Slashdot Mirror
Klez: a closer look
sheriff_p writes "Anyone recieving even a small amount of email is likely to have encountered Klez varients of some form in the last few months - Message Labs shows it as being the biggest email-transmitted virus of all time by some way. So just how boring is it? Virus Bulletin has an indepth look at what makes Klez tick." And today alone, Klez virus e-mails were 90% of my e-mail by bytecount. YAY Outlook!
As I have tried to explain to my more gullible user-friends, a little crankiness goes a long way
towards virus protection!
: )
Don't read this!
Klez has been great for my company! We just classify every copy of Klez we receive as "corporate acquistion of capital" and assign it a monetary value. We've got 6.2 billion in Klez inventory baby!
But seriously...127K seems to be the magic number for Klez.
So couldn't a filter simply be set up to block all emails 127k in size?
tcd004
Encryption doesn't solve anything if the method of opening the address book is the point of failure.
;-)
i.e. the virus doesn't raw-read the address file, it uses the Outlook API to look it up on it's behalf, just like any other program.
Hence, the fact the address book file is now encrypted does not stop the virus using it.
You dig?
We use outlook and exchange server where I work. Never, ever, seen a virus in the two and a half years I've worked here. Why ? because the admins know what they're doing and catch all the viruses before they ever get anywhere near us delicate users. I'm not an especial fan of MS (I'm a bastion of Java in a sea of MS where I work) but all the sniping at Outlook is just bs. People target outlook and other MS products because it's popular. I mean, why bother writing a virus that targets some system only a couple of geeks ever run ? The key factor is competent admins, properly configuring and defending the systems they're responsible for.
Bad analogies are like waxing a monkey with a rainbow.
Set up an E-Mail address at your domain, called something like:
ignoreme@example.net
and publish it on your webpage, as an address for UCE only, and ask people not to send correspondence to it.
Then, filter all E-Mail received in your other mail boxes, against all of the mail received by ignoreme, and any that matches, delete.
Well, yes they could do that. I'm sure everyone will feel safe for a couple of months, until the encryption is broken, or a loophole is discovered. Then it will be back to square one.
It would appear that a more long term solution would be to remove scripting! I have yet to see a use of scripting used within an email that could not be done if Microsoft removed scripting from Outlook. The only thing anyone ever uses is the ability to add buttons to the top of the email. You do not need a turing complete scripting language that can open sockets and read the address book to do that.
Then again, baubles and shiny things make managers with budgets happy, I guess.
Syllable : It's an Operating System
...is when even viruses don't send you mail :-(
;-)
Steve
Enjoy Y2K? Roll-on Year 2037!
It would only help if the addresses were encrypted with a one-way hash ;)
Silly question:
Whenever Hemos or CmdrTaco posts about a Windows virus, they always end with "yadda yadda 90% of my e-mail yadda...". How is it that you can run the #1 geek news site and still have e-mail viruses infaltrating your inbox? Is it that much trouble to install MIMEDefang? If you'd like, I'll offer up my services as a consultant to install virus scanning software on your e-mail server, since you two obviously can't figure it out, but I hope that isn't neccesary.
There is no reasonable defense against an idiot with an agenda
:wq
I mean, that the whole going through your contacts/sent items list and mailing them is all very well, but I can write some perl that does that with your Pine folders easily enough.
I posted an article a while ago on this but it was rejected. It's a Wired article entitled "The Great MS Patch Nobody Uses". Granted it is Microsoft's fault this stupid stupid exploit happened in the first place, but it's also interesting to note that the fix for 80% of these problems have been available for over a year virtually unnoticed.
And finally, if you're running procmail then:
* Content-Disposition: attachment
* name=.*\.(com|exe|pif|scr|bat|lnk|shf|vbs)
{
# Stick it somewhere
}
does a pretty good job of filtering out that sort of junk.
Avantslash - View Slashdot cleanly on your mobile phone.
My wife and I both use Outlook for all of our email. Neither of us have ever been infected by the virus because we've kept up with updates to Outlook that block you from opening programs (and we know better).
She receives several copies a day of the Klez virus. I've never received it despite having about the same overall email traffic.
I think that the difference lies in who we know. I'm a Computer Engineer and she's a counselor. Thus, the average individual with my email address is a lot more computer savvy than those with her email address.
Nearly. It doesn't go far enough, IMHO. Active Scripting is still there, but Microsoft have increased the security restrictions, and done some of the more obvious stuff (Like adding warning dialog boxes under certain circumstances, stripping obviously infected attachements etc.)
Scripting is still there, however. How much do you trust that there is not Yet Another Security Loophole in there somewhere?
The fact remains that if there is no scripting at all in Outlook, it will make it impossible for worms to spread themselves via. Outlook.
Syllable : It's an Operating System
If I receive emails with the Klez virus attached, that means someone I know is probably infected, doesn't it?
In which case (since the From: field is not necessarily indicative of who it came from) how can I find out who it came from so that I can tell them that they're infected?
So can I just assume that Klez is just generating these on its own and it's actually the *other* guy who is infected? Because I run Norton AntiVirus with the latest filters...or am I actually infected with Klez and I am really generating all this email that is bouncing at the other end?!?
Inquiring minds want to know. Thanks.
- adam
Klez is not really such a smart virus, compared to some of the earlier Outlook scripts that would grab a real document off the luser's HD and send it. The thing that makes it a major PITA is the forgery.
The only way to track down a Klez sender is to follow the Received: headers back to the ISP, and ask them to search their RADIUS &/or DHCP logs to figure out which user was at that address at the time the message was sent. Most ISP's that I've contacted would rather not bother, so the infected PCs remain blissfully ignorant.
Alternately, the ISP could require authenticated SMTP, and attach the real user ID to every message in some way. Or install a virus filter on the outbound connection. But once again, they don't want to bother. It's the tragedy of the commons.
Last month my work PC was infected with Klez. Although Norton apparently can detect the virus it doesn't seem to be able to destroy it. I went to the Nortin site and tried the Klez cleaner and insturctions, but it didn't do any good. Then I noticed that Klez runs under the Guest account. I changed the password on the Guest account tand the problem seemed to go away.
"God fights on the side with the best artillery." - Napoleon, Marshal of France - speaking truth to power
The virus I've had the hardest time getting rid of:
[ ] Nimda
[ ] Klez
[ ] ILoveYou
[ ] Sircam
[ ] Hybris
[ ] Whatever CowboyNeal has
Give me my freedom, and I'll take care of my own security, thank you.
* ! ^Received:
* 9HyTO130D42FAAAAU1bo5RoAAGoAi9joFC4AAIvwi0UIg.YBV
klez
The lameness filter is putting a space in the string of characters above so be sure to remove it when you put this in your procmailrc file. Also remove the space before the :0 B in the first line.
Prevent email address forgery. Publish SPF records for y
Well, the anti-virus companies won't tell you how to block Klez (except by buying their products) but I funnel all my mail through a custom filter and this is the algorithm I use to get rid of Klez-like messages, once and for all:
If message contains multipart/alternative entity, /etc/mime.types,
and entity has a part with a filename,
and the filename's extension doesn't match the entry in
then drop the message.
You could also, I think, send a "you're an idiot" bounce message to the envelope MAIL FROM: address (not the header From:, it's wrong). That one usually looks correct. Not sure though, probably best to just drop them.
There are other clues in the message, such as IFRAME code, etc., but this seems foolproof, and I can't imagine any normal email program generating multipart/alternative sub-parts with a filename.
my dedicated slashdot spam account gets roughly 2-5 emails with klez per week. I dont know if some virus writing moron has a address harvester or what, but thats the only way i ever get email viruses. I should clarify, my mail server catches the bugs, squashes em, then mails me the paticular details so my actual email client never gets infected.
Lawyers, MBA's, RIAA? A jedi fears not these things!
In the height of the Klez infections (about 2 1/2 months ago), I got 76 emails infected with Klez in one morning.
The trick with Klez is that it spoofs the "from" header, and chooses an address at random from the infected computer's address book and its web cache.
I got tons of infected emails from people who had only surfed into a page containing one of my email addresses. Since I have 25 or design clients, this can add up to quite a few "webmaster@" email addresses. While my busiest site gets about 700 unique visitors daily, overall, my email accounts are exposed to ca. 4500 uniques daily.
That's a lot of novice users who think that getting an email that has the subject:
"A Excite Game"
and a body message that runs something like:
This is a excite game I made. It is my first try at a game. I hope you like it!
is a legit email. I have personally gotten this one over and over again, with the adjective randomized (a FUNNY game, a NEW game, etc.).
I can't believe that people open it, but they do. And they get infected, and then I get mails from them, spoofed to appear to be coming someone in their address book, or their browser cache.
Which makes it a drag, because you can't easily track down the offending individual.
The reason I think this virus is so prevalent (aside from the fact that most users are so gullible) is simply because you can't email the infected party and say "hey, you are infected with Klez", but with other viruses, such as SirCam and what not, you could, therefore stopping the virus infection, eventually.
::.. check out some Cell Phone Reviews