Nimda To Strike Again

Seabass55 writes: "Researchers say Nimda is set to propagate again after rechecking Nimda's code. God help all the MS boxes ... again." Looks like the owners of unpatched IIS machines have until 9 p.m. GMT (1 a.m. ET) to get ready. I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants. Update: 09/27 22:45 GMT by T : Temporal confusion -- that's 5:00 GMT, sorry :) Update: 09/28 00:14 GMT by T : Carnage4Life contributes this link to a command-line tool from Microsoft to list patches already installed or still needed, if you think your Windows machine may be vulnerable.

Comments

9 PM?

[SpanishInquisition]

All NT admins leave at 4:50 PM, too bad for them.

Re:9 PM?

[D Anderson n'Swaart]

Ianamss (I am not a Microsoft supporter), but it almost sounds like you think easy administration of a server is a bad thing. I'm sure that can't be what you meant...

Re:9 PM?

[ethereal]

Except the user was right, of course - if you guys weren't using NT, or possibly just kept up on the patches from Microsoft and hoped that those patches didn't hose something else that was important, the Internet wouldn't be broken (or at least the only brokenness would be coming from machines outside of your site, which you could at least firewall off). Heaven forbid a user point out that you guys can't keep it together. The fact that you had to work really hard and still couldn't get things back up in a timely fashion doesn't fill me with sympathy at all, it just makes me wonder when you'll finally come to your senses and use a technology that doesn't let you down so badly. I'm guessing not too soon, though.

- ethereal, who bitches all the time about the Microsoftening of his workplace, because the IT team deserves to hear exactly how their "solutions" are working out. "Not well" is the answer.

Again?

[Dimensio]

What does this mean? I was under the impression that once Nimda infected a machine it would attempt to propigate indefinitely unless the machine were cleaned. What was the propagation time cycle for the first run?

Mind you, I've not seen a significant dropoff in my firewall hits (hits doubled after Nimda first hit), but perhaps I've not been checking properly.

Re:Again?

[Pathwalker]

I saw a sudden dropoff in Nimda infection attempts a while ago.
It's quite obvious if you look at the graph I have here.
One moment, the nimda hit count is heading straight up, the next, a sharp bend to the right as the rate of new hits drops to almost nothing...

Re:Again?

[sharkey]

That's probably from many, many PHBs reacting immediately to the Gartner Group's reccomendation to replace their IIS PCs with $SOMETHING_LESS_VULNERABLE. Once they had turned 'em off, hits would have to drop.

Re:Again?

[reverius]

That's not possible... any significantly large company that was going to change something like that would need an obscene amount of time to switch to "something less vulnerable"...

somewhere around a year and a half. :)

Re:Again?

[GreyPoopon]

That's not possible... any significantly large company that was going to change something like that would need an obscene amount of time

Not completely true, although I almost agree with you. If they assume that their intranet is safe (a dangerous assumption), they can just replace external web servers. For many companies (even large ones), those external servers are probably just serving up static pages. Switching to Apache or something else wouldn't be too bad. Now on the other hand, getting management approval to do something like this will probably take most of that "year and a half" that you cited. :)

Re:Again?

[sharkey]

I guess I should have put the tag in, huh?

Patch your damn servers!

[jiheison]

I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants.

Maybe just corn syrup and regular ants for the admins who still haven't patched their servers.

Re:Patch your damn servers!

[4of12]

The usual punishment of:

• a hosed server first thing in the morning, before coffee,
• a stack o mail from other irate sysadmins that are getting hit on by the infected zombie to which your name is attached,
• some urgent voicemails and pages from users and from your management asking what the !&%$ is happening.

The usual...ho humm.

Otherwise, Friday morning would have been relatively pleasant.

Re:Patch your damn servers!

[Skevin]

I guess that would include me. I *intentionally* set up an IIS honeypot of sorts, collecting and running Code Red, Sircam, and Nimda, to show Microsoft that the biggest threat comes not from corporate servers, but from at-home enthusiasts who only partially know what they are doing.
Firewall? "What's that?" Security patches? "Too paranoid to use 'em." DoS/slashdot effect? "Aw, shucks - I'll just reimage my webserver. Hyuck, hyuck."
By perpetuating the spread of these tidbits of code, I hope to make at least a few companies wake up and realize that IIS is not a viable solution. For every one of me doing what I'm doing, there are hundreds of unwitting newbies doing the same thing, unknowingly. Yes, that includes PWS.
Psychotic? Vengeful? You'd be, too, if you spent hundreds of dollars for an MCSE(SD) and MCDBA, only to wake up one morning with a Mandrake distro in one hand and realize it was all for naught.
Okay, I'm ranting, but it's only natural to feel a burning desire to destroy the cult you just escaped from.

Skevin

Re:Patch your damn servers!

[Rogerborg]

• I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants

I'd recommend 25 years of indenduted servitude at Microsoft. Possible outcomes:

• Microsoft learn how to think and code defensively.
• Microsoft learn that bigger isn't necessarily better.
• The s'kiddies have the will to code sucked out of them.

Either way, we win.

Not Me

[NitsujTPU]

I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants.

Are you kidding?

Legislation shows that people have a hard time differentiating what's a serious offence and what isn't.

For one thing, taking this out on someone hard, would only lead to approval of laws like the proposed law to make a bunch of kids in HS "terrorists" for winnuking each other.

We KNOW that these aren't hard to create, kids with no formal training can crank them out like they're nothing. To a 14 year old kid who needs to show off to his friends (and almost all of them do), it's IRRESISTABLE. I can't picture throwing someone behind bars for more than a couple years just because they're virus is effective.

If anything, they need counseling to know WHY what they are doing is bad, that it affects other people and that it isn't just a game, but certainly making an example of these people sets a precident for the treatment of all of us.

In other words, turn some silly kid with a script for making viruses into a real criminal, when people are getting in trouble for stupid stuff like scanning someone's ports, and soon you'll see anybody without corporate backing thrown in jail for having a debugger.

Re:Not Me

[rgmoore]

We KNOW that these aren't hard to create, kids with no formal training can crank them out like they're nothing. To a 14 year old kid who needs to show off to his friends (and almost all of them do), it's IRRESISTABLE. I can't picture throwing someone behind bars for more than a couple years just because they're virus is effective.

But this is really an argument in favor of different sentencing for juveniles than for adults (an idea that I support, and feel that recent laws are incredibly stupid to ignore) not against heavy potential penalties for writing viruses. IMO, writing a virus is the ethical equivalent of starting a fire, and deliberately releasing one is the moral equivalent of arson. Like a fire, a virus has the potential to spread completely out of the control of its originator and cause tremendous damage along the way. Little kids are not generally sent to prison when their playing with matches burns something down, but adults who do so are- and deserve to be- treated quite harshly. IMO any person who is legally competent to understand the consequences of releasing a virus and does so anyway deserves a nice long vacation at Club Fed.

Re:Not Me

[sphealey]

"Legislation shows that people have a hard time differentiating what's a serious offence and what isn't"

Despite the fact that I thought we were patched and secured, the Nimda worm hit our servers. Oops - missed one of those MS security bulletins. My bad.

The cost in real dollars (not "gartner dollars" or "TCO dollars) to clean it up was around $25,000. For one small manufacturing company.

If a naughty kid threw a rock through our window and did $100 of damage, the police would yell at him and call his parents to pick him up. If he threw a bottle of gasoline through the window and did $25k of damage, he would be prosecuted for a felony.

So exactly how is this Nimda bomb not a "serious offense"?

sPh

Re:Not Me

[RollingThunder]

The cost in real dollars (not "gartner dollars" or "TCO dollars) to clean it up was around $25,000. For one small manufacturing company.

I've always been curious - exactly how was this value arrived at?

I know that one of the major factors that goes into the usual "damage" estimates is actually people's time, but if you have a sysadmin on staff, it's not costing anything real, it's just changing his tasks for the day (to arguably do something he should have done already).

Not meaning to flame you, I've missed my share of security bulletins too. I'm just honestly interested in where that figure comes from. I understand if you don't want to mention specifics due to corporate interest, but even a rough breakdown would be enlightening.

Re:Not Me

[einhverfr]

We KNOW that these aren't hard to create, kids with no formal training can crank them out like they're nothing. To a 14 year old kid who needs to show off to his friends (and almost all of them do), it's IRRESISTABLE. I can't picture throwing someone behind bars for more than a couple years just because they're virus is effective.

For the most part, yes. However, Nimda behaves in some very strange ways indeed and I think may have been the work of a pro. I have seen it spread through 2 methods which are completely undocumented and through software which is supposed to be immune, such as IE 5.5 SP2 or IE6.

I saw it write to a share which had write permission denied to everybody. Furthermore, it somehow executes itself through that share. So we have one patch which was supposed to work and another vulnerability for which there is no patch. That makes me suspect that the virus uses 2 previously unknown vulnerabilities.

FWIW, I did the following to secure my system at work (unfortunately MS OS) and have not had problems since:

1: Remove the following groups from NTFS permissions: Authenticated Users, Everyone.

2: In the security tab of IE, click custom and either disable javascript, or file downloads...

Re:Not Me

[ptomblin]

but if you have a sysadmin on staff, it's not costing anything real

Maybe this isn't the case where you work, but where I work people use the computers to get useful work done rather than just to provide employement for a sysadmin. If a virus or worm causes down time, or the DDoS-equivalent of all those scans causes people to be unable to reach the internet to do their jobs, then everybody in the company sits there twiddling their thumbs doing nothing. That costs money. So do lost orders because people attempting to reach your web site get a defacement message and probably a copy of the worm instead of your orders page.

Re:Not Me

[Drake42]

I bet you have security guards, fences and cameras to protect your buildings from 14 year old kids.

Why don't you have a secure firewall to protect your servers?

We are living in the time that 100 years from now people will look back and think we must not yet have evolved properly. They will look back and think, "Why did they put up with that idiocy? Were they just stupid back then?" And parents will shrug and grandparents will say "It was like the frontier!" and kids will think "Wow. Those guys were stupid."

Don't bitch about the lack of govenment protection when all you have to do is install appropriate security which costs NOTHING. I don't want my taxes paying to protect you from your own laziness.

25K lost? Serves you right.

Re:Not Me

[sphealey]

"Not meaning to flame you, I've missed my share of security bulletins too. I'm just honestly interested in where that figure comes from. I understand if you don't want to mention specifics due to corporate interest, but even a rough breakdown would be enlightening."

Well, I'm a bit busy at the moment :-(, but a rough breakdown goes like this:

We are in the middle of an ERP implementation. I (who serve as the IS Director, IT Manager, business analyst, and project manager) am six weeks behind on some critical tasks. Fixing the worm took 5 days of my time (about 100 hours - but I won't charge for the lost sleep). I had to bring in several temps to key data that couldn't be pulled from our reports server, bring in our networking consultant on short notice from out of town, pay overtime to the other members of my staff to assist in the cleanup, buy two additional machines to use as recovery servers. We missed several customer shipments because part of the shipment processing system was down, for which we will probably have to pay penalties. We had to pay our EDI vendor to fax us transactions that should have EDI'd in, and Customer Service and Accounting people overtime to key them in manually. We may be charged penalties for not to the customer for not completing the EDI transactions. And so on.

There are real dollars involved when business processes fail. Normally I am not the most even-tempered person in the world, but this time, every time I started to get angry I thought to myself: "and how do they sysadmins on Wall Street feel?", making my problems not seem as critical. But it was a very ugly week.

sPh

Re:Not Me

[sphealey]

"I bet you have security guards, fences and cameras to protect your buildings from 14 year old kids.

Why don't you have a secure firewall to protect your servers? "

There's something to that argument, and I have already abased myself in front of the owners of the company.

OTOH, we DO (and did) have a firewall and virus scanners of reasonable strength. I also own a house on a fairly heavily travelled street. Should I have to put up 3m walls with razor wire and install bullet-proof glass, as they do in Jo-burg? Is that a pleasant way to live? And what about personal responsibility on the part of the felon who did, in fact, actually cause the damage?

sPh

Re:Not Me

[Ryandav]

I hate to ask, but are you assuming that everyone who was unable to reach your site never came back to complete the interrupted transaction? If so, I don't believe I would take the numbers themselves quite as seriously. It's unreasonable to assume that based on the average amount of business time a given site remains offline due to Local problems , that people haven't learned "gee, maybe I should come back in 5 minutes". It's kind of a new "internet-ism".

People posting damage estimates should included some indication at how they were arrived at: its just a part of gaining credibility. 50 different companies are going to estimate it 50 different ways, and everyone from consultants to law enforcement will have their own definition.

Re:Not Me

[technos]

Despite the fact that I thought we were patched and secured, the Nimda worm hit our servers.

Oops indeed! All of Nimda's exploits were old. You had what? Five months? At a total cost of $25,000?? Damn, I hope you have some money put away, because if you were one of my employees, you'd be working at half pay to reimburse the company for your negligence. That's on a good day. On a bad day, you'd be fired, and I'd call Legal to have them sue your ass once it cleared the doorstep on your way to the unemployment line.

Rule 1: If you're an NT admin, you have to stay on top of *EVERY* patch. You don't patch, your company loses money because of your negligence. If you don't patch, you deserve to lose your job.

Now, if you're one of those companies that has lost a lot of 'good men' to rule 1, perhaps you should not use Microsoft products? Perhaps they're not everything the Microsoft rep told you they would be...

Re:Not Me

[sphealey]

Good luck finding work in the real world. I am afraid the days of 600-man data processing departments went out with the 1960's. And while we do have security guards around our physical facilities, we don't have detachement of 200 ex-SAS blokes with night vision and sniper rifles, either.

sPh

Re:Not Me

[sphealey]

"Oops indeed! All of Nimda's exploits were old. You had what? Five months?"

You are assuming that you, and the security vendors, fully understand Nimda and all its vectors. I am not quite so sure myself.

sPh

Re:Not Me

[sphealey]

"And if you had your main office door open wide with a $25k piece of equipment sitting there with no apparent security"

We didn't. But even if we had done that, it would still be a felony offense to do 25k of damage to someone else's property. And the person who created Minda was not an innocent kid who didn't know what he was using. "I'm sorry - I didn't realize that a bottle of gasoline was dangerous". Yeah, right.

sPh

Re:Not Me

[sphealey]

"Oh no, you did leave your front door wide open.

It is also not necessarly a felony offense because even though the net damage could have been $25k, you would only be able to claim what would have been reasonable damage."

We had private addresses, a proxy server, a firewall, packet filters, a virus scanner, and various other mid-level defenses, plus 99 out of 100 recommended patches (mea culpa). If that counts as "wide open" you live in a different town than I do (and in my town, people do actually leave the front doors of their house open into the evening).

And the "intent" thing will work, up to a point, for someone under the age of 14. I wouldn't bet my bacon on it if I were older than that.

sPh

Re:Not Me

[ryanvm]

The cost in real dollars (not "gartner dollars" or "TCO dollars) to clean it up was around $25,000. For one small manufacturing company.

Bullshit. Have you ever seen how these companies estimate their damages? $5000 for the computer the report was typed on; $6500 for the manager's time; $1500 for the laser printer it was printed on; et cetera. It wouldn't cost somebody $25000 to clean up a virus if they had Bill fuckin' Gates doing it.

So exactly how is this Nimda bomb not a "serious offense"?

Breaking into an unpatched/insecure OS is a piece of cake (and not just Microsoft OSes either). When kids are writing software that can cause over $1 billion in "losses" worldwide, it's a sign that there is a bigger problem than the hackers. Software systems need to be self-patching, and companies need to hire competent people to install them.

When you are running a NT Server with IIS and have taken no steps to secure it - you are begging for trouble. You might as well take all your digital assets, burn them on CDs, and dump them in the fucking street.

Re:Not Me

[berzerke]

All of Nimda's exploits were old. You had what? Five months?

You forget several things.

1. Microsoft does not test their patches. The patch probably will fix the problem, but they are also known for introducing new problems. Patching from Microsoft is rather risky in and of itself.
2. Security at many firms is a low priority, at least until there is a crisis. At a place I used to work, I actually got repremanded (more than once) for "wasting time installing patches".

Re:Not Me

[Rogerborg]

• they need counseling to know WHY what they are doing is bad

Worms are baaad, m'kay, so don't write worms, m'kay, 'cause you'll be baaad, m'kay.

I'd like to council them with a length of rubber hose. And yes, I have thought that through, very carefully indeed.

Re:Not Me

[Rogerborg]

• If you're an NT admin, you have to stay on top of *EVERY* patch. You don't patch, your company loses money because of your negligence. If you don't patch, you deserve to lose your job

You apply SP6 to NT4 the day it comes out. Your company's Lotus Notes system falls on its arse. You lose your job.

Admins have a hard enough job keeping a known, stable system running without applying day-0 patches every time Microsoft figure they're screwed up again. Applying patches immediately and automatically isn't a black and white issue, and all your sound and fury won't make it so.

Re:Not Me

[Rogerborg]

• you assuming that everyone who was unable to reach your site never came back to complete the interrupted transaction?

That's a good point, but on the other hand, every time your site goes down, you stand to lose customers permanently, and that really costs.

I agree that (average revenue per unit time * down time) is a sucky way of calculating loss, but working it out any other way would just add to the cost of the downtime.

Re:Not Me

[Rogerborg]

• I bet you have security guards, fences and cameras to protect your buildings from 14 year old kids. Why don't you have a secure firewall to protect your servers?

My company, like most, has a bunch of minimum wage geriatric rentacops, armed with torches and haliotosis. About three months ago on a Saturday, one of the guards let in a guy who claimed to be from another of our offices and who urgently needed to collect some data. He took him around the building, opened doors for him, then left him in a lab. When he came back half an hour later, the guy was gone, as so was about $5,000 of equipment containing sensitive development data.

My company, like most, has firewalls and filtering to protect us from outside intrusion. Last week, some sales weasel with a laptop running 19 month old McAfee definitions got Nimda'd while surfing at home, then trojaned the bastard right into our system. The thing kept propagating so fast that we had to turn the servers off, and lost a full day of productivity across the entire multinational.

Shit happens, and heads have rolled, but the cause of both of these incidents wasn't lax security, it was that one guy decided to steal a bunch of stuff, and another guy decided to wreck our systems.

When your house gets broken into, do you think "What a bastard!", or do you think "Gee, I should really have bought better locks."

Re:Not Me

[Rogerborg]

• Bullshit. It wouldn't cost somebody $25000 to clean up a virus if they had Bill fuckin' Gates doing it.

My, what a well informed opinion. As a counter example, my multinational employer had to take the entire corporate network offline for a full day to clean Nimda off. That's a day of tens of thousands of people doing nothing, not some Lame-O-Whiz web site going down.

Re:Not Me

[CaraCalla]

Why don't you send the bill to Microsoft? After all it's their software which sucks.

Re:Not Me

[GreyPoopon]

I think it's time we rebel against this UCITA crap, and start demanding some security in our software products.

I agree with that it's time to rebel against UCITA, but I don't think that'll help this situation too much. If we can lay aside (for the moment) Microsoft's negligence, you'll see that there's a much larger problem. For all of these virus attacks, people should have fixed their machines within 48 hours and the attack would be over. But instead, there are still machines pounding away weeks after initial infection. The single biggest problem is the lack of knowledge. People are running web servers and other vulnerable services who have absolutely no idea how to handle security. They don't even know they are infected. Let's assume that everybody agrees that Linux has less security holes than Windows. Yet we all know that if you install an out-of-the-box Linux server with all the services turned on and humming along, then connect it to cable modem or DSL, you have just provided a public computing resource. This rarely happens because few people running Linux are likely to do something that stupid. The key here is user knowledge. With "always on" connections coming into greater and greater use, people really need to learn a bit more about their computer security. If they have no need for a web server on Windows 2000 Professional, they should know how to turn it off. Now, if only there were a fair way to ensure that everybody using the 'net had such knowledge.... Oh well.

Re:Not Me

[GreyPoopon]

I'm just honestly interested in where that figure comes from.

Let's start with one possible source: Overtime Pay. I don't know about the business cited, but I know that here our admins are completely busy with project work. We are always upgrading and changing system configurations to meet project needs. If our servers get a virus, they either have to change their project deadlines (which could be really really bad), or they have to work overtime to fix it. That would be at 1.5 times the pay for each hour each person puts in.

Here's another piece of the pie. I'm a developer. I have a list of projects I'm working on. I depend on the development systems being up and running so I can get my work done. There are very few other things I can do when the servers I use aren't working. Now if the virus takes out our servers, and you add up downtime before we could get the admins to look at it, and downtime while they figured out what was wrong with it, and downtime while they fixed it, and downtime while I made sure my PC wasn't impacted, it can get quite large. During that time, I'm being paid to do nothing remotely related to my job role. If they want my projects completed on time, they now have to hire a consultant to help with the work.

One more cost that I can immediately think of: somebody in IT to send out notification of the problem and come up with a good way of explaining to people who've been infected how to fix their PC's. Remember, these people have daily tasks too. If they spend time working on other things, they have to work overtime and get paid for it. Many times, it might be late hours helping to disinfect PC's for users who just don't know enough about them to do the job themselves.

Even though it seems kinda stupid to include estimates of people's downtime in the cost, you really have to do it. Anybody who isn't doing their normal job and getting paid for it is wasting money. The work doesn't go away. It just either takes longer to get it done, or you have to hire more people to accomplish it in the same time frame.

Re:Not Me

[psin psycle]

If he threw a bottle of gasoline through the window and did $25k of damage, he would be prosecuted for a felony.

We've know about these exploits for many many years. There are even patches for them, fire retardant materials and bullet proof glass. For some strange reason though, it is still the bottle thrower who is at fault and punished, and not the poor facilities guy who didn't upgrade the bits that make up the windows to something that cannot be attacked.

Why the double standard? In the 'real world' good-enough security is, well, good enough. In the computer world, good-enough security gets laughed at and scorned.

Re:Not Me

[RollingThunder]

Good point on the disruption of non-sysadmins, don't know why I blanked on that one. Probably because I've been damn lucky, and the one time we got tagged, it happened late late at night and I was able to fix it with no disruption to the users.

The cost of defacement one is a fuzzy one to determine, that's why I was asking. :)

Not saying "how on earth can you say it costs", just "how do you determine your costs?". :)

Re:Not Me

[ptomblin]

The cost of many of these factors (except employee down time in certain instances) is a fuzzy one. And I can't give you formulas to calculate, merely assertions that it does cost.

For instance, I know often when I'm shopping on-line, I'll do a web search or a pricegrabber.com search, and if the first match doesn't work, I'll go an order from the next one. And if some future time I'm looking for something similar and once again those same two firms come up one and two, I will remember that firm number two worked well for me the last time, so I'll go back to them before even bothering to see if firm one is back on-line. That's a case of a 5 minute outage leading to permanently lost business. Not a huge amount of business, but no business likes to lose even one profitable sale.

Another loss is sysadmin opportunity cost. Providing your sysadmins had something else to do at the time, presumably they will have to do that other task later. That's an opportunity cost - maybe the people waiting for those tasks to be done will have to wait longer, maybe you'll end up paying your sysadmins over time, or maybe the sysadmins will resent the time spent away from their game of Quake and make higher salary demands next time.

As an aside, I had a friend whose boss told her that he expected the systems would be so well administered that as long as nothing broke, she (my friend) could spend most of the day playing Quake.

What?

[jpinnix]

No double stockade and fireants for the IIS creators?

Re:What?

[chromatic]

Presumably they already have to attend Microsoft pep rallies, where Steve Ballmer may dance again. Haven't they suffered enough?

Re:What?

[einhverfr]

Presumably they already have to attend Microsoft pep rallies, where Steve Ballmer may dance again. Haven't they suffered enough?

They do. Trust me. Which would you prefer...

SysAdmins....wake up

[cOdEgUru]

Gosh! It would be interesting to see if any more servers turns up affected after so much of patching and screaming and thrashing. I would normally expect everyone of those Admins to patch their boxes by now, but at the same time, there would be some more, either ignorant or out on vacation, who is bound to get hit.

And when shit hits the fan, the management is sure to turn around and bite yelling "But we all knew about it..Why didnt you do it ?" .. Err..well..

Patch those boxes up..and do so in a routine manner. Sure its pathetic and time consuming. but its your data and your hardware..

Re:SysAdmins....wake up

[Roofus]

Heh, I work with a guy who isn't the brightest at times. He's been setting up a 2000 Server that's been hit twice with nimda in the last week. He reinstalled the server from scratch after each infection. His response?

"I put the computer on the network to install Norton, and it keeps getting infected before I can get the updates"

Ok, TWO THINGS:

1) If your going to install IIS, do not plug it into the network you've shut down IIS. Then go download the updates.

2) Norton isn't going to stop you from getting infected, it will only warn you about it during a routine check. If you want your machine to stay healthy, PATCH YOUR GODDAMN SYSTEM.

Seriously, Microsoft has a little utily called HFNetChk that will scan any local or remote system and will tell you what patches need to be applied. This includes system, IIS, and SQL Server, and IE.

Not all updates are listed on the little automatic update website.

Sigh...

Re:SysAdmins....wake up

[sphealey]

"Gosh! It would be interesting to see if any more servers turns up affected after so much of patching and screaming and thrashing. I would normally expect everyone of those Admins to patch their boxes by now, but at the same time, there would be some more, either ignorant or out on vacation, who is bound to get hit."

You are assuming, of course, that all the vectors of infection are known, all the behaviours of the worm are understood, and that patches exist for all of them.

It's typical terrorist tactics to hit the same target twice 20 minutes apart. That way you get all the rescue workers and gawkers too. The IRA figured that out years ago - the WTC killers just perfected the idea.

So perhaps Nimda was designed to throw a scare into everyone, cause them to run around and download lots of patches, expend lots of effort - and then 10 days later do its real dirty work.

sPh

Re:SysAdmins....wake up

[q-soe]

We use netchek and it works like a charm - the problem we had with Nimda was that the SAP servers connected to our network but maintained by the providor (we are in month 3 or an Enterprise Rollout) were unsecured and not running any virus protection, we got slammed by nimda - it did not hit any of our servers in the front door thru IIS but spread to boxes not running IIS but connected to the SAP system and to dekstops from there.

Thats then thing that really pisses me off, we spend the time to lock down and secure our netowkrs, hours patching systems and making usre virus scanners are up to date and then we get slammed by servers we have no access to or control over - yet we are the IT dept.

If we cant maintain it and gurantee it safe then it should not be on my network dammnit !

Re:SysAdmins....wake up

[geoffb91]

Be careful how much you rely on hfnetchk. It only verifies that a patch is installed but doesn't actually tell you if it is valid. If you are using NT there isn't an easy way to know the patches are valid (there is a utility out for Windows2000 that will check this).

We had an NT 4 IIS server that hfnetchk gave a clean bill of health and it was actually vulnerable to Nimda because one of the older unicode patches was somehow undone and no longer working.

Microsoft also released the URLScan utility that filters incoming requests for unicode, dots in the path, backslahes, etc. and blocks them before IIS can be affected.

This is much more pro-active since it might actually have a chance of blocking a future exploit simply because the requested URL is unusual and triggers the filters. It also can protect a server from some common attacks even if IIS is not fully patched.

-G

Re:SysAdmins....wake up

[Judg3]

Agreed, HFNetchk essentially looks for Registry keys that state which patches are installed. If you use it, always use the '-z' switch, which tells it to not look for the registry entries. This makes it take a little longer, because it searches for actual files, but it's ALOT more accurate.
Also, eEye has a neat little NIMDA Scanner which will do up to a Class B net looking for exploitable machines. Sometimes finding a machine that COULD be infected is harder then finding the actual infected ones.
URLScan is nice, but you really need to know what your doing to run it, as it's easy to mess up a webserver thats running fine.
But the most important thing to do is to get on those security lists, NTBugtraq, MS security lists, etc. As well as hitting the big security related sites out there before your morning cup of coffee to make sure nothing new has come up.

It's all basically common sense, but every now and then you need a nice reminder.

Learn Internet Security Or Get Off The Web!

[BIGJIMSLATE]

I believe this Wired article applies in this case (as many machines are still left unpatched), as well as an idea of what some ISP's are considering/doing if their subscribers don't have a clue.

(Plain-text link):
http://www.wired.com/news/business/0,1367,47037, 00 .html

sircam may me feel warm today though...

[edrugtrader]

a video game i wrote 10 years ago in Qbasic was just emailed to me today via sircam...

that means that someone actually had it on their computer, and that made me feel all fuzzy.

god bless sircam, and its glorious resurrection and distribution of great software titles.

Re:sircam may me feel warm today though...

[BIGJIMSLATE]

I had a similar case, but it involved some porn. Now naturally I'd be happy about that under normal circumstances, but not if it's my freaking SISTER!

EWW.....

Re:sircam may me feel warm today though...

[allism]

Ummm...your sister SENT you this porn or your sister WAS this porn?

Re:sircam may me feel warm today though...

[ocie]

Yeah, it's good to see that push technology is finally coming to the net :)

Re:sircam may me feel warm today though...

[geekoid]

isn't that the wierdest feeling?
I went to a someone house to find out why there PC was running slow, they had a program I wrote 8 years ago, and they were still using it! I did ask him why he never sent the author the shareware money(10.00). he said "I'm sure he made so much money he won't miss my 10 bucks".
then I told him it was me, and NO ONE sent me ANY money. boy did we laugh. Of course he still hasn't paid me my 10 bucks...rat bastard.

Fight back

[Anonymous Coward]

Check out my script! If you're running Apache, it'll monitor the logfile and send mail to the Administrator of the infected server!

Re:Fight back

[Sagarian]

Given the way that these viruses work, and given that your script fires a message to everyone who attempts to Code Red exploit a server running your script, and that there's no central registry of which servers / email addresses have been notified by your script :

Wouldn't this script, if widely employed, bring forth massive tidal waves of email as well?

Imagine an admin's joy at finding that not only are 20 of his servers infected and/or destroyed, but he has an inbox full of thousands of messages that are now swamping his mailserver.

Given that the communication of the email is not secure, could a malicious party not monitor traffic for copies of your script's message, and thus know exactly which servers can be exploited?

Perhaps a better solution would be a secure central registry / database of known-infected systems, which exposed a secure known-infected system reporting mechanism (even a simple XML message protocol via https for example). Just thinking on the fly here...

Anyway, the intention is noble...

Re:Fight back

[technos]

Wouldn't this script, if widely employed, bring forth massive tidal waves of email as well?

Please! As a patched NT admin, let the unpatched be DOS'ed off the face of the planet.

Re:9PM GMT == 1AM EST???

[frknfrk]

from the article it is clear that the 1 AM Eastern Time Friday is the correct time. And what is ET, GMT - 5, right? So it will be 6 AM GMT.

-sam

Why the sudden infux?

[Anonymous Coward]

Why is windows suffering so many of these attackes recently (I know this is the same but I mean coupled with Code Red etc)? Is it becuase the exploits have only recently been found that enable them? This implies that fewer such exploits existed in older MSware - is this true?

Is their widespreading mostly helped by the recent influx of cable/dsl users? Instead of the usual MS bash, could we try to explain some of the factors that make these stories so common on /. recently?

Of course, we can't escape that it was Microsoft that published exploitable code but I'm sure their software has always been as bad so what else is behind the current surge?

Fireants

[irix]

I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants.

I'd like to see some fireants for the server admins who still haven't patched for this thing. What kind of rock do you have be living under not to have heard of this by now?

Re:Fireants

[IronChef]

What kind of rock do you have be living under not to have heard of this by now?

Rocks like this:

216.84.60.138

I have the addresses of a lot of other rocks. They appear to be quite common. But how can you alert a rock-dweller if they don't have a domain name and email set up?

Re:Fireants

[IronChef]

OK, yeah, that works for this particular IP address... I didn't bother to check before I posted. I suck. But MOST people attacking me do not have any extra info available. If you look up what there is, you see that it's one of a zillion faceless @Home cable users (for example). What can you do about those people? They are the real problem, because they don't even know they are compromised. And you can't tell them. And you can't tell the ISP about them. ISPs don't care.

(Well, @Home didn't anyway. Now I am on Speakeasy DSL and they are killing circuits of infected people, which is great.)

Re:what do you mean again?

[ncc74656]

Ditto...I'm up to nearly 13k hits logged since Nimda began, vs. a bit under 10k Code Red hits. The weird bit is that the number of Nimda-infected hosts is much lower...400 vs. 3500 for Code Red. Maybe it spends so much time banging away at the same system that it doesn't spread itself as effectively as Code Red.

Math?

[sharkey]

9pm GMT -04:00 (EDT) is 5pm EDT.
9pm GMT -05:00 (EST) is 4pm EST.

However, the time mentioned in the article is 1am ET. Hazard a guess that it is really EDT they are citing, making 5am GMT zero hour. It will be 12:00am (Midnight) EST.

Re:Math? (Mea Culpa)

[timothy]

You're right -- I just updated it to reflect the right time :)

Sorry about that.

timothy

Nimda cost me Microsoft.

[standards]

My organization was hit hard by Nimda. Our poor Windows Administration staff ran around like crazy cleaning, patching, and upgrading hundreds of machines.

Is this a Microsoft problem? You bet.

Microsoft OSs do not have a complete, common set of system administration tools built in. This results in haphazard machine administration.

Microsoft and other companies sell useful administration tools, but these are high priced tools that only do a piece of the job. And since they aren't included with the OS, very few sysadmins have expertise with them.

So Microsoft, get on the ball. If you want to sell an OS, it should be ready for the enterprise.... including enterprise administration.

In the meantime, we're porting our apps from IIS to Apache. Yay!

Re:Nimda cost me Microsoft.

[bad-badtz-maru]

Our organization didn't do squat because we spent five minutes researching commonly accepted practices for securing IIS and NT boxes before we ever put our first box on the net. We do the same for every piece of hardware and software, exploits are not an MS-exclusive thing. The simple act of unmapping unused extensions in IIS has saved us countless hours (or days) of agony on many occasions. I suspect your organization may not contain the level of security-conciousness necessary to properly maintain systems connected to the internet since such security-awareness would have included remedial research into the securest method of presenting a piece of hardware or software to the internet. In other words, if your organization knew what they were doing, the issue you experienced would not have occurred. It's not an apache/IIS issue, it's a poor administration issue that will plague your organization, unless corrected, regardless of what OS and web server software they choose to deploy.

Hope this helps,
maru
www.mp3.com/pixal

Re:Nimda cost me Microsoft.

[Pfhreakaz0id]

God, where are my mod points. Gee, one of my Win 2k dev servers hadn't been touched in two months, but It STILL didn't get the damn thing. (niether did it get code red. Why? Because I FOLLOWED THE RECOMMENDED GUIDELINES for setting up IIS securely. If you rely on the default setup for anything, your an idiot. Period. and I'm a developer, not a sysadmin "network guy"

Re:Nimda cost me Microsoft.

[trcooper]

So what happens when one of these things hits apache. It bothers me when people think they're immune, or somehow less vulnerable because they run a particular piece of software. Apache has had problems in the past, and common sense dictates that it will have problems in the future. Could someone write a worm that attacks an older version of Apache? Sure, and as an admin you have to assume that it is going to happen.

If you're hit by one of these things, 99% of the time it's completely your fault. Nimda can be combatted by a patch that's been out for quite a while. Don't blame the OS, don't blame the software. Be a man and take responsibility. Blaming this problem on IIS is simply ensuring that you'll get hit again. Switching to Apache is fine, but you still have to make it a priority to keep up to date on patches.

You have to get to the root of the problem, and that's bad admins.

Re:Nimda cost me Microsoft.

[ethereal]

So, if there are recommendations on how to set it up securely, why isn't that the default? Still sounds like a faulty product to me.

Re:Nimda cost me Microsoft.

[NMerriam]

Our organization didn't do squat because we spent five minutes researching commonly accepted practices for securing IIS and NT boxes before we ever put our first box on the net.

Unfortunately Nimda spreads itself over shares, too -- so our server was well-maintained, but every shared directory on there was filled with the .dll and .eml files from Nimda that users had been infected on their desktops.

All it took was a single person on our network who had disabled their antivirus to spread it all over ever network drive in the place.

Re:Nimda cost me Microsoft.

[NMerriam]

So what happens when one of these things hits apache

Nimda on unix would have to attack Apache, Samba, the system password file, the email client, the email server, the firewall software, and the kernel itself.

Just taking over the web server would not be half as effective as the MS viruses have been -- they spread by email, by web, by network shares, etc.

Re:Nimda cost me Microsoft.

[trcooper]

Blame the sysadmin? Sure! The sysadmin who hasn't fixed it on his own machine is a problem. But what if the sysadmin's machine is protected? Is Nimda still his problem? You bet!


Huh? Machines in my shop were patched. We had no problems. The NT machines reacted the same way to Nimda as the Unix machines... Log the request and go on.

You act as if you've used a bug free peice of software. I've used NT, 2K, RH, Debian, Solaris, Digital Unix... and oddly they've all had bugs in production releases. They've all needed patches, or upgrades to prevent attacks. Bugs are a fact of life, and have to be expected.

Sysadmins are paid to maintain these systems, and have responsibilities to stay current on patches. But there's a lot of bad sysadmins out there, and there's a lot of companies who don't want to pay a sysadmin. Folks who were affected by these recent worms need to look at that as the problem and not the software. If your machines got hit by both code red and Nimda, fire your sysadmin, he's worthless. If you don't have one, evaluate the cost and see if it might not be a bad idea to find someone to take care of your systems.

MS isn't to be blamed on Nimda. The hole was known, and they had released a patch for it. Anything beyond that is out of their control, and up to the people you pay to take care of that.

Re:Nimda cost me Microsoft.

[trcooper]

Nimda on unix would have to attack Apache, Samba, the system password file, the email client, the email server, the firewall software, and the kernel itself.

Actually all it would have to do is find a root exploit somewhere and it has everything. Apache, BIND, WU-FTPD, et.al. have had root exploits in the past. Would it be hard to write a script that hits one machine and starts scanning for more with the same hole, or even one that looked for multiple holes? Nope, assuradly not.

Nimda was assisted by the shear number of people who will click anything emailed to them. The readme.exe file could have attacked UNIX machines as well. And heavan forbid it's not a script kiddie who writes the next one of these. Someone with some talent and forsight could cause some significant damage.

My point is this: This could happen on any platform. It could happen on multiple platforms. It could be just as effective on any platform. You are not safe simply because you run a particular OS. The only way to prevent this to be vigilant in keeping current on patches. PERIOD (Well, besides keeping your machine unplugged and locked inside Fort Knox)

Re:Nimda cost me Microsoft.

[Pfhreakaz0id]

the point is, worms/viri/hacks are expect to see a default setup. Put a partition with ONLY the web root. No amount of virtual directory /../../.. is going to navigate to anything besides the data. There's lots of other suggestions, but that one would save you from Code Red and Nmidia both without patching.

Sure, I'll fault Microsoft for it's setup. IIS servies should not be on by default, Particularly in win 2k pro, that's bad. Map paths should be off by default (so ../../ doesn't even work). But if you call yourself a sysadmin/webmaster and have a web site running on a public server in C:/inetpub/wwwroot, you just haven't really thought about security. Now if you have a hack, it is sucessful, the first thing the dude is going to do is "../../WINNT/System32/Cmd.exe" if you've changed your directory, they are lost!

Dangerous Viruses??

[dragons_flight]

Whatever happened to all the "3v1|_ h4x0r5"(TM)??

We seen a number of highly infectious viruses in the last year (Sircam, Code Red, Nimda, etc), but none of these were actually very destructive. Sure they are a pain to get rid of, and may spread a little information around, eat up bandwidth, or compel you to reformat just to be sure, but they aren't flattening people's systems.

Whatever happened to the anarchists out to destroy the system? Now admittedly I don't want to encourage people to be more destructive, but it seems almost trivial to think of ways that viruses and worms could easily be made more destructive. For instance, upon infection, delete everything in the "My Documents" folder. Or, change default web page to a share of the whole computer. Or even wait a couple days and then wipe the person's hard drive.

I haven't been vulnerable to anything to come along lately, and I'm glad, but I'm also glad to note that the truly skilled black hats out there seem to have moderated how much damage they actually intend to do. I wonder if they are scared what the law might do to them if their attack truly was evil.

Re:Dangerous Viruses??

[Minstrel78]

The reason that these widespread viruses aren't as destructive as one might imagine they could be is analogous to how viral outbreaks happen in nature, IMHO.

Most successfull viruses don't kill their hosts right away, or ever, as by doing so they destroy their own method of propogation. Even if they did no harm for some amount of time, you'd find that the number of vulnerable systems would be down very quickly once that timer hit on a large scale, whereas with non-destructive viruses, you're almost garunteed to have repeat outbreak becuase of lingering infections out there that never get cleaned up, or are left for long periods of time.

In general, the more destructive a virus is, the shorter it's overall lifespan, and the lesser the overall damage.

Re:Dangerous Viruses??

[desertfool]

My first day at a computer related job (helping users) in '94 I found a computer with NATAS. That was one nasty virus. A real bitch to get rid of. And the computer had to be completed cleaned and re-installed. Then, upon scanning, I found several more that also had been infected, but it hadn't popped up and decimated the .exe and .com files yet. What a mess.

The new worm/virus phenomena is more of an annoyance. I keep my servers patched and protected, but I get 20+ emails a day from my users (all properly paranoid) about the new virus they heard about while driving in to work. That is the worst part.

Re:Dangerous Viruses??

[dragons_flight]

I don't buy it.

Viruses in nature are developed through evolution and mutation and thus long term survivability makes sense. Computer viruses are intentional creations of people, and it doesn't seem to me that virus writers would neccesarily focus on making them last in the wild for a long time. There are people who just like destroying stuff right? And depending on what you destroy or how you do it, it isn't neccesarily immediately obvious to the user, or going to stop the worm from seeking new hosts.

Also with the IIS worms, they tend to just about saturate all vulneralbe machines within the first few days if not hours. Once you've got 98% of what's available to get, then shutting all those down doesn't cause much loss in total reach. Especially since after a point the infection rate goes down due to patching faster than it increases from finding still uninfected machines.

Some people say they write viruses to demonstrate vulnerabilities, well it doesn't seem like a huge leap, by that logic, to decide to start taking out vulnerable software.

Somebody please show Gartner this article

[Carnage4Life]

After I heard about the Gartner report calling for a rewrite of IIS, I couldn't help wondering how a company that is supposed to be full of analysts can miss the mark by such a great deal. The problem with IIS isn't that it needs a rewrite, because a rewritten version will probably still have bugs since it will be a non-trivial piece of software and all software has bugs, but that

1. Microsoft needs a better way of getting patches out to people. Preferrably something as simple as the apt-get/cron combination.
   
   
2. IIS admins are typically inexperienced and unknowledgable about security and thus never get around to installing a patch even though it was released almost a year ago.
   
   
3. IIS patches need to be on the Windows Update website.

Re: How can I protect myself?

[none2222]

. . . running Win2k and IIs on my dorm computer. Am I at risk?

To put it mildly, YES! While it's true that Microsoft products are no less secure than those of other vendors, Microsoft's position as market leader makes them a prime target for hackers, virus writers, and other internet terrorists. You really have no business running a web server until you learn something about security. You can start by reading up on Nimdahere.

There is blame for Microsoft as well

[chongo]

I'd like to see a nice double stockade for the writers of Sircam and Nimda ...

I'd like to see something similar for the IIS developers along other selected members of Microsoft.

... or maybe a class action lawsuit against Microsoft for using their monolopy to propogate such insecure code?

Stockades all around

[ackthpt]

I'd like to see a nice double stockade for the writers of Sircam and
Nimda, and maybe some fireants.

Yes, and a special one for those who roll out vulnerable server software. Ideally, with all the attacks, IIS should get stronger, as a body's immune system does with constant testing, however, it would indeed be a sad body which has been so patched. Make Frankenstein's monster look like George Clooney.

Terrorists?

[Ghoser777]

Here's what most terrorists do. Atleast this is what I've heard/seen done by past terrorists:
1. They take hostages
2. They kill people
3. They make demands
4. They invoke terror in their victims

In no way do these "hackers" fit the description of a terrorist except for maybe #4. These are generally just people who find a whole in security and take advantage of it. They can be really annoying, and people who make these types of viruses should be tried for damages, but I don't think they fit the desciption of a terrorist.

But more important, I think Ashcroft isn't talking about virys writing hackers, but any type of hacker. Essentially, if you mess with a system at all, then you're a terrorist accroding to Ashcroft.

Boy, my parents must be disappointed in me now, rasing a terrorist..

F-bacher

Re:Terrorists?

[jiheison]

These are generally just people who find a whole in security and take advantage of it.

Hackers find security holes. Crackers take advantage of them.

Re:What about Microsoft?

[sharkey]

Maybe InfoWorld uses FrontPage 2002 to do their page creation. If so, they wouldn't be able to give proper credit to everyone involved, as it would violate the EULA.

If you follow good practice...

[drinkypoo]

Then you're not vulnerable to either.

Good practice in this case means keeping your systems updated to the latest patches, not having open shares at all, and updating software to the latest version. It also includes not using software known to be not only a security risk, but basically an open door to "hackers". Note the quotes, please. They indicate sarcasm.

If you have patched Win2k to SP2, are running IE6 final, and do not use outlook, you have protected yourself from every vector these worms, except for the "Web Folder Traversal" issue. That's a minor quick fix, though it shouldn't have been necessary.

Why am I willing to specify not using outlook and not specifying not using IIS? Because it became abundantly clear that outlook was unsafe well over a year ago, whereas IIS could have been terms "more or less okay" until recently. Also, you just can't walk away from NT/IIS webservers and jump on the *[iu]x bandwagon right away, because there's all that ASP code lying around.

Until M$ rewrites outlook, outlook express, and IIS from the ground up, you should immediately (or as close to immediately as you can get) stop using them. Given that IIS sucks anyway, you might as well stop using it permanently. I understand the allure of outlook, and the interoperation between it and exchange, but consider a web-based scheduling/collaboration system. Exchange is pretty lousy anyway, for a whole bunch of reasons I won't bother going into here.

And finally, this is not anti-microsoft FUD, this is all based on reality. I'm not against microsoft on the desktop, or microsoft servers to serve microsoft clients. But we've seen time and time again how running microsoft windows of any flavor as a web server platform incurs a much higher cost than unix, because unix just doesn't tend to break as often -- Or be compromised. While this is not an OS-level bug, you really only have one choice as far as performance and support goes for a webserver on windows, and it's not a very good choice.

Re:If you follow good practice...

[Spy Hunter]

WARNING to IE6 users or people without Outlook installed: You are not invulnerable! A virus file on your system can still easily be excecuted. I recently got infected, and it was the dumbest thing ever. Some time ago I had to reinstall Windows (gdi.exe was corrupted!?!), so I backed my files up to my friend's computer over the network. To get them back I made an open share on my computer (should have had a password) and sent them over. When I was done I noticed that some *.eml files had been inserted into my open share. "Hey, that's the virus I read about on Slashdot," I thought. So I went to delete it. I simply selected the file to delete it (I didn't run it) but Explorer, in its infinite stupidity, ran the file in the preview pane! Simply by the act of selecting the file I had run it inadvertently! This on a system running IE6 without Outlook installed!

Fortunately I was able to boot into Linux and delete all those .eml files, then download a virus remover from McAfee or someplace. But let this be a warning: Before deleting a .eml file, TURN FILE PREVIEWS OFF!

Re:If you follow good practice...

[jiheison]

Not hackers, crackers dammit!!!!

What's sarcasm?

Re:If you follow good practice...

[kerincosford]

Thats simply not true.

I run w2k pro sp2 with IE6 at home (dual-booted with slackware), with all of the various MS patches installed, behind a firewall - I know the dangers of IIS.

Last week, I was browsing through some UK web agencies, and one of them had been infected with Nimda. Unlike most other people who got hit by Nimda, when I hit that IIS server, I didn't get a "save as..." dialogue. My firewall didn't notice anything amiss either.

All that happened was :

My desktop background changed to a chessy pic of a skeleton over a forest background.
My machine started grinding away like hell.
I muttered "Oh fuck." under my breath and whipped the cable out of my ethernet card so my girlfriends machine didnt get affected, as far as I could manage.

I'm no sysadmin guru, but I'm a pretty savvy user, and had patched my system up fully, and I still got dicked. Yes, it wouldnt have happened if I was under *nix, but I do a lot of work with Shockwave and Flash, so 9 times out of 10 I'm running win32 rather than linux.

It blows.

Re:If you follow good practice...

[einhverfr]

This is correct. Also, if you have the authenticated users group listed in the share or ntfs permission areas, even if write access is denied, the virus can still write itself to your hard drive (had this happen, but fortuantely caught it in the act...).

The IE6 issue can be prevented by disabling file downloading in the security settings, and the share issue can be resolved by removing the everyone and authenticated users groups from the share and NTFS permissions of shares.

Re:If you follow good practice...

[sheldon]

Umm, you don't want to install every damn hotfix in the world on your machine. Some of them are only needed if you have a particular RAID controller and you are trying to run FTP during a full moon.

The important ones in this context are all listed, up to date, under www.microsoft.com/security

Re:If you follow good practice...

[sheldon]

That's interesting, but Nimda doesn't change the desktop background to a cheesy pic of a skeleton.

I don't know what you did exactly, but I seriously doubt it came from your browsing stuff through IE 6.0. Especially considering IE 6.0 is not vulnerable to the MIME problem Nimda exploited.

Perhaps you aren't as savvy as you thought.

Re:If you follow good practice...

[Spy Hunter]

uncheck the option in the view menu that says View as web page

Re: How can I protect myself?

[matty]

While it's true that Microsoft products are no less secure than those of other vendors...

You're Trolling, right? It's been over 3 years since the last remote root exploit in Apache, and IIS has had several this year!

If you're not Trolling and you actually believe what you just said, you'd better do some research.

Re:Thanks, guys

[carlos_benj]

Why do you need to label yourself anyways?

So we know what shelf to sit on?

I am so sick of this

[ellem]

I administer Notes, NT, Win9x and a Linux box, plus firewalls yadda, yadda.

I work in a Corporate Travel Agency in NYC, they just decimated my entire staff and I have me and one other guy who has been relegated to inputting ticket refunds.

I DON'T HAVE TIME FOR THIS! My lone IIS server has been patched since the first day. Lotus Notes doesn't care about these dumb ass viruses (virii) and my Norton's are all up to date.

My USERS got this crap from infected web pages!

We're losing a machine a day in the field b/c these bozos can't figure out how to click on a button called VIRUS_FIX on the corporate intranet.

I am ready to frigging quit and become an English Teacher fuck the money! If the whole MS world can be brought to its knees everytime some kid in Sweden has the day off then we're all fucked.

CIOs who continue to use Outlook/IIS deserve whatever happens to them. (We HAD to use IIS for a 3rd party software app.) Micorsoft SHOULD ABSOLUTELY BE PAYING IT'S CUSTOMERS BACK FOR THIS! HOW DARE THEY GET READY TO RELEASE YET ANOTHER VIRUS RUNTIME OS.

It is seriously time for the MCSE farms to be shut down and for corporate America to move to another OS. Fuck the users; guess what they don't know all that much about the OS they are on switching them now will have no lasting impact.

Re:I am so sick of this

[Black Parrot]

> I am ready to frigging quit and become an English Teacher fuck the money!

Read up on "run-on sentences" before you quit your day job.

Stocks, Stockades & Pillories

[remy]

Sorry to be nitpicky-Stockades aren't much of a punishment, really just a jail. I think you mean stocks or a pillory.
Take a look here: Stocks and Pillories

I summon buckets of fireants!

[Jayde Stargunner]

...especially considering that the IIS patch has been available on WINDOWS UPDATE for the last THREE MONTHS. Fireants for any worthless tech who hasn't figured this out yet.

-Jayde

Re:Math? (Mea Culpa)

[ekrout]

I didn't know you read comments (or just the ones about articles you post?). That's cool, as well as the fact that you can admit when you make a mistake every once in awhile.

Re:A Tribute To Laxness or Stupidity...?

[jedwards]

Because there are a million people that don't even know they're running a webserver.

When you log attempts on port 80 from infected boxes go and have a look with a browser.
The majority will show the default "this site is under construction" page, the rest show the Code Red defacement page.

Reading the code is one thing.

[xFoz]

Okay so they checked the code. But did they test it out? Has somebody changed the time on a server [issolating it first] and seen if really starts flinging bad bits?

How long until someone drops the bomb?

[Anonymous Coward]

If there's anything surprising about the entire worm phenomenon, it's that the payloads have been so benign. There's absolutely no reason why that has to be the case though, and sooner or later some little shit is going to slip in something like:

FORMAT C:

as the ultimate payload of a nimda-like worm, and all hell, and I truly mean all hell is going to break loose.

I think that it's absolutely shocking that no one knew until right now that the damn thing is going to start up again tomorrow. What else don't we know about the program? I certainly hope that the experts who are now giving us some six hours notice (at night!) that the damn thing is about to restart haven't missed any other little details of the worm's operation.

The entire ISS/Outlook security situation is absolutely shameful. Microsoft has been fucking around for years piling on layer after layer of buggy, insecure active this and executable that into the Windows mail system, and pretending that it doesn't matter, and the result, today, right now, today, is an internet that's about as secure as an airport with no guards, and half the locks in the terminals and on the planes flat out nonfunctional.

Someone is responsible for this mess, and it ain't the folks who wrote the RFCs!

Re:How long until someone drops the bomb?

[Pathwalker]

That would be really stupid. If the machine is not working anymore

Now, wouldn't it be nasty if the next worm did something really really destructive, iff it noticed that some set of security patches had been installed; otherwise, it would just spread normally.

This might help it preserve it's ecosystem (unpatched IIS systems) by discouraging people from installing security patches unless they make sure that there is no way for the worm to get in.

Even that wouldn't concern me very much - spreading and wiping out systems is not actually the most destructive action that can be taken. What scares me, is the possibility of a worm designed to be hard to notice, that just changes data and erases all traces that it was there. - changing a few numbers on a spreadsheet, changing tolerances in an engineering design.

Little things, that might be nothing, but might result in a company being closed down for tax law violations, or a bridge collapsing decades in the future.

That thought scares me.

How to install patches without a network?

[jvj24601]

I was helping a friend install Win2KPro on his home machine to do some development work (for work, of course). I'm not a big Win guy, but I've done the point-click install before.

Anyway, as soon as we were done (installing while his home network was live), we tried getting to windowsupdate.microsoft.com to install patches. However, we soon discovered that we were already infected! Two freaking minutes after installation!!

If you don't install behind a firewall, how the hell are you supposed to get updates to all of Win2kPro's problems without getting infected?

Re:How to install patches without a network?

[finite_automaton]

Turn off (IIS/PWS) before you hook the machine up to the net.

Now reinstall and try again.;-)

Re:Thats it ... time to go

[jiheison]

Sure we'd hear about them, just not as much as we bo with MS's great products.

Of course you realize that Linux hasn't had nearly enough exposure to back up that claim.

Administration tools

[fahrvergnugen]

The sad truth is that patches to protect yourself from these worms were released well ahead of the worms themselves. Getting hit by it is irresponsible, but Microsoft's current patching procedures are such a mishmash that getting the right information ahead of time is a total bitch.

Those who are forced by circumstance to be responsible for administering IIS and other microsoft software should look at St. Bernard Software's UpdateExpert. It's a little pricey, but it doesn't cost nearly as much as even one full day of nimda / CodeRed / etc. infection.

It simply keeps a list of all patches released on the Microsoft support site, and lets you roll them out to machines on your network without the users knowing about it. It's saved my bacon a few times now.

The myth of regular patches

[Carnage4Life]

If a piece of software requires regular patches for serious security problems, that's probably a sign that its basic approach to security is flawed.

But does IIS really need patches as frequently as you imply? Code Red, Code Blue, Nimda et al exploit the same security hole that is almost a year old. The problem is that for every security hole, there are several waves of worms because IIS admins simply never patch their boxes.

If you disbelieve me check out Netcraft's security survey which shows how long several IIS boxes have gone unpatched and that about 12% of SSL sites (meaning they are probably eCommerce related) running IIS have been "rooted".

Re:The myth of regular patches

[NutscrapeSucks]

A quick count at www.microsoft.com indicates that there's been 16 IIS patches (not including rollups) going back to September 2000.

Even if all of these vulnerabilities do not apply to the default configuration (for example NNTP), that's still lots of patches.

Read between Gartner's lines

[alienmole]

Did you read the Gartner report carefully? It said "enterprises hit by both Code Red and Nimda" should investigate alternatives. This implies that enterprises not hit by both worms don't need to switch.

If a company wasn't hit by both, presumably their security policies and procedures are either already up to scratch, or capable of being improved sufficiently. But if a company was hit by both, their procedures are probably beyond repair, and they'd be better off with a server that's more secure by default.

So I think Gartner was absolutely correct. Not only that, but people who didn't pick up that subtlety from the Gartner report are also more likely to need to switch servers, so the report works either way! :P

Re:Read between Gartner's lines

[technos]

As much as I beleive that Microsoft writes shit code: You sir, are right.

Re:Read between Gartner's lines

[Ryandav]

Absolutely.

Some one mod this man up...

People considering a change from the top should look at the report card of their IT department in recent times. It's been a bad summer for MS products...

Re:Read between Gartner's lines

[sheldon]

HAHA!

You are absolutely correct. :)

Patches, and security principles

[einhverfr]

I think the previous poster's analogy to Sendmail and Bind were quite appropriate. But I also think that Gartner is slightly over the top on this one too.

Apache is more secure than IIS because it does not trust itself to police itself-- it allows the OS to police it too! This is the problem behind Sendmail and BIND, and it also exists in many competing web servers, including Tux, Websphere, etc. I do not know enough about iplanet to comment about their security model.

That being said, there are some places where IIS may be the most secure alternative (where the security needs to be integrated into the user-level security on a domain, f. ex). I just believe that the world of serving pages to public networks is not it...

I smell an ASP migration product opportunity

[Sagarian]

After Gartner's recommendation, thousands of PHB's and even sane people will rush to switch from IIS to Apache / IBM HTTP Server / whatever.

Has anyone written a product yet to translate Active Server Pages (ASP) code to PHP, JSP, or some other format? Most of the basic scripting language concepts should translate pretty nicely.

Even if someone has built their IIS / ASP application 'correctly' (cough cough) isolating middle-tier logic to MTS or something similar, wouldn't Perl / Java / whatever wrappers to those COM / COM+ services also be straightforward to write?

Or has someone done this already? Isn't there (or wasn't there) a Chilisoft implementation of ASP that you could run on Apache and Linux?

killer app

[Anonymous Coward]

nimda and its ilk are the killer apps that will
spark the next information revolution.

I'm looking forward to Microsoft's first foray into creating actual worms, instead of just
providing the infrastructure.

One day we will all look forward to the next MS worm with all the enthusiasm that we now share for the next Windows.

It is not so simple as just blaming lazy admins

[moof1138]

I have been monitoring my logs, and most of the hits I get are from Cable/DSL users. I bet a lot of these people are unaware that they are even running IIS, let alone that they need to install a security patch.
I have not used W2k much (set up a test server at work, and reboot it now and then when it fails mysteriously), so I guess by default there is no automatic "Your Software needs updating" dialog that pesters you. If MS had their SW configured to do a weekly check and let users know that updates were available it would help. I know that Mac OS 9 and Mac OS X do this and it is useful for making sure systems stay current, and I wrote a few scripts that run as cron job on my Debian box at home that do apt-get update weekly, and mail me if there is a security update.
Maybe something like this is already there in W2K (though if it is it sould be surprising), and I just have never seen it, I apologize if I speak from ignorance, but if there is not, then MS needs to get on the ball. Their software is causing a lot of problems, and they need to be more active in making sure that their boxes get updated.

Re:It is not so simple as just blaming lazy admins

[einhverfr]

Yep. You are right. Most of the ones I saw were new installations of IIS, and not on any large corporate network.

I myself have helped at least five people uninstall IIS. None of them even knew what it was. One person asked me if they would still be able to view pages on the internet, like Yahoo... No I am not kidding.

Re:It is not so simple as just blaming lazy admins

[odaiwai]

If you use the Microsoft Update pages, a little app will be placed on your system which checks for critical updates. Every now and then it'll start flashing in the system tray and a dialog box will prompt you to go to Windows Update. It's not as good as a weekly 'apt-get update' (or CVSUP for FreeBSDers) as it needs user control, but it's better than nothing. IIRC, the Windows Update page had this feature as far back as Win98.

dave

Serves You Right.

[Drake42]

(I already made this as a reply to comment, but I'm irked about this enough that I want to post it to the main thread in hopes that people read it)

I bet you have security guards, fences and cameras to protect your buildings from 14 year old kids.

Why don't you have a secure firewall to protect your servers?

We are living in the time that 100 years from now people will look back and think we must not yet have evolved properly. They will look back and think, "Why did they put up with that idiocy? Were they just stupid back then?" And parents will shrug and grandparents will say "It was like the frontier!" and kids will think "Wow. Those guys were stupid."

Don't bitch about the lack of govenment protection when all you have to do is install appropriate security which costs NOTHING. I don't want my taxes paying to protect you from your own laziness.

25K lost? Serves you right.

Re:Serves You Right.

[SuiteSisterMary]

I'll point out that a firewall won't protect from this, as these are legitimate http requests. Your gateway anti-virus solution and/or intrusion detection system, on the other hand, should catch these. But this sort of thing is NOT what a firewall is supposed to stop.

Re:Serves You Right.

[Rogerborg]

• I already made this as a reply to comment, but I'm irked about this enough that I want to post it to the main thread in hopes that people read it

And I find it funny enough, in a naive kind of way, that I'll respond again.

• I bet you have security guards, fences and cameras to protect your buildings from 14 year old kids. Why don't you have a secure firewall to protect your servers?

Most companies have geriatric minimum wage security guards who can provide only the most token form of protection.

Most companies do run firewalls that provide a great deal more electronic protection than their security guards provide physical protection.

In neither case are you protected from malicious or idiotic insiders who decide to (literally or figuratively) go around spooning ice cream into all the hard drives.

My own company was hit and the servers switched off because of the numbers of induhviduals who got hammered with Nimda (notably sales weasels with laptops bringing it in in the first place). The firewall was happily stopping intrusions from outside, but no firewall is proof against a sufficiently determined idiot.

Re:Serves You Right.

[SuiteSisterMary]

Oh, absolutely, and that's because most firewalls do content filtering as well; the lines between firewall, content filter and IDS are blurring every day. Hell, most of the nimda and codered bounced off of my firewall because the requests didn't match any of the server publishing rules.

Hmmm

[einhverfr]

YES! While it's true that Microsoft products are no less secure than those of other vendors, Microsoft's position as market leader makes them a prime target for hackers, virus writers, and other internet terrorists. You really have no business running a web server until you learn something about security.

Market leader?? If that was it, I think that Apache would be three times the can of worms that IIS is. You must admit that the default installation of Apache is MUCH more secure than the default installation of IIS.

IIS has the same design flaw that Sendmail does, an dit has enough market share to be a viable target. It is also true that many other vendors make the same mistake (including Red Hat and IBM)but lack the market share to be reasonable targets.

Moral of the story: If you want to use IIS, tell it only to listen to IP address 127.0.0.1. If you can't figure out how to do this, please install Apache instead. (www.apache.org)

Re:Hmmm

[einhverfr]

Actually easy. Most web servers send back a descriptor on the HTTP packets, so send a request for /mypage.ida and analyze the response. It should be pretty easy to write one in PERL...

Re: How can I protect myself?

[greenfly]

If they were going to exploit the industry leader then they *would* write Apache exploits. Despite what MS would like you to believe, according to Netcraft they only have about 20% of the webserver market to Apache's 60%. So that argument goes out the window, the underdog IS IIS.

Profit from it!

[manon]

Let's make some profit out of Nimda :)

Like T-shirts...
"I've been attacked by Nimda and all I got whas this T-shirt"
"Chicks dig Nimda"
"(front:)IIS (back:) you are dumb"

Or posters...
"Internet map of Nimda infected domains"
New 'Inc DeMotivators' poster :"Suicidal" with a kind of Nimda showing.

We should inform Thinkgeek of this nifty plan :)))

Let's all simply block Microsoft IIS

[EaglesNest]

The boss of my boss of my boss (his rank is somewhere around a full bird) asked me personally and the rest of the staff in earshot to encourage the entire enterprise (around 20,000 white-collar workers) to get off IIS. Although all MY web servers are Apache, most at the Enterprise are M$. We have never used Outlook and never will.

Well, I suggest that we go farther. We already block harmful and suspect viruses at our perimeter and throughout the enterprise. Why not instruct our routers, firewalls, and proxies to block any packets that indicate the content is coming from IIS - and block any M$ Internet Explorer broswer? Just drop the packets?

OK. I'm speaking toungue in cheek, but I could actually make a justifiable argument that such use has PROVEN twice in a month that those tools are demonstrated security risks and should be defined as dangerous activity.

Re:Some advice to cut down on the runnin around.

[technos]

It's not MS fault this happened

snip!

Just so happens more people are writing them for MS

Gee, why do you think that is? They don't exactly have a monopoly on the server market. Saying they have 30% is a error in their favour.

*gasp*

Do you think it's because they write a hole-riddled bit of software?? If 70% of the market is someone elses, and yet 100% of the exploits that make the news are written for MS, that does not bode well even in the most conservative analysis.

*gasp*

Now, if they did write a hole-ridden bit of shit, that does make it their fault! Damn, the logic train just keeps going... And just like MS, the verdict of the logic train ain't in your favour.

Re:Some advice to cut down on the runnin around.

[curunir]

It's not going to matter what o/s it is if someone can write a virus, root kit, whatever for it.

From the OpenBSD website: "Four years without a remote hole in the default install!"

Now, with the resources that M$ has, there's no reason why they shouldn't be able to say the same. The simple fact is that they've determined that they can make the public believe that they are not at fault, so it is more cost effective to add another "feature" to the os. If general motors didn't put airbags into their cars so that they could put in extra cup holders, would they be at fault? After all, it is the other car that actually caused the fatalities, right?

Don't want the attacks clogging up your logs?

[rayvd]

If you run Apache and hate looking at the hundreds of annoying attacks by the Code Red and Nimda worms, try adding these to your httpd.conf:

SetEnvIf Request_URI "^/default.ida" attacks # For Code Red
SetEnvIf Request_URI "^/scripts" attacks # For nimda
SetEnvIf Request_URI "^/c/winnt" attacks # ... ditto all the way down
SetEnvIf Request_URI "^/_mem_bin" attacks
SetEnvIf Request_URI "^/_vti_bin" attacks
SetEnvIf Request_URI "^/MSADC" attacks
SetEnvIf Request_URI "^/msadc" attacks
SetEnvIf Request_URI "^/d/winnt" attacks

CustomLog /var/log/access_log combined env=!attacks
CustomLog /var/log/attack_log combined env=attacks

This will dump all the "attacks" into a file called attack_log and leave your normal logfile clutter free.

Here is our example of the money breakdown

[div_2n]

I am contracted to a mid-size steel and auto-parts company. They have contracted out the most complicated IT tasks. From my company, there are 5 consultants that had to drop every task to battle Nimda. We bill at $75 per hour. We put in a total of about 30 hours a piece on Nimda last week. 30 x 5 = 150 hours. 150 x 75 = $11,250 in pure wages. We have about 100 sales people that couldn't do their jobs for a good 6 hours. I happend to know the average salesperson at the company sales about $5,000 in steel and parts a day. So lets say a low number of $2,000 per person was lost that day. 100 x 2,000 = 200,000. I think that number speaks for itself. Just in case my numbers are inflated (they aren't) lets remove 1/2 of that. 100,000 is still one heck of a chunk of change. That figure is just for our main office. We have 10 smaller satellite offices. Was it our fault? Maybe. Is it our fault that Windows is the defacto OS in the company? Absolutely not. I am one of the biggest pushers of Linux. I probably send the IT manager 3 links a week on Linux. The problem is that those in charge don't know squat about security. In fact, the IT manager is an accountant and she wouldn't know a router from a washing machine and if you mention a CSU/DSU she would probably mention what a great school it is. Bottom line is that Techies from Macrosalt built an OS that isn't worth crap. They have sales people that couldn't grasp recursion trying to tell IT managers who wouldn't know a VPN appliance from a toaster what a great product Windows is. Until the managers start listening to those in the trenches, this cycle won't end soon. Just my 2 cents worth.

I agree: M$ needs to get serious about security.

[Anonymous Coward]

1.Microsoft needs a better way of getting patches out to people. Preferrably something as simple as the apt-get/cron combination.

Apparently that's what M$ is working on right now...a system to "push" updates directly to .NET Server. They are also working on ways of applying the patches without the endless reboots between patches. Considering that companies have been doing this for years (Symantec "Live Update" anyone?) it's absolutely STOOPID that M$ hasn't done this before.

2.IIS admins are typically inexperienced and unknowledgable about security and thus never get around to installing a patch even though it was released almost a year ago.

And as someone who has been through eight (count 'em!) Microsoft Official Courseware MCSE courses, including their "Designing Secure Windows 2000 Networks" course, I can tell you from experience they don't teach you SHIT about security. You NEVER get tested on how to lock down IIS against exploits. Firewalls get short shrift in favor of endless prattle about VPNs. MICROS~1 needs to talk about security from point zero on in their MOCs. There is no excuse.

3.IIS patches need to be on the Windows Update [microsoft.com] website.

Actually they are, if memory serves me right. However, when Code Red v.1 was at its apex, Windows Update itself got hosed by the worm. Hilarious. I laughed my ass off.

Help?

[D Anderson n'Swaart]

I wonder if anyone could give me a couple of pointers, if they even notice this post among the zillion others. I run a dialup server (um, yeah) that I allow my friends access to, and to be honest, I'm getting very sick of Nimda/Code Red attacks, which are literally sucking my bandwidth dry (one particular fellow at 203.167.112.100 is really getting on my nerves); most of these people are on the Asia-Pacific IP range (as am I, since I am in New Zealand) however there seems to be no one I can contact, and I have serious doubts as to whether anyone would do anything about it anyway. To be honest, I have gotten beyond the stage of caring about whether it's right or wrong, and would simply like to stop having my (tiny) bandwidth sucked by stupid/ignorant people.

Since I am running Win2k with Apache 1.3.20 for Win32, and am relatively new to webhosting, I have little idea of how to do anything about the problem. Can the same Apache scripts that are run on Unix be run on Windows? If so, could someone point me to a website with a script that will at least pop up a message to the user of the machine, if not simply shut them down? Help would be much appreciated.

Windows Update?!

[dimer0]

Since I heard about Code Red, and Nimda, I've been hitting Windows update every day or so just to make sure I'm still up to date with all their security patches.. I've gone there before, downloaded security updates, and regularly make the rounds.

For the past month or so, all that's been there are IE6 and Microsoft Messenger 3.6. Whoopie.

So, I'm safe. Nothing can touch me.

UNTIL I SEE THIS STORY ON SLASHDOT. That "command line tool" (hfnetchk) showed that I had 8 security patches I needed to apply, one of them had a WARNING next to it.

Uh, hello Microsoft? Is Windows Update NOT for security updates? Just a place to peddle your frickin MSN Messenger!? I'm sure there's thousands of people like me who think that since Microsoft doesn't have any security updates posted under the CRITICAL heading on Windows Update, that we're free and clear. Geeze.

Re:Windows Update?!

[Meorah]

Ehh. You can't judge a book by its cover. "Windows Update" will not supply hot-fixes for security updates. These are combined with all the other new features, bug fixes, and security fixes in a SERVICE PACK. You can definitely get all your service packs from Windows Update, but you'll have to wait for them to actually come out. This is obviously unacceptable, which is why MS started releasing separate hot-fixes for any security flaws that simply had to be implemented immediately, and couldn't wait on any service packs.

You might also want to read the directions for the tool you are using before jumping to conclusions about what the "WARNING" means. Read the security bulletin, and try to figure out why they made it stand out from all the other patches.

So, in summary... MS used to release Service Packs for fixes/updates/additions/bloat/etc. Although this is adequate for non-life-threatening issues, it has quickly become inadequate for security. MS releases a free tool to be used AS A SUPPLEMENT to Windows Update, which will allow you to apply each new security hot-fix as they release them, instead of being forced to wait on the next Service Pack.

"CRITICAL UPDATES" are where Service Packs are placed. Those 8 hot-fixes are part of SP3, but you can download them now since they relate to security making your system vulnerable to certain viruses and trojans.

With the increasing awareness of security, I'm surprised that you assumed anything, when you could have taken 10-15 minutes on MS's site to find out how clueless you were.

Anti-Microsoft FUD

[sheldon]

First of all I love the comment "Given that IIS sucks anyway".

Just for the record. We had some issues with this at work because some development machines weren't properly patched. Old NT4 w/SP5, Office 97, etc.

At home, on the other hand, I am at the bleeding edge. Win2k sp2/hotfixes, Norton XP, Office XP, IE 6.0, etc.

Got home after fighting the virus at work, went to Outlook to check my email. Yep, got a handful of emails from Nimda.

Confidentally opened up the emails to see what they contained using Outlook XP... thought it was kind of cute, but I deleted them.

Went out viewed a couple of websites to see what the latest news was.

Then I decided I probably better update my Virus definitions, so I did that.

Not once was I ever vulnerable to Nimda. The IIS exploits were very old, as were the IE exploits. Outlook has had patches available since last year for Outlook 2000 to prevent this type of attack. Outlook XP by default out of the box blocks many types of attachments, and does not allow email with HTML content to be scripted.

So granted, some older versions of their applications and OS are vulnerable to some problems. What do you expect Microsoft to do? Fix it?

They already have.

Re:A Tribute To Laxness or Stupidity...?

[rodgerd]

I'm aware of one company where the major causes for concern were people running systems in violation of company policy (which is no net-facing IIS). They'd managed to sneak around the security controls in the company.

That wasn't the fault of the systems staff in the company, but they still ended up cleaning up the mess because a bunch of idiots were Doing The Wrong Thing.

More to the point, Nimda is *not* just another Code Red; it spreads through shares, email, and a number of other vectors, including browser use. It's quite capable of destroying an internal network simply by getting on a staff member's laptop while they work off-site and then unleashing itself internally.

Re: How can I protect myself?

[sheldon]

I would have thought the various reports from Netcraft showing IIS is in use on most commercial web sites would have laid to rest the false claim that Apache is more popular.

Re:Where does the blame really lay?

[IronChef]

The Windows EULA basically says that M$ is not responsible at all no matter what. In reality, whomever agreed to the EULA's is responsible for this mess.

That's unfair. If someone using Linux or FreBSD suffered from some kind of attack, is it their fault for choosing an OS that doesn't provide someone to sue?

And can you suggest an OS alternative that does provide legal recource for something like Nimda? I can't think of one.

Re:Why treat this so flagrantly, Tim?

[einhverfr]

Strange, I could have sworn nimda only used a selection of old, well known exploits, the patches having been available for anywhere between 1 and 6 months...

That is what everyone says. However, I have a hard time believing it because I have seen it hit systems with those patches on it.

I even saw it hit an XP system with a read-nly share (NTFS Permissions denied write access) and IE6 (which is not supposed to be vulnerable. IIS was not involved in either case, nor, surprisingly was Outlook, at least not directly...

eh... actually I'm glad about these viruses

[hypergreatthing]

There shouldn't be security holes that allow these viruses to exist in the first place. Don't blame the kids who wrote this, but rather blame microsoft. I'm sure you can use the excuses that microsoft can't be held responsible for everything their software causes, but this is rediculous. Why did it take tons of viruses for microsoft to even patch this?.. Why wasn't this patched before, or caught before and addressed? It's simply because microsoft can't afford to make their software secure until it's demanded, and that's just wrong for a company like microsoft.

Nimda is a tough worm to keep out of a network!

[Nonesuch]

Nimda is complicated beast.

Unlike 'Code Red', Nimda does not spread by pushing the worm binary in the HTTP request. The worm uses HTTP to find a vulnerable IIS server, then causes the IIS server to make a TFTP request out to the attacking host to retrieve the ~64K binary.

Most normal 'secure firewall' products aren't tuned to block outbound requests from the protected servers to internet hosts. Mine are, but that only gave me about 72 hours of lead time before it came in another way...

Even when firewalls block the IIS scanning, Nimda spreads by email, file shares, and by putting a copy of 'README.EXE' in the root of the IIS server and adding Javascript to all web pages on the server, pushing the worm at users of the infected web site server.

My firewalls block _all_ UDP packets, but my network still got hit hard, and probably incurred more like $60K in 'paper losses' -- lost productivity, bandwidth, overtime, etc.

We haven't found 'patient zero', but we have two good suspects, in both cases a user with a laptop that did not have updated anti-virus software and that got infected from one of these routes:

1. User took the laptop home and connected to an infected network/file shares.
2. User accessed 'hotmail' or a similar site and downloaded an attachment.
3. User visited an infected web site (probably at home) and ran README.EXE when prompted.

The common thread here is user error.

The best firewall is no protection against malicious, or just plain ignorant, users. Blame also falls on local admins for failing to push virus signature updates and keep up with system patches.

I've only ever seen around a dozen inside hosts from which the work was actively scanning HTTP, but the worm traffic from those dozen machines alone was enough to severely degrade WAN and firewall performance.

Re:Nimda is a tough worm to keep out of a network!

[Milalwi]

Unlike 'Code Red', Nimda does not spread by pushing the worm binary in the HTTP request. The worm uses HTTP to find a vulnerable IIS server, then causes the IIS server to make a TFTP request out to the attacking host to retrieve the ~64K binary.

Most normal 'secure firewall' products aren't tuned to block outbound requests from the protected servers to internet hosts.

I would hope that most firewall admins aren't allowing TFTP outbound!

If you don't need the service, turn it off. Only allow what is required.

Now if Nimda had used HTTP to retrive the Admin.dll file, many more folks would have been infected, as most firewalls do need to allow HTTP outbound.

Milalwi

Re:HF NetChk

[Foaf]

Cheers for the HFNetChk info. What a pain that it needs IE 5 to run. There's no way I want to install that on a production server on a Friday afternoon. Not much choice though...

Re:Nice astroturfing

[sheldon]

How much are they paying you?

I share my knowledge and expertise for free.

not here yet :)

[mbyte]

See up to date MRTG statistics Nimda-Log

Command line tool link fixed

[prototype]

The command line tool listed in the article link is broken. Below is the updated one to Microsoft's Network Security Hotfix Checker (hfnetchk):

http://www.microsoft.com/downloads/release.asp?rel easeid=31154

Enjoy!

liB

What if changing from IIS is not an option?

[new-black-hand]

Alot of companies have spent large amounts of money on IIS based websites that cant just be moved over to an Apache or other webserver. I think there has been too much hype about IIS being insecure, perhaps companies should just stop leaving the responsobilities of webserver security to clueless admin's with microsoft certs.

With a few easy steps, you can setup an IIS server so that it wont be vulnerable to a large number of new vulnerabilities and worms taking advantage of these vulnerabilities.

- Take the time to do a custom install of the option pack, and remove what you wont need (transaction server, frontpage extensions etc.)
- Setup the webroot on another drive (not C:), and make the filesystem NTFS.
- Remove all sample directories
- Remove all associations to default ISAPI objects (webhits.dll, ism.dll) from the management console
- Apply the latest service pack
- Apply all the latest hot fixes since the latest Service Pack (only those that apply to your server).(http://www.microsoft.com/technet/security )
- Monitor Microsoft alerts and security mailing lists for latest bugs
- Turn off verbose error output from the server, and have a customer error (404) page, a custom 404 page still returns a 200 OK response and confuses alot of scanners
- Install an IDS (snort has been ported to win32, http://www.snort.org)

All this shouldnt take too long, and will give you a much better chance of surviving a worm outbreak.

Here's how I'm getting them patched

[DrSkwid]

I've gone through my logs and found quite a few

What I do is go connect to the offending box via smb

Usually they have a printer attached to it so I print out a page of A4 with :
"YOU ARE INFECTED WITH NIMDA, SORT IT OUT
here's how : http://www.antivirus.com"

on it in 72 point text

it's working so far

if they don't have a printer then they usually have an open share that's world writable so I leave text files called

you are infected with nimda.txt

and put the url inside them

that's closed a couple too

(I also found a keygen I'd been looking for so that was a bonus)

I'm not sure if nimda resets the passwords but which might not lead to a surprise of how far you can go with

un : adminsitrator
pw :

have fun

Re:Here's how I'm getting them patched

[Hard_Code]

Attorney General Ashcroft: You are in violation of the Anti-Terrorism Act. Go directly to jail. Do not pass go. Do not collect $200. Hacker bastard. By the way, please work with us against terrorism.

Re:Where does the blame really lay?

[IronChef]

OK, so which OS is the "real house?" MacOS? Windows? Solaris? Which OS is licensed under terms providing you with someone to sue when there's a security flaw?

I don't think such a beast exists.

Re:Math? (Mea Culpa)

[Rogerborg]

• Yes, I'm friends with Britney Spears

Jeez, if you're her friend, tell her to get her radiation scarred sagging skin out of the damn sun. That woman is turning herself into jerky.

Also, last I heard, friends don't post candid photo's on the web for every cheez-o-news site and pathetic geek (like me) to leech then lech over. Give the girl a break, huh?

How to protect an intranet with Linux?

[avel599]

OK, let's say there's an intranet with all sorts of Windows boxes, which uses a masquerade (IPCHAINS) Debian Linux box to connect to the Internet.

How can I use the Linux firewall to protect all the machines inside it from those evil viruses? Any ideas/URLs? There *must* be something!

Re:How to protect an intranet with Linux?

[new-black-hand]

If you are talking about mail viruses, and if your workstations are picking up their mail from your linux server. Then you can install a mail scanning package on the server that scans all incoming and outgoing mail for viruses and can generically block certain file extensions (.vbs etc.)

Amavis (http://www.amavis.org/) works with most major virus scanning software and mail servers (sendmail, Qmail, postfix etc.) and i find that it works well.

Mine didn't realy freeze...

[budgenator]

but of course because /dev/mouse is a streaming file, it caused the browser to basical block until the end of time. Mouse movement got real glichy. I almost was able to click to kill icon on NS, eventualy had to [ctrl alt backspace] to stop X-Windows. Actualy I thougth that my machine handled it pretty well. Brought back memories of running windows. Immagine in Linux we have to emmulate viruses via diliberate user intervention; or of course use WINE/IE/OUTLOOK.

Hello people, we're at war remember...

[budgenator]

and sense we're at war, why should we be suprised that we're under attack? There are terrorists out there that want to destroy our way of life because we are sucessfull and not living in their 14th century fuedal theocratic version of utopia. MS VP thinks using free or open source software is un-american; well get a clue running unpatched MS software is aiding and abetting the enemy in my book. And if you think one million people in the far east is going to go to microsoft.com to get patches for their bootleg software; I've got some realy nice office space in the WTC to lease to you.

The authorities have Carnivore and echelon stuff running overtime. Do you think this is all a coincidence, or does it feel more like a way for the terrorists to bury their commo channels in background clutter, while still asaulting a worthy target? sphealey, do you feel like you're being kicked in the groin? well don't take it personaly, you and your company is just one battle in a terrorist war to take down Microsoft, and after that probably Sun. Maybe they'll have a hard time deciding between Apple and Linux for number three.

These guys hate the internet because it lets us communicate and do business all over the world. We can post our opinions and our rants for the world to see, and they don't want the world to see. They think we're soft, decadent in short we are their prey. It's their perogative to use us like chattle, just like they do to their own woman. Just do the math $25K for one company times all of the simalar companies, the economic implications are staggering. What is this doing to the TOC for the products of the biggest software company in the world? Viability for future sales? Remember most of the Military runs on Microsoft, and they flew an airliner into the pentagon. What happens if Microsoft goes belly up five years from now?

Microsoft might to have to put some money in an reactive defense initiave to counter-attack infected users; maybe send then viruses who's payloads are uninstalled patches. How many broadband users would even notice?

I know this sounds like a rant or troll but just think about it. Actualy Linux needs Microsoft to keep things honest. We need to get the message out to everybody, use a firewall, use anti-virus and get those patches installed. If we don't do it it will be legeslated.

Re:Hello people, we're at war remember...

[sphealey]

I year ago I would have said you were nuts. Today, while I don't necessarily agree with you, I can't dismiss your theory either. Great way to live.

sPh

Re:Math? (Mea Culpa)

[greenrd]

Also, last I heard, friends don't post candid photo's on the web for every cheez-o-news site and pathetic geek (like me) to leech then lech over.

Er, if Britney was worried about that, don't you think she'd have left showbusiness long ago?

Re: How can I protect myself?

[budgenator]

My brother told me about a class he went to about securing web servers Apache, 15 minutes, Netscape 30 min. and IIS, the remainder of the two day course. Go Figure, it's not because of market share.

Re:Virus Patch?? I got this a while back,

[budgenator]

I use apache so I dont know what this does, and I added backslashes to the get just to be safe and choped off the code so not to distribute
203.247.193.77 - - [09/Sep/2001:09:15:57 -0400] "\G\E\T /default.ida?Code_Green__V1.0_beta_written_by_'Der _HexXer'-Wuerzburg_Germany-_is_dedicated_to_my_sis terli_'Doro'.Save_Whale_and_visit__and_ Code deleted on purpose HTTP/1.0" 200 1 "-" "-"

We need 'Bandwidth Liscenses'

[eth1]

They would work just like a driver's liscense.
Class A: You can administer high-bandwidth connections (ISPs)
Class B: You can get broadband
Class C: 56k dialup max
Class D: 28.8 AOL for you!

Ignorance

[_anomaly_]

You might wanna ask yourself a question before replying to posts... "do I really know what I'm talking about, or at least to sound like I do?".
Concerning the Nimbda virus (if you're referring to something else, sorry, I assumed you were OnTopic), even if you have EVERY patch installed on your MS IIS servers, you still get slammed by random IP's from MS servers that weren't patched, thereby bringing "your internet" to a slow crawl (bandwidth/data rate dependent, of course).
So, all in all, in defense of the NT admin you responded to (FYI, I'm not an Admin, I'm a programmer), sometimes you can't do anything about the problem besides try blocking the most common IPs that hammer your site, after all, you aren't going to be able to get all of them blocked (which is probably what they were doing till 3am).

Re:Ignorance

[ScuzzMonkey]

Here, most of the scans seemed to be from our ISP's netblock, so I'm guessing that how badly you were affected depended mostly on how many infected NT machines your upstream provider served. For instance, I noticed significant degradation from Nimda, although we were not affected; from Code Red, however, I didn't get a single scan. I think that luck played a factor in how badly any of us were hit by these worms--if no instance of it got loose inside the scan range, other hosts never got infected, and service was good. If it did get in, you got slammed, whether you were vulnerable or not.

Re:Ignorance

[b1t r0t]

even if you have EVERY patch installed on your MS IIS servers, you still get slammed by random IP's from MS servers that weren't patched, thereby bringing "your internet" to a slow crawl (bandwidth/data rate dependent, of course).

First of all, if you have every patch installed and don't get infected, then you're helping by not contributing to the problem. And you're keeping internal machines (which might not be accessible from the general Internet due to firewalling or NAT) from getting infected and making your own problem worse.

Second, a lot of the problems people are encountering are due to ARP storms as unused IP addresses are scanned. The solution is to have a proper mix of routing and switching, and not to simply pipe a LAN in one branch office to every other branch office by using VLAN trunking. You have to break up the ARP broadcast domains to keep the effect under control (which it seems most cable modem companies are not doing). VLAN switching isn't a substitute for proper routing.

No, but you can try NET SEND

[phillymjs]

Try

NET SEND [idiot's IP address] Hey idiot, your friggin' computer is infected with [IIS virus of the week], why don't you get a clue and fix it?

My Mac server's firewall software has been logging these attempts forever. I'm currently looking for an AppleScriptable Mac program that can send out these NET SEND messages to the idiots automatically. For now, I have to print the firewall log from my Mac and send the messages manually from my PC.

~Philly

Re:what do you mean again?

[ncc74656]

I got 45,000 requests on the 2nd day (first full day). I think each attack has something like 7 requests in it, checking for various ways in, not just one.

The SQL query that extracts the count from my logfiles only looks for one type of activity. I said something about needing to fix the query to consider the other requests Nimda makes back when it first hit, but I never got around to it.

At least the 'net so far today doesn't seem to be bogged down like it was when Nimda first hit...

Re: NATAS

[b1t r0t]

I remember that one from a previous job. The thing about it was that we normally never noticed it, but there was one cash register PC where the floppy drive would stop working once NATAS took hold. It wasn't used very often to test code, but when one of those stopped reading floppies, it was time to go around and run a virus checker on hard drives and stacks of floppies. Also nasty was that it would infect an executable file of some sort in our software which had a file extension that the virus scanner's "quick" mode didn't scan! After about four years (yes, years), I think we finally got rid of it.

Re:Math? (Mea Culpa)

[Rogerborg]

• Er, if Britney was worried about [having candid photos from relaxing on the beach posted online], don't you think she'd have left showbusiness long ago

I know, plus anything that you do in a public place has really to be considered public. It's not the same as snapping her with a tele lens through a window.

I'm just an old fashioned guy, I suppose. ;)