Slashdot Mirror
Klez: a closer look
sheriff_p writes "Anyone recieving even a small amount of email is likely to have encountered Klez varients of some form in the last few months - Message Labs shows it as being the biggest email-transmitted virus of all time by some way. So just how boring is it? Virus Bulletin has an indepth look at what makes Klez tick." And today alone, Klez virus e-mails were 90% of my e-mail by bytecount. YAY Outlook!
As I have tried to explain to my more gullible user-friends, a little crankiness goes a long way
towards virus protection!
: )
Don't read this!
Klez has been great for my company! We just classify every copy of Klez we receive as "corporate acquistion of capital" and assign it a monetary value. We've got 6.2 billion in Klez inventory baby!
But seriously...127K seems to be the magic number for Klez.
So couldn't a filter simply be set up to block all emails 127k in size?
tcd004
Encryption doesn't solve anything if the method of opening the address book is the point of failure.
;-)
i.e. the virus doesn't raw-read the address file, it uses the Outlook API to look it up on it's behalf, just like any other program.
Hence, the fact the address book file is now encrypted does not stop the virus using it.
You dig?
Perhaps I'm missing something, but how would encrypting the address book help?
It's not like the virus is accessing raw binary data from the address book; more than likely it's using some sort of API call to get the data.
* Q
P.S. If you don't get this note, let me know and I'll write you another.
We use outlook and exchange server where I work. Never, ever, seen a virus in the two and a half years I've worked here. Why ? because the admins know what they're doing and catch all the viruses before they ever get anywhere near us delicate users. I'm not an especial fan of MS (I'm a bastion of Java in a sea of MS where I work) but all the sniping at Outlook is just bs. People target outlook and other MS products because it's popular. I mean, why bother writing a virus that targets some system only a couple of geeks ever run ? The key factor is competent admins, properly configuring and defending the systems they're responsible for.
Bad analogies are like waxing a monkey with a rainbow.
Set up an E-Mail address at your domain, called something like:
ignoreme@example.net
and publish it on your webpage, as an address for UCE only, and ask people not to send correspondence to it.
Then, filter all E-Mail received in your other mail boxes, against all of the mail received by ignoreme, and any that matches, delete.
Well, yes they could do that. I'm sure everyone will feel safe for a couple of months, until the encryption is broken, or a loophole is discovered. Then it will be back to square one.
It would appear that a more long term solution would be to remove scripting! I have yet to see a use of scripting used within an email that could not be done if Microsoft removed scripting from Outlook. The only thing anyone ever uses is the ability to add buttons to the top of the email. You do not need a turing complete scripting language that can open sockets and read the address book to do that.
Then again, baubles and shiny things make managers with budgets happy, I guess.
Syllable : It's an Operating System
...is when even viruses don't send you mail :-(
;-)
Steve
Enjoy Y2K? Roll-on Year 2037!
Personally I get the enlarge your penis by up to three inches distribution quite a bit. I'm thinking a lot of my male associates must have some ... errr deficiencies... that they keep opening that particular email up and spreading it to me.
This comment was generated by a Squadron of Ultra Ninjas
It would only help if the addresses were encrypted with a one-way hash ;)
Silly question:
Whenever Hemos or CmdrTaco posts about a Windows virus, they always end with "yadda yadda 90% of my e-mail yadda...". How is it that you can run the #1 geek news site and still have e-mail viruses infaltrating your inbox? Is it that much trouble to install MIMEDefang? If you'd like, I'll offer up my services as a consultant to install virus scanning software on your e-mail server, since you two obviously can't figure it out, but I hope that isn't neccesary.
There is no reasonable defense against an idiot with an agenda
:wq
I mean, that the whole going through your contacts/sent items list and mailing them is all very well, but I can write some perl that does that with your Pine folders easily enough.
I posted an article a while ago on this but it was rejected. It's a Wired article entitled "The Great MS Patch Nobody Uses". Granted it is Microsoft's fault this stupid stupid exploit happened in the first place, but it's also interesting to note that the fix for 80% of these problems have been available for over a year virtually unnoticed.
And finally, if you're running procmail then:
* Content-Disposition: attachment
* name=.*\.(com|exe|pif|scr|bat|lnk|shf|vbs)
{
# Stick it somewhere
}
does a pretty good job of filtering out that sort of junk.
Avantslash - View Slashdot cleanly on your mobile phone.
You'll see the value once you start to make more friends. Especially if your friends have ugly email addresses on a variety of providers. Besides, there's an easier way to avoid spreading virusues than avoiding your addressbook: just avoid Outlook.
I read the internet for the articles.
Well, you know the HTML specs, when a browser sees a tag it doesn't recognize, it *should* just ignore them. Obviously, your browser doesn't recognize the tag yet ;-)
--You will rephrase your request for me to go to hell. Goto statements are not acceptable programming constructs
I am an avid Outlook user, I love the ease of use, and all the features. I have received like 2 viruses in my whole time using my computer. Maybe I'm just unpopular, or I just use virus protection with hueristics scanning. Or maybe my Microsoft based Email Server actually does a pretty decent job of blocking all the crap from flowing down the pipe. I agree with another post in that kiddies write virii for Outlook cuz everyone uses it. Hense M$'s Market Share. If everyone used pine, it would be Pine Bashing time. Now Mod me down now because I flamed LInux like you always do.
"On a long enough timeline, the survival rate for everyone drops to zero."
This article is very timely for me. I had never received an email virus until about a week ago. Now I get Klez virtually every day.
Fortunately I look the descision a long time ago not to use Outlook as my email client (I use Eudora). However, Klez is still a nightmare because it can randomly choose an address for the "From:" field from the computer it has infected, which means that if someone you know gets infected, you can get irate emails from people telling you not to send them viruses!
Nightmare.
...that require semi-regular contact with many people. Personally, I am the IT Manager and Corporate Buyer for the company that I work for.
Small company, so I wear a few hats. Anyway, I have a fairly decent sized Address book that contains virtually all of the vendors that I have to deal with, business contacts at both client sites as well as my geek contacts that let me bounce ideas off of them.
Sure, if you are a "house-geek" or a college geek, you probably only have a small number of people to E-mail. (Mostly your 3733t friends and such.) However, once you hit the "real" world you find that your boundless memory actually has a few boundries.
-.-
If you ignore the other uses of a tool, does that make the tool less useful, or you less useful?
If Microsoft would just do good encrypting on the address book, and update it every once and a while for new encryption, stuff like this wouldn't happen because the virii wouldn't be able to get the addresses of every person using Outlook.
Unless every use of the address book required the user to enter a key then this would do nothing especially useful. Since a virus could easily decrypt the data, assuming it even needed to.
At the least, this would slow a virus down.
Only if the encryption was complex enough that decrypting the data too a long period of time...
My wife and I both use Outlook for all of our email. Neither of us have ever been infected by the virus because we've kept up with updates to Outlook that block you from opening programs (and we know better).
She receives several copies a day of the Klez virus. I've never received it despite having about the same overall email traffic.
I think that the difference lies in who we know. I'm a Computer Engineer and she's a counselor. Thus, the average individual with my email address is a lot more computer savvy than those with her email address.
1. set up mail filter to punt any attachments to .jpg, .gif, .txt, .zip
2. There is no step two.
"Draco dormiens nunquam titillandus."
Nearly. It doesn't go far enough, IMHO. Active Scripting is still there, but Microsoft have increased the security restrictions, and done some of the more obvious stuff (Like adding warning dialog boxes under certain circumstances, stripping obviously infected attachements etc.)
Scripting is still there, however. How much do you trust that there is not Yet Another Security Loophole in there somewhere?
The fact remains that if there is no scripting at all in Outlook, it will make it impossible for worms to spread themselves via. Outlook.
Syllable : It's an Operating System
If I receive emails with the Klez virus attached, that means someone I know is probably infected, doesn't it?
In which case (since the From: field is not necessarily indicative of who it came from) how can I find out who it came from so that I can tell them that they're infected?
Brilliant. Sheer brilliance.
These are nicknamed "White Worms" (like white magic, which is a helpful form of magic), but the problem is that they're still viruses/worms that exploit security holes and waste companies' bandwidth (remember how Nimda and CodeRed really put a strain on lots of servers?) If you wrote one of these and spread it, companies would still try and sue you, and law enforcement agencies would still prosecute you.
So can I just assume that Klez is just generating these on its own and it's actually the *other* guy who is infected? Because I run Norton AntiVirus with the latest filters...or am I actually infected with Klez and I am really generating all this email that is bouncing at the other end?!?
Inquiring minds want to know. Thanks.
- adam
DAMN! That's the best suggestion I've seen in a long time.
You could've hired me.
Recently I received something that could be a new variany of Klez. The difference is that it does not look at your own computer for contacts. It looks at web-pages. This is how it seems to work:
- Download a random web-page.
- Rip all the addresses.
- Choose a small phrase from the web-page
- Spoof an email from one address to another, using the key-phrase.
- Go to 1.
This seems to be a much better option than using the outlook addressbook, because it is more probable that emails will be read by the corresponding parties. Why? Because they are both mentioned on the same web-page, so they must have some common interest. The subject line can be something related to their interest too... it is not like getting a pr0n email from a priet in Nevada or something B]I miss my rubber keyboard.(Homepage)
Klez is not really such a smart virus, compared to some of the earlier Outlook scripts that would grab a real document off the luser's HD and send it. The thing that makes it a major PITA is the forgery.
The only way to track down a Klez sender is to follow the Received: headers back to the ISP, and ask them to search their RADIUS &/or DHCP logs to figure out which user was at that address at the time the message was sent. Most ISP's that I've contacted would rather not bother, so the infected PCs remain blissfully ignorant.
Alternately, the ISP could require authenticated SMTP, and attach the real user ID to every message in some way. Or install a virus filter on the outbound connection. But once again, they don't want to bother. It's the tragedy of the commons.
Klez doesn't read your addressbook, it just snoops the network interface. Far more effective.
Do daemons dream of electric sleep()?
I know that Klez forges the "From:" line in the header. There is a "From" (no colon) line at the top of email messages. I believe that this line comes from another source not forged by Klez. Usually, this line appears to be correct. The "From" (no colon) email address tends to agree with the first mail server that relayed the message. Is my understanding correct?
Two or three times, I have tried to warn users that they are infected by sending messages to the "From" (no colon) address. It never has worked. Why not? Every time, I have ended up emailing the administrators of the domain or mail server. (BTW, most places do a terrible job of monitoring email to postmaster.) I always have included the headers so that the administrator could track down the infected user by date and IP address. Each time, the administrator then contacted the user and put a stop to the problem. How come the user never fixes it? Shouldn't my emails have gotten through? Did the users just ignore my warnings or was there something else at work?
1. Connect to a mail list archive
2. etc.......
Mailing lists are better, because the sender is ofter waiting for a reply.
thank God the internet isn't a human right.
Its the other guy. Mostly, the virus will not forge the return-path header, but some variants do that too. As mentioned elsewhere, the only solution is to contact the ISP concerned.
You will be clean.
Just another postmaster.
I can throw myself at the ground, and miss.
Last month my work PC was infected with Klez. Although Norton apparently can detect the virus it doesn't seem to be able to destroy it. I went to the Nortin site and tried the Klez cleaner and insturctions, but it didn't do any good. Then I noticed that Klez runs under the Guest account. I changed the password on the Guest account tand the problem seemed to go away.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
The virus I've had the hardest time getting rid of:
[ ] Nimda
[ ] Klez
[ ] ILoveYou
[ ] Sircam
[ ] Hybris
[ ] Whatever CowboyNeal has
Give me my freedom, and I'll take care of my own security, thank you.
I'm getting various Klez emails in my Hotmail at the rate of about 6 a day : Clearly these viruses are scanning the newsgroups as they are not coming from people I know or converse with (I use my Hotmail account as a reply for newsgroup postings, so I get about 60 spams a day). I find it humorous, and of the potential for conspiracy theorists, that shortly after Hotmail started selling memberships for expanded storage space, I started getting a warning every 2 days or so about running out of space : Of course I'd check my account to find that 90% of the space suckage were various Klez viruses (which Hotmail does not, at least up until yesterday, filter out. Again, warm up the conspiracy machine...).
It should be noted that only a small proportion of the messages contain "Klez" in the subject. I've seen it with subject lines that seem faintly related to newsgroups that I've posted in : SQL Server terms, HTML phrases, CSS selectors, etc.
* ! ^Received:
* 9HyTO130D42FAAAAU1bo5RoAAGoAi9joFC4AAIvwi0UIg.YBV
klez
The lameness filter is putting a space in the string of characters above so be sure to remove it when you put this in your procmailrc file. Also remove the space before the :0 B in the first line.
Prevent email address forgery. Publish SPF records for y
Well, the anti-virus companies won't tell you how to block Klez (except by buying their products) but I funnel all my mail through a custom filter and this is the algorithm I use to get rid of Klez-like messages, once and for all:
If message contains multipart/alternative entity, /etc/mime.types,
and entity has a part with a filename,
and the filename's extension doesn't match the entry in
then drop the message.
You could also, I think, send a "you're an idiot" bounce message to the envelope MAIL FROM: address (not the header From:, it's wrong). That one usually looks correct. Not sure though, probably best to just drop them.
There are other clues in the message, such as IFRAME code, etc., but this seems foolproof, and I can't imagine any normal email program generating multipart/alternative sub-parts with a filename.
my dedicated slashdot spam account gets roughly 2-5 emails with klez per week. I dont know if some virus writing moron has a address harvester or what, but thats the only way i ever get email viruses. I should clarify, my mail server catches the bugs, squashes em, then mails me the paticular details so my actual email client never gets infected.
Lawyers, MBA's, RIAA? A jedi fears not these things!
just push your mail providers to install a virus scanner on ther mailer daemon side..
Not necessarily something a provider wants to do. For starters, scanning thousands upon thousands of incoming e-mails puts a heavy strain on the servers. More importantly, however, is that by doing so a provider implicitly admits legal responsibility for what their users are doing on their systems. If you can read through users' e-mails to determine if they're infected with a virus, Big Bad Government is going to come in to ask you to scan for evidence of illegal actions as well.
For this reason, my employer has, for now, decided to forego server side virus scanning, and I pretty much would agree with him.
News and bla for computer musicians: http://lomechanik.net/
In the height of the Klez infections (about 2 1/2 months ago), I got 76 emails infected with Klez in one morning.
The trick with Klez is that it spoofs the "from" header, and chooses an address at random from the infected computer's address book and its web cache.
I got tons of infected emails from people who had only surfed into a page containing one of my email addresses. Since I have 25 or design clients, this can add up to quite a few "webmaster@" email addresses. While my busiest site gets about 700 unique visitors daily, overall, my email accounts are exposed to ca. 4500 uniques daily.
That's a lot of novice users who think that getting an email that has the subject:
"A Excite Game"
and a body message that runs something like:
This is a excite game I made. It is my first try at a game. I hope you like it!
is a legit email. I have personally gotten this one over and over again, with the adjective randomized (a FUNNY game, a NEW game, etc.).
I can't believe that people open it, but they do. And they get infected, and then I get mails from them, spoofed to appear to be coming someone in their address book, or their browser cache.
Which makes it a drag, because you can't easily track down the offending individual.
The reason I think this virus is so prevalent (aside from the fact that most users are so gullible) is simply because you can't email the infected party and say "hey, you are infected with Klez", but with other viruses, such as SirCam and what not, you could, therefore stopping the virus infection, eventually.
::.. check out some Cell Phone Reviews
Clever.
- adam
We use Lotus at my company. But I still get about a dozen emails a day from Klez. But I never got any virus originating from a Linux machine...
toncho/~ apt-cache search virus
clamav - powerful anti-virus scanner for Unix.
mailscanner - An email virus scanner and spam tagger.
renattach - Rename attachments on the fly.
sanitizer - The Anomy Mail Sanitizer - an email virus scanner
xbill - Get rid of those Wingdows Viruses!
amavis-exim - Interface between MTA and virus scanner.
amavis-milter - Interface between MTA and virus scanner.
amavis-postfix - Interface between MTA and virus scanner.
scannerdaemon - virus scanner written in Java
virussignatures - virus signatures for ScannerDaemon
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Yes, really. My mailbox is constantly full of the damn things (well, that, and SPAM from Korea). I have a number of readers of my small fanfiction page, and I think they all use Windows/Outlook Express, so there you go. They are not computer geeks; they know how to use a computer to read and send e-mail, to browse the web, and to write stuff/design websites in some cases, but, like most Windows users, their computers are tools to get a job done, not a way of life.
I, on the other hand, am a programmer who uses Linux at home; I didn't get infected by those damn Klez viruses, nor do I even download them--I limit fetchmail on the size of attachment and inspect the oversized mails thru my ISP's web interface every few days. Almost everytime, they are Klez viruses, though I'm also seeing some Goldfish thingy, starting recently.
I'm really, really sick of this crap filling up my mailbox. It's viral spam: an unspeakable hybrid of two of the worst internet evils.
---dragoness