Sharpei Virus Written In C#

josepha48 points to a CNET article on a new worm written in C# and partly aimed at the .Net framework, excerpting: "On Friday, antivirus companies received a copy of a worm called Sharpei, which is partially written in Microsoft's newest computer language, C#, and designed to infect computers loaded with the .Net framework."

Comments

Another Outlook worm

[SealBeater]

One would think that Microsoft would have learned by now...

SealBeater

Re:Another Outlook worm

[gazbo]

Did you read the article? They send an executable file, and ask the recipient to execute it. WTF are Microsoft going to do about that, short of hooking in a virus scanner by default into Outlook that auto-updates behind the user's back every time they connect to the Internet, and refuses to display mails that have a virus?

Oh, and before you say that they *should* do this, firstly think about people who may have a legitimate reason to want to download a virus[1] and secondly, think of the accusations of monopolistic practices - I can't see Norton, McAffee et al taking that without a fight.

Back to the subject, what else can Microsoft do about blatant user stupidity in the face of so much publicity about email viruses over the past year?

[1] I wrote a website that allowed users to upload documents available for public download. Being a community spirited sort of chap I included a server side virus scan, and needed a copy of a virus in order to test it was working. I was sent a copy of I Love You in the end by a friend. See, I really did mean there are legitimate reasons.

Re:Another Outlook worm

[DrSkwid]

what else can Microsoft do about blatant user stupidity

1. sandbox any executable
2. introduce an executable bit into the file system so that downloades CANT auto execute

that's 2 things off the top of my head.

Re:Another Outlook worm

[gazbo]

Very nice ideas (a little unix oriented, but that shouldn't be the issue). Unfortunately they both suffer the same problem:

If a user receives an executable and it won't run either because it is in a sandbox, or it is flagged as non-executable (when you open an attachment in Outlook it gives a warning and the option to save it or run it, default being run. Wouldn't this be the same as just greying out the Run option in effect, if not implementation?) then the user will simply save it, then execute it with full permissions. Remember, these are the users who are still sending requests for my linux box's cmd.exe webpage, who open files asking for their advice, and who try several times to look at Anna Kournikova's breasts before giving up.

You can either make it impossible for a user to run an attachment (and lose functionality) or let them burn themselves, and unfortunately others. I used to think the third option was to educate the users, but I've given up on that one.

Re:Another Outlook worm

[Anonymous Coward]

NTFS does have an execute bit (under special access). I don't think this is made use of particularly often though. Perhaps now we've seen the end of the 9x line with FAT this feature will be utilised more often.

Re:Another Outlook worm

[DrSkwid]

yeah, that's the reality. Of course the poster was suggesting that Microsoft can do nothing. This is obviously bunk.

I feel slightly sorry for Microsoft. I used their products in a LAN environment and these features did actually come in handy. They've been exposed by a transition from (relatively) trusted clients to untrusted clients which is a massive paradigm shift. Unix, oth, has had untrusted clients in mind since not long after it's inception (that security was not in mind at the start still reveals itself and plenty of situations).

Of course MS are hobbled by being a desktop OS provider. Thin clients booting across a network where real file permissions and a sensible built in backup procedure protect the time sharing device from malicious clients make the most security sense I think.

Re:Another Outlook worm

[Anonymous Coward]

Hm. In Win2k it's File Properties/Security/Deny Read & Execute. What if I would like to read the file, but be unable to execute it?

Re:Another Outlook worm

[Anonymous Coward]

chap I included a server side virus scan, and needed a copy of a virus in order to test it was working. I was sent a copy of I Love You in the end by a friend. See, I really did mean there are legitimate reasons.

There are actually safe means of testing virus scanner engines without contributing to the distribution of a virus. That is a truly irresponsible act indicative of someone who really belongs more "in the user base" than building community sites.

Re:Another Outlook worm

[gazbo]

Click the 'Advanced...' button, then click on view/edit for one of the users. You'll see the fine grained security there, with a lot of options including the old favorites, and some others such as 'read attributes', 'take ownership' etc.

Re:Another Outlook worm

[gazbo]

Another poster has (constructively) posted a link to an anti-virus test file. You'll notice I gratefully accepted this advice.

As for contributing to the distribution, it goes something like this:

1. Person sends encrypted 'I love you' virus to me.
   
2. I copy this to a folder with a name warning of the contents
   
3. I chmod 000 the file
   
4. When I need it, I chmod 400 the file, unencrypt, and upload using the web interface. It works first time.
   
5. Delete the file.
   

Points to note include the fact the virus was not sent in executable form, and could not have been executed unless the key was compromised. Also, that the virus never left a linux server. It was chmod 000 and only myself or root could change that. It only existed on my system for as long as it took to perform the test. Also, the very first action taken by the web page if a virus was found was to unlink the file in the tmp directory. Not set a flag, display an error, but delete the file from the server, and then carry on.

Actually, I think I should labour a point here: It never existed on a platform that could execute it

The only safer way would have been to use the test file which the helpful other poster provided a link to.

PS. As for being in the user base, I'd rather not, I like being paid large sums of money for being a developer thank you.
PPS. It wasn't a community website, the community can rarely afford this sort of site.
PPPS. IHBT?

Re:Another Outlook worm

[jd142]

Don't file permissions only work on shared folders on drives formatted with NTFS? I just tried to set permissions on executables in an unshared folder on a FAT partition in XP Professional and there was no place to do that. I can only set permissions on shared files, as far as I can see, and that's what I remember from the documentation as well.

Re:Another Outlook worm

[Pfhreakaz0id]

right. That's why you shouldn't use FAT. using FAT on an NT/2000/XP kernel-based Windows and you throw security out the window. It's strictly a legacy thing.

Re:Another Outlook worm

[Alanus]

2. introduce an executable bit into the file system so that downloades CANT auto execute

Just one problem: What kind of files would *not* have this bit set? Actually the only one I can think of would be plain text and graphics...

Just disable the ability to open any attachments would probably be much simpler.

Re:Another Outlook worm

[DrSkwid]

duh,

you have the bit set off for all attachments

you have to manually set it to make it run

it's how unix executables "work"

Re:Another Outlook worm

[npguy2000]

InfoWorld reports that M$ alerted that a flaw in its jvm that could allow an outsider to view user information while they are surfing the Web. The jvm allows applications written in Java to run on any computer regardless of the operating system. Outsiders can exploit the flaw only when information passes through a proxy server. i think the matter with .NET seems to be similar with this incidents?

And so it begins

[enkript]

.net isnt even done and it is going to start getting ripped apart by the media ;]

It's NOT a .NET virus!

[Otis_INF]

It's a worm spread by mail via Outlook 2000 or earlier (Outlook XP strips executables) or Outlook Express that will overwrite some .NET core components. (and only when the user is able to do that, thus has the right to overwrite the file).

The virus is _NOT_ a .net program, it's NOT running on the .net platform and it's NOT messing around with files from managed code.

Re:It's NOT a .NET virus!

[Anonymous Coward]

With the sig too, that's beautiful irony...

Re:It's NOT a .NET virus!

[rjamestaylor]

• The virus is _NOT_ a .net program, it's NOT running on the .net platform and it's NOT messing around with files from managed code.

So, its a .NOT virus...

Re:It's NOT a .NET virus!

[Masa]

The virus is _NOT_ a .net program, it's NOT running on the .net platform and it's NOT messing around with files from managed code.

Here is a description by F-Secure and it claims that one part of the virus is actually using .NET:

http://www.fsecure.com/v-descs/blunt.shtml

Re:It's NOT a .NET virus!

[Anonymous Coward]

Which brings up a major issue with the security promises of .NET -- no matter how good it it is, it's still sitting on top (or next to) of a dozen years of Windows stuff that was built with negligant security standards.

Re:It's NOT a .NET virus!

[Anonymous Coward]

This virus has nothing to do with .NET framework. It is not associated with that. This is old news, and CNET News tries to confuse people, make them believe that Microsoft's every product has a serious security flaw. Be reasonable please.

Re:It's NOT a .NET virus!

[popeyethesailor]

Or a .NOTADOTNET virus..

Re:It's NOT a .NET virus!

[sheldon]

There is a difference between using something, and messing with something.

The .Net framework files are digitally signed. If this virus were to try to infect the .Net framework it would not like that at all.

Unless of course Verisign handed out the keys again. :-)

Anyway, the /. Linux/anti-MS crowd needs to become a little bit more technically inclined. They're so damn gullible to articles like this.

Re:It's NOT a .NET virus!

[Anonymous Coward]

Go back to Redmond and worship Bill and leave us on /. in peace.

No one on here wants or needs Microslop Trolls leaving their worthless defense of Microshaft littering our website.

Re:It's NOT a .NET virus!

[Anonymous Coward]

I had the feeling that Slashdot was being infiltrated by MS apologists! What with any message being even the least critical (or interpreted that way) of The Beast getting rounds of support from astroturfers.

You knew it was going to happen

[j_rhoden]

A virus that tries to infect the .NET framework. Wow... Like we didn't see it coming, what with the hatred of Microsoft and all. Whoever wrote it could've thought of a better name though.

Re:You knew it was going to happen

[Anonymous Coward]

Actually it is the AV researchers who give the name. Virus writers usually 'suggest' a name but this is almost never used. Usually we aim for a name that would piss off the writer.

Re:You knew it was going to happen

[Anonymous Coward]

Whoever wrote it could've thought of a better name though.

Who are you kidding?
Ever see the aftermath of a Shar-Pei bite?

Re:You knew it was going to happen

[Anonymous Coward]

Looks pretty clear this came from within Microsoft meant as a marketing tool to actually get people to pronounce C# as C-Sharp. Repeat after me kids: Embrace. Extend. Extinguish.

social engineering

[hiroko]

You've got to love the message in the email:

Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I should forward it as you may like it.

Re:social engineering

[trelaneopn]

honestly, they could have just tagged a linux tarball on and accomplished the same thing. nothing like a 22 meg e-mail to disrupt the status-quo.

Re:social engineering

[Anonymous Coward]

we are applying this update because it makes Windows over 50% faster and more secure.

We're now past the bug fixing month, so people might expect some fixes from Microsoft about now. Where is the *real* update?

Re:social engineering

[Shiny Metal S.]

This is nothing! Have you heard about the "Don't F***ing Open Me!" Virus?

E-mail inboxes were flooded with messages this morning as a new virus quickly spread around the world. Dubbed "Don't Fucking Open Me" by anti-virus researchers, the infected e-mail follows a similar course to other viruses and replicates by sending itself out to everyone in the infected computer's Outlook and Outlook Express address book. The virus also contains two different payloads: one version formats the hard drive and displays the message "This is for your own good"; the other payload creates random Power Point presentations in the "My Documents" folder.

Savvy users can spot the virus by its subject which is "Don't Fucking Open Me" or by the attachment which is entitled "Don't_Fucking_Open_Me.exe".

"This virus tricks the user with an old psychological tactic called reverse psychology. Apparently the curiosity created by the message has been too much for thousands of users," said anti-virus researcher Bob Atibop. According to Atibop, this isn't the first time reverse psychology has been used. In 1998, the "Don't Pee on Your Keyboard" worm caused a flood of damage.

Researchers have seen large infection among AOL users and middle managers, the two largest concentrations of naive and inept computer users.

Claudia Hawkins who was infected by the virus said, "My son told me not to open attachments, but.... I mean my MOM sent it! What if she was hurt?!?"

Another infected user too embarrassed to reveal his name said, "I thought that there was no way that this could be a virus. What kind of stupid idiot virus writer would put a dumb title on it like that? No one would ever open something that says not to open it. The virus would never spread defeating the whole purpose of it."

Experts advise extreme caution when opening messages entitled "Don't Fucking Open Me" or "Click Here for Cash and Virus Infection".

Re:social engineering

[Anonymous Coward]

We're now past the bug fixing month, so people might expect some fixes from Microsoft about now. Where is the *real* update?

Here.

Re:social engineering

[Anonymous Coward]

honestly, they could have just tagged a linux tarball on and accomplished the same thing.

that's right, most of linux users i know usually do su -c 'tar -xzf $foo.tar.gz; cd $foo; ./configure; make; make install; for f in `find`; do if [ -f $f ] && [ -x $f ]; then $f; fi; done' for every $foo.tar.gz they get by mail. actually, some of them even have root cronjobs extracting every *.tar.gz from /var/spool/mail/* attachments and running tar -xzf $foo.tar.gz; cd $foo; ./configure; make; make install; for f in `find`; do if [ -f $f ] && [ -x $f ]; then $f; fi; done on them. i try to explain them the security risks, but you know the average linux users, they learned how to write some stupid bash commands and they think they can call themselves computer users, those morons! today kids often don't know how to use a mouse and gui any more, all they use is a keyboard and text console, stupid punks! damn you linus! damn you!

Re:social engineering

[Bodrius]

Well, depending on which files it deletes and/or overwrites, it could be arguably correct.

As usual.

[Anonymous Coward]

As usual poor code/data seperation..

They will never learn untill their platform is smashed into little bits by some hacker..

Not sure I'd call this a .NET virus

[wadetemp]

If the attachment is opened, then the worm uses the Outlook address book to send messages--with a copy of the virus attached--to every address in the book. It then deletes the e-mails from the sent folder and removes the copy of itself.


.NET exe files won't run unless the framework is present. They are "dead" exes that do nothing when double clicked. So the question is... is the bulk mailer part native code or .NET code? Read on...


On PCs loaded with Windows XP and other .Net-enabled computers, however, Sharpei would additionally infect files in four other folders. If those files were opened, the virus would run again.

This *additonal* behavior that affects .NET enabled computers is the part that could possibly be written in C#, and it looks like it's not responsible for any of the bulk emailing... it just runs the native executable portion again, which does the bulk mailing. And by the way, XP is not .NET enabled. I think this is either a hoax or a very misunderstood virus.

Re:Not sure I'd call this a .NET virus

[muffen]

This *additonal* behavior that affects .NET enabled computers is the part that could possibly be written in C#, and it looks like it's not responsible for any of the bulk emailing...

You are correct, this is the only part that is written in .NET compiled down to MSIL. Here's a cut from the Symantec writeup: The replication code of the virus is written in C# and compiled to MSIL...

The emailing routine is done by dropping a VBS file that enumerates the outlook addressbook sending an email to everyone in there.

This is said to be the second virus that infects .NET files. The first one was W32.Donut (even though W32.Donut doesn't actually infect the MSIL part of the executable, but the one containing the normal X86 code).

In my opinion, we still haven't seen the first *true* .NET virus. When there is a virus that infects the MSIL (Microsoft Intermediate Language) code, then I think it qualifies as a .NET virus. All the .NET virus we have seen so far appear to be attempts by viruswriters to get media attention, and as we can see, it worked :-/

Re:Not sure I'd call this a .NET virus

[rfsayre]

who could be sure?

Microsoft has made a habit of calling everything it is releasing lately ".NET". If it infected Visual Studio, would it be a .NET virus? Face it, the MS definition is purposely nebulous, masking the fact that .NET is a Java clone.

What about Java virii?

[petree]

If you actually step outside of the 'yet another microsoft virus' mindset you might be frightened more by the concept, although simple. Why hasn't someone (or has some one) created a virus that attacks the JRE. You could pretty well attack a large number of people by either A) attacking/modifying the JRE or B) Piggybacking java bytecode into other applications. Wouldn't one of these be just as damaging and at the current time even more wide-spread in their effect? Just a couple of thoughts.

Re:What about Java virii?

[Anonymous Coward]

Maybe everyone _but you_ has already noticed that M$ users get hit with a new virus at least once a week. Maybe if big Bill didn't make it so easy deviants would branch out. But chances are it doesn't happen with Java because its more secure. beyatch.

Re:What about Java virii?

[InfoSec]

The problem is that the JRE has a security manager which, unless the user mucks it up, won't allow virii to access the local machine or resources (i.e. address book).

Re:What about Java virii?

[jaavaaguru]

The JRE lives in a directory where normal users don't have write permission to. This is definitely the case in UNIX/Linux and our Win NT based machines at home are also set up this way. If someone installs something into a directory that is world writable, then they should be prepared for these kind of things to happen. If an OS insists on putting important things in silly places, then maybe software manufacturers for that OS should make their users aware of this and possible change the permissions on directories after their software has installed? If Windows XP treats users as dumbasses, why should these same users be expected to know anything about securing their system?

Re:What about Java virii?

[tlh1005]

Maybe someone has created a virus that f*cks with the JRE, you'll find out Oct. 18th.............

Re:What about Java virii?

[Big Dogs Cock]

Nobody wants to write a virus which executes that slowly.

Re:What about Java virii?

[Anonymous Coward]

It's called a Security Manager, dummy. Look it up.

Re:What about Java virii?

[JKR]

The problem is that the JRE has a security manager which, unless the user mucks it up, won't allow virii to access the local machine or resources (i.e. address book).

What? Java provides a default SecurityManager object which allows pretty much anything. And anyway, if you can subvert the class loader (e.g. by providing your own) you can do anything you like. The only time you'll see a SecurityManager which does anything is inside a webbrowser.

Besides the system policy file installed by default is pretty lax. I quote from the Java SDK docs:

The java.policy file installed with the SDK grants all permissions to standard extensions, allows anyone to listen on un-privileged ports, and...

Jon.

Re:What about Java virii?

[KwamiMatrix]

What in the world are you talking about? What's up with OCT 18th huh??

Re:What about Java virii?

[thona]

And since when is a security manager actually doing SOMETHING if the file is started LOCALLY? Dont forget that the USER has to START the "Worm" (not actually a virus) by double clicking. IMHO and the last time I did java work, a local application was allowed to do everything. Do, better start reading the manual again yourself, you know.

Re:What about Java virii?

[gazbo]

There are some serious checks in place to make it hard (impossible?) to subvert the class loader to avoid the security manager.

However your point still stands; if you run a .class file who's base is on your computer, you have full access to the filesystem etc. A java analogy with this virus would be an executable (IA32 native) that ran, emailed itself to everybody, and then ran a file within the JVM that did something or other (deleted files, printed 'hello, world!' or whatever) The Java zealot would scream 'But that's not a fucking Java virus, thats a normal worm that runs a java program! Where's the JVM security problem in that?' And fortunately, if unexpected, several posters have said the same about this worm.

Re:What about Java virii?

[Anonymous Coward]

If you actually step outside of the 'yet another microsoft virus' mindset you might be frightened more by the concept, although simple. Why hasn't someone (or has some one) created a virus that attacks the JRE.
I don't know. Because Sun is not so fuckin stupid as Microsoft?

Re:What about Java virii?

[jsse]

What? Java provides a default SecurityManager object which allows pretty much anything.

Huh?
Like?

And anyway, if you can subvert the class loader (e.g. by providing your own) you can do anything you like. The only time you'll see a SecurityManager which does anything is inside a webbrowser.

Can you show me how to subvert the class loader with Java itself?

(I'm not bashing you opinion, I'm really asking the questions. Showing me the links is also welcome :)

Re:What about Java virii?

[gregorio]

I've always wondered why someone never wrote a virus that takes advantage of some Linux users false sense of absolute security about Linux and open-source applications. I think most people here is going to say that I am wrong, but the average Linux user (specially the ones that think they are really 1337 and run scanners with packet fingerprinting) runs a considerable number of new applications under the root uid.
The virus could even look like it was sent from a security-related mailing list.

Re:What about Java virii?

[MikeyO]

The problem is that the JRE has a security manager which, unless the user mucks it up, won't allow virii to access the local machine or resources (i.e. address book).

Thats only for java applets, not for standalone java programs. Don't belive me, try this program:

public class HelloWorld {
public static void main( String[] argv ) throws java.io.IOException {
java.io.FileWriter fw = new java.io.FileWriter( "/tmp/hello" );
fw.write("Hello World");
fw.close();
}
}

compile it like this:

/usr/local/jdk/bin/javac -classpath /usr/local/jdk/jre/lib/rt.jar HelloWorld.java

run it like this:

java -cp /usr/local/jdk/jre/lib/rt.jar:. HelloWorld

The do a cat /tmp/hello

Re:What about Java virii?

[rutledjw]

How about this for a reason:

No file associations with java.

Windows needs to be able to associate the file type (.class) with the JRE.Last I checked such as association doesn't exist on my computer. I think the only way it could be done is if they send an HTML page with an embedded applet. Then you have to deal with the security manager. Plus there are multiple files to send...

H3ll, I'll just write a .shs file instead!

Re:What about Java virii?

[Anonymous Coward]

Check out the Javadoc on java.lang.ClassLoader:

http://java.sun.com/j2se/1.4/docs/api/java/lang/ Cl assLoader.html

They've got an example of a Network class loader.

Re:What about Java virii?

[sheldon]

"Besides the system policy file installed by default is pretty lax."

Microsoft has made the default system policy for .Net fairly strick. There was actually quite a lot of bitching about it on many .Net mailing lists because it made life more difficult for developers. But I suspect MS felt they could live with complaints of this nature, rather than make it too loose by default.

For instance if you try to run any content off a network drive, it has no access to drives. I just tried it, and I can't even get a local directory listing. You just get a popup box warning that it can't do this.

Re:What about Java virii?

[Anonymous Coward]

Someone already did.

It's called emacs. :-)

Re:What about Java virii?

[Anonymous Coward]

>I've always wondered why someone never wrote a virus that takes
>advantage of some Linux users false sense of absolute security about
>Linux and open-source applications. I think most people here is going
>to say that I am wrong, but the average Linux user (specially the ones
>that think they are really 1337 and run scanners with packet
>fingerprinting) runs a considerable number of new applications under
>
>
>
Work for an anti-virus outfit eh? No wonder you don't have a clue about why it's so hard to create a Linux virus....

Re:What about Java virii?

[ari_j]

There is no such word as 'virii'. The plural of 'virus', as in the not-quite-a-life-form-on-its-own virus, is 'viruses'. The word itself is probably not Latin, and if it is, there is no a single grammatical construction in any dialect of Latin that would make its plural be 'virii'.

Re:What about Java virii?

[Anonymous Coward]

"If you actually step outside of the 'yet another microsoft virus' mindset you might be frightened more by the concept, although simple."

If you actually step outside of Windows this shouldn't be a problem.

Re:What about Java virii?

[tlh1005]

My apologies....... I dunno why but I'll come in from a long night of beer and still read/reply on slashdot.... I have less Karma to show for it too :)

Re:What about Java virii?

[U6H!]

NIMDA, Perhaps the most viscious virus to date, used java in at least mode of propigation that I'm aware of. A small line of java added to all html content on infected servers. This was used to cause an automatic download of readme.eml from an infected webserver when clients viewed webpages hosted by these servers. Outlook would then run the readme.eml file because it assumed it was an innocent .eml attachment file or something. Anyway... It was virus content that initiated the infection process for this particular mode of infection. (I state "this specific mode of infection" since Nimda had at least four major modes of infection.) Nimda was a very special virus though, and it would have been insain to blame SUN for it's small contribution when it was really a plethora of MS problems to blame. In fact, without the defective email clients, the .eml file would have been harmless.

Re:What about Java virii?

[Ayende Rahien]

That is good, there is a good security model in the basis of both .NET & NT, the problem is that the defualt permissions were always too lax, resulting in unsecure default installations, which not many bother/or had the knowledge to change.
That is a re-assuring.

Re:What about Java virii?

[Ayende Rahien]

http://www.sophos.com/virusinfo/articles/java.html

Been there, done that, moved on...
There is *nothing* in Java that prevents you from writing viruses if you're running a Java application.

yet another unhackable system

[trelaneopn]

it AMAZES ME, that the security analysts who keep saying there is no such thing as a unhackable system heap laud and praise on every "unhackable *" released. the hypocrisy is not only unprofessional, but it's a grave disservice to people that look to them for direction in securing their networks. remember, there is no such thing as a perfectly secure system, we try, but we are human and thus we fail (And learn). as much as I hate to say it, to an extent the crackers do us a service by keeping us honest. and we do the world a service by trying to send them to jail.

Re:yet another unhackable system

[_Sprocket_]

it AMAZES ME, that the security analysts who keep saying there is no such thing as a unhackable system heap laud and praise on every "unhackable *" released.

You have quotes and references to the same security analysts making both of these claims?

Re:yet another unhackable system

[Anonymous Coward]

remember, there is no such thing as a perfectly secure system, we try, but we are human and thus we fail
Maybe there is no such thing as a perfectly secure system but I have yet to see anyone breaking my servers. I have a debian out-of-the-box installation and 10000 euro prize for anyone who breaks in. I got about 100-400 tries daily, still no one did anything in the last two years. So yeah, there is no such thing as a perfectly secure system but the trick is that you can have effectively unbreakable system under debian (or openbsd) and you can have a shitty windows box. They're both not perfect, but debian is much closer to being perfect, now isn't it? You know, Einstein was not perfect and stupid Joe Sixpack is not perfect, but there is a difference, can't you really see it?

Sharpei?

[evil_one]

My ex had a half sharpei, half lasso apso. I never could tell which end it ate from.

A worm named after a breed of dogs, cute. Does it get you in the heart?

Re:Sharpei?

[Anonymous Coward]

Stupid, yes. Overrated, perhaps. Offtopic? Uh, no.

Re:Sharpei?

[Anonymous Coward]

Mod this up! That's funny!

Re:Sharpei?

[Anonymous Coward]

Space Quest 6 anyone? Wasn't it the Sharpei virus that infected Stellar Santiago?

Who said it was a .NET virus?

[Anonymous Coward]

Let's try your karma whoring strategy:

It's NOT a pink elephant!

Just trying to clear up a potential misunderstanding here: The Sharpei Virus is a worm spread by MAIL via Outlook. It has NOTHING to do with elephants, mammals in general, or any kind of pink lifeform. The virus may overwrite some files if the user has write access to them, but rest assured that you won't have to deal with 10,000 pounds of pink flesh suddenly appearing in your computer room.

Re:Who said it was a .NET virus?

[TheConfusedOne]

>It has NOTHING to do with elephants, mammals in general, or any kind of pink lifeform.

Hmm, seems like you have far too much knowledge about the virus writer. Especially to exclude mammals. Mr. Ashcroft and his "Defenders of Liberty" (tm) will be having a few words with you soon.

Re:Who said it was a .NET virus?

[bflong]

>rest assured that you won't have to deal with 10,000 pounds of pink flesh suddenly appearing in your computer room.

Hey! I have a fat DSL pipe man! If I want to see 10,000lb of pink flesh, I'd better be able to get it, damnit!

Oh, you're talking about an elephant.... sorry, my bad...

Re:Who said it was a .NET virus?

[saintlupus]

rest assured that you won't have to deal with 10,000 pounds of pink flesh suddenly appearing in your computer room.

Ah, so the admin found his pants, then?

--saint

Re:Who said it was a .NET virus?

[The Evil Troll King]

Let's try your karma whoring strategy:

It's NOT a pink elephant!

The scary thing is that this strategy worked twice in the same thread. It's 2 for 2!

Read the technical details at Symantic

[Carnage4Life]

I just looked at the Symantec write up for W32.HLLP.Sharpei@mm and from what I read its primarily just another social engineering email-with-executable-attachment worm ("Please run this MSFT update") which happens to use C# in some of the code it runs after it has 0wn3d your machine.

The fact that the worm tries to run a C# executable after it has already compromised the machine is not much of a technical feat since it could run anything including a Perl script, Java program, Lisp code, etc as long as the runtimes were available on the target machine.

Disclaimer: The opinions expressed in this post are mine and mine alone and do not reflect the opinions, wishes, strategies or intentions of my employer.

Re:Read the technical details at Symantic

[markmoss]

So it doesn't exploit security holes in MS's new, barely finished .net framework. Instead, it exploits the gaping security holes which have remained in Outlook for years. This is a good thing???

Re:Read the technical details at Symantic

[Anonymous Coward]

Ah, but ANYTHING from Micros~1 is Good Thing, according to our Resident Micros~1 Apologist and Bill Gates Worshipper "Carnage4Life"

:-D

What do you expect

[InfoSec]

They take all of the power of Java and then throw in all of the security vulnerabilities of C/C++. It's only inevitable that C# is going to cuase all sorts of headaches for people like me (Security professionals).

Re:What do you expect

[yatest5]

They take all of the power of Java and then throw in all of the security vulnerabilities of C/C++. It's only inevitable that C# is going to cuase all sorts of headaches for people like me (Security professionals).

Er, that's why get paid so much isn't it?

Re:What do you expect

[gregorio]

They take all of the power of Java and then throw in all of the security vulnerabilities of C/C++. It's only inevitable that C# is going to cuase all sorts of headaches for people like me (Security professionals).

lol, read this please...

Re:What do you expect

[Tom7]

Looks like you need to read the story more carefully -- if you get all your information from Slashdot's misleading headlines, you're going to be pretty misinformed!

This worm really has nothing to do with C# (or even .NET). It's just a regular e-mail worm that happens to also have a .NET payload, part of which is written in C#.

Re:What do you expect

[sheldon]

How is it that someone calling themselves a security professional can't be bothered to take the time to actually research a topic before injecting their opinion?

Just curious. I take it the GISSP is like the MCSE, it only requires memorization skills?

You might want to look into GIAC.

Re:What do you expect

[sheldon]

Oops, sorry. I meant CISSP. My memorization skills aren't that good.

M$ doesn't call Sharpei a worm

[Ilan Volow]

They prefer the term "a few wrinkles here and there"

Re: M$ doesn't call Sharpei a worm

[Black Parrot]

> They prefer the term "a few wrinkles here and there"

"A feature with a few extra body segments."

Re: M$ doesn't call Sharpei a worm

[Anonymous Coward]

1 word, 4 letters.

foff

VIrus in attachment

[Henry V .009]

This is simply the old virus as attachment trick.

And guess what? It's implemented in C#. And when run, it will screw up other folders on the system. Imagine, if you will, a computer language, somewhere, that somehow, could not be used to write this virus. I'm drawing a blank, but I'm sure there will be lots of +5 funny responses.

Since my current sig just confuses everyone anyway, maybe I should change it to "$5 for a thousand pages of this!?" and save everyone the typing.

Re:VIrus in attachment

[yatest5]

Imagine, if you will, a computer language, somewhere, that somehow, could not be used to write this virus.

Er, is that a computer language that can't do anything at all then? Useful.

Re:VIrus in attachment

[mikeage]

Microsoft's Q-Basic. Can't be compiled, can't be double-clicked (tm).

Not to be confused with QuickBasic, which can be compiled.

Re:VIrus in attachment

[illusion_2K]

How many java viruses have you seen lately?

Re:VIrus in attachment

[Anonymous Coward]

Just wrap a batch file around it that does:

@echo off
qbasic worm.bat

Can be double clicked, doesn't need to be compiled.

Re:VIrus in attachment

[WildBeast]

Very funny. So when people execute the virus, they'll have to wait for it to load and then have messages like "Please wait while executing the virus....Sending Message1...Sending Message2..."

Re:VIrus in attachment

[Anonymous Coward]

qbasic /run file.bas

Re:VIrus in attachment

[Anonymous Coward]

HTML d00d!!! Huh--whut d0 j00 mean 1ts n0t a languejj?

--5cr1pt k1dd13

Re:VIrus in attachment

[taradfong]

Depends. Java Applet Viruses - those are tough. But Java Application Viruses? Piece of cake. I can open a file, write binary x86 opcode data, close the file, and execute it. Or just trash a bunch of files through ordinary file I/O calls.

Re:VIrus in attachment

[Anonymous Coward]

Java Applet Viruses - those are tough.

Well not really a virus, and not particularly damaging, but fun on win 9x anyway:

Simply write an applet that does an infinite loop while spawning threads.
This doesn't do much to Win NT/2000 or Linux, but someon using a default JVM on say IE on 9x will have to reboot if they go to your webpage with this on it.

I think some news site was spreading FUD about this hole a year or so ago.

Go to sleep Timothy

[fredistheking]

Go to sleep for gosh sakes. You've been posting since Noon yesterday.

Re:Go to sleep Timothy

[MiTEG]

Go to sleep for gosh sakes. You've been posting since Noon yesterday.
My god you're right! Timothy has has less than 3.5 hrs between posts for the past 24 hrs! A quick breakdown of Timothy's postings:

March 03 3:15 AM
March 03 6:47 AM
March 03 8:29 AM
March 03 11:59 AM
March 03 12:22 PM
March 03 12:57 PM
March 03 2:16 PM
March 03 3:56 PM
March 03 5:19 PM
March 03 5:35 PM
March 03 5:46 PM
March 03 7:47 PM
March 03 10:35 PM
March 03 11:11 PM
March 04 3:17 AM

I say go for another 24 and then see what happens, turn it into a sort of geeky endurance test or something.

Re:Go to sleep Timothy

[Anonymous Coward]

no, "Timothy" is really the code name for Rob's random-submission-selection.pl script

Proof of concept?

[Alizarin Erythrosin]

Seems to me this is more like a proof of concept virus, like that one that was written in Flash a while back, demonstrating the kinds of things that COULD happen should Outlook's holes and bugs not be patched up.

The message body is actually a very misleading one though... I mean, who wouldn't wanna speed up Windows by 50% and make it more secure? We can't get that kind of update, even out of Microsoft!

Re:Proof of concept?

[gregorio]

demonstrating the kinds of things that COULD happen should Outlook's holes and bugs not be patched up.

What holes? Stupid users or allowing those stupid users to open attachments? Should Microsoft release some kind of version of Windows that doesn't allow stupid users to execute whatever they want?
I don't think so, people should just stop executing unknown e-mail attachments.

Re:Proof of concept?

[Pope]

who wouldn't wanna speed up Windows by 50% and make it more secure?

Dang! I guess us OS X users are going to be targetted next! :)

SSSCA Impact on Viruses

[heretic108]

I worry about SSSCA.
If it goes through, virii would definitely fall under the category of 'interactive digital devices'.
It will be illegal to write or transmit a virus unless it contains 'approved security measures'.
Any attempt to circumvent a virus' protection mechanism, or communicate to others the nature of a virus or possible defences against it, will be a criminal offence punishable by law

Re:SSSCA Impact on Viruses

[DrSkwid]

Maybe one can claim self defence, like being burgled and apprehending your burglars.

If we could then project that theRIAA are an illegal cartel and that we are trying to act in self defence ... hmm pretty long shot.

There is one oft overlook aspect to the legal system (at least in the UK) and that is that a jury does not have to return a guilty verdict even if they have been convinced that the defendant committed the act. It is quite within the power of a jury to return not guilty if they think that the law is unjust or unjustly applied. Maybe someone should try that defence sometime and see if they can make it stick!

Re:SSSCA Impact on Viruses

[edhall]

virii would definitely fall under the category of 'interactive digital devices'

That makes no sense whatsoever. An "interactive digital device" is a piece of hardware, as defined by the SSSCA. Unless you know something about computer viruses that I don't, they hardly qualify as such.

Even as software, they are highly unlikely to contain the likely-to-be mandated digital signature. And that's the scary part: Microsoft is promoting digital rights management as an anti-virus solution (among other things). Part of the .NET infrastructure is providing the ability of each software component to be signed. Thus the SSSCA dovetails quite nicely with Microsoft's need for better security. And it gives them the opportunity to get even more leverage over non-Microsoft software (not just virunses). Who do you think will control the certification process necessary to get a signature?

-Ed

Re:SSSCA Impact on Viruses

[heretic108]

virus, n.
1. A computer program intended to replicate itself throughout multiple computers without the user's consent.
2. A licensing condition applied to computer software which allows users to understand and modify the programming code used.
3. virii, pl. Computer programs written without the express support or approval of Microsoft Corporation or its strategic partners, which threatens national security by undermining Microsoft's ability to control the global use of software in personal computers.

(Source: Microsoft - New Employees' Orientation Handbook)

Re:SSSCA Impact on Viruses

[fishebulb]

In the United states atleast the Judge has the ability to override the jury verdict. Its rare to happen, but in cases when the jury DID ignore the law, the judge can still make it applicable. im not sure on the specifics, or even if its still constitutional to do that here. Anyone?

Re:SSSCA Impact on Viruses

[CousinDave]

Is there a name for this strategy of "encouraging" business to buy into Microsoft's plan for owning the world? It seems too convenient for them to provide for solution for a problem that they created themselves. Dave

Re:SSSCA Impact on Viruses

[Anonymous Coward]

What's the plural of virus?

Worm with a virus payload

[prockcore]

This is actually a win32 worm, with a .net virus payload.

" On PCs loaded with Windows XP and other .Net-enabled computers, however, Sharpei would additionally infect files in four other folders. If those files were opened, the virus would run again."

The .net half is a true virus, and spreads among .net executables.

Who even said it was a virus?

[fireboy1919]

Its a program designed to advertise the amazing new security features built into the incredible .net framework!

Similarly, LSD is capable of demonstrating the incredible new navigation (flight) features of Windows XP, and my assault rifle is useful to demonstrate windows new, millisecond speed shutdown procedure (along with security lock to ensure that no one who is not unauthorized won't be able to boot the machine).
Its the best, isn't it?

I should be on MS's marketing staff.

OT

[Anonymous Coward]

Holy crap....you're right. I guess he never sleeps. Hey... job dedication I guess. Thats what we're going to be paying for, right?

Great Advertising

[woolite]

A successful widespread virus attack proves that there are actually .NET users out there.
If no one attacks or cracks a software it's mostly not worth anything. To believe that it can't be successfully attacked is naive anyway.

Overall, viruses bring free publicity and prove the point that the product is a roaring success.
BTW: Who wants to be left out when all your friends have been hit by the new naughty Kournikova virus? There will be little left to discuss over a few beers.

Re:Great Advertising

[Tony Hoyle]

You're shitting me... there are .NET users?

Wow.

Viable alternative

[Anonymous Coward]

A true test of the MS environment, at e-Week:
http://www.eweek.com/article/0,3658,s=708 &a=23115, 00.asp

EICAR Virus Test file

[fsmunoz]

Yes, I had the same need... in order to test a virus scanner I mailed BO2k to see how it worked.
It wasn't necessary though; every virus scanner should react to the EICAR anti-virus test file (she here). So if any of you ever need to test a virus scanner and have some management guy brething in your neck and raving about how using a real virus can compromise security use the EICAR file. Just mail him the virus personally by another mail gateway after that just to prove your point :)

fsm

Re:EICAR Virus Test file

[gazbo]

Noted, bookmarked and downloaded, cheers. Well, downloaded once I persuaded my virus scanner to stop buggin me about it.

It's not a virus

[Grax]

Don't click on executable attachments in your email.
Please. (Outlook team: Please don't execute everything I click on)
Also. Don't send me messages that are really just plain text in either html or word document format.

Re:It's not a virus

[x0n]

It's not a single click to execute attachments, it's double click; ergo you need to be twice as stupid as some to run an executable attachment sent to you unannounced.

Re:It's not a virus

[Grax]

I'm glad that extra protection is in there.
Of course in the email program I use (KMail), you have to save the executable and set the permissions to executable before any execution happens.

Re:It's not a virus

[Reziac]

UNLESS you have Windows set to "single click to execute stuff". Yes, there is such a setting, and I've met crazy users who have it turned on. Eeeep!

Security hole in PHP allows arbitrary code to exe!

[Anonymous Coward]

Stefan Esser, who is also a member of the PHP team, found several flaws in the way PHP handles multipart/form-data POST requests (as described in RFC1867) known as POST fileuploads. Each of the flaws could allow an attacker to execute arbitrary code on the victim's system.

For PHP3 flaws contain a broken boundary check and an arbitrary heap overflow. For PHP4 they consist of a broken boundary check and a heap off by one error.

For the stable release of Debian these problems are fixed in version 3.0.18-0potato1.1 of PHP3 and version 4.0.3pl1-0potato3 of PHP4.

For the unstable and testing release of Debian these problems are fixed in version 3.0.18-22 of PHP3 and version 4.1.2-1 of PHP4.

There is no PHP4 in the stable and unstable distribution for the arm architecture due to a compiler error.

We recommend that you upgrade your PHP packages immediately.

Eat that, Microsoft haters.

Re:Ralph Jewhater Nader Read This Comment

[Anonymous Coward]

hey, you took my advice! Thanks, friend!

.net and gnome...

[kevin lyda]

it seems this is not a true .net virus but it does bring up some interesting possibilities regarding the gnome project. ximian has professed to wanting gnome 4 to use the .net framework. so either they'll code it in such a way to avoid all the security issues in microsoft's .net, or they'll have the same security issues.

in some ways either "wins." if the main linux .net implementation avoids security issues it's a pr disaster for microsoft. ditto if it has the same bugs as it will show a design flaw in .net.

otoh it will "lose" - anti-virus companies will be against linux for taking away their product stream. and if the same security flaws show up then it removes a major distinguishing item from a linux desktop.

Re:.net and gnome...

[NtG]

What .NET security issues? This virus spreads via email and infects files relating to .NET which have to be executed to further infect. The .NET environment is not instrumental in the attack, you could substitute in any executable in.
.NET is not an unfeasable technology simply because it was developed by Microsoft. From what I have seen on the DotGNU Portable.NET environment on *NIX, C# bitcode is able to be executed with low overhead. You could be fooled for thinking you were executing native binaries.

Re:.net and gnome...

[kevin lyda]

did you even read my post? like, say, the first sentence. no, this wasn't a .net virus, but it is quite likely there *will* be .net security issues in the future. they may be design flaws or implementation flaws, but there will be flaws.

Wording

[GSV NegotiableEthics]

Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I should forward it as you may like it.

Something about the wording suggests to me that this worm is intended to target only very stupid people. Does anybody reading this actually have friends who write emails like that?

Re:Wording

[Migx]

I'll give ya an example : At my company there has been released two times a warning saying: "if you got win98, don't istall IE6(or summit like that) coz it might cause the need of a reinstallation"

4 reinstallations done so far.....

Probably not the case with most people that read slashdot but there are millions of users that are just "plain users", they don't care for programming / development / OS's etc etc ... they just use the PC for mail, browsing, chat and NOTHING MORE(for the simple reason that is all they need really).And they feel 100% safe for having their antivirus updated. So if a friend says: Hey, use this, it will get better, why not ?!? And imo it's not a matter of stupidity, a person that sells cars has a better chance of making a better bargain when buying a car. (no 100% direct analogy to the subject in this example:)

Re:Wording

[Anonymous Coward]

Something about the wording suggests to me that this worm is intended to target only very stupid people. Does anybody reading this actually have friends who write emails like that?


There are people like thaton /.....though, they won't be posting for a couple days after most viruses.

Re:Wording

[GSV NegotiableEthics]

There are people like thaton /.....though, they won't be posting for a couple days after most viruses.

If that is so, then somebody stands to make a killing by distributing bogus "subscribe to Slashdot" emails with their paypal account reference. :(

Re:Wording

[frisket]

> Does anybody reading this actually have
> friends who write emails like that?

No, but I have 15,000 users who might.

///Peter

Re:Wording

[ehiris]

Somebody skipped english classes for writing bullshit worm code.

So where's the java virus?

[autopr0n]

Hrm. I don't seem to ever hear about any viruses for the Java platform, even though it would theoreticaly be possible.

And what about perl!?

Re:So where's the java virus?

[Anonymous Coward]

Seeing as how the vast majority of Windows machines do not have a Perl interpreter on them I do not think that we will be seeing any Perl Virii in the near future.

Re:So where's the java virus?

[Anonymous Coward]

There has been at least one true java virus out for years, however it was pretty much a proof-of-concept and never made it ITW. It's called Strange Brew.

More here :
"http://securityresponse.symantec.com/avcenter/ ven c/data/javaapp.strangebrew.html"

Don't buy their bollocks about having "discovered" it though, it was published in the Codebreaker's virus zine!

Bob-the-I-must-really-make-an-account-someday AC

Outlook strips

[lseltzer]

Outlook 2000 also strips those executables if you security patches that have been available for almost 2 years. This may be true of Outlook 98 as well. These patches also block the mass-mailers, so the only reason the mass-mailers exist is that people are running older versions of Outlook (97 and earlier) or not patching their current versions.

Re:Outlook strips

[fanatic]

These patches also block the mass-mailers, so the only reason the mass-mailers exist is that people are running older versions of Outlook

<sarcasm>Must be the new AI feature that automagically separates spam from legitimate mail.</sarcasm>

This last is a pretty broad claim. Seriously, though, what is this and how does it work? Spammers may be the only group on the planet that I hate more than MS (in the 'technical' arena, anyhow).

Re:Outlook strips

[CaptainSuperBoy]

No. The newest versions of Outlook won't let you run a dangerous attachment such as a .EXE, .PIF, etc. It doesn't block incoming viruses, it just won't let you run them. Isn't that what the Linux zealots wanted? ('Well our OS doesn't run viruses automatically')

Re:Outlook strips

[egreB]

Well, the last time I tried Outlook XP, it wouldn't let my friend download (or run) an EXE-file wich I sent to him. One thing is not running a file without user's permission, another is to deny any kind of access to the file. I coulnd't, no matter what I tried, run the .EXE-file, even though I knew this was a perfectly virus-free device-driver. So I had to resend the file with a different extension, and then rename it when it arrived. Security is good, and it's a good thing that Microsoft is focusing towards it, but there have got to be limits! My OS will let me run any file I want..

Re:Outlook strips

[Anonymous Coward]

> Well, the last time I tried Outlook XP, it wouldn't let my friend download (or run) an EXE-file wich I sent to him. One thing is not running a file without user's permission, another is to deny any kind of access to the file. I coulnd't, no matter what I tried, run the .EXE-file, even though I knew this was a perfectly virus-free device-driver. So I had to resend the file with a different extension, and then rename it when it arrived. Security is good, and it's a good thing that Microsoft is focusing towards it, but there have got to be limits! My OS will let me run any file I want..

The process you described (save file, rename it [ie, make it executable], run it) is the Unix Way as applied to Windows. What you and your friend were stumbling over is the compromise between letting folks like you manage their downloads and run those .exe's that you all know are OK, and giving *all* of us protection against the clueless dumbies that continue to open those damn Anna style email attachment viruses no matter what - and wind up becoming DDOS zombies.

The compromise is that no, power users can't just simply open .exes - you need to do that save-and-rename two step. On the other hand, all those clueless dumbies won't bother us anymore with their mindless opening of attachments - they just can't, and lack the werewithal to do the simple save-and-rename sequence. It's a crappy way to have to run things, yes, but what else can we do except kill 'em?..

Re:Outlook strips

[egreB]

I believe in education of users, and not idiot-proofing of software, rendering it useless. In the Old Days(TM), when my dad learned computers (that was round DOS 3), users really had to learn stuff. They needed to know what a file and directory was, and the difference between a .EXE and .DOC-file. And my dad was just as productive with DOS, CLI and WordPerfect 5.1 (RIP) as with his current version of Windows (98), in addition to the fact that he KNEW WHAT HE DID. Microsofts general software designs tries to hide everything from the user, so that he doesn't need to know anything. And we see where that's heading - into users who don't know what a .EXE-file is. Any general HCI (Human Computer Interaction) document will tell you that this kind of design is bad. I'm not suggesting that we get back to DOS 3 or Unix CLI. That's too cumbersome. But when people at my school, using MS Word, asks ME whether they saved to a diskette or not because they don't even know what a file is, something is wrong. Imangine to drive a car without knowing how to steer..

.net virus

[Anonymous Coward]

shell "FORMAT C:|Y"

Re:Security hole in PHP allows arbitrary code to e

[dbateman]

The difference is that there is no known exploit for this PHP security hole at the moment. The announcement is timely in that it allows sys admins to patch a POTENTIAL hole before they cause a problem.

When was the last time microsoft announced a security problem before there was a known exploit in the wild?

D.

There is a Perl virus

[Anonymous Coward]

Damian Conway wrote a piece of obfuscated code called SelfGOL that was several programs connected together. The primary one was the Game of Life, but among other tricks was it was a virus that could infect other Perl programs.

If you have basic technical skills you should now be able to find it, and extract the source-code. Figuring out how to get it to infect things might be harder, and figuring out the source-code is definitely harder.

However, respecting Damian's wishes, I will not explain any of these things on the Internet. He doesn't want a basic "proof of concept" turned into a real virus.

Terrible .NET Virus

[SubtleNuance]

designed to infect computers loaded with the .Net framework."

With the proper diligence, and a competent admin -- NO computer should ever be infected with the .NET virus.

Only a boob could ever allow such a thing to occur.

... heheh now this is a meme I like... if only i controlled the Media, I could infect billions with this simple mind-virus.

Muahahahahhahah

Re:Terrible .NET Virus

[josepha48]

"Only a boob could ever allow such a thing to occur."

Yes and the same could be said about most UNIX systems. It takes a little intelligence to prevent your machine from being taken over by virus, worms, or trojans, buffer overruns or other exploits.

Something most /.ers here seem to miss is that not all computer users are as computer savy as many of the readers here. Many computer users WILL grant permission to a program to run on their machine. They will execute a file even if they do not know who it is from. While this article may not be 100% accurate, as most never are, it points out that .NET is not even out 'in mass' and people are already looking for ways to exploit it. This may actually be good for windows as it will hopefully make them find more ways to tighen the security and 'dummify the system' so that user xyz does not screw up their system just by click on a file. Like integrated virus scanner.

Personally I'd go with what I call 'registered execution'. This would require that programs that are 'registered' could execute code to do certain task. If you wrote a macro on your computer it would become registered, but if you sent that macro to someone else it would not and they would then be prompted to run that macro and if they wanted to register it. Then when virus abc is sent to user xyz and the user click on it the OS pops up a message of the program you have tried to execute is not registered, it wants to modify registry settings and blah blah. While this is not 100% foolproof, it could help in reducing virus spreadding.

Someone here compared perl to VB. I almost fell out of my chair laughing at that comparison. Perl is not embedded in email applications on UNIX or windows like VB is in Outlook. Perl is not part of an office application that is used by 90% of computer users (of course with China moving to Linux that number will change). Perl is a script and the number of virus that are spread uusing perl vs VB is tiny. perl can be used for buffer overruns and hack attacks, but then so can VB and C/C++ or even Java.

"and a competent admin"

If you have ever done system administration or IT support and had to support end users then you'd know that many of these people probably should not even be using computers at home. The point is that the .NET framework WILL be attacked by virus, worms and/or trojans and at some point they will spread.

Hmm maybe /. doesn't hate all my posts after all....

Re:Security hole in PHP allows arbitrary code to e

[fuali]

"Code Red"

The Sercurity Pacth was available in June. The Worm hit in August/September.

Re:Security hole in PHP allows arbitrary code to e

[Anonymous Coward]

Let's see.

Code Red
Code Blue
Nimda
ILOVEYOU
Papa
BadTrans
Anna
And this list continues.

Sharpei exploits a "hole" in Outlook that was patched over two years ago. If you don't patch, you're still vulnerable, so what do you do short of driving across the country and cramming patches down people's throats? Do you think everyone in the world has already patched their PHP problems? Can you answer that question?

Re:Security hole in PHP allows arbitrary code to e

[lessthan0]

I had all my production servers, my home server, and my laptop patched within 30 minutes of reading about this PHP problem. That's the big difference between open source and closed source security. I don't have to wait six months for Microsoft to get around to fixing it (usually they get it right on the second or third patch).

Eat that, Microsoft lovers

Power w/o responsibility == danger

[f00zbll]

The one useful thing I get out of all this .NET virus article and dicussion is power comes at a price. Allowing developers write C/C++ within a .NET application provides a lot of flexibility, but it creates new ways to exploit a system. Perhaps the most interesting fact to me is the big difference in approach between MS and Unix camp. It makes me think of an analogy:

lojack is to unix as an idling car in south central LA is to microsoft

Some might say "making things easy encourages mistakes." If any two bit script kiddie can jump in and write a powerful virus, than I would argue for making it harder to write code. It's not bad to make software engineers and developers stop to think carefully about how they are doing things. Maybe then management won't be as tempted to set unreal development schedules, thereby increasing the time for QA and producing higher quality applications. Using a tool that promotes itself as "super fast and easy" will only give management more reasons to shorten development cycles and make more bad code faster :)

That won't work either

[Hektor_Troy]

At that point in time, they will con(vince) the government that virus-writers are terrorists, that terrorists are per default trying to kill people and destroy the economy and that as a result of that, that the government should invoke the death penalty for all virus writers.

Of course the upside of that, is that it only takes very little effort to prove, that Windows is a virus, and that every OS writer at Microsoft should be put against the wall and shot.

MS: Favorite OS of Criminals Everywhere

[Alien54]

Get Microst C# today. Be on the cutting edge of Microsoft Virus spreading technology.

More successful virus writers use Microsoft compared to any other operating system. You too can be a successful virus writer. Get in on the cutting edge made by a company that knows how to mess with people.

[/sarcasm]

etc.

I just call all of these these Microsoft viruses. Makes life much easier.

[OT] Re:SSSCA Impact on Viruses

[_Knots]

I sugguest you read Fletcher's "The Myth of Jury Nullification" (IIRC, that's the title).

Re:[OT] Re:SSSCA Impact on Viruses

[DrSkwid]

thanks.

I did find an interesting review of Jury Nullification: The Evolution of a Doctrine Clay S. Conrad

A very telling passage for me was :

-----------
Instead of conceiving of it as a separate and potentially dangerous institution that is the servant or agent of the people ... government has come to be conceived as embodying the will of the people itself.
-----------

I have never much studied US political history, that of the is long and complicated enough to take a lot of book reading. The supplanting control through the people seems to have been particularly subverted by the longevity of governmental institution (if I'm feeling generous).

It's particularly sad that only a handful of politicians I have spoken to have the slightest clue about the history of the institution they feel compelled to enter, much less the people that choose to put their faith in them.

tbh I have little real faith that jury nullification would ever be any use in modern times. "12 good men and true forming a jury of the defendants peers" hardly ever forms. I mean, who wants to place their faith in 12 people that weren't clever enough to get out of jury duty!

Re:[OT] Re:SSSCA Impact on Viruses

[DrSkwid]

s/that of the is long a/ that of the UK is long a

bah

Re:Security hole in PHP allows arbitrary code to e

[WildBeast]

Those security issues existed since PHP 3.0, no you didn't have to wait months, more like years.

Re:Security hole in PHP allows arbitrary code to e

[Anonymous Coward]

Theres a difference between waiting for an update once the problem/hole is public and waiting for an update for a problem/hole nobody knows about....

....you fucking idiot :)

it's a Trojan horse actually ...

[Zero__Kelvin]

The article doesn't get any of the terminology right, so I wouldn't put too much stalk in anything they say.

It is neither a virus or a worm, though they seem to think the two terms are interchangeable ...

It is a trojan horse. As a point of education:

1) A Virus attaches itself to a host program, and does not necessarily require user interaction to infect additional files (e.g. it may attach to an OS device driver or other system program.) It may be attached to an application, but no coaxing is done to get the user to run it. It simply waits for the user to do so, and then goes about it's business.

2) A Worm is a stand alone program that makes it's way through a system ... it isn't attached to anything.

3) A Trojan horse is a program that is sent to an ignorant user, and requires them to run the program. It may appear to be a program of another sort - hiding it's behaviour - or it may immediately and blatantly do it's thing. Solicitation like the E-Mail body is always a component of a Trojan horse. The fact that it is an E-Mail attachment in no way makes this a virus. It spreads only with the help of user interaction and involves the direct solicitation of said action. It is fundamentally undifferentiated from an E-Mail asking someone to download an .exe and then run it. The fact that the downloading is performed via E-Mail attachment does not in any way change it's status from that of a Trojan.

Come on folks ... if the Slashdotters of the world can't get this, then how will anyone else?

Re:it's a Trojan horse actually ...

[istartedi]

I dare ya to walk into the next room and ask that attractive young AA if her computer has a Trojan.

In the common vernacular, "virus" has become the superclass for all these subclasses that you describe. Maybe /. should nitpick and choose the appropriate subclass, but I take no offense if they don't. However, these people that were correcting /. and saying it was a worm apparently deserve to be corrected by you.

As far as I'm concerned, if it's on my computer, and I don't want it there, it's a "virus". Now, if I were at a technical conference discussing these things then I'd take pains to be accurate.

Re:it's a Trojan horse actually ...

[Anonymous Coward]

Working for an antivirus company (as a researcher), I can asure you that some AV researchers would hit you if you said that to their face.

1) A Virus attaches itself to a host program, and does not necessarily require user interaction to infect additional files (e.g. it may attach to an OS device driver or other system program.) It may be attached to an application, but no coaxing is done to get the user to run it. It simply waits for the user to do so, and then goes about it's business.

The definition of a virus is a program/code that replicates. If your definition of a virus was true, then HLLO viruses (High-Level Language Overwriter) would not be called viruses. Since they are, you must be wrong. Check the writeups for any of the HLLO viruses or the first palm virus, and you'll see that the AV companies has called it VIRUS! I could go on for a long time to prove that you're dead wrong, but I think I'll stop now!

2) A Worm is a stand alone program that makes it's way through a system ... it isn't attached to anything.

Again, dead wrong! A worm is a program/code that can spread by itself (yes, even if a user must click on it to begin with, it's still a worm). Under your definition, Hybris, MTX, Magistr and many more are not worms. Check any AV vendors writeup, and you'll see that your definition must be wrong.

3) A Trojan horse is a program that is sent to an ignorant user, and requires them to run the program. It may appear to be a program of another sort - hiding it's behaviour - or it may immediately and blatantly do it's thing. Solicitation like the E-Mail body is always a component of a Trojan horse. The fact that it is an E-Mail attachment in no way makes this a virus... [cut]

Again, wrong!! A trojan horse is a program that disguises itself as something, and does something different. However, the virus/worm definiton has presidence over the trojan definiton. Therefore, if it spreads or replicates, it's NOT a trojan

Sorry for posting this anon... but I don't want my username to be known, because the things I say on slashdot are my ideas/opinions, and not those of my employer.

Re:it's a Trojan horse actually ...

[gmanske]

2) A Worm is a stand alone program that makes it's way through a system ... it isn't attached to anything.

Actually a worm can also be a set of programs (or program segments, and one could argue in this way the segments are attached or communicate to each other.

Although this alludes to just 'deleting the program', history tells us it might not be as easy as this.

Re:it's a Trojan horse actually ...

[Zero__Kelvin]

"The definition of a virus is a program/code that replicates."

You couldn't be more wrong. The term virus was biological before it was technological. Just as the biological analogue requires a host to survive, so too does the technological virus. Just because enough people misuse a term - and some of them are "in the anti-virus field" doesn't change it, any more than the fact that, while many people claim to write good, it is only possible to write well. Sorry chumly.

"A worm is a program/code that can spread by itself (yes, even if a user must click on it to begin with, it's still a worm)"

Hmmm ... a program that spreads by itself, but requires user interaction. You contradict yourself quite well. Perhaps you should think before you post???

"A trojan horse is a program that disguises itself as something, and does something different. However, the virus/worm definiton has presidence over the trojan definiton. Therefore, if it spreads or replicates, it's NOT a trojan "

When replication requires user interaction, it isn't a worm ... period. It's not a virus, because it has no host program to which it attaches. It's a Trojan. The fact that it performs it's Trojan activities in an automated fashion makes it no less a Trojan than if someone used and automailer to mail it to a list gathered from usenet... really.

" Sorry for posting this anon... but I don't want my username to be known, because the things I say on slashdot are my ideas/opinions, and not those of my employer."

What the hell does that have to do with anything ??? Your Slashdot login name obfiscates (or should) any corporate affiliation already. Clearly your excuse is exactly that!

Re:it's a Trojan horse actually ...

[Zero__Kelvin]

"I dare ya to walk into the next room and ask that attractive young AA if her computer has a Trojan. "

Actually, I have social skills, so I would make sure she knew what I meant before I asked the question; there is nothing daring about it. BTW - Is an AA anything like a 'weeping young devotchka'?

"In the common vernacular, "virus" has become the superclass for all these subclasses that you describe. "

In the 'common vernacular' people run around claiming to write good (when of course when can only write well, or not so well, etc...) It was common 'knowledge' that the sun revolved around the earth in Copernicus' day ... you could just ask anyone on the ancient Slashot site. So my question is this ... do you have any actual valid point to make?

"As far as I'm concerned, if it's on my computer, and I don't want it there, it's a "virus". Now, if I were at a technical conference discussing these things then I'd take pains to be accurate. "

Perhaps you were unaware that Slashdot is a technical forum???

Re:it's a Trojan horse actually ...

[Zero__Kelvin]

" Actually a worm can also be a set of programs (or program segments, and one could argue in this way the segments are attached or communicate to each other. "

True enough. I probably should have said 'stand alone application' but it sounds a bit funny. Many people refer to Word or Excel as a program rather than an application, and that is the (albeit incorrect) manner in which I used the term.

Re:it's a Trojan horse actually ...

[istartedi]

In the 'common vernacular' people run around claiming to write good (when of course when can only write well, or not so well, etc...) It was common 'knowledge' that the sun revolved around the earth in Copernicus' day ... you could just ask anyone on the ancient Slashot site. So my question is this ... do you have any actual valid point to make?

Yes. There is a time and a place for technical jargon. You are confusing the "common vernacular" with "common mistakes". "Write good" may become acceptable over time as language evolves, whereas the position of the Sun is an objective scientific fact.

Efforts to use precise technical jargon all the time will actually result in ineffective communication. Judging when and where to use what kind of language is an important skill. It might be more convenient for you to use multiple words that convey fine shades of meaning, but you stand a good chance of losing your audience when you do that.

This reminds me of the whole "cracker" vs. "hacker" debate. You know who won that, and you should know why.

Perhaps you were unaware that Slashdot is a technical forum.

Chuckle. LOL.

Re:it's a Trojan horse actually ...

[Zero__Kelvin]

""Write good" may become acceptable over time as language evolves, whereas the position of the Sun is an objective scientific fact."

"Write good" is never acceptable except to those who are members of the ignorant set, in which you are clearly a proud member.

"Efforts to use precise technical jargon all the time will actually result in ineffective communication. Judging when and where to use what kind of language is an important skill."

I would only add that you really should begin acquiring such skills at some point, preferably before you reply to another of my posts.

"This reminds me of the whole "cracker" vs. "hacker" debate. You know who won that, and you should know why."

Indeed, it is a rough analogue to the 'nigger' vs. African-American debate. You can tell the ignorant one by the term he or she chooses.

Re:it's a Trojan horse actually ...

[istartedi]

Your contentiousness is exceeded only by the irony of your .sig.

Re:it's a Trojan horse actually ...

[Zero__Kelvin]

"Your contentiousness is exceeded only by the irony of your .sig."

I see what you mean. Clearly someone with a truly open mind would believe whatever you say, no matter how completely off base you are. Those with a truly open mind would never correct anybody no matter how absurd their coments are, because having an open mind means believing everything you hear, no matter how contradictory. The irony is just overwhelming.

Either that, or you truly are a trolling ignoramus. I'm open to that possibility as well, of course.

.NET Security

[rabtech]

By default, the .NET framework will not run untrusted code and allow it to do anything of note.

You will notice that the host EXE being sent over email is native x86 code, NOT MSIL. Therefore, it has no security permissions of note.

If you were to attempt to write a pure-C# virus and mass-email it, you wouldn't get very far as the user would actually have to tell the framework to grant execute permissions to the downloaded code.

I even have to grant permissions to the files I myself write with Visual Studio.NET; they won't execute by default.

Lastly, Outlook 2000 w/security patches and Outlook XP both automatically disallow the user to download or execute EXE attatchments, period. Unfortunately, this makes it a hassle having to ZIP all EXE files before sending them (and VBS files, etc.), but that's a small price to pay to protect us from idiot users. My only complaint with Outlook security is that Outlook Express does not do this by default.

I think Microsoft is doing a better job these days; they still have things to address of course. Sometimes I think people just misunderstand though... calls for the removal of VBScript are like asking *nix distributors not to ship Perl with their installs; its kind of silly.

Fortunately, with XP Home, you don't have a bunch of home users running as Admin all the time; I think that's a big key right there.

Re:.NET Security

[thona]

Wrong. Like in Java, applications started locally do NOT have any security enabled. And this IS a locally started application.

Re:.NET Security

[10am-bedtime]

this argument is flawed; x86 code is more fundamental than any virtual machine running on top of it, and can be used to do a sumo move on said runtime (to change its behavior away from design security handling). in other words, your nice house on the hill can still be attacked from its sewer system.

thi

Re:Ralph Jewhater Nader Read This Comment

[Anonymous Coward]

Still doesn't work with Mozilla, twerp.

huh???

[Tom7]

This is totally dumb. The SSSCA is certainly a bad idea, but it's meant to force copy control mechanisms in hardware. It has nothing to do with this!

First look gave me a cats and dogs moment

[lww]

I thought the virus was infecting users _with_ .NET... now that would be biblical in proportion.

What do you mean biblical?

Fire and brimstone raining down from the sky

40 days of darkness

Earthquakes, floods

Cats and dogs living together, mass hysteria

Gratuitous but obligatory ghostbusters moment to get your Monday* off to a good start... ;)

*Okay, in the name of Geek Correctness, feel free to adjust the local, horribly provincial, time reference to match your currently preferred time/space coordinates.

Re:Security hole in PHP allows arbitrary code to e

[dbateman]

You give a nice list of virii that tickle the same security hole in windows. And as you say the patch exist (turn off VB isn't it?)... I'm certain that there was an exploit of some form of this security hole before Microsoft had any fix in the market. Which one was it on your list?

My point was that the basic philosophy of Microsoft to security is that a security hole is not a problem until there is an exploit. Thus the previous authors comment about PHP, and the announcement of a security issue with no known exploit in the wild, in fact pointed to a strength in Open Source development rather than a weakness.

D.

Already happened

[sheldon]

Outlook2000 has a patch entitled "Fix stupid user", which prevents users from opening attachments. Outlook XP ships this way by default.

Granted, the patch also does some useful things like changing the profile under which email is viewed to Restricted Sites Zone, thus disabling active scripting, etc.

And if some user still insists on running that .EXE, the patch pops up when things connect to the Outlook COM objects and says "Hey, this thing is trying to send email.. is that ok dummy?"

Re:Security hole in PHP allows arbitrary code to e

[thona]

Wrong. CodeRed and others replicated through a security error in IIS, not in outlook (sorry to say, guy, you dont have a clue). The patch for IIS administrators was our a long time before Code Red hit. And wonder what? Code Red still tries to infect web servers all around the country. The number of idiots on this planet is monumental.

Another Episode of: "Duelling Moderators"

[Anonymous Coward]

Bookmark this silly comment and watch the fun.

Re:Security hole in PHP allows arbitrary code to e

[dbateman]

Have you read the story at the top of this page? The virus discussed uses the same scripting security hole in Outlook as a dozen other virus. Don't point to a particular virus and say that because this is an IIS bug and not an Outlook bug that my argument is specious.

Fact: This is no exploit for the PHP bug mentioned by the author to which I responded

My Opinion: This points to a strength in Open Source development in that it demonstrates a willing to address security issues in a rapid and timely manner. Something that I find lacking in Microsoft.

Frankly, I don't a shit how many idoit sys admins are still infected by CodeRed. My point was to point out that the original author threw out as an insult of the open source development model something that sane people would consider a strength.

D.

mass-mailer-blocker

[lseltzer]

if an external program (including any of these mass-mailer scripts) tries to send mail you are prompted to allow or deny the operation. After some period if you don't respond it times out and denies the mailing.

Re:mass-mailer-blocker

[fanatic]

OK, by mass-mailer you mean a virus. I thought mass-malier was referring to spammers. "Never mind." ;-)

Wonder if Miguel de Icaza will like this

[asobala]

Of course, .NET support in GNU/Linux would make it that much easier to port a .NET virus when one finally is made...

Flexibility

[SporkLand]

I'm just glad to hear that C# is flexible enough to write viruses in. My job was considering not using C# due to flexibility concerns, but this virus has put all of our fears to rest. Haha.

What kind of analogy is that?

[MillionthMonkey]

lojack is to unix as an idling car in south central LA is to microsoft

That makes no sense. Car theft and security have no direct logical relationships with computer operating systems. Your analogy is twisted out of shape. You should have said
"unix is to microsoft as lojack is to idling a car in south central LA."

good

[Anonymous Coward]

But are .NET virus's really a bad thing? Okay, so this isn't a virus, and the fact that it is related to .NET might not even be saying anything about.NET itself (it being an attachment worm), but, would someone please, or many people, start exploiting .NET, so that it doesn't get popular.

Re:good

[Anonymous Coward]

Spoken like a true luddite. You know nothing about it and you fear it and shun it like a psychotic 4th century peasant would fear the god of weather.

You people make me sick. You're the plague.

So you've started your own little cult of what was. Fine. Just go off and be happy with it and leave the rest of the world to move forward with progress.

Well...when the first .net virus arrives

[shaldannon]

Do we continue to chang Microsoft's favorite slogan: "1 degree of separation"? Which starts to sound like "less protection"...and if it's really so easy to use...well...might make people wish for the old days with non-standard standards ;)

s/chang/chant/g;

[shaldannon]

what's a preview button anyway?

Why this doesn't happen in Java

[MillionthMonkey]

From reading the article, it seems that this is a win32 worm that patches security components in the .NET runtime before running a damaging .NET application. A program similar to this written in Java would have several disadvantages:

1. It has no natural vector. Outlook serves well as a vehicle for socially engineered worms/viruses because it automates the execution of mobile code that arrives in attachments. The recipient only has to click on an attachment, and there is no way to know what it does unless you already know what it is. People using non-MS mail clients have to save an .EXE to disk and then manually run it.

2. The JRE doesn't have Microsoft's assistance in getting onto every shmoe's machine out there. While XP doesn't currently have .NET support, this situation won't last long. Soon everyone will have a .NET runtime on their machine whether they're aware of it or not. And, these will be the same machines that are running Outlook.

3. The security concerns surrounding Java and C# are quite similar. Either runtime can have a patch applied by wily native code. However, the average target machine will not have a JRE simply because it's a non-MS technology- it's not "part of the OS". (You won't find the old MS JVM on an XP machine.) If it does have a JRE, it will be deployed in the arbitrary directory that the user installed it into, which is unknown to the worm code unless it scans the disk. IIRC Microsoft puts the .NET runtime components in well-known places so this isn't a problem when making hostile C# patches. A worm written in Java would probably have to lug around its patched JRE with it- making it too heavy to spread very far.

4. The people who write worms won't pay any attention to Java as long as C# is around. :)

Of course, if the executable is running with no security manager in place, you can do whatever you want even if the runtime isn't patched. I can write a Java class that does a Runtime.exec() of anything I want, and send it to you. If you execute it as an application, it has no problems. I don't know personally what security constraints are placed on C# arriving in an Outlook attachment, but I can imagine they would be roughly similar to the constraints browsers place on applets. The fact that security constraints can't easily be placed on incoming native code, and the fact that the .NET runtime is so easy to patch using a little native code, means that MS has to seriously rethink its strategy of what types of mobile code are allowed to run.

C#?

[Mr. Pibb]

how does one pronounce that? Is it C-pound? C-number? C-two sets of lines at near-right angles?

Re:C#?

[dtinferno]

c sharp dufous

Re:C#?

[Phroggy]

how does one pronounce that? Is it C-pound? C-number? C-two sets of lines at near-right angles?

C-sharp. Or the enharmonic equivalent, D-flat.

Cnet/XDnet Bias in reporting

[q-soe]

This is an example of an increasing bias in Cnet and Zdnet reporting - the desire to push out information as fast as possible and as loosely checked as possible grows daily.

But i have to take the /. team to task a little - a small amount of research would have seen that the virus may be the first written in C# but its not designed to attack .NET. It makes use of some .NET frameworks components to spread but its simply a mass mailing worm and an exe file to boot, it creates a VBS.

Now to look at at that in another way.

1. Systems vulnerable to this are 2 years behind the curve - if you still allow .exe and .vbs into your environment in any form your not qualified to work in it.
2. Not keeping virus scanners up to date is asking for it
3. These guys simply did the invitable and made a virus in the new language - its been done with every language and OS platform since computers began and will no doubt continue.

I dont want to attack anyone but i would suggest that we might all be benefited by spending 5 minutes researching before we comment (and to the anti MS crowd - if you cant be bothere finding out the truth dont comment - to be honest the attacks on every mention of microsoft is getting tedious and pointless and i suspect is driving people away from open source - enough is enough - you dont like MS - they are evil - we know so dont keep telling us)

It depresses me that the level of technical discussion of anything non linux on here is lower than a snakes arse - i wish we could see the same passion that is applied to Kernal Updates applied to other areas.

Editors - check your sources please !!

What took them so long?

[iie1195]

What took them so long? I mean... really.

-iie1195
"Audaces fortuna juvat"

Vbscript is far more efficient .

[dtinferno]

In a situation where the user's op sysytem is unknown, VBscript is far more efficient. It cannot mess with .net framework, howvwer it can essentially do the same job.
(ex. Plancolumbia and Iloveyou)

Re:Security hole in PHP allows arbitrary code to e

[Anonymous Coward]

lol, i don't think so!

call it .Net

[BlueboyX]

If these virus writers were really against MS, they would have named the virus .Net, which reallyl would mess with the heads of corporate management teams. I could imagine something like that slowing down the adoption of .Net in the corporate world.

KuLPuF

[Anonymous Coward]

ARIEL!!!!!!!!!!!
KURUZZZZzzzzzzzZzZZZzzzzz!!!!!
(what?)

Well, sorry guys, I'm testing something.. oh, and I'm looking for a girlfriend. For more information: CooK4Me