Slashdot Mirror
Building The Ubervirus
Johnath writes: "The HNN has a rather eye-opening article about a potential disaster dangling overhead. It's not so much that the ideas presented are revolutionary -- most /. readers would probably come up with a similar scheme, if called upon to design a killer net virus, but nevertheless, it pretty lucidly addresses the potential damage."
That is to say, this is the second time this article has been posted to slashdot. /me is too lazy to find a link to the first time it was posted. Search is your friend.
-russ
Don't piss off The Angry Economist
For the benefit of those trapped behind the berlin firewall (filter), could somebody mirror or paste the article contents here?
Large corporate filters don't like us to visit seedy places like HNN.
Mucho Thanks
They were slashdotted by the slashdot effect!
hlag
this exists already. It's called the dumb PR/HR employee, more interested in loveletters from strangers than in network security.
Sadly they are also the type most likely to grow exponentially as the internet becomes even more KEWL.
we're doomed *sigh*
Da Warez D00d
Basically all these people have done is make a list of the parts of trojans, virii, hacks, that work the best and list some thoughts and figures on what they could do if someone actually spent some time to do a good distribution of a virus using IRC, FTP and user ignorance and then exploit the user ignorance factor to get it to spread like wild fire. It was a good read but not really news, I agree with the post, most any /. reader could come up with the same if they spent a couple minutes thinking about it.
I've read this article at HNN at least half a year ago, maybe more. It's clearly interesting, but is this news?
Kaa
Kaa
Kaa's Law: In any sufficiently large group of people most are idiots.
in a networked invironment, diversity = more applicable exploits. simple as that.
Stop the brainwash
in one of the recent phrack releases, an ubervirus with AI capabilities has been discussed, but the phrack website seems to be down at the moment. check it out, it was quite frightening stuff...
Ok, people are doing some fine things with Outlook and other tools nowdays in the virus world but I think where they fall down is in the social engineering area :) I don't know whether this is technically feasible and I have no desire to find out (I take no responsibility etc....)
Let's say the point of the virus is not to physically disrupt the mail system, but to mentally disrupt it. People should be afraid to open mail messages, and disbelieve the ones they do open, rather than have the mail server crash.
So, step one is to send out the messages gradually so that people don't realise immediately that something is wrong. You don't want to make people wary at the begining. After some interval when you've infected enough machines, then go for the full virus crash.
Step two is to vary the subject. One way would be by making the subject be Re: of something already in the mailbox from the person you are sending the current message to. Make all others that you can't find messages to reply to start with Fwd:.
Step three is to look in the mailbox to see if you can find an administrator of some sort. Look for system administrator or something similar in the title, or look for membership of the admin group or similar. If you manage to get on an administrator's machine then send out a virus alert message to everyone in the address book. Include in the alert a copy of the virus with instructions to double click to disinfect the machine. If you are not on an administrator's machine then send to one or two people in the address book a message that says in the subject Fwd: Virus loose (from admin name here) to see if you can fool people that way.
Anyway don't try any of the above because they probably don't work, and I certainly don't want to be responsible if it does. I'd guess this is the sort of stuff that a professional/governmental virus would try to do. If you were China (for example) and wanted to disrupt email in the US (why I don't know) social engineering to produce a lack of trust in the system is more likely to be successful and effective than the sort of spam attacks we've been seeing lately.
development.lombardi.com
Don't worry! As soon as the virus/worm starts to spread we'll all be inundated with "DON'T OPEN [MELISSA/STACY/LISA/BELINDA] IT WILL ERASE YOUR COMPUTER!!!1!!" emails, which will spread faster than the worm itslf.
--
Have fun: Join D.N.A. (National Dyslexics Association)
I'm getting no response from the server.
That was fast.
loev,
Axel
mhm23x3, alt.fan.karl-malden.nose
Instantaneously slashdotted. Now get back to work already so I can read it.
Eloi are stupid, throw morlocks at them!
Is any research being done to compare computer virus/security hole propagation patterns? I'm sure the CDC (that's "center for disease control", not "cult of the dead cow") would have a lot of useful input on this "ubervirus" problem.
I'm not an expert so I'm not going to try to defend the following statement, I'm just going to make it. I recently finished "Chaos" by James Gleick. He mentioned that one of the places you can find chaotic behavior was in the spread of an epidemic. In fact, efforts to step up vaccination (and other disease prevention techniques) actually caused an increase in the rate of infection (sometimes and short- to mid-term). Apparently this has something to do with perturbing an oscillating phenomena.
I bring this up as a warning to those who think we should all immediately rush out and start locking things down. We might make it worse if we do. I know this statement sounds ridiculous--I'm just saying that maybe we should slow down and think before rushing off to act. Do the research, ask the questions.
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
Can someone mirror this website please
Brunner describes a similar scheme in Shockwave Rider, way back in 1975.
Nick Halflinger (an uberhacker who can cracka system using a touchtone phone) travels the world coding a giant worm designed to be launched as a simultaneous, distributed attack from hundreds of different computers, quaintly visiting each site in person.
Portions of the head of the worm are used for replication, other parts are used to detect and deter anti-virus attempts, the middle part breaks into secret archives, and the tale is the contents of the secret archives.
I can't recommend this book highly enough.
George
Most (computer) viruses today are created with malicious intent. When you are infected, you know it. I was thinking the other day that if a virus were to arise "organically", i.e. not designed (or alternatively, mutated from a designed virus), that its best chance at survival is the exact opposite of what most viruses do. The best strategy would be to lie low, staying as much out of sight as possible, and continue reproducing when possible. Has a virus like this been seen? If so, then I wonder how many more have not been seen?
Yo dawg, I heard you like the Ackermann function, so OH GOD OH GOD OH GOD
Oh, sure, it seems all-powerful, but doesn't it still suffer from the same problems that plauge other worms? Namely, you have to a) be running an insecure system or b) be a sucker.
I'd like to think that most people don't use the dummy settings of Outlook (or even use it at all), and that they scan files they download for viruses, and that they don't blindly accept (or auto-accept) DCC sends.
Of course, I also think the succeptible masses don't really use IRC anyway. Now, if the virus could infiltrate various Instant Messenger networks...
I guess it would be nice to think that worm viruses shouldn't work, but as we all know, this is not the case. So, I'll just sit here with my Mac, running Eudora, and wait for this new worm to come out, as it inevitably will, and not affect me.
A killer net virus that would destroy the Net as we know it has been very easily in reach once the majority of computers on the Internet became homogenized Windows//MSFT Office//Outlook boxes.
.doc , .xls, .sys, .bat, .dll, .html and .jar to 0, I am sure corporations would probably be fuming about Trillions of dollars in irreparable damages (after all how much stuff is actually backed up or centrally stored in a Windows world).
Whenever I read about a Mellissa or an I Love You I smile to myself and think "I would have trashed their hard drives after spamming myself to all their friends.". If Mellissa or I Love You hadn't been content with simply bogging down net servers and had decided to set the file length of all
In my opinion the article is overkill, a virus doesn't have to be particularly clever or well designed to cause havok anymore thanks to the beauty of MSFT operating systems. Any script kiddie or MSCE with a passable knowledge of Virus Building Script can bring it all toppling down.
Off course, none of us will ever do it because we know it would do so much damage to the 'Net (government would step in hard) and also hurt many of us financially in some indirect way.
WHY C SUCKS
-----------
int i =0;
i = i + 1;
It's a nice scaremongering document, but the hypothetical worm is a *worm*. We've already been bitten by vbs and StagesA, so the potential for a virus that self-replicates is, IMHO, diminished.
As for having web-servers which relay instructions/recieve data, the 'bot would have to know how to fill out registration forms/upload information, and even then the server would have to have some kind of handshake with the worm, which could be detected by the hosts of the web-site.(i.e. geocities)
Why not have the server host misc. content, with the instuctions embedded in the HTML?
In any case, is it a good thing to have people publishing design documents for killer virii? The script kiddies which came up with ILOVEYOU weren't smart enough to design something really nasty, and HNN are just providing inspiration, which means they'd be liable in the event such a worm was released.
But so what? If a supervirus strikes, it will only affect single workstations ("Oh my. Something must be wrong with my Win98...") and shouldn't cripple any of the critical components of the net.
Now look at the state of the virus world - ILOVEYOU.vbs (OK, it's a trojan, but still replicates like a virus) and the damage it caused. I'm not talking about the x billion the media claim it cost, just the panic in my IT department when virused email couldn't be deleted fast enough. Look at the code for ILOVEYOU.vbs - it is a doddle. No real inspiration involved - just patch 4 entries out off bugtraq together, and there you go.
What we have now is a state of play where the entry level in writing malicious code is dropping rapidly as more and more people get into computers. Don't want to spend a few years learning to code? Hah, our whizbang COMActiveXCORBA plugin gives you the power on your desktop!!!
Don't worry that your soft underbelly is now exposed because we can't give you the ease of use you want, without you knowing what you're doing!!! And you're too stupid to realise!!!
So now that the learning curve has been removed, you will have people all over the net trying to write and run viruses, without a clue of the repercussions it may cause. Because they don't really understand what they are doing.
Strong data typing is for those with weak minds.
Strong data typing is for those with weak minds.
Site appears to have baulked. I got as far as page 3, and then drew a blank. Give them air!
well, i read the first page before the server evidently got /.ed.. sounds like nothing new to me. ILOVEYOU cost, what, "billions of dollars?"
people need to quit blindly trusting their computers and the benevolance of other internet users. it's like driving.. you don't have to know how your car works under the hood, but you MUST know how to operate it.
Computers are the same way. You don't have to know what goes on inside the box, or how the kernel works, but you have to know how to operate your computer, and part of computer operation is security.
having a computer is a responsibility just like having a car. if you use your computer carelessly, and by doing so your system gets compromised and used to attack other systems, are YOU not responsible for that? Just as if you failed to pay attention at the wheel and killed someone with your car?
Ignorance is not an excuse for carelessness.
wish
---
What I fail to see is how this could be an eye-opener. Within the /. and HNN communities the facts presented in the article should be obvious. Disaster almost happened at least twice already (remember melissa? loveletter?), and the only reason things didn't turn out worse was because of either some kind of empathy and/or bad coding on the virus-programmers' side. Heck, most of us could modify loveletter's code in 5 minutes to make it 10 times more deadly to those windows boxen.
I know people are going to yell "What disaster? These viruses affects only Micros~1!" but face it, that's where the majority of the money invested in information are.
I _do_ think that should a larger newsprovider, like cnn, post these facts, albeit 'dumbed down', we would see a genuine eye-opening of the general public, PHB's included.
That would be something!
Oh - it would be better if the virus could cope with as many different platforms as possible.
An ideal method for 'mass distribution' would be a crack to put it in a MS Website upgrade patch, then release a mini-virus targetting against MS system to 'encourage' people to download the infected patch file. Obviously, you'll probably need someone inside Microsoft, but...
Richy C.
--
The uber virus already exists!!! Here's how to do it, in one quick easy step:
1) Post an article on Slashdot reffering to a particular web site
Now sit back and watch the fun! The Slashdot Virus is guaranteed to take down ANY website within seconds!!!
Microsoft is the primary cause for the proliferation of viruses in the past few years. Scripting ability is a nice feature in software, but should it be defaulted to be active upon installation of the software? A vast majority of users don't need scripting in spreadsheets and word processors.
But with all of the holes in older software (sendmail, etc), it seems that the problem is getting worse, not better.
So, where does the problem lie? Programmers not willing to look back over their own code and eliminate such holes? Corporations that are pushing for release, regardless of the security issues (hmmm, could it be... M$!!!)? Users that blindly open attachments without looking to see what they are opening?
No boom today. Boom tomorrow. There's always a boom tomorrow. - Cmdr. Susan Ivanova
Consider using other operating systems, like Line or BSD.
Is this a case of a unenlighten spell checker, or is Line an operating system I've never heard of?
---
I know of a virus which would be much worse than any of the current crop of viruses: Make one that randomly changes bits in a database. Just think about it for alittle bit...
The network is always going to be vulnerable to some sort of attack -- be it DDS, electro-magnetic pulse, SYN Flood, email virus, spam or whatever. Some well placed, unexpected volume will even do the trick.
Let's think outside the M$ box for a minute and consider what a 'virus' could do to routers and switches. Everything that carries configurable software is vulnerable to some sort of attack!.
--
Wooden armaments to battle your imaginary foes!
By suing Microsoft, etc. for having such crappy software and security. Of course, that may be a cure worse than the disease.... Question: is the court system really like a computer that runs on people and paper? And are bogus lawsuits its version of a virus?
InstaPundit! Ahead of the Curve Since 30 Minutes Ago
diversity also = smaller chance of finding a particular exploit, thus restricting (and in some cases stopping) the transmission of a particular virus that can only use a limited set of exploits.
As a corrorlary to this, given sufficient diversity, it becomes impractical for a particular virus to carry the code necessary to infect all of the availible machines.
Putting all your eggs in one basket is never a good idea. You might be a smaller target, but if you do get hit (and it's foolish to think you're invulnerable), you're automatically 100% dead.
Among other things, this is borne out by quite a few thousand years of agricultural experience.
You'd be hard-pressed to find any farmers or biologists who would argue that monoculture is the best way to limit your vulnerablity to crop diseases, just because there are fewer possible diseases that could infect your crops.
DNA just wants to be free...
1st, 2nd, 3rd and 4th page, cached by Google.
Let's see, the /.'ed article talks about a worm/virus that coordinates it's attacks through several web sites, and becomes unstoppable.
I describe a book, in 1975, that had a very similar subject.
This is offtopic?
I could care less about the kharma loss, I have tons, but really, is watching Barney and having the intellect of a 2 year old a pre-requesite to be a moderator now?
Let me try to shamelessly get my kharma back now.
Killer virus possible becuase of too many Windows.
Use Linux to stop this.
Linux good, Windows bad.
George
Why does a virus get more attention here in the USA than the AIDS epidemic in Africa? Proximity. We here in the /. community are so close to the issue of viruses and virus-fighting that it is taking over our lives. If you take a step back from the monitor (remember in "Fight Club": you are not your job)you will see that non-MIS people saw Melissa, and other viral attacks on businesses, as a half-day off work and nothing more. Like most other problems in the USA it is going to take an epidemic to get the common man's attention. We are still living under the mid-20th Century pretense that the US is indestructable. Until a virus comes along that will wipe everything in its path and reach home computers (like an AOL instant message script) we are the only ones who are going to sit up and take notice. dbthomas
"These are the days that must happen to you." -Walt Whitman
"Is it possible to build software that is 100% resistant to computer viruses? Can software be coded with no possible pathways for a virus to spread?"
Good question. To answer it, we'd need a rigorous definition of "virus", but let's take a whack without this: "An entity is a virus if it can induce a program to reproduce it."
First, trivially, yes it is possible. Here's a program that does not spread viruses:
void main(void){}
So we the real question is "can any interesting programs be made virus-free?" And what is interesting? Well, minimally, it needs to accept input and produce output. The input to a program (actually, to a function) is called the "domain". The output is called the "range". If there is no overlap between domain and range (say, you input an integer and it outputs a color) then you clearly cannot induce the program to reproduce the input in the output. But that doesn't put us in the clear. A pair of programs that complement each other such that the range of A overlaps the domain of B (and vice versa) could be induced to reproduce the virus.
Note that domain/range overlap doesn't guarantee there exists a virus that can exploit the program. It is a necessary but no sufficient condition.
--
Linux MAPI Server!
http://www.openone.com/software/MailOne/
(Exchange Migration HOWTO coming soon)
And that's all i have to say about that.
write a M$ Lookout!(tm) virus that not only uses the target's address book to find new targets...
But also forwards everything in the targets in/out boxes to everyone in the address book...
This should probably have some sort of time-delay "dribble" effect so that it covers the most distance...
Just imagine the fun when some HR person or the CEO (with budget or payroll info) gets nailed by this. People quitting, people fired, death threats, arson, arsenic in the coffee pot.
Then organizations will start taking security seriously. And rightfully slamming M$ for creating an environment that fosters such problems. oh, and...
[91 days without being moderated!]
Check out the Extremely Reliable Operating System. www.eros-os.org.
If you do everything on a "least privilege" basis, then a virus is infeasible. There's no reason why anything in an incoming mail message (for example) should have access to your address lists, or your outgoing mail queue.
In an EROS system, since there's no reason for a program to have write access to its own code space (let alone anyone else's!), the virus can't alter it.
Remember, a virus is only only half of the problem. The other half is the brain-dead children at MicroSquish who built a mail client with a turing-complete language, and full access to the whole goddamned machine.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Good start to a bad analogy. You are responsible if you leave your car running, up on a wobbly jack, in front of a playground and someone gets hurt. You aren't responsible when someone steals your car and then commits a hit-and-run with it.
The computers, and users (for the majority), involved in spreading this type of virus aren't being negligent. It's a fair analogy to describe the average net-user as the average drivers because they are likely the same people these days. They don't know the risks involved in just double-clicking attachments and launching them any more than they know the risks of getting into a friend's car and driving it around. "If it's my friend's car, it must be safe.", unless someone has sabotaged your friend's car, or car-jacked it that is...
A better question might be to ask if the car manufacturer is to be held accountable when they don't install doorlocks and the car theft/hit-and-run occurs, or when they fail to make modifications that would prevent future events of this sort from occuring again in the future. The responses to-date from companies like M$ have been less-than-acceptable; the equivalent of (if I can continue to over-use the car analogy) like plating over the windows and welding the doors shut on the car to prevent future thefts.
This just goes to prove the insanity of low-cost easily-accesible computers and software in the hands of everyone. Every day, hundreds, perhaps thousands of machines are infected with virus and trojan software. The cost in lost data and productivity is easily in the millions.
We have to stop this madness now.
Right now, computers are less regulated than lawnmowers or automobiles. We require drivers to pass a proficiency test, why not computer buyers? It's time we registered computers and performed background checks on people who buy them. This is the only way to keep computers out of the hands of children and criminals.
I am proposing a Million Geek March. We will have speakers telling stories of how their lives were destroyed by computers. Let's send a message to Washington now: "We need to be safe from computers!" It is absurd that in the year 2000, I have to scan every attachment I receive and every program I download. We need to make our information infrastructure safe again.
All of you who oppose my plan, I ask, "What do you have to fear?" We're not planning to take away your computers. We just want some common-sense legislation for the safety of all. It will be a tough fight -- the rich lobbyists from Dell and Microsoft will try to stop us. They'll claim that the right to access information cannot be restricted. They'll claim that computers aren't the problem. We know they're wrong. Modern computers make it easier than ever to create destructive programs. A computer in the home is a tragedy waiting to happen.
Let's get some common-sense computer regulation now. Thank you.
Save the whales. Feed the hungry. Free the mallocs.
But.. Let's say that I've got a diverse network. Some Macs, some MS boxes, some Linux boxes and a couple of solaris boxes for the fun of it. Now, we all work on the same project - say a web project. So - we all have shares from the file servers mounted on our workstations. It is now sufficient to find an open exploit on one of the four operating systems to hurt my business. See - this bug doesn't attack the plants - it attacks the soil itself(roughly speaking). So, the entire monoculture point becomes moot.
Furthermore, it's not necessary for the virus to carry code for all operating systems. ILOVEYOU et al taught us that. If the virus infects one machine, that's enough to clean out all network shares, and start spreading itself randomly (or less than randomly.. it could look in the inbox, and check what emails originate from vulnerable systems). Voila.. A few thousand years of agricultural experience gone.
Stop the brainwash
Here is a clue.
The Samba folks don't publicize it, but they have found a number of buffer overflows in the stacks of every single OS out there. (They patched the ones they found in Linux.:-) A truly nasty critter would be set up to transmit itself using those overflows.
If done right you would get a worm or virus that can transmit from computer to computer without any manual intervention. There has to date been exactly one such on the internet. The Morris worm. It went out of its way to be nice, and it still shut down the Internet through sheer speed of reproduction.
You see getting a human in the loop slows things down. If you want to be truly nasty, automate it from start to finish. Then the first people will hear about it is when their networks go down.
Cheers,
Ben
My usual seat in the cluetrain is at A HREF="http://pub4.ezboard.com/biwethey.ht
Nice to see that we have the first ever 100% bug-free piece of non-trivial software: it's EROS! I guess you just install that once and then forget about it? No security updates or anything like that?
Not to knock you completely. Capabilities make for a very nice security system, but if you think that it will *ever* be completely secure, or completely impervious to malicious code, which is what the OP was asking, you're kidding yourself.
So the answer is: NO.
For instance, if you have an e-mail program that the entire world knows has a gaping security flaw, it is your responsibility to remedy the situation. Now that doesn't mean you have to re-program the software, it means you need to find different, better software.
I agree completely with your assessment of certain software companies also, but remember that those companies' software is used by choice of each user.
To be blatant and to the point, and stretch that analogy a little more, running Microsoft Outlook is like leaving your car running, up on a wobbly jack, near a playground.
wish
---
The famous Robert Morris Internet worm of 1988 did precisely this.
It worked beyond the author's wildest dreams - but the worm didn't do a good job "staying out of sight." Once a machine, it did *nothing* except try to infect another machine. The problem was that it was too good of a cracker: The worm spread like wildfire, spamming the network and bring many machines to a crawl by infecting them thousands of times. Read more here.
"one treats others with courtesy not because they are gentlemen or gentlewomen, but because you are" --G. Henrichs
If a website doesn't meet those "requirements", instead of linking in the article, we could place an unlinked http address in the article. That way people interested can go ahead and see the article, and some lazy bastards won't try to get to the site. Just a few people less, and maybe some sites won't get slashdotted. Probably won't work, but what the hey???
We don't need no Net Explorer We don't need no Thought control
Many interesting ideas here about how to write viruses which are difficult to detect. But what if they are out there already? Would we know it? Seriously how difficult would it be to create an "evolver" virus which:
1. reproduces without human intervention
2. is harmless (doesn't try to crash anything)
3. occasionally mutates itself at a random time
We could have a whole virus ecosystem evolving out there right under our noses without us even having a clue. Part of their strategies for surviving would necessarily include not crashing the systems they were "living" on.
In fact this sounds like one of those things that because it CAN happen, it MUST eventually happen. Eventually somebody will do it and there will be no way to undo it once done. Maybe the first Artificial Intelligence created on Earth will be an internet-dweller who has never even met a human being before.
-- laws are the opinions of politicians --
Different scary attack thoughts: Samhain (mirrors - linux-list, Red Rock Eater, bugtraq).
One of worst things that can happen is the information about virii and other security threats to be shared only among some selected few. You may have seen the story about a 3 year old AOL security hole this weekend. The only way to prevent this kind of problem to become a major problem is to publicize the risk to the maximun possible extend. It guarantees that every system administrator in the world will hear about it and take the necessary steps to protect his/her piece of the network.
One, two, three, --crack! We'll never know!
Has anyone ever thought of / heard of viruses that do physical damage? I'm talking about anything from the wasteful (printing 1 character per page on a printer, and then formfeeding it), to a virus that might cause actual permament harm to a computer. They say (and I assume it's true) that if you tamper with the refresh rates of your monitor, and set them too high, it can hurt the machine. What if (and PLEASE don't try this) a virus tampered with these settings? Maybe billions in damages is possible after all...
-- Is "Sig" copyrighted by www.sig.com?
Back in 1995 I used to monkey around with virus writing.
;p
My favorite was a little randomly mutating virus. I wrote the little bugger to duplicate twice and erase itself. On each duplication the virus could chose to mutate or not (50% chance), if it did mutate it could either randomly alter or add data to it's data section, or randomly alter or add an opcode at any point in the instruction section. Also if there was a floppy in the floppy drive it would append itself to the largest executable file.
I ran this on my 90Mhz Pentium running DOS and after about an hour my computer froze. I rebooted and nothing happened. I whipped out Norton Disk Utilities and looked at the contents of the drive. One of the little buggers copied itself into the MBR but didn't know how to boot.
The lesson here is that the Uber virus could very well take very little planning and simply be a genetic mutation of a simple assembly program.
If I were to write this program today, I would give it networking libraries, code to try the 10 most commen sploits on target machines, binary formats to run on all the major platforms and mabey even a DB of opcodes for different arcitectures so it can translate itself from an x86 bug to an Alpha bug and so on.
A virus like that would suck and I haven't touched Assembly for two years so I'm not going to code it up but somebody might...
...but I hope anybody with that much talent would rather do somthing constructive like make video games
If someone wanted to write a virus to do really lasting damage, it wouldn't do boring stuff like delete files or steal credit card information. Come on, who cares.
The road to immortality is to hack people, to change relationships permanently. So here's what you do: propagate like iloveyou, but with vastly more discretion. When launched on a new machine, take the following steps:
- Dig through all the places typical mail clients store mail. Build up a list of all the subject's correspondents.
- Send the virus along to various correspondents, but do so with a very plausible looking reply to their last email. If you really want to go to town, emulate the subject's writing style, but some brief nondescript text should be sufficient. Lots of optimizations here, all with the goal of getting the subject to execute the attached program.
- Now, after enough delay to get that thing propagating a bit, search all the mail looking for mentions of people in the third person. Then package it all up and send it anonymously over. Thus, every mail our subject "Foo" has ever received mentioning "Bar", or ever sent mentioning "Bar", is now in Bar's hands. Repeat for everyone else in their mail.
It should be obvious how devastating this would be, especially at cutthroat companies. The effects of such a virus getting much propagation would be felt for a long, long, long time.Nobody should do this, of course!
-- Stop the violins!
submit a story that was interesting, but is slightly stale.
Watch it make the front page
watch the site get slash dotted.
Presto chango! instant DDOS!
the poor guys trying to run the site probably haven't even figured out what is going on yet - They just know it looks like legit traffic, and they likely have an account that that charges big bucks for heavy traffic.
so for them they are likely just standing back in awe at an attack that looks like it is coming in from maybe 100,000 sites.
Imagine if the site is hosted on some kids home machine?
"It is a greater offense to steal men's labor, than their clothes"
As for home users with Outlook, well, ignorance is the only excuse I can find for them. I cannot believe the average net-user is aware that they're using an 'unsafe vehicle' for their email transportation and those that might know don't necessarily know of an alternative (my ISP distributes Eudora Lite to new members, thank God). [Good poll idea: what email software comes bundled from your ISP, if any?]
So again it comes back to accountability. Let's enjoy the car-analogy a bit more. If the drivers can rightly claim ignorance as a defense (which most can I believe)and we don't want to go after the manufacturer, can the distributor be responsible? If I know I'm selling you a dangerous vehicle, am I accountable? I'd think so. Hrm. Any lawyers care to bite at this one?
Here's an idea for a virus that would really be killer. I'm not sure how it would be distributed, but this is what it would do: all RAM (SDRAM, and I believe RDRAM as well) has something called SPD data. There's a tiny EEPROM on the RAM module that holds information about the RAM: it's CAS latency, the size, technology (64 Mbit, 128 Mbit, etc.), and other things. The BIOS reads this data to figure out what kind of ram is in the system (NOTE: some RAM does not have an SPD chip on it, and many BIOSes just run some algorithm to determine how much RAM you have... but this can't detect things like CAS latency so performance can be lost if you have good RAM and this is done). Anyway, the SPD data is read using SMBus... thing is, THIS DATA CAN ALSO BE WRITTEN OVER SMBUS. So the virus would just write fake data over the RAM's SPD data, telling the BIOS that the user either has far more or far less RAM, or that it runs at a greater speed/CL than it should, which will generate all kinds of errors when programs are run, or not let the system boot up at all. It would be deadly because not only would it not let the computer work, it would be very hard for the average person to get rid of. And info on programming SMBus and SPD data are readily available on the web...
Start a data recovery buisness, then set your l33+ hax0rz to the task of creating a "uber-virus" that will format/fdisk on a certain day whenever. There will be pleanty of buisness for everyone, and lots of money to be made.
oh yuck. There's some social engineering for you.
Just target FedEx and UPS with a virus and watch as the go-go-go e-conomy grinds to a halt.
Bzzt bzzt!
I still can't get to the HNN article, but I can tell you that such a virus is indeed possible, because I've written one.
As well as trapping filing system calls to stealth the virus, it is possible to take the opportunity (while a file is being accessed, so the user wouldn't notice a slowdown) to scan through the file for magic words that cause embedded code to execute locally. You need a CRC to avoid executing random code of course, and a text encoding scheme (I used a 64-bit code starting at '?').
Thus you can turn any non-executable piece of content (mail, web page, news posting) into a harbour for native executable code, something that up to now Microsoft have at least only been doing by accident. ;-) The advantage is that the client itself accesses the code; unless BO and co., the virus supplier doesn't need to make a connection to the victim machine to execute things on it.
Obviously I no intention of letting this see the light of day, but it's also unlikely to take over the 'net since it doesn't run on Windows. I guess it'd be possible, but I don't have enough knowledge of Windows internals (shurely m4d sk1llz? -Ed.) to write it.
Anyway, it'd have to be rewritten into a mail worm, since actual viruses are terribly out-of-fashion these days. <g>
--
This comment was brought to you by And Clover.
And created a new sig for each person containing itself so the person could be sending it out with each new e-mail they sent.
The Morris worm only worked because the net, at the time, was rather homogenous. That kind of shit won't work today because there's at least four or five different processor architectures (OK, one might be able to get past that problem by using shell script or some such, but then there's the problem of reproduction across the network) and a big honking lot of different software configurations. Sure, the worm might be able to punch through the by default insecure ia32-redhat installs, but how many of these are being used in critical backbone-related tasks? Not a lot, I'd guess. There was even enough bandwidth in the US backbone for it not to go down because of Melissa, and that thing was HUGE.
The internet's major strengths are redundancy and diversity. Let's hope that neither of those go away.
"But PLEASE don't do this."
"Don't get me wrong; nobody should do this"
"It would be really cool but please don't take me seriously"
Uh...if you wanna talk about building viruses, fine. Free country, etc. But don't try to cover your shiny little butt with a little disclaimer at the end.
"So here's the step-by-step procedure on how to steal 14 million dollars without getting caught...but, uh...please don't do it."
Please.
With my own content, the idea of a self-modifying virus seems.. abstract. The best virii are as compact as possible, although I could see something that randomly changes a footer or something to prevent antivirus detection. A sentient version though.. I don't know. I don't think that AI is impossible, or even improbable, but I kinda doubt that it could work as a virus. I'd think you'd need something more intellegent than the average human (or has some mechanism to fake it) to learn how to exploit systems. At least without any intervention.
Then again, I could be speaking out of my ass.
(or trojan or worm or whatever) that gives hits to the hunger site.
That would really kick ass.
(oh, and I don't know how to do any of this stuff, so if it happens, it's not me.)
From time to time those corporate morons have their ass kicked by a sweet Windoze-only virus or hack.
In our spare time we, *nix addicts and Mac faithfull, think of a Win-only apocalyps.
Here comes our version of the almost perfect Win virus (=Winrus?).
Imagine a virus similar to I Love You but which replies everyone who mailed the given Windows looser. Replying simply with the standard RE: [original subject] and in the body "Conclusions" or something similar. Every time another short body text (out of a range of possibilities) can be produced in order to make the simple protection by spreading the word not to open an attachment entitled X or Y or Z or etc. more difficult.
Anyway you get the picture: those "Conclusions" or whatever are clickable and after spreading the word to other users wipe out some crucial registries or other files.
Isn't Windows wonderfull?
The Singing Skunk
The nice thing about Windows is: it does not just crash; it displays a nice little dialog box and let's you press 'OK'
This is true as long as those with the virus-writing skills (a) have some stake in the Net as we know it and (b) are fairly rational about things. In this case, even though everyone has a loaded weapon at his/her disposal, it's not used, because the consequences are seen as too severe. (In the Cold War, we didn't have nuclear exchanges in large part because we and our adversaries acted rationally. Similarly, we don't have carnage on the highways, because people know that intentionally causing severe accidents could put them in the hospital and/or jail.)
But one can imagine another world in which people did NOT have stakes in the continued utility of computing and the Net, and therefore had an incentive to do severe damage, just because they could. In this case we would be constantly in a war of destructive viruses vs. security tools, and many innocents would be severely damaged. (Think about Sierra Leone, for example, where almost total anarchy prevails.)
Fortunately we are closer to the former condition. But it could change. If the economy severely tanked and several hundred thousand geeks suddenly became unemployable, for example...
sulli
sulli
RTFJ.
Background checks and proficiency requirements are a good thing. But what about the loose cannon out there who has nothing bad in his background but one day gets up in the morning and thinks "I'm gonna go out ta buy me one of them compewters and turn loose one helluva vearus!"
Obviously, the only way to protect ourselves from these nuts is to also implement a mandatory five day waiting period to buy a computer.
Also, what possible need does anyone have for more than a Pentium 166? It does word processing, email, web browsing and runs solitaire. Any more power can only be used by someone with dangerous intent. We need to start worrying about these assault-computers, namely those with 64-bit processors. The evil PC makers (such as Dell and Micron) are already planning to unleash these weapons on the consumer market. They need to be stopped now with sensible legistlation that outlaws assault computers.
>support in their OS, that means they're to blame
>for script viruses! How dare they have scripts
>that run under Windows! Wait a minute...doesn't
>Linux also support scripts? Never mind that --
>more MS bashing!
>But seriously (read before moderating this as
>Troll of Flamebait), the reason that the e-mail
>script viruses we've seen all attack MS Outlook
>isn't because of how terrible Windows is.
Yes, windows *IS* terrible (ESPECIALLY from a security context). Or have you simply not been paying attention for the last year and a half?
The DEFAULT configuration of the DEFAULT mail client will run a script with the windoze equivelent of root permissions when you open it. It is ridiculously STUPID to allow a user-space email client to run amok in system space. Absolutely poor design, and worse implimentation.
And worse, they have known about this for a good YEAR AND A HALF! Ever since Melissia, this has been a known flaw... but gates REFUSES to fix it!!!
Now, since you complain that Linux includes scripting as well as windoze, let's look at the equivelent sequence of events that would have to happen for a malicious script to be a problem:
Say that someone sends me a malicious perl script as an attachment to an email. Well, when I open up that attachment, pine DISPLAYS it as a TEXT file. It is NOT run by default when I open it. I have a chance to examine it BEFORE I let it run, if I run it at all (not bloody likely unless I'm about to switch distros and am already backed up). Now, in order for it to be run in such a way that it could trash my system, I would have to:
1) Save it as virus.pl, or whatever
2) su to root
3) Run it by typeing "perl virus.pl"
Or, if I am doubtful as to wether it is harmful or not, I could run it in user space with NO CHANCE of it trashing anything important.
Now... which security paradigm is better?
Not that Linux (or any given xBSD or Unix) is PERFECT... but it is by all means hella-better than anything that hath spewed forth from redmond.
john
Resistance is NOT futile!!!
Haiku:
I am not a drone.
Remove the collective if
Imagine all the people...
Ever hear of network.vbs? that ones sneaky but doesnt use buffer overflows or other sploits at all.. It just randomly scanns IP addys for windows machines with drive C shared and no password on it. When it finds one it installs itself.
If your firewall is getting hammered by UDP-netbios crap its a fair bet thats where its coming from. If you're a windows user just look for a file called NETWORK.VBS in your startup folder, in c:\windows\system and the root of drive C... if you got them, you got it and are portscanning other folks networks whenever you are online.
# human firmware exploit
# Word will insert into your optic buffer
# without bounds checking
I had a
Thanks to the miracle of Captive-X, it is already possible to make a web-based worm that executes upon viewing. Just look at all these delicious exploits. And since more and more windows apps (e-mail, newsreaders,etc) are using IE as the in-app browser then those are affected too. What is rediculous is that the 'good times' virus is now a very real possibility.
I don't have to worry about it as I use Linux (not that we don't have exploits) but if you're a windows user please turn ActiveX off. The uberworm will happen eventually, and next time maybe it'll delete *.DOC,*.XLS,*.MDB instead of just *.JPG and *.MP3. That's going to seriously break some corporations off.
Building a killer virus for fun and profit
By Bill Gates
1- Buy "Quick and Dirty Virus" from some other guy.
2- License virus to a large company that manufactures chess grandmasters. This should provide a fruitful infection vector. And remember: 640k is enough for anyone, so don't worry if your virus does things that prevent access to the rest of memory, nobody will notice.
3- When other, nicer looking viruses come along, copy the user interface, but make it quirky and inconsistant (this is a virus we're talking about here, so it has to be nasty in one way or another).
4- When "dr-virus" threaten to replace our virus, spit out weird error messages to confuse and disorient the user, allowing our virus opportunity to re-establish control over the system. Viruses that are dependant on our virus, however, can be left free to roam.
5- A web browser should be integrated into the virus. Everything integrates a web browser sooner or later so make sure its ours and not somebody else's. This will expose you to the feds, who love to go after virus writers, so be careful not to get caught.
6- By this time the virus should have infected most of the world. For new challenges, create another virus (or several!) and start the process again. If the feds put a stop to our old virus we'll still have this new virus already spreading.
7- And whatever you do, don't call it a virus!
Don't worry...just practice safe cybersex.
It's 10 PM. Do you know if you're un-American?
"I don't think I really love you", or writting internet worms for fun and profit
Anyone doing serious work in these fields could write this. It's just a matter of time before one is released into the wild. Genies, bottles, and all that.
On a related note, the potential impact of this class of worm is probably responsible for funding approval to the new "Infrastructure Protection" the USGOV is deploying to protect us from ourselves. Amusing, considering that this is one class of worm that will likely evolve to a point where it can't be eradicated from the net, at least as long as a few insecure systems are still online.
Why did you tattoo "Die Ubervirus, Die" to your chest?
No, no. It's German for "The Ubervirus, The."
Well, no one who speaks German could be an evil man.
Yes, this particular moderator was a nit. Either that, or he/she/it accidentally mis-moused in the drop-down box, clicking "Offtopic" instead of "The Greatest Damn Brilliant Piece Of Insight To Issue From The Human Mind Since Plato", and then moderating in blissful ignorance of the error.
Humans are not infrequently A: stupid/destructive/confused twits or B: butterfingered. We should not act surprised when proof of this fact is, as here, made evident to us. Nor should we presume the fact that a system does not absolutely prevent all foolishness or error on the part of its moderators to be an indication that this deliberately subjective system is functioning in an unintended manner. That's what the multiplicity of moderators is for -- to (most often) sufficiently compensate for blunders like this.
Nuclear weapons are really hard for the average person to make or get a hold of. Try it sometime and see. One needs, ideally, to run a government of a good-sized country for a number of years. Failing that, one generally needs lots of money, a huge amount of planning, a good number of friends/followers who share your plans, and a willingness to risk being apprehended and unpleasantly killed by agents of a concerned superpower.
Virus-writing, however, has rather lower barriers to entry. Psychological stability is not one of them.
There were a set of viruses (supposedly) written by people working for the Soviet Union that could physically damage you computer. One of them did do the monitor refresh rate thing. Another (supposedly) fiddled with the DAC on you video card to fsck it up royally.
Of course, while a friend of mine did have some actual binaries claiming to be some of these viruses, he never tried them out. But then again, who would?
I've also heard it rumoured that by poking the same register over and over and over again as fast as possible you can blow them out on some chips that were marginal so far as the specs went.
You could also seriously mess up certain types of hard-drives by doing a 'low-level format'. The procedure used to be used to clear older drives and prepare them for an ordinary format. Some newer drives respond poorly to this sort of thing, and end up getting necessary information (sector coding + the like) wiped.
Also, for BIOSes that support it (all new ones) you could (I suppose) have a boot virus that immediately causes a hard boot. Might possible hurt the power supply it happened unoticed for long enough. You could do the same thing to the motor on the CD-ROM drive (or a hard-drive), by spinning it up and down repeatedly. Of course, if the user is sitting at the machine when this happens, it's a bit suspicious. But if you did it to a closeted server, you'd have hours to cause mechanical failures.
This whole post is a bit vague, rumourish, and unconfirmed. Except the monitor-refresh thing. I've had a monitor die because of that (no virus, just a stupid shareware game poking the video card). The rest is just hearsay. But it's all plausible/probably hearsay.
I forgot. I have heard of a (confirmed) virus that does physical damage. It pulled a neat hardware trick that on one of the original IBM-PC's, would cause the disk drive to make a little clicking noise. Perfectly harmless, and did it ~ once a month. No biggy.
Thing is, that on later hardware, that harmless bit of code would fry the drive motor.
I have no clue as to whether it damages modern floppy drives. Given that it was written for the IBM-PC, it may not even run properly anymore.
that'll teach me to hover my damn links...
There was a bug in Zip drives like this. A particular scratch on the magnetic surface would slightly dislodge the read/write head. If a fresh disk was put in, the dislodged head would replicate that scratch.
Cheers,
Rick Kirkland
> Or do all TCP/IP exploits rely on knowing the target architecture (buffer overrunns need to inject machine code... etc).
Nearly all of them, at least those that allow you to take over a machine.
TCP/IP itself had(s?) some glitches that allow for DoS attacks of strict implementations thereof, but those do not allow you to write an ubervirus, or indeed any virus at all.
"We won't use guns, we won't use bombs, we'll use the one thing we've got more of and that's our minds" - Pulp
...and that's simply because TCP/IP itself hasn't got any mechanisms for transmitting and executing CODE.
Forgot to say that...sorry...I'm pissed...
"We won't use guns, we won't use bombs, we'll use the one thing we've got more of and that's our minds" - Pulp
There is no perfect operating system which is immune to the maliciousness of certain individuals. If you have a computer you have something that can pontentially run code that will fuck things up. This is a given and is true for any operating system. When I see people boast that they run Linux or Mac and are therefore immune to virii and exploits I just shake my head and usually sigh. I'm still waiting for one final thing from the virii and worm dudes. Virii as part of a business model.
Just imagine a virus that spread as fast as Melissa (in the course of a weekend) that didn't do anything too terribly maliscious but did replace your screensaver and bookmarks with some new internet start-up's advertisements. Or how about a worm that replaced your GUI libaries with logos and ads for some start-up. Maybe companies will get so bold as to unleash virii into competitor's computer systems. We're already at a point where taking out a businesses infrastructure could cripple and/or destroy a company. Right now we're seeing lots of worms just floating about because someone was pissed off at the world because they were a loser who had no other form of expression. What will happen when malicious exploits hit the mainstream of business and are actually aimed at individual companies. Script kiddies can cause a company's servers to stumble for a day but that is all pretty meaningless when compared to a virus bootstrapping all of a company's office systems. It isn't the OS that you need to worry about or boast over, it is how much you'll be fucked if that system fails.
I'm a loner Dottie, a Rebel.
The article on HNN appeared last year, round about August...i think. I wrote it. That was a while ago.
The article was nothing *new* - no revolutionary concepts - it was, as the article suggests, a culmination of all the bad things out there, neatly packaged. The article was written before the outbreak of Outlook and MS based viri and as such this avenue was not even fully explored.
The idea was basically just to give the readers an idea of what could be done - how the viri and worms that we were seeing back then were actually quite "harmless" in comparison with how they could have been. I still think that this statement is very relevant today.
I have received many suggestion on how to further enhance the worm/virus, and many suggestions on how "easy" it could be stopped. Like I said in the conclusion - I am not the brighest person on the planet - I am sure that there are many ways to further "enhance" the thing, and just as many ways to try to stop it. The idea was just to see how bad such a thing could be - to toy and share the idea with others in the field.
We would be blind to think that such a monster (or something more dreadfull) cannot and will not be developed in the near future (or maybe even as we speak).
My 2c,
Roelof.
PS: I have no idea how it got to /. after all this time... ...and yeah... the "Line" O/S...a case of an over eager spell checker, and some finger trouble :)
PPS:
-------------------------------------------
Roelof W Temmingh
SensePost IT security
roelof@sensepost.com
http://www.sensepost.com
-------------------------------------------
We discussed this some months ago and decided that it is damn lucky that no truely talented software authors have put their hand to writing virii. And that most virus authors have publicity closer to mind than virus longevity. By looking at virus ecology (there's a large body of literature on propagation strategies) and design, you could get results far more scary than anything we have seen so far.
X.
"Everything is adjustable, provided you have the right tools"
I don't know which would be worse: A virus that merely does a backup of empty files, or one that is good at getting itself safely backed up.
:-o
Let the virus sit idle for 1.5 weeks (assuming companies backup once a week?). Once the infected files have been "safely" backed up, then the virus awakens, zeros all files, then backs up the zeroed files.
cpeterso
Hmm...kinda ironic that HNN's servers can't handle traffic.
What kind of virus is this again? Think about it.
--cr@ckwhore
Skiers and Riders -- http://www.snowjournal.com
http://achurch.org/nitmar.html or http://achurch.dragonfire.net/nitmar.html (on different servers)
I couldn't get to it from any of my servers. Nice job, guys.
Linux rocks!!! www.dedserius.com
www.dedserius.com
VB != VisualBasic
What you are suggesting here is akin to a description of a good parasite.
A bad parasite is usually one living in a host other than its usual host, and doing too much damage. The point of a parasite is exactly to not do very much damage.
A badly adapted parasite, for example a worm that lives happily in a pig without damaging the pig, can do a lot of damage if a human eats undercooked pork.
Thus, the parasite kills its host. The well adapted parasite does not kill the host, lives long and prospers and reproduces more (which is its goal, if it can be said to have one).
It follows that if the goal of the computer virus is to propagate itself as widely as possible, it should not do immediate crippling damage to its host system.
There's absolutely nothing new even in the vocabulary used to discuss computer viruses...
Anyway, what strikes me is that these email and msword viruses have on the whole been quite tame in their side-effects. The ILOVEYOU virus, aside from emailing itself to your whole addressbook, replaced all the .mp3 and .jpg files on your hard drive. Some graphics people may have lost actual work stored in .jpg files, but on the whole, I don't think much got destroyed aside from porn and mp3 collections. Yet, it woudl have been just as easy for the virus to erase all your data; just replace "mp3" with "doc" and see the *real* damage!
And then there's another, more insidious way, in which an email virus could do very serious harm: by randomly forwarding your emails to people. Imagine a virus that forwards each email in your inbox to one random person in your addressbook. Whoops, there go most companies' secrets!
I just tried to connect to hackernews and got a buffer overflow error, Should I be scared? or them? Or is it just thier 404?
Special Relativity: The person in the other queue thinks yours is moving faster.
These 2 ideas i have wondered about for a while...
1)
Why do viruses attack machines they are on?? Isn't this giving insentive for the owner of the host to get rid of it? For example.. lets say a virus (call it x) is spread. Now as long as x is small and and doesn't take much resources then how would people know they have it? Even if it is detected by scanners there are plenty of people without scanners who may be hosts. This is where x differs from other viruses. If x is attacking a remote system (for example a DOS attack) having a virus detection program won't help, and people won't be inspired to get rid of it.
2) Why not model x on a real human virus!!! as silly as it sounds i believe it may work. My idea was to have a core unit of the virus which doesn't change. This unit duplicates the virus and makes random changes to the rest of the virus. Alhtought most of the duplicates wont work there will be some which will work.
Survival of the fittest!!
Now lets say x has both of these characteristics.. it spreads mutants.. and lets say at a specified time (after it has spread) it begins a large DOS attack. The amount of traffic on the net and networks could become intollerable. As well how can it be cured?? ONLY by every person on the netowkr (or internet) to scan for the virus..
Basically i believe that a lot of viruses lately have failed because they harm the host.. What are your opinions? I'd be interested to know..
argh.. if you want to borrow some expression from Nietzsche then use the correct spelling :
Übervirus - from german über mostly meaning above. (see this Dictionary entry for about 190 different meanings =)
And if you have no 'Ü'-Key on your Keyboard - hey.. that's HTML here.. the correct character is just an Ü away.
while (!asleep()) sheep++
What if you took the philosophy behind the Morris worm: that a virus could benifit from security heuristics, and extended that to the motives of the worm. Couldn't, for instance, a slowly spreading Windows trojan that exhibited some descretion (for instance, only spamming the first dozen email addresses lexigraphically following its current host) and some polymorphism (pretending to reply to Inbox email) and known security glitches in windows (between vbs and that weird Windows scrap file thing) to patch said glitches? To basically rate the host system on some level of newbiedom and then make basic and fairly transparent security changes?
Possibilities include:
- Changing default settings of Outlook to disallow autorun of attachments, and especially of VBS stuff.
- Installing a faceless MacAffee ripoff (or better still, a Virex port) to do virus checking quietly for the user.
- Change some default settings to foil simple scripts; like moving the Start Folder, or Sharing setups.
Is there something wrong with this idea? My gut feeling is that any virus is wrong since it removes control of the machine from its user. But then again, if you targeted Windows, control over system was never a concern of those users.I guess the biological analogy would be to release a weakened influenza virus to innoculate a populace too ignorant (or "underinformed") to get vaccinated. Sure, some people are going to get very sick, and the weak, the sickly, the very young and the very old will exhibit casualties, but over all lives might be saved. Same deal here: the worst, closest to breaking systems will probably break, but everyone else should be better off, right?
Ushers will eat latecomers.
IP is just rude.
Is there any torture so subl
Look up the papers on EROS. It's provably secure. If you don't have a capability to a resource, you can't even DETECT its existence: it's not in your address space.
The contention that no OS will ever be completely secure is a crock, and it's used over and over to excuse the half-assed security hacks that UNIX and NT layer over their broken kernals.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."