortunately, game theory indicates that trends will tend toward the MAD scenario - and if everyone else has a gun, I certainly don't want to be the only person w/o one.
I definitely know that I don't like BS, and your post smells of well-polished BS.
I don't think you have to be an 37337 HaX0R to know not to click on an infected file... It's like saying that people shouldn't know better then to have unprotected sex, and are 'victimized' by AIDS. There's plenty of education in the media now.
Maybe that's what we need! Public service announcements for AV programs, and 'scanning files'
Remember. When you use someone's floppy, you're sleeping with every computer they slept with.
-Dusty
So, has anyone explained exactly how an AVI is infecting people's machines? Assuming everyone is talking about windows, explorer uses the file's extention (.avi) to know to hand the file to some media player (which one wins the war is often unpredictable.) Check my spelling here, but avi's don't carry any executable code that a player would execute. Even if I renamed format.exe to foo.avi, clicking on it isn't going to run it.
Has the media just "got it wrong" again? Or is the system infected in some known permiscous way and then ends up with some virus/trojan lurking as a <randomly named>.avi?
Are they so anxious to protect M$ from negative publicity that they can't even give a list of what platforms are vulnerable to this new "threat"?!
I wasted almost 5 minutes tracking down the fact that only win machines are vulnerable. Even then it was not explicitly stated.
A. That's shoddy reporting (nothing new, for CNN), and B. It's an obvious way to avoid saying yet again "Only computers running M$ software are vulnerable to this Trojan." I wonder how much Gates & Co. paid to keep that out of print this time (CNN was a unix shop, last I heard, btw).
M$ is enabling these attacks. Hanging a Windoze box on a DSL line or cable modem should a misdemeanor, punishable my not less 6 months running MS-DOS 4.0 with no TCP/IP stack, and a fine of $1000.
Spin, spin, spin.
"The Internet is made of cats."
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Software: Like guns, can be used for good or evil. However, I doubt that 1 on in three suffer any kind of injury (including financial) from their OS.
But we do need immeadiate "government intervention into the Internet" right?
--8<--
NEWSFLASH!
MODERATORS RELOCATE STASH!
Today on slashdot.org, a popular web community, at least two moderators mistook a comment intended as jest as being informative. The comment suggested windows users search their hard drives for ????????.exe to find a "randomly named file". It was meant to be humorous, as such a search would turn up hundreds of files even in the most bare installations of microsoft windows. [Ed: Microsoft, MSFT, which creates microsoft windows, owns everything, including the original poster, this one, and the two moderators.] The moderators however thought it was "informative", likely since it has been years since they used any microsoft software and didn't know any better. A user known as "anonymous coward" argued that this was yet another reason to add the moderation "Safe, +1". Many others ranted about moderation in general. This happens because no one who uses slashdot likes slashdot.
Who's missing the sarcasm now? :)
--8<--
I wonder - aren't the computers used in DDoS attack usually 24/7 connected computers? Even more likely, aren't they usually some small, old and left-over university department servers -- like an ex-secondary mailserver or a callback dialup server and such - but all in all usually a server?
And how likely is a movie going to be played on that machine? It seems to me rather, that this trojan is directed at multimedia computers of porno-seeking perverts. This isn't likely the best platform for DDoS, I'd say...
Looks like it spread pretty much entirely over Usenet. Here's a report on QuickFlix.mpg.exe as it was identified as Spam. Looks like it is probably dead now. Deja News
http://download.cnet.com/downloads/0-10040-100-886 616.html?tag=st.dl.10040_106_16.ls t.td
"Professional Minesweeper is the BEST product ever. really."
Gonzo... please... say it ain't so!
:wq
Yeah.
How about, when you get a DSL link, they restrict inbound connects heavily by default.
Then, if you play a game like Quake 3 and want to host a game, you just call them up or go to a support page and get them to open up that port.
In my experience most users just want to be able to browse the web, ftp, chat on IRC and not much else. That only requires the ident port to be open.
Feh, its asking too much isnt it?
Whatcha got in your mouth Sissy?
- Earlmeyer the Butt Pirate.
Blar.
Since texts have a multiplicity of interpretations -- semiotics, the sign/signified stuff -- then I'd advocate a more rigorous reading method on the part of the reader rather than a more critical posting method on the part of the poster.
It's up to the reader to determine what is and what isn't sarcastic. The reader must make that determination. I mean, what if, for example I say [sarcasm]I'm six feet tall[/sarcasm].
What exactly does this mean? Does it mean I'm actually four feet tall? Does it mean I'm six feet tall and I'm tired of people saying I'm five foot nine inches?
What's the context?
Let's face, if you're reading slashdot non-critically -- if you are, for example, a 'literal' reader -- then you're gonna get fooled by the presence of the [SARCASM][/SARCASM] tags, as well as their absence.
So goddammit, just try a closer reading, okay?
Sure..
do a find for
???????.exe
and
????????.exe
Just three more hours seapeople and you can finally take me away from this crappy God Damned planet full of hippies
And also pretty common. Things like BackOrifice have been doing the irc thing for a while. The channels it broadcasts too are pretty busy with people going in to get details of open machines to play with!
---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"
The virus is being typically transported by some bots/people as: DIVX_3e.exe (Remember installing those drivers?) PSXCOPY.ZIP (bleh n64 r00lz) CDRWIN3.8f (cracked) If you've installed these lately , you're probably running the srvcp daemon (do a ctrl-alt-del task manager and look!) and you'll find srvcp.exe in /windows/system and gus.ini (gravis ultrasound rules! hehe) in /windows/system. remove the files. run regedit.exe and remove the service profile for srvcp (find srvcp, delete the entry for service_profile) reboot trojan is gone. The bot will download files to your system, connect to efnet irc servers and will attack others and you'll eventually get our ip banned for running drones. bleh. lamers. rigor-http://sam.bytebandits.com
need to find the irc servers and post the ips here, put them out of action quite nicely
~ppppppppö
No, this is just another example of why they should take the Microsoft marketing twits, who decided that file extensions were to hard to use, out back and euthanatize the lackwits to put them out of their misery. Ooops, too late.
:wq
Sweet Jesus! Thank god for script kiddies -- else, what would the media have to hype up this week? Elian's over with, Timofonica isn't spreading beyond Spain, and Clinton's kept his dick in his pants, as far as the public knows ... so what better than a brand new DDoS that may or may not exist, and may or may not demolish the commercial Internet as we know it?
I am, therefore you think.
They used the usual trick of nameing the .EXE somthing like foo.AVI.EXE, and made sure that the embedded icon colour matched that of the associated fake file type.
I dumped the file using 'strings', and it appeared to generate a fake error message regarding a missing codec, as well as a registry key to autorun a program at boot. I presume this trojan contained this code.
> Actually, Windows in a bid to look a little more like a Mac now actually HIDES the file extensions on a default setup.
Man. And I always thought mere hidden files were an insult to my intelligence.
--
Sheesh, evil *and* a jerk. -- Jade
Exactly!! Who is to say that this NETSEC found anything! Perhaps they're just reporting everything to make people feel safe; that there actually is someone watching out for them...
....Paul
They wouldn't need any proof. When nothing happens they just say, "Well, the purpetrators must have caught on to us and bailed. We'll get'em next time!"
Then again, perhaps they really have something and are afraid to tip they're hand too soon. They want to catch'em in the act.
F U NE X N M? Son: "Dad... How do you spell 'hourly'?" Dad: "0 * * * *"
A quick check of the Network Security Technologies website has a bit more info than the CNN article. Read their advisory here. Apparently, the Serbian Badman Trojan (as they're calling it) is using an IRC channel to report the compromised IP address, and then starts listening on a port -- this is why they think it could presumably be used for a DDoS attack.
---
---
"Go Metallica. Die RIAA." -- Linus Torvalds
I think the most likely use of the "zombie" machine is to pop it's CD-ROM tray out. I know that is what most people that use BO like to do with it.
Refrag
I have a website. It's about Macs.
We're finally reaching a point in technology where the line between techno-savvy administrator and computer end-user is being blurred - not in terms of their knowledge (that's wider than ever) - but in terms of what they are setting up and runnning.
With tools like MS internet connection sharing and cheap networking cable, clueless users are now capable of setting up (almost setting up?) ethernet networks from the comfort of their recliners. Of course, this added ability does nothing to impart new information to the users.
It is possible to set up secure MS networks (this is what I do...) but its not easy, especially when the default settings for so many things are open access to everyone. Unless MS changes the settings (not very likely from what I've seen) or someone comes up with an easy and well publicized way for users to set up at least moderate security, these things will only continue to grow.
Actually, one other thing that could help is for the ISP's to use short lease DNS and keep everyones IP address changing. That would at least make things a little more difficult for crackers.
I've helped check and set up connections for my friends and found that more than a few of them had permitted open file sharing with their computers when all they wanted to do was share a printer.
Oh, and for people who think this is just a MS problem so linux users don't have to worry, if they get enough computers, they can start attacking backbone segments. Then everyone gets shut out.
Of course I use Microsoft. Setting up a stable unix network is no challenge
According to the articles I read, the file almost always resides in the Windows directory and is approximately 370k in size. Finding this file using windows find is a trivial exercise. Just search for *.exe and limit the search to only files of 350k or more and that were created in the past, say, month. There are barely any .exe's which are installed in the windows directory which meet all of those criteria so if anything pops up you will know to be suspicious. ROTFL indeed...make sure you know what you are talking about...
... why you turn the friggin' filename extensions on under Windoze. If I saw something like foo.avi.exe, you'd be damned sure I wouldn't try running it.
--
These are *MY* opinions.
These are *MY* opinions.
They will not be *YOUR* opinions until the Orbital Mind Control Lasers are operati
some other guy managed to decipher some of SkinnyPuppy's lyrics a few page-ups up..
Hear, hear! I started ZoneAlarm recently. At first I was scared stiff - I was getting at least one intrusion attempts every 10 minutes. Now I'm just happy the script kiddies are going home hungry.
And I completely agree. But my anger would stay longer with the builder if he continued to do the same, or if he failed to warn other owners of houses he built, while the anger at the (non-burglar)intruder would go away once I learnt of the problem and moved or changed the locks. And then what would happen if the builder claimed that it wasn't his fault, because he took measures prevent illegal entry (under mat) and that the intruder should not do that anyways.
Basically, its my belief that if you leave your car door open and something gets stolen from inside, its really your own bloody fault, even if the law says otherwise. But if the car comes with car locks that look like they work, but can be opened by lifting the handle for five seconds, then the responsibility rests with the assholes who sold you the car.
Theft and illegal entry will happen[hell, what guy didn't try when he was 13/14?], but failing to prevent the obvious is just as bad a crime, if not worse.
Lemure, wtf! Don't you mean Lemur?
The FBI is just trying to get more funding ;-) You all know that every executive enforcement agency is jockeying to be "The" internet defense agency. This is yet another installment of "Look at me, the FBI, I was first on site." I'll bet you the so-called "hackers" Serbian and Badman are actually working for NETSEC in one of those SecureRooms (tm). Keep in mind, like the article says, NETSEC was created by the NSA and DoD. Conspiracy, I think not.
Bob
The funny thing about the BSoD is that it appears after the "its safe to switch off yer doze ridden junk" message!
"Immediate execution of mail attachments" has nothing to do with Win95/98. That is purely up to the mail program. For instance, I have NSMail set to truncate any message over 12K, which nicely makes it so that I get less spam and shit like this.
But I fail to understand the problem here. If the user is a moron and wants to run unsafe programs on their computer, why not let [him/her]? I don't want some sappy dialogue box popping up every time I run a new program warning me that it may have viruses, and I definately don't want Windows to prevent me from working in the name of convienience.
Education is necessary, not the dumbing down of the OS until its just MS Bob all over again.
Is it the breakup, or what? Don't come and cry to us if you suddenly can't access your compressed partition because you mistook drvspace.exe for a virus.
Say no to software patents.
Apparently you never saw the "Compaq would like to preset you with a free gift" program. It would pop out the CDROM drive and say "Here is your complementary cupholder".
Great. Somebody is getting set to collect massive amounts of information from a gazillion PCs and install remote-control software, letting them do essentially anything.
And the only threat that folks see is DDOS? Get real. Denial of service is about as exciting and useful as a traffic jam.
Some crackers with a bit of subtlety could clean up. Lets's see, we could:
I'm sure just about any /. poster could come up with enough "interesting" ideas to keep the nice people at the Justice Department awake for a long time.
Welcome to the Turing Tarpit, where everything is possible but nothing interesting is easy.
They hangout on the Newnet IRC network. They use the channel #Jaxn on irc.jaxn.com
:\
erghh must sleep
~ppppppppö
At least, I really really hope he was being sarcastic...
"Genius may have its limitations, but stupidity is not thus handicapped." --Elbert Hubbard (1856-1915)
Pah.
Honestly I don't know. I'd guess that the most efficient way to set up a dos attack on a wintel box is to use it to telnet to a decent platform and do the attack from there.
I don't know, and chances are very few people know, but does the backdoor "phone home" to say it's ready and waiting?
And don't underestimate solitaire. It's globally acknowledged as one of the most efficient productivity killers around.
Make a DOOM patch that lets you watch for excessive ICMP packets (in the form of those annoying yellow flying fireballs), and get your little brother in the server room 24/7! He'll have a ball!
the real at&t mix
It would seem that the wonderful (patented) file format MS ASF can contain script/executables of some kind. See this article in Linux Today.
Two step attack:
...you know, I wrote that in a (probably vain) attempt to be funny. But then I thought: you could actually do this. How about a virus that disabled Dialup Networking (yeah, yeah "it's called AOL 5.0")? Sure, they could just reinstall Windows, but maybe they'll learn something in the process.
1) Get modem and NIC manufacturers to modify the ports on their products so that they can eject a connecting wire under program control.
2) Write a virus that does one thing and one thing only: Triggers the wire eject on the NIC and/or modem.
This automatically removes virus-running morons from the 'net.
--
Wanna hook MAPI clients to your Tru64/AIX/Linux server?
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
Yeah, icons are embedded in the executable. So yes, you can make your program have an icon you damn well please. Plus with some simple tools, you can actually take icons from other sources - instant accurate MPEG movie icon, for fake MPEG movie.
You are in a maze of twisty little relative jumps, all alike.
doors that can be used against cyber terrorists, and we'll need to levy a tax on it to pay for this law enforcement.
How about having a security certification for operating system configurations and networked applications?
I don't think a manufacturer of widgets that resulted in 1 out of 3 people being injured (or say, hypnotized against their will) would be allowed to be sell their products for very long. Probably a government standard would prevent this? Or at least "flag" the product somehow to allow consumers to make an informed decision. Exceptions include: tobacco, guns, software... Why?
--8<--
Yah, the NETSEC guy, but the media is still clueless. It's not like they listened to that guy, they just reprinted his words.
I don't think a manufacturer of widgets that resulted in 1 out of 3 people being injured (or say, hypnotized against their will)...
...Exceptions include: tobacco, guns, software... Why?
Tobacco: It's not against their will. People freely choose to kill themselves with tobacco. If a critical mass of people decided to drink paint thinner, should it also be banned?
Guns: I'm not going into a whole gun argument. The reason for gun ownership have been presented before and if you don't believe in gun ownership then I'm not going to preach to you. However, remember that those who want to keep guns, have them. Those who want to ban guns don't. Who do you think is going to get their way?
Software: Like guns, can be used for good or evil. However, I doubt that 1 on in three suffer any kind of injury (including financial) from their OS.
Finkployd
Quite simple these guys want your money and they created a media hype to get it. No reason to flip. And now I am off.
Use Adsense for Charity
The next one won't set up any DDoS clients. It will just wait until Monday, and then send all your cow-orkers a message saying "I sat around and watched porno movies on my computer all weekend!"
Then, when the news reports that the new exploit does in fact send that message, and is in fact borne by a porno flick, everyone in your address book will know that it realy is true.
Heh heh heh. Maybe it will even count and report which scenes you replayed, and how many times.
--
Sheesh, evil *and* a jerk. -- Jade
: Lots of people drive without knowing the fine
: details of their cars, and doing a good job of
: computer security requires a knowledge of
: computers at the same detailed level. What kind
: of computing education would you like to
: require?
Still, most people wouldn't put sugar in their gas tank and expect the car to work perfectly, or just start sticking random modifications into their car. Its becase cars cost a lot of money and people don't want to ruin it and to have a proffessional fix it, but when it comes to computers a large amount of people feel that they know what they're doing when they don't (I feel this way because I worked for a year and half at a place that had public access to computers, and I was constantly resetting network settings and fixing computers that some "bright" user fiddled with).
Of course, the first Trinoo and TFN clients ran on what OS? The insecure consumer OS from Redmond ... or the free-beer hacker OS from Finland?
... their e-mail program? "Click there ... no, no, THERE, no, you just shut the program down." Don't fool yourself. Not everybody is cut out to be a computer security expert.
Just giving them Linux isn't going to solve the problem. You actually have to teach them how to implement security. Have you ever tried to teach your non-techie friends how to implement
----
lake effect weblog
{Network engineer in Chicago--looking for work!}
I notice that you didn't include statistics of suicide-by-firearms, which by the statistics @ http://www.suicidology.org/suicide_statistics.htm, account for 43,240 deaths in 1997 alone.
I discount that statistic for the simple reason that the CDC says there were only 30,535 total suicides that year, so how could 43,240 of them have been by firearm?
Also, statistics on places that have outlawed firearms shows that the effect is nearly zero; better than 99% of those who want to commit suicide will find a way, whether they have a gun or not.
But I see it as a freedom thing; if you want to commit suicide, who am I to say you aren't allowed to? And how is society worse off if you use a gun to do it than if you use pills or jump off a bridge?
Actually, society is probably better off if we don't have to fish you out of a river or repair the damage you cause to the bus when it hits you.
however the fact that you did not include their deaths in your "statistics" makes your argument considerably less persuasive.
Then what does the fact that the statistics you quote are nonsensical mean for your argument?
This is in fact typical of the anti-gun arguments; they quote easily-disproven numbers that are completely out of whack with reality, and conglomerate them into official-sounding foundations like Suicideology.org so that nobody will look too closely at where they come from. I got most of my numbers from the Centers for Disease Control and the National Safety Council. Some come from the Justice Department. Not only did I not go anywhere near the NRA's web page, but I'm not even a member. (Although I certainly appreciate the central role they've taken in reducing childhood gun accidents this century, and will undoubtedly join soon.)
All of the places I got my numbers from are run by an anti-gun Democrat Executive Branch, so if the numbers are off they're probably off in your favor, and they *STILL* support my argument.
My favorite tactic of the anti-gun folks is that whenever they quote numbers regarding children, they include everyone under 25!
And they count everybody killed in World War I, World War II, Korea, Vietnam, etc. in their "total American deaths by firearms" numbers. That one's priceless, because it means that even if civilians couldn't own firearms and criminals didn't own them, the numbers would hardly change.
And that brings us to the bottom line; gun laws only affect people who follow laws. Criminals by definition don't follow laws.
That's why *EVERY* state that has passed "shall-issue" concealed carry laws has seen an immediate drop in violent crime, greater than the national average drop. All of them.
Those statistics are from the Justice Department; check them out yourself.
--
Damn straight. At the time most email virii do their damage there are no virus definitions available to screen for them.
Icebox
IT IS A HOAX
The Register is reporting that this is a hoax.
Yes, the video is a trojan -- but it is a known trojan and is not a DDoS threat.
To summarize:
===========
"NETSEC alerted the Internet community about BackDoor-G2 by calling it 'Serbian Badman Trojan (TSB Trojan)'. News stories suggest that the controlling Trojan which is downloaded is a new threat -- it is not. Although the Trojan known as "Downloader" is new, the file downloaded is a known Trojan."
In other words, NETSEC's discovery amounts to nothing more than a publicity stunt by an opportunistic security firm in quest of free advertising in the form of media attention."
--
--
Don't like it? Respond with words, not karma.
As reported by The Register, here, there's nothing new about the video trojan. "We now know that the video Trojan, which NETSEC dubbed 'Serbian Badman' (ooohh, how scary that sounds), is actually known by the tragically prosaic name 'Downloader' (aka Backdoor.ldr; Downloader.Kit; Trojan.Win32.Loder.WPW; W95/Loader; and WWWPW).
It works by fetching, downloading and silently running another, and quite familiar, Trojan called 'Sub7', which consists of a remote server enabling a third party to control an infected computer.
We are terribly disappointed to report that the Sub7 server is not capable of launching DDoS attacks, unless it has been updated radically since the last time we, em, 'evaluated' it. "
This seems to have been a publicity stunt by a company called NETSEC.
Seth
$5 / month hosted VPS on linux = awesome!
someone was asking about the binaries for this. i got a trojan/virus the other day that does pretty much the same thing. connects to a remote irc server, joins a channel, and waits for commands from a remote user. all this without the users' knowledge. i tracked the trojan and found the person who gave it to me, then suckered him into talking to me and giving me a bunch of information about him and the trojan. full logs and a brief run through can be found at this page, including the trojan binary. be sure and read the irc logs where the 'culprit' states he uses it mostly for dos attacks. i got this about 2 days ago, before i'd heard anything on the news about this new so-far-unknown tool. -jg
Jesus built my race car. dang a dang dang....
------
www.chowda.net
------
YouTube & Google Video -> podcast http://castcluster.blogspot.com/
That would be humorous...engineer a virus to 'SECURE' the victims box correctly then delete itself with a polite comment :)
Yes, i think this one could be an answer! I faced several times the request from Media Player to download a codec. And naturally I blindclicked on the "yes" button...
Hmm, maybe if software giants like Microsoft were legally liable for the software products they sold, this wouldn't happen. What would happen to Masterlock if they sold locks that simply unlocked after one sharp tug, or all had the same combination? Their collective ass would end up in court, that's what. Thanks to the some of the recent laws passed in this country though, it looks like that might never happen to large companies selling crap software in the United States.
like in the ap article
NETSEC employees have since monitored an Internet chat room set up by the hackers as the vandals identified victimized computers, discussed strategies and boasted of their work.
``When he thinks all of those clients are sleeping, one of them is really active and watching them,'' Waskelis explained.
err so these h4x0rs can write vb trojans, get them onto 2000++ comps, but they don't understand the concept of lurking?? (2nd thoughts, maybe the client mentioned is meant to be the trojan)
love this though, from their site
Search the hard drive for a .exe file with a random seven to eight character name. The file typically installs itself in /Windows directory. , now that advice is better than the trojan (the next step is to :)) even if you ignore the number of exe files on most pcs and that win95 doesn't show all cap filenames by default (?)
anyway off to delete any 7/8 char exe files in my win dir to be on the safe side
oo just a thought, anyone here work developing firewalls/etc? want to contact them to get a copy of the file to study in order to block it
~ppppppppö
It's funny how news companies in the past have tended to blame UNIX and OSs modeled after it for DDoS attacks. Now we have one in the form of a windows executable. Correct me if I'm wrong but doesn't Linux have the ability to bring network connections up and down even though it is still physically attached to something (eg dsl or cable modem). I'm sure others do too I just haven't used them yet. Wouldn't that be the safest thing? If you're not using your connection why leave it active?
No need for virus scanners...just don't run things you don't know. What is it with people's strange need to double click on every single thing that appears in front of them?!!
This kind of stuff drives me nuts. You wouldn't talk to strangers but you will open up strange binaries from them? Ug...
-- soldack
Ok, so they say they noticed this virus because it caused unexpected network traffic.
That means that they actively go out and try to download software that might be infected, trying to find new viruses.
imagine the job specification:
"Candidates with at least 3 years experience in searching the 'net for pr0n are invited to apply to NETSEC as system infectors."
So there's this guy sitting in their office, probably dressed in a suit and tie, tongue lolling in his mouth, downloading one exe after another, hoping that this one won't be a virus so that he gets to watch some more porn.
You gotta grin.
Reminds me of the visual-recognition people a few years ago who were using pr0n as input -- it turns out that skin is such a uniform color, it's easy to discriminate. So they were sending their program -- funded by darpa no doubt -- into their collection to find matches for "woman, bent over".
It's all honest research. really.
Maybe they want to increase their ranking on Distributed.net.
Maybe it's an experiment that got out of control.
Maybe pigs will fly.
In the CNN interview
But if a stranger came into your house, looked through everything, touched several items, and left (after building a small, out of the way door to be sure he could easily enter again), would you consider that harmless?
So lets continue the analogie. What if the builder of your house left a spare key to your house under the mat without telling you, but has been known by people in the industry to this at every house he builds? Who would you be mad at? The person who got in without a challenge, or the person that gave him the opportunity.
Lemure, wtf! Don't you mean Lemur?
Hmmm... Doesn't Windows use icons in .exe files? (It's been a while since I was near a Windows box) If so, even looking at the icon is no guarantee that the file is actually what it claims to be.
It's more or less described here: http://www.netsec.net/advisory.html Roughly: an .exe file with avi icon and random name, about 373Ko.
Boy is that a novel idea. That is what everyone's talking about. Thanks for spelling it out so clearly. Now all we need is someone to implement your idea. Oh wait, that's right someone already did. Nevermind.
It's funny, every time I use sarcasm, there is always one person who takes it seriously.
:)
Maybe I should include some kind of disclaimer in the sig from now on
Finkployd
Good point. Though Windows has no security whatsoever, it'd be trivial for the cable companies and DSL providers to provide basic, network-level security for their users that could at least block most of these DDOS script kiddie tools from getting "go" signals.
Ultimately, the responsibility falls on the user, but given the cluelessness of most home (and many office) users, and the inherent vulnerability of Windows, the network providers really need to step up and fill this gap soon.
There's no reason why filtering couldn't be built into the cable modem (the same way many of them now block NetBIOS), and updated by central control at the head end to block new threats.
That said, given that it's cable companies doing this, the login for administration would probably be:
Login: admin
Password: admin
Scary, huh?
- -Josh Turiel
-- Josh Turiel
"2. Do not eat iPod Shuffle."
Be afraid.
" This sounds rather hoax'sih to me. "
maybe it is one of those mind Trojans. they prepare you for an attack, warn you of imminent doom, media alarms the world, there's hysteria, and then nothing happens. kinda like y2k.
It's intresting the first thing some one thinks the use of taking control of 2000 computers (a very small number i think) is DDoS attack. What ever happened to simply stealing credit card information or finding those nice cross linked networks that never should be linked in the first place. I mean the artical said something about trying out a network of taken computers presumably this is how they found 2000 infected pcs. but It could be more like 200000 pcs. and those just where note activated(this time). ok im done bableing
I label myself idiot - I summed the entries in the suicide-by-firearm table @ http://www.suicidology.org w/o checking to see if they covered overlapping categories (which they do). Proper summation yields 30,535 number you mentioned above.
This is, of course, still ~30.5k more deaths due to firearms than you listed in your original message, a statistical modification which you conveniently dismiss as "their choice". You show a severe lack of understanding (or sympathy) on how depression can suppress critical thinking abilities & cause irrational behavior.
I certainly hope that, if there is no way to remove ALL guns from a society, then all gun-owners are thoroughly indoctrinated in safety. Unfortunately, that still doesn't remove the source of MY basic worry - as long as someone else has a gun, I have to worry about whether or not they're going to decide to shoot me (note that I don't distinguish between individuals or the "authorities" here). If they don't have a gun, then I don't have to worry about them shooting me - even if they're insane or really pissed off at me. All your statistics don't mean squat to me if you can't address that basic fear.
Children die when they get shot - why only include statistics for adults?
I don't think this was an issue with the statistics we were attempting to use (once I got my number right).
Bullshit - if weapons were scarce, then even criminals wouldn't use them (since the criminals wouldn't have to worry about being shot, and since they would be damn expensive.) Since they aren't scarce (through the very diligent efforts of US arms manufacturers), to maintain a MAD (Mutual Assured Destruction)-type balance of power, suddenly EVERYONE needs to get a gun - and I no longer feel safe.
Ah yes, the infamous correlation==causality argument - which is, of course, a classic logical fallacy.
I doubt anything I can say is going to change your mind, and I don't think anyone is listening to us anymore, so I'm going to get back to work now.
Two issues: 1. Those who quibble about the particular type of trojan that we found have missed the point and display their ignorance of network security and hacking techniques. A trojan is a tool. It's no more dangerous than the person who uses it. In this case, a *variation* of a known trojan was being used by at least two "hackers" to attack third parties from a distributed base of hundreds of infected machines. Those hackers are now shut down, at least temporarily, due to the press and the threat of an FBI investigation. So, who cares what type of Trojan it is? 2. The naysayers here are the anti virus cartel who speculate without even bothering to gather fact (sorry to step on the toes of your little fraternity, guys.) This was proactive detection and prevention of an active attack before it caused major damage. What did companies like Network Associates and Semantic do to detect and prevent the last DDoS attacks BEFORE they caused millions in damage? The answer is: nothing. Thanks, Michael Allgeier mta@netsec.net
Like someone mentioned in the article about the new cell-phone problem, it seems like there's been a HUGE proliferation recently of different types of infections for computers. Perhaps it's the damned Y2K bug, just a little late...
Seriously, though, this all has to make one think about security. Unless one is broadcasting the news. Then, it tends to make one ask questions like, "What's slashdot?" and "How did you get your nickname?"
"I'm not even supposed to BE here today!"
If only people weren't so stupid as to download everything that someone sends to them...
"The further I get from the things that I care about, the less I care about how much further away I get." -Robert Smith
It's exactly like that! Now you're catching on!
I didn't say it was NICE, I just said it would WORK.
--
Wanna hook MAPI clients to your Tru64/AIX/Linux server?
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
Two issues: 1. Those who quibble about the particular type of trojan that we found have missed the point and display their ignorance of network security and hacking techniques. A trojan is a tool. It's no more dangerous than the person who uses it. In this case, a *variation* of a known trojan was being used by at least two "hackers" to attack third parties from a distributed base of hundreds/thousands of infected machines. Those hackers are now shut down, at least temporarily, due to the press and the threat of an FBI investigation. So, who cares what type of Trojan it is? 2. The naysayers here are the anti virus cartel who speculate without even bothering to gather fact (sorry to step on the toes of your little fraternity, guys.) This was proactive detection and prevention of an active attack before it caused major damage. What did companies like Network Associates and Semantic do to detect and prevent the last DDoS attacks BEFORE they caused millions in damage? The answer is: nothing. Thanks, Michael Allgeier mta@netsec.net
Yeah, but they didn't get everything right. The (software) engineers I know generally aren't very firm.
--
Fuck the system? Nah, you might catch something.
Is it considered a criminal act under current law to deliberatelym run this program on your computer?
I gots ta ding a ding dang my dang a long ling long
Um, the ones who vote? Unless you're planning a coup d'etat...
---
Zardoz has spoken!
Oper on the Nightstar
Looks like the DOS attack was just dragged in for publicity's sake: "Once opened, the file infiltrates the computer, turns it into a "zombie" machine controlled by hackers.
It can then be used to launch a denial-of-service assault."
Yes of course. But then, it can also be used to launch solitaire. Sounds pretty upsetting to me.
René
I agree.
And yet, oddly enough, my Linux box is on my home LAN, working as a client. My Proxy and Firewall, ironically, is running probably the second most insecure operating system on the planet: Windows 95.
Now, I'm no dummy. File and print sharing was turned off. There's nothing of value on the hard drives of this server, either. All the latest service patches and things are installed. Going to http://grc.com doesn't show up any big holes on my system.
But I want to run Linux as a proxy/firewall. Why? Well, because I like the security, I like the power, and I want the experience. And I'm working towards it.
Why am I not running it?
Well, I got a copy of Red Hat 6.0, and installed it onto that server. It's a 486DX2-66 with 24 megs of RAM, 600 megs hard disk space, an NEC Multisync 3 monochrome VGA monitor and a Vesa bus.
First, the installer started up, and tried to detect the mono monitor for me. All my text became the same color as the background, and I couldn't read a damned thing. So I had to upset my main system and drag my color monitor off it. Installation was able to continue.
I was asked how I wanted to set up my hard disk. I attempted to just click "okay" and be able to install default settings, but it didn't like it. Clicking on the help button told me how to install partitions, but didn't tell me the syntax for making a root partition, or how big they should be, or anything. Finally, just by playing around, I was able to get Disk Druid happy with my partitions.
Then, I was asked if I wanted to install PCMCIA services. Well, this thing has Vesa architecture, therefore it's a desktop, therefore it probably doesn't have PCMCIA slots. I chose not to install PCMCIA services.
So, it copied for a while, and got everything installed. I rebooted the computer at the end.
"LI". Stall. LILO had died. I stuck my rescue disk into the drive, restarted the computer, and was able to get running again. I later found out that LILO had died because any boot partition bigger than 1024 cylinders, with some system BIOS, makes LILO unhappy. Even if the bug wasn't fixed, it would have been nice if Disk Druid (the "easy"-to-use alternative to fdisk) had warned of this possibility.
So, I booted the system on floppy. The root filesystem was mounted onto my hard disk, and everything continued from there.
Oops. What's this? We're stalling on starting PCMCIA. But I told it not to install PCMCIA support.
In frustration at an install process even more buggy, inconsistant and difficult to use than even the worst Microsoft product, I shelved the Linux machine for a while. I'm back at it now, but even as an advanced user with some UNIX experience, and lots of Unix-like AmigaDOS experience, I really have not enjoyed my Linux experience yet. I keep plugging away because I want to like it, and I will like it, and I will become good at it.
But, before you bash Windows users for the irresponsible act of hooking a Windows machine up to the Internet, consider that the Linux alternative is only there for the most advanced and dedicated users.
About 70% of the time, a new computer user could install Windows 95 successfully, just following through the defaults and reading the prompts. The other 30% of the time some hardware would be detected wrong and the system wouldn't work.
I consider myself to be an advanced user. I've been on the Internet since 1988. I got my first computer when I was nine years old, so I've accumulated 17 years of computer experience now, on a large variety of platforms and operating systems. I can think inside and outside the box. And I'll maintain that Red Hat 6.0 was the single most difficult piece of software I've ever installed on any computer system.
I don't like Windows any more than you do. I'm pulling myself away from it more by the day. And I'm lucky, because it's within my skillset to get Linux running.
So, perhaps this is the issue that needs to be addressed, not just another rant about how evil Windows users are. Instead, can you not sit down and help re-write the installation routines?
You can bet money that as soon as I'm familiar enough with Linux, my first order of business will be to try to make the installer a little bit more useful.
Fire and Meat. Yummy.
This obviously is yet another example of taking advantage of that little check box that says "Hide MS-DOS file extension for types that are registered", which can be found on a windows explorer menu under View --> Options and clicking on the View tab. Once that is checked, the .exe extensions are "hidden" from the user and the only way they have of knowing what kind of file they see is by the icon they see, which can be changed to be whatever the originator of the file wants. Naturally, they see an icon typically associated with an AVI file and think "cool, a movie...I wonder what it is..." and click on it to watch without ever suspecting that it is in fact not a video clip, but an EXE file. Most windows users don't even know about that checkbox and that it's usually checked for them by default. They just assume that the icon is true and run with it. Oh well...
Did anyone go looking for the movies and find them?
or is it more fud?
I know I've wasted countless hours watching forwarded e-mails. Does this count as a DoS? And if is send it to all my techie buddies am I causing a DDoS?
Look out Superfriends-"Wassup"-Guy! The DOJ will be coming after YOU!
Just wait till some crappy band steals your nic.
I guess, then, the question would be - for an "average" gun, how many people is it used to injure (either on purpose or accidentally) during the course of its lifetime?
I think that CNN needs to lay off the sensationalism and provide more relevant facts. This sounds a little odd IMHO, as media streams are not technically executable binaries, but are instead associated with executables. Unless M$ started putting activeX garbage into mediaplayer, I don't see how that's doable. Sounds like either CNN or this would be security firm is trumpeting themselves a bit much, and I'm sure we'll hear about day - saving when the attacks never come. Geez what weenies.
Imagination is the silver lining of Intelligence.
Congratulations!!!! You're the first weaner to hit the 'write predictable comment about how fantastic Linux is but no-one give a toss because it's off topic' button. You sad, sad individual.
"It's expensive, stupid, last only seconds - but makes your mouth hurt for days - it's BEE IN A BALLOON" - Kibo 3/1/95
The service providers really need to take some responsibility for these types of situations. The average user doesn't grok the concept that if they hook their computer directly up to a cable modem or DSL connection that they are inviting their computers to be messed with. There are ways to deal with this problem relatively inexpensively, but if people don't understand that there is a problem why would they look for a solution.
I have a nice little cable router that does I.P. packet filtering and also doubles as a 4 port switch. It is made by Linksys and costs about $180. Hawking makes one that is just a router that costs in the $150 range. If the cable companies just told people they needed the hardware up front, people would buy or rent it and not complain...and be safer for it.
Obviously we don't need government interference (especially not tracking everyone's moves across the net). If government is the solution to problems like this why didn't the FBI find it? Fact is, they didn't. It was found by a private company who informed the DOJ. Lets get real here, do you really trust your leaders and bureaucrats enough to let the know your every move on the net. "Hmmm... BadERA is pr0n surfing, how can we use this?" "The conventional view serves to protect us from the painful job of thinking." -John Kenneth Galbraith
sig this
Or, *gasp* they could run Linux.
Running linux is no guarantee against stupidity. There are a LOT of unsecured linux (and *nix in general) boxes around.
(from these reporters) The article comments that most home computers are vulnerable to these exploits because "most home users have fixed Internet addresses that are easily identified." Woah. am I using the wrong ISP? I've sure like to get one of them fixed IP addresses myself.
You could just as well been meaning it. It's a most valid argument and solution to the problem. IF you have no problem with trampling peoples privacy and general rights.
- Steeltoe
http://www.debunkingskeptics.com/
Home users are especially susceptible because they do not have up-to-date antivirus software
That's the same kind of BS Micro$oft has been spewing about the ILOVEYOU virus. It doesn't matter at all if the antivirus software is up to date, although that is a great idea, it doesn't protect against any of the newest worms, virii or trojans. That's the problem with all the major companies, they feel like instead of taking the blame for stuff like this, they have to blame it on the user for "not having virus software up to date". What they need to do is find the security hole and patch it, not blame the clueless user.
You should recommend to anyone (particularly not geeks) you hear is getting a DSL/Cable or any "always on" connection to go to www.zonelabs.com and get ZoneAlarm. It's free (beer) and it's really easy to use and it will alert you anytime any program tries to get out to the internet (in very easy to understand terms: "Program XXX is trying to contact the internet, do you want to let it?" -- along with a check box not to be bugged by that program again. Plus it does the blocking job of incoming probes too. Not and industrial strength firewall, but fine for home use. Plus, the new version has a nice "mailsafe" feature for vbscript trojans.
---
DO NOT DISTURB THE SE
I'm sorry to interject this into this thread, and I am sure I will be moderated down as offtopic (hey, because I am) but I couldn't let this statement pass without comment. Those who want to keep guns do not always have them (Have you been to New York City lately? You're more likely to make the US Olympic Team than qualify for a handgun permit) and those who want to ban them sometimes do. At one point in time, Dianne Feinstein had the ONLY legal concealed carry permit in the city of San Francisco, because she "felt a need to protect" herself, while consistantly promoting an anti-rights agenda.
Rosie O'Donnel, who spoke at the hundred thousand woman march, a woman who really has NO cause to fear crime (last time she did, she sold her house and moved to a nicer house in a better neighborhood) has a bodyguard who has applied for a carry permit in Greenwhich, CT. Rosie, who once declared "Only police and the military should be allowed to have guns. If you own a gun, you should go to jail" is now in the position of being protected by an armed guard, and her stance is now, "If you're licensed, and registered, I have no problem with it."
The problem with these people is they are so full of bullshit that it's amazing you cant smell them from a thousand yards away. There are countless "gun control - we need to save the children" types like those I posted above, and what it comes down to in the end is that they want to control PEOPLE, and the easiest way to do that is to take away their means of self-defense.
You can call it an extremist stance if you want. I'm an NRA member, and a TFA member, after believing for years that groups like this were over the top, but look at the legal climate of the last few years. It's always called a "compromise" when someone proposes "sensible gun laws" and yet we never seem to get anything out of these compromises. Thats why alot of gun owners take an uncompromising stance, and end up getting labelled as nuts because of it.
It's enough to make you sick. And you know what? From time to time, it really does.
What part of "shall not be infringed" is so hard to understand?
As for being a "defensive MS supporter" I don't feel as though that really describes me. I am not a linux/BSD zealot which maybe means you mistook me for an MS booster. I just wonder why you feel the need to put "espcially on windows" on your apparently mis-informed post claiming it was not possible to search for something random...if that makes me a defensive MS supporter then so be it I guess I am guilty as charged.
Bullshit - if weapons were scarce, then even criminals wouldn't use them (since the criminals wouldn't have to worry about being shot, and since they would be damn expensive.)
Then why is gun crime increasing in the UK, and decreasing in the US?
--
Haven't we learned anything?
This kind of problem is bound to become more and more common place as DSL and cable (or more generaly speaking, permanent and high speed connections) get democratized.
I live in France and I am of of the first thousands of users who have had DSL and my linux firewall has been attacked several times by script kiddies, but the strong seetup hasnt allowed anyone in.
I remember of a internet cable provider setting up it's own firewall to protect its customers from nuke and stuff like that (and prevent them from sending any too) so that they don't have problems with their 24/7 connection.
I guess the only solution would be that everyhome had its linux / freebsd box to act as a router, proxy (protecting kids from porn), and anti hack system.
Hope everyone could be as lucky as I am...
D.
"The obvious mathematical breakthrough would be development of an easy way to factor large prime numbers." Bill Gates,
Where's the beef? This sounds rather hoax'sih to me. I would beleive that this could be done, but for all the press on radio and tv, someone would have come out with a real filename, or more information on what to look for if this was real. I have my doubts.
This should be a wake up call for government intervention into the Internet. It's no longer a place of students and computer enthusiasts, it's a place of business. It needs protected from hackers, and there needs to be accountability. It's time to implemant changes so that people can be traced and logged, encryption all has back doors that can be used against cyber terrorists, and we'll need to levy a tax on it to pay for this law enforcement.
Or perhaps that is the point to this story.
Finkployd
Can you believe they know of infected computers and will only tell the commercial concerns? What about the individual citizens? Excuse me! Why warn the commercials and not Joe SixPack?
The information carried by the icon is prominent respect to the one carried by the extension, so many user whould probably believe that a .exe file is an image or a movie, if it looks like one.
Ciao
----
FB
Anybody know how to search for something random? Especially on Windows... ROTFL!
Say no to software patents.
How's that for off topic!
:wq
For those of you running Windows9x, you'll find that ZoneAlarm is a good firewall. Access Zone Labs here.
.vbs worms, it claims. That, I'm not so sure about. But it does appear to be effective against a number of attacks, holes, etcetera.
Also protects against
Absolutely essential for anyone with a 24/7 connect.
--
--
Don't like it? Respond with words, not karma.
The virus keeps a counter. It kills DUN after 10 (or 100 or 500) more connections (reboots, etc). Or it mails itself, Melissa-style, to the addressbook and then kills DUN.
--
Wanna hook MAPI clients to your Tru64/AIX/Linux server?
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
Question to those people who know this sort of thing...
does Video 4 Windows allow you to embed Codec download information into your video clip?
If it does, that may explain how a video clip (or any other streaming media requiring a codec) may be used as a virus transmission vector.
Just a thought......
This particular one is a .MPG.exe. Now, as everyone knows, you don't care about anything except the three characters after the last dot (a carryover of the old DOS 8.3 format, except now it's 255.3.)
Anyways, I know, and have seen, ASF's that can, toward the end of the page, redirect you to a webpage, usually the maker of the movie. However, you can make a quick 1 second, 5 second, whatever length you want, ASF, and have it redirect to a page that contains an ActiveX script, or Javascript. If you have those enabled on your browser, boom, instant run, and you don't even know about it!
I don't see what everyone is so worked up about. We already know you can't run DrDos with Windows.
--
Wanna hook MAPI clients to your Tru64/AIX/Linux server?
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
They're finally getting their terminology right
Pete C
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
This story's seriously lacking in technical merit as mentioned in the blurb. This is missing such important details as the platforms that can be effected (Windows? Mac?) to HOW a movie clip can contain a trojan horse.
You are in a maze of twisty little relative jumps, all alike.
This trojan horse attempts to download a program file from the Internet and execute it. The intended program file is no longer available on the Internet, thus it currently poses no threat to users.
This, in the context of the cnn report, I find to be a little bit creepy. And how the fsck do they know that the file is no longer available on the Internet? And then they go on,
This trojan horse was originally posted to an adult Internet newsgroup on June 7, 2000. It was described as an adult movie file. However, it actually attempts to download the file http://www.lomag.net/~ryan1918/MySissy.mpg.exe from the Internet and launch it after it has been downloaded. It performs no other actions. The program file no longer exists at this Internet address, thus this trojan horse essentially does nothing and poses no threat to users.
:wq