Slashdot Mirror
New Windows Worm Inching Around Internet
helixcode123 writes "The Register is reporting a Windows Worm that
takes advantage of weak default passwords. This
looks pretty nasty, as it mucks with the registry
and disables network sharing." Basically if it finds SMB shares with weak passwords, it drops an executable in the startup folder... for once a security problem that isn't really Microsoft's fault.
I bet they just made a program that tried, "Love, sex, and god".
Please tell me why isn't it Microsoft's fault? Shouldn't the service be turned off by default and when it is turned on, FORCE the user to set a proper password?
...for once a security problem that isn't really Microsoft's fault...
Taco: Hell just called. They want you turn back on the heat.
Is the one left open by an Admin who has no business being an Admin....
But (more seriously), doesn't is just scare the hooey out of you that brute force password cracking is now running around as an autonamous virus on the Net???
Yeesh, I get the willies thinking of every user that I've told "you can't use password as the password".
Unbind network sharing from your external tcp/ip settings.
This should be done by default (but of course, it isn't), and I'm sure 90% of home users don't even realize their network shares are available on the internet. A lot of them probably don't even realize that they have network shares enabled in the first place.
And let's not forget the default hidden shares under win2k....if your admin password is blank, then blamo - full access to your machine.
If you can't beat them, arrange to have them beaten. -George Carlin
Okay, so it drops inst.exe into the folder... and then just waits for some mouth-breather to come along double-clicking all the .exe's he can find?
Well, I suppose if you're stupid enough to leave a default password on a shared folder, perhaps you'll fall for it, but I don't see this being a cause for widespread alarm.
I don't remeber there being default passwords on Windows file sharing (have setup multiple filesharing networks, both w/ Win domains/active directory and w/out)....weak passwords I'd expect, but default?
I'm out of my mind right now, but feel free to leave a message.....
If the worm is using default passwords to get in, then I would say that it *is* the fault of Microsoft. There should be no default password. When antype of networking is setup, you should be prompted to create a password. If no password is provided, no service is provided.
Life sucks, but death doesn't put out at all. -- Thomas J. Kopp
I just installed a new Netgear router that has a security logging feature. It is filling up in a big way with SMB requests and UDP cals.
It is currently set to ignore anything on any port that is trying to come in - and it also apparently looks for things like DOS attacks and it is listing a lot of stuff.
I just set it up yesterday, so I don't know how much of this I would have seen prior since I never logged the attempted contections before.
There are some odd things afoot now, in the Villa Straylight.
Also, even those who know better often seem to leave passwords to default if the system shouldn't be accessible from the outside. A typical example of such a system is an ADSL router / firewall. I know several of these whose password is left as standard. Granted, attacking them will be more difficult (and probably cannot be automated like in this case) but once one of the hosts inside is rooted, it's easy to connect to the router from within the LAN and gain access to the rest of the services.
You can't shut us down! The Internet is about the free exchange and sale of other people's ideas!
Actually, this might just be MS's fault. Windows 95/98 prior to 98SE and NT4 prior to service pack 4 (i think) all shipped with samba enabled by default, without a password. That means probably at least some of the hosts affected by this worm were affected because of MS's bungling.
__________________________________________
Take comfort in your ignorance.
Grandmaster Plague
Right....this one definatly can't be laid at the feet of MS...this is definatly a user problem :p
--CypherDragon
There is a reason why intelligent password crackers (dictionary attack) will first try passwords such as "password", "secret", "administrator", "root" or its variants before going through the main database.
/.ers are young (mostly). Most users never needed to know passwords longer than a 4 digit PIN until the last decade.
It isn't only at the PHB's desk that PEBKAC can occur.
Unfortunately, in an employment environment where complicated passwords are just another encumberance and annoyance for most people, this is not going to change any time soon.
Doing the Right Thing should not be preempted by making a buck.
New UNIX password: oliver
BAD PASSWORD: it is based on your username
New UNIX password: jp821968i
BAD PASSWORD: it looks like a National Insurance number.
New UNIX password: rg78kn
BAD PASSWORD: is too simple
Yeh, nothing to do with the password system.
Ok, so that's how my linux box is setup (without post install configuration), why isn't windows setup this way?
thank God the internet isn't a human right.
for once a security problem that isn't really Microsoft's fault.
What!! On Slashdot!! a story that absolves Microsoft of guilt when blind-eyed finger pointing would have been so easy...
Who are you and what have you done with the slashdot editors?!?
--
Dilbert - "If aliens take over your boss's body, is that a bad thing?"
Wally - "It depends on the aliens"
I think I'm going to write myself a little VB app that deletes everything (except itself) in the startup folder once in a while. I'd like to make my own list of things that are permitted in there so I'm not 'surprised' by bs like that.
Note to Microsoft: How about providing the user with a "Are you sure you want this here?" dialog every time something's copied in there?
Little bit of brute force coding? Or a very tiny dictionary? Would be interesting to see how it's done, really.
Doesnt say if it affects SAMBA, and i couldnt really find anything out. anyone else found or heard anything?
-- "It's tough to run with both feet stuck in your mouth" - Zoe's evil side
I'd hate to see a worm built with a password guessing algorithm that just used a dictionary attack with a capitalized first letter and '1' appended at the end.
When the admin requires a password that must be at least 6 characters long, mixed case, and contain both numbers and letters, this is the most standard type of password that is generated by users. Easy to remember.
This isn't a problem with Windows, per se. It's a problem with braindead network administration that requires either nothing in the way of password requirements or such outrageously difficult "strong" passwords that users have to write them on Post-Its stuck on the monitor.
Perhaps the best solution would be biometrics?
I have been pwned because my
"..as it mucks with the registry and disables network sharing." Okay, a worm entering you system and messing with the registry is very bad. But isn't network (file and print) sharing the number 1 windows security risk? It would be preventing potentially more malicious attacks, or at least alering the user to the problem.
I better disconnect my Windows 3.11 with TCP/IP and Win32s, don't want it getting infected!
m
http://www.froggy.com.au/mike.skinner/16bitwin.ht
xyzzy
on the list of passwords it tries. Guess I don't have to worry about this one.
Best Buy can have you arrested
for once a security problem that isn't really Microsoft's fault
this is the first time it's not Microsoft's fault? This is just another one where the user has a choice. He/She can choose a bad password, or they can be smarter than that. He/She can choose to use Windows, or they can be smarter than that.
It's about time someone wrote a worm like this.
If it does enough damage, maybe people will learn, through aversive conditioning, not to use stupid passwords.
I once worked as an SA at a bank. I could guess 90% of peoples passwords in 3 tries. I'd say about 30% were the default "welcome". And the users would bitch (and occasionally get someone fired) if we told them to change them.
If it is clearly communicated that this thing is spread because of weak passwords, maybe people will wake up and start using real passwords.
Or is it just wishful thinking?
Follow the adventures of the new wandering jews
This is the seventh posting on the front page in a row by Taco. And none of them are dupes!
Dammit, I knew I should have built that bomb shelter...
On Sunday, March 09th 2003, Symantec posted AntiVirus updates on their site as well as the LiveUpdate.
LiveUpdate:
Virus Definitions released March 9
Norton AntiVirus Corp. Edition Defs Version: 50309h
Norton AntiVirus Corp. Edition Sequence Number: 21592
Total Viruses Detected: 63225
This is peculiar since Symantec does not post any regular updates to their AntiVirus software on the weekends.
They know something, definitely.
How many of you read that article and went and changed your share password from eight asterisks in a row? How many of you thought that was so clever?
~SL
My meaningful posts keep getting modded down... all incentive to contribute fading.... fading....
Love Sex And God are actually in there!
..I hate that movie.
root, sex, god,
pass, love, mypc,
I wasn't aware that any versions of Windows shipped with Samba.
What the hell are you talking about?
My login password is a 30 digit alpha numeric with special characters in it. I don't even know what my farking admin password (except it is of equal insanity and yes I am su). It is annoying to type it in but goth damn I feel like a secure guy, then I read somthing like this and feel even better.
There is nothing wrong with being gay. It's getting caught where the trouble lies.
St. PAtricks day is this month.
For employees that are forced to change the password monthly picking a holiday from the month is easy to remember...
What's the maximum or mininum limit for password? I generally go with 6-8 with a combination of letters and numbers, often defering to foreign languages, rather than english.
I was surprised that it didn't include:
Months (i.e. january, february, ...) since I catch people using those a lot
system (i.e. another favorite)
xyzzy
plugh
Tho I do not 'foobar' is in there, but I generally use that on internet sites where I could care less if someone assumes my identity.
A feeling of having made the same mistake before: Deja Foobar
Multidropper/dropper is nasty, I am coming off of an entire weekend chasing this hunk of code.
1. Once on the system it disables personal security/firewall/virus scanning
2. Copies itself to the start up group
3. With virus scanning disabled it drops several nasty bugs.
4. Network traffic/processor utilization goes thru the roof.
5. It then tries to replicate on the next machine...
next DAT release on the 12th will include that def.
Good Luck
McAfee has an extra.dat that fights it, the
Wow, this is really hilarious. Windows, is a very secure operating system, but not out of the box. It requires an amount of time and effort setting permissions and enabling/disabling services and the like. However, Windows users are generally the people who don't know how to do anything and need everything built in and done for them.
On the other hand we've got linux, the do it yourself operating system. You've got to set up, tweak, fiddle, configure, code and compile everything. Nothing is done for you. But of course, it's secure out of the box.
Now we get a worm that is/isn't Microsoft's fault. It doesn't take advantage of a hole in the windows software, like an unchecked buffer or anything. It just takes advantage of the fact that windows isn't secure by default. So who comes out to complain that something isn't automatic and built in? Oh, of course, the linux users who love the operating system where nothing is done for you and you have to write code to make software work.
linux guy: "You're operating system isn't secure by default!"
windows guy: "You're operating system isn't anything by default!"
And dont' get me wrong, I'm a dual boot win2k/mdk9 man, but this typical slashdot hypocrisy cracks me up.
The GeekNights podcast is going strong. Listen!
Give Microsoft a break. Open source software has its own fair share of exploits and worms that take advantage of unpatched boxes. I subscribe to all of the securityfocus mailing lists and I can tell you that I see a lot more *nix than MS activity.
I feel sorry for those that let their hatred of a company clout their perception on information security.
-Lucas
Aaaah!! Damn, gotta change my password!
Seriously though, many Linux distros come configured out of the box to test your password. If it is too simple, it at the very least informs you of that problem. I don't know why Microsoft doesn't do the same thing.
IANAL... But I play one on
MS does not provide default user password under NT/2K/XP. If this worm is going around it is because users setup week passwords. MS is in no way responsible for stupid users.
Browsing through my firewall logs, a simple "file://attackeripaddy" in a browser window results in around 80% success using either no username/password, or a simple "guest" username with no password. On occasion, I'll have to throw a "C$" on the end (file://attackeripaddy/c$) but that's only necessary with fools running winNT or winXP instead of win9x. Sometimes it's even obvious that the people with compromised and unsecured computers are spammers...
Banging on my firewall then leaving their own computer open is arguably an invitation to come on in and look around. Leaving a guest account open is a clear invitation to come on in and look around just like having anonymous ftp available is an invitation to enter and at the very least look around. They're both file servers, both well known and documented...
Lock that 80% out of the internet, or even slap them upside the head temporarily, and 80% of the computers whacking away at my firewall will stop. That doesn't sound like a bad thing to me. Stupid/ignorant people who let their computer get used as a DDOS or other worm/trojan client through a basic lack of care don't get any pity from me.
Nothing happens.
Just to be the devil's advocate (literally
And second, I wonder why Microsoft hasn't jumped on the bandwagon of enforcing secure passwords (eg. password too easy, try again)? Personally, I think SUSE's restrictions are too much, but there must be a middle ground where at least very weak passwords are prohibited.
NO CARRIER
Please tell me how it's MS's fault that people pick easy to guess passwords?
Some systems I haved used in the past have a built in list and/or password analyzer, for the purpose of forbidding use of easily predictable passwords. While users tend to hate what these methods limit them to, break-ins tend to be limited to those people they know.
You can't fault Microsoft for not including such a feature. Chances are, if Microsoft did build in such a feature, someone would be taking issue with it on slashdot.
A modest proposal:
Suggest Microsoft include the ability for the administrator to select a tool (yeah, I know they typically want you to use only Microsoft Brand stuff, hence the aforementioned 'issue') Does Microsoft accept advice from users, or do they only innovate buy buying up a company that already makes such a product, integrating it, then driving all competitors out of the market? (oops, I did it myself...)
A feeling of having made the same mistake before: Deja Foobar
Now I have to change the password on my luggage.
Happy Saint Patrick's day!
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
A worm that isn't Microsoft's problem!?!? Next thing you know you'll hear about airliners falling out of the sky due to flying pigs...
eh, food for thought...
While, admitedly, the admin who left a default password in place deserves a beating with a big foam cluebat, the very fact that there is a default password in the first place is a major security flaw that traces its origins in Redmond.
A properly constructed security scheme would prompt you for a password upon activating the feature at the very least.
But MS is only following the Marketroid mantra "The users can't be bothered. They don't want to know. They don't want to understand."
That mantra might even be mostly true; but it still begets bad security. Users need education, not bad security.
For that matter, most features that end up having big security implications in Windows are not needed by the vast majority of the users out there, and activation (or better yet installation) of those features should be an explicit act.
-- MG
Hey this is great. It should take out all those morons that still have code-red banging on my webserver.
This program SHOULD have taken advantage of the Norton AntiVirus default password, 'symantec', and then worked some more magic.
Surprising that the most popular 'simple' password I have come across: drowssap wasn't on the list... either it must not be very composite, or the programmers of the worm are fairly out-of-touch.
Erutangis ym si siht.
... unfortunately for your feelings one of my henchmen said he broke into your place last night and single-user-moded your 30 digit password out of existance.
Disables file sharing, hrm. Sounds like something the RIAA would like. It could cut down on collage campus shares and stuff.
autopr0n is like, down and stuff.
That sounds like a password some idiot would have on his luggage.
It's NOT a WORM, it's a SELF INSTALLING PATCH
It looks for vulnerable shares, and disables sharing on that PC, looks for others.
Thank you very much, the Net is a safer place.
And if MS wrote it, chances are it's legal (SP3 EULA).
JWall: GUI client for IPTables
These aren't default passwords. They are just bad passwords. Haven't we learned that wide open systems with bad passwords are not a good idea? I bet 90% of the exploited systems have blank passwords. Complex password requirements can be enabled.
I see a lot of people talking about the default shares (C$, D$, etc). To use these you need full admin rights. If I have full admin rights I don't need those shares. I could set those shares up myself. They don't get me anything.
It's about time people figured out that blank passwords and the Internet don't go together. Cheap NAT routers are $30 now. Go buy one. Get one for your mom. Get one for your users that work from home.
This, again, isn't a MS problem. Users need to be responsible. I also think ISPs should be blamed as well. NAT routers are cheap enough they should be built in to cable/dsl modems now. They aren't a "real" firewall but they do the job just fine.
Is the one left open by an Admin who has no business being an Admin....
For 99.997% (Manhattan Project, anyone?) of the cases, I'd agree wholeheartedly. The rest of them, like our Network Admin where I work, are under the thumb of some stupid BEEYOTCH of an IT Director who wants to continue to use the same passwords used by the old Network Administrator (who was shitcanned by her), and refuses to allow the new guy to set newer, more secure passwords. And believe me, it's not a matter of people just not getting along. For Pete's sake, she's even yelled at me for encrypting DSN strings and sticking them in the registry of the server, instead of plopping them in a text file like everyone else, open to the world. And she totally f*cking flipped (when she read the documentation I wrote about the procedure) upon hitting the section that described how every time the DSN was accessed, read, edited, or yelled at sternly the code modified and scrambled it with a new, different algorithm. She described it as "unsafe, and taking things to an extreme that was unnecessary". She also said made some asinine comment about how we would never be able to recover the passwords if the code were ever lost, to which I recall thinking "Well first, that's job security for me, second, don't forget your goddamn passwords, and third, that's what sa access is for, you dumb bitch."
Yep, this type of commentary coming from someone who not only has no business being an IT Director, but swears on a stack of bibles she can reverse engineer MD5 in her head (we have another application that uses MD5 to hash passwords, she simply recognizes the default password hash).
I swear to God I'm not making this shit up. I wish the nasty bitch would stick to pushing pencils and leave the real work to those of us who know.
Spread the RC luvin'
It boggles the mind how the admins who choose passwords like "password" or "1234" can keep a job. These people are supposed to secure systems and make sure they work in harmony. These usually go hand in hand, too. If you have insecure systems and they are breached, obviously things won't be all harmonious and blissful. If you have problems with the network, security won't matter since problems can usually lead to backdoors. If a system is compromised by this worm, I hope the companies that hired the admins give their security and networking department hell. They deserve it. No system should be cracked by a worm that searches for the sort of passwords you'd expect an idiot (or President Scroob) to have on their luggage.
Slashdot is a waste of time. I enjoy wasting time.
What it should do when it is about to install a service that could, theoretically, compromise the system is this (assuming the admin password has not yet been set):
The final thing would be for the OS to perform the same checks on a password when anyone wants to use the control panel tool to change it. Now the premise here is that the OS won't *FORCE* you to pick a good password, but if it made a user jump through hoops like this, you can bet your ass that there'd be WAAAAAAAY less problems with people who used MS products.
Of course, then what would the Linux and BSD zealots have left to bitch about?
File under 'M' for 'Manic ranting'
MS should be punished because some users pick weak passwords.
"5... 4... 3.. 1... OFFBLAST!"
Try changing your Linux user password from the command line (hint: type passwd)
Pick something easy, like a dictionary word, or something really short.
You'll see:
[nimmerge@costanza nimmerge]$ passwd
Changing password for user george.
Changing password for george
(current) UNIX password:
New password:
BAD PASSWORD: it is too short
New password:
BAD PASSWORD: it is based on a dictionary word
New password:
Now give me a valid reason why Microsoft can't require strong passwords by default?
I'd rather be a conservative nutjob than a liberal with no nuts and no job.
Of course, no one in their right mind should leave a password blank.
On the other hand, it reminds me of the story that rms used the null string as his password at MIT so that people who couldn't otherwise get an account could still learn to use the computers. No one was really (AFAIK) spreading malicious code, at that time, either. How times change....
philcrissman.com.
Ofcourse unix has more bugs than MS , MS makes /begin list .net /end of list
...
:)
:))
:))
win95,98,win2k,winXp and
unix is sco,irix,aix,redhat,debian,gentoo , solaris,sunOS, net/open/free bsd's , tru64,hp-unix , and probably many more
don't say linux flavours are all 1 os, if then i'd say all microsoft os's are 1 os ->
16bit viruses on 32 bit platforms, and currently developing 64 bit viruses on the latest hardware.
i'm not counting the applications on them
think Msoffice and IE+outlook express, it will outsum all the bugs.
Microsoft is very good in its own way, they have an excellent gui and very easy to use system, *HOWEVER* does not mean anything if you are compromised and have your financial accounts on the same disk you browse the web with
I'd give Microsoft a big break, infact I'd break it into kazillion pieces
"disables network sharing."
:)
Thank you god. Now all it has to do is infect our network and all those open Sharedocs shares that WinXP automaticially creates that are full of Nimda are history. Although the PC would most likely be history too.
Either way nimda would be off the network
In Soviet Russia, Trojan exploits YOU!
Good for those Linux boxes! You're using a weak password.
First, the word you selected happened to be on your desk. Most likely it's a not-uncommon term in either English, your native language (if not English), or a technical term. Any good password cracker dictionary will include all three.
Second, any good password cracker is going to try variations on the words in its dictionary. Minor misspellings, appending numbers, or translation into l33t-speak. Trying every possible minor misspelling and l33t-speak variant is relatively cheap compared to searching the entire key space. Expect them to do it!
Any test the passwd filter is doing is likely based on an attack already in use by a password cracker. It would be nice if the program gave you a reason the password was rejected (I've had apparently random password rejected), but ultimately it doesn't matter. If the passwd filter doesn't like it, a cracking program probably will like it.
Search 2010 Gen Con events
It is unfortunate that users often pick weak passwords. One of the student Win2K servers we run at our university got hacked because a remote attacker guessed a local password (=$username). However, we did learn one thing from the experience - we (or rather, I) firewalled our LAN from the internet behind a linux box. It could have been a BSD box, or a Linksys router -- who cares. This is kind of OT anyway.
I firmly believe that the more heterogeneous we keep the mix of systems running on the internet, the more resilient the internet will be to any type of attack. It's like an ecological system in which different beasts catch different bugs -- but hardly ever do they all catch the same bug in the same way, at the same time. Now isn't that smart? I really think the United States and other concerned countries should invest in encouraging diversity of computer systems in order to reduce general vulnerability to a 'cyberterrorism' or whatever attacks.
In either case, to see how our Internet is currently faring check out the Internet Storm Center. Increased probes from this worm were immediately visible on the site. Also worth a read is McAfee's details on this worm.
Where I work the network has been split into two sections, IT and Engineering. The IT section is run suprisingly enough by trained IT personnel, the Engineering section by engineers who think they know how to run a network. Guess what the Admin password was on the Engineering servers - "".
Now if there had been basic password checking enabled from the get go, at least they would have been forced to use a bloody password.
Is that case sensitive?
Keep Austin Weird!
President Skroob: 12345? That's amazing I have the same combonation on my luggage. Prepare SpaceBall-1 for immediate departure and change the combonation on my luggage.
File sharing on my XP box suddenly stopped working not too long ago. I fortunatly have a firewall and decent enough admin passwords(not to mention nothing in startup) so I'd wager I'm not infected. Doesn't change the fact that any attempts I make to renable the workgroup fail miserably. This should teach me for using a legal copy of XP. Next week I go back to pirating 2000.
--
No cheating using Google!
-- @rjamestaylor on Ello
despite what you may think, these people likely aren't security professionals. They are probably your regular users, or grandmas that don't even know they have file sharing enabled.
void
If you had read the article (jk) then you would know that the worm attacks those with simply passwords like [empty]
And what's the password for a new account on Windows XP Home Edition created by the most obvious method, using all default settings?
Answer: [empty]
My computer's password is not performa6230.
Will I retire or break 10K?
Such a system would just really piss off the average user, who would just OK his way through it anyways and keep his password set to his dog's name, with it posted on a post-it note on his monitor, just in case he forgets.
A Minesweeper clone that doesn't suck
you deserve to have your system fucked up royally.
Perhaps the best solution would be biometrics?
Bruce Schneier warns that biometrics cannot be revoked. If somebody pirates your thumbprint, you can't be issued a new one ;-)
Will I retire or break 10K?
A slashdot reader that didn't read the article or even the article summary?!? I'm shocked
Weak passwords aren't a Microsoft security hole. Encouraging stronger passwords would be a good feature, but it does not make a security hole. Crawl out of your parent's basement, take a bath, and get a fucking life.
It doesn't take advantage of a hole in the windows software, like an unchecked buffer or anything.
It does take advantage of the fact that Windows allows a blank user password as a valid means of authentication. In fact, it does take advantage of "an unchecked buffer" of sorts, as the "set password" phase of the new account wizard apparently fails to check whether or not there's anything in the buffer holding the new user's password!
Will I retire or break 10K?
a simple "file://attackeripaddy" in a browser window results in around 80% success using either no username/password, or a simple "guest" username with no password.
The guest account in NT is a feature, analogous to "anonymous FTP". You just have to make sure that group "Guests" is denied write privileges outside of the temp folder and denied read privileges of any sensitive information.
Will I retire or break 10K?
World domination. Samba is perceived as definitive and Microsoft as the cheap rip-off. Natural mistake.
It boggles the mind how the admins who choose passwords like "password" or "1234" can keep a job.
Problem is that the "admins" in this case are those who administer their own home computers. I see no reason why sub-$10/hr employees of Wal*Mart or Wendy's would have any appreciable connection between administering their home computers and their standing with their employers.
No system should be cracked by a worm that searches for the sort of passwords you'd expect an idiot (or President Scroob) to have on their luggage.
Then how does anybody prevent idiots from connecting their home machines to the Internet?
Will I retire or break 10K?
eXXPee 15 t3h sux045!
That is all.
Oh, and besides that, I hope Longhorn is as good as they claim, minus removing control of consumer's hardware with DRM bullshite.
Of course, then what would the Linux and BSD zealots have left to bitch about?
We'd probably complain that what you're talking about being an OS-level software program is really not a part of the actual OS. That's what struck me really. The service may very well be considered a pre-packed part of the whole system, but it's not really part of the OS itself.
Take NFS for instance. I could very well remove every bit of code from my Linux box dealing with NFS if I want to. Not just shutdown the service mind you, but take it -ALL- out so that I -NEVER- accidentally turn the thing on. Can you do that with MS filesharing? Nope, probably not. If you can, I sure don't know how... but I'm now Windows expert either.
It's a small gripe, but the very notion that you call it an "OS" feature irks me. It's a "service" feature, but one that happens to be bundled along with the OS.
I guess we "Linux and BSD zealots" are just more uptight about the OS vs application layer. We've got clearly defined boundaries in our minds, mostly because our software has always done a good job of forcing that distinction between OS and application.
It's nitpicking, and I admit that...
A little OT, but do any *NIXes have Kerberos as your default auth service after a fresh install?
--
est modus in rebus
I remember reading that a good way of making complex and easy to remember passwords was to think of surreal or absurd politically incorrect obscenities, think about martian unicorn genitalia for example. Since supposedly no one will ever will see your password you can use highly offensive words the like of which you would not say in your day to day life, so I am not advocating hate speech. Add to this some weirdness and you end up with a password that is both complex and very easy to remember. Here is an example: _religious-slur_numer-of-people_sexual-act_impossi ble place.
give me a break. linux 'passwd' will warn if a password is too short or weak.. and if you are smart you dont allow root to ssh or telnet into your box directly.. so it wouldnt be possible to run an app with root priv anyway.
Windows wasn't meant to be secure.. it was meant to be easy.
I guess after the 2 years I've been using the same exploit I'll have to learn something new :(
With windows 2000 the administrator password is accully left blank by default if you select the auto login (all users use same login) option on the windows 2000 install. That what makes this exploit so widespread. Its nothing new, Rit.edu had a the exact attack almost a year ago.
Smev
Nonono, that's for the free outsourced system administration service.
It tries passwords? What, the lanman trick doesn't work anymore?
Mail? Put "slashdot" in the subject to pass the spam filters.
I thought that too, but the parent post was actually made first. Nice try, though. We're looking for a new Sheriff around here. Are you interested? How does Sheriff Anonymous Coward sound? You could read all the comments on slashdot looking for redundant posts. Whenever you find one, just reply to the redundant post, and I'll send in a posse. This job doesn't pay anything, and you'll be considered an idiot, and you will likely die from boredom, and you will probably lose your sexual organs from atrophy, but it's all worth it in the end when you die.
"1-2-3-4-5"
"1-2-3-4-5!? That's the stupidest combination I ever heard in my life, thats the kind of combination and idiot would have on their luggage!"
"1-2-3-4-5? That's the same combination that's on my luggage."
LOAD "SIG",8,1
LOADING...
READY.
RUN
Actually... the fault *is* the user's. You can turn on password strength enforcement via a local security policy. Crank up "Local Security Settings" under the administrative tools. Then go to Local Security Policies|Password Policy, then enable "Passwords must meet complexity requirements". It'd also be worth cranking up the minimum password length, enabling "Enforce password history", and lowering the Maximum Password Age. The reason it's off by default is because Joe User doesn't understand password complexity requirements.
Shit... Tried in Mozilla the "file://IPofanattacker/ Guess what... My own hard drive directory structure is sitting in front of me. I'm running linux and everything is fuck'n rock solid tight. All IP ports turned off. Can anyone else duplicate this. Just enter any IP address into file://(right here). Mozilla defaults to the hard drive of the actual machine it's running on????!!!! Something which I do not like....
"What's your password?" "It's random." "Great, glad you use a smart strategy, now tell me what it is, please." "I told you, it's 'random'" "How can it be random...you have to decide it when you rotate, and of course it's picked at random...so, anyhow, tell me what it is right now... " " it's random....I just told you!!!"
Everyone knows it's because your aunt worked as a secretary on her Windows 3.1 machine for years, and those ugly white windows kept the ancient monitor's CRT burning so hot straight at her chest from 9 to 5 everyday. Sheilding didn't used to be so good, you know.
Everything IS Microsoft's fault. Duh.
CAn'T CompreHend SARcaSm?
Theres something that IS microsofts fault that will let this worm wreak havok. When you install WinXP Home, and i believe Pro, it does NOT set a password for the Administrator account, or it can be bypassed eiasly (ive seen too many boxes w/o one to think its just a random thing).
Thats right. Usually all it takes to break in to a winXP box is to hit ctrl+alt+del x 2 and your back to the normal winNT login. Then type in Administrator, no password, and unless this person knows anything about windows, and often thats not enough, your in.
Add to that that all accounts made are Administrator by default, and DONT need passwords.
What REALLY hurts windows here is not being truely multiuser on a local machine. This can be felt when you try to lock down say a web kiosk, and as you edit the Local security policy, you can watch the system lock down around you, since you CANT change it on a per user basis.
Add to this things like the viral Xupiter, and windows is chock full of holes. And leaving a winXP box in non-admin node is almost worthless, because SO many programs require admin access rendering it a pain in the ass.
While in the article, the poster mentioned its not microsofts fault, it BLATENTLY is. Windows comes SO dumbed down, i have to spend hours locking it down, turning off all the annoying services and popups, etc. Not only that, it doesnt have a default to make sure you password is at least somewhat secure. The options DO exist. From a sys admin perspective, windows is a waste of time. They NEED to have a deafult "im not a dumb user" setting you choose at startup that will among other things, make sure your system is tight and passworded.
They also need to go truly multiuser, clean up permissions w/o making them useless, and make EACH local user have a SEPERATE security policy, with an emphasis on editing it when you first install.
To put thins in perspective, in a public user setting, you leave an XP box out for use for a week, and an OSX box, i guarentee you, even the most basic setup, the OSX box will be exactly how you installed it, with a bunch of crap on the desktop.
The windows box will have every spyware app on it, stuff deleted, etc, etc.
OH, Xupiter just installed itself again, i have to go...
"Stuff... In my home!? NEVER!" - Zim on Invader Zim
"I want the toilet seat!" - Little Dog on Two Stupid Dogs
Find any of your friends who works as a network admin for a sizable company that has a strong-password policy, and ask how many times a week they have to reset people's passwords because they forgot them. Divide by the number of people at said company. Now multiply by the hundreds of millions of Windows users.
That's how many calls a week Microsoft would get from home users who'd forgot their passwords. Now add the fact that Microsoft can't reset all those passwords (or even worse, imagine if they could!)...
No, Microsoft isn't going to require strong passwords anytime soon.
--
Do I look like I speak for my employer?
I don't know about you, but an out-of-the-box RedHat 8 is pretty damn secure, assuming you don't install any services with it. Select 'high security' in the installer, and boom! Instant firewall.
:) Took me about 10 minutes worth of clicking on little boxes, nothing beyond the automatic partitioning that even remotely resembled thought. Bless rpms.
Comes with more software than I've currently got loaded on my Windows machine, period. Office suite(s), games, usenet, web, mail, irc, packet sniffer, firewall, cd-burning,... I could go on, but at 4.6 gigs it's kinda scary
Anyway, your point again was?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
BEcause it will piss people off, that's why. Let the users and admins decide on their own password policies. For example, I have some systems that are not on a netwokr, so they have no admin password. No danger, you can't hack what you can't get at (they are in a secure area too).
Also, what is good security is a differing opinon. For example, many people think that frequent password changes are the best way. I disagree, I use really hellishly hard passwords instead (I still change them, just not all that often). Then again, I have a memory that allows me to do that.
It isn't something the OS should try an mandidate, all it will do is piss people off. If the admin wants to change teh policy, Windows has the tools to enforce almost any password policy they like.
This is the seventh posting on the front page in a row by Taco. And none of them are dupes!
/. editors have been replaced with the cyborgs that live among us. I for one, welcome our new android overlords. As a trusted /. personality, I can be helpful in rounding up others to toil in thier underground sugar caves.
Along with that, this post observes that Taco posted a story about a worm that did not contain a snide comment about Microsoft.
It's very clear to me now, obviously the
Enigma
Absolutely! She should have deleted the password to her breasts completely and replaced it with a DSA key.
In this case, Microsoft by default allow you to choose pathetic passwords (including no password), so they're a contributor. Mind you, that decision was probably taken back in LanMan days when the most excellent of passwords still did you no good.
At a customer site where stricter password checking is enforced on the Windows boxen, the users pick random filenames from their main public share to use. <thwack>
Got time? Spend some of it coding or testing
VMS (from which NT/2k/XP descends, I think literally descends as in stoops lower than). VMS has security clearances that Windows can only fantasise about, with special creams. Which really does make the security issues Microsoft's fault, doesn't it?
Mandrake Linux also does pretty well, at least as far as remote access is concerned. Services only listen on 127.0.0.1 by default and so on. (-: Install it in `paranoid' mode if you really like having to think up imaginative passwords and enable each service at three different levels before the world can see any of them. :-)
Got time? Spend some of it coding or testing
No no no no! You don't understand. See, this is Slashdot, and we are always against Microsoft; it is always their fault when something goes wrong, ok?
So there you have it: rule No 1 when posting stories on Slashdot. Welcome!
...many Windows versions and apps didn't install stuff like shares with empty passwords.
Got time? Spend some of it coding or testing
If this were RISKS-Digest, somebody would comment that blaming the users might be fun, but building a system that encourages users to do obviously dumb things (or permits them) is usually a Bad Idea. (Somebody else would comment that that's not always true, because enforcing some kinds of standards without thinking about the side effects, such as Yellow Sticky Notes, is often a Bad Idea too.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I see we have the expected collection of replies from people who think they're experts on passwords because they've turned on all the security settings on their debian box and ran a cracker over a shadow file. *sigh*
Here's the straight dope: passwords suck. No, seriously, I mean they really really suck. A password is either insecure because it's too "simple", or it's too hard to remember for anyone but us nerds who breezed high school without having to learn anything due to amazing powers of recall. Hard passwords are nearly always written down somewhere (how many of you carry passwords, or obfuscated passwords, in you wallet/purse, eh?). You can enforce really "hard" passwords, but all you'll do is make your users hate you. And watch you don't actually end up reducing the search space!
But hell, it doesn't matter anyway, because a complete brute-force search of the 8-character ascii domain is feasible, and is only going to get easier. (Longer passwords? Great, until you find a system you need to support that truncs at 8 -- suddenly you've got an even less secure password because the randomness in the first 8 chars wasn't an issue. Or you have to let people use phrases, and English's entropy isn't that high. What, you mean you don't manage domains of hosts with common auth? Sit back down then.)
The good news is, this doesn't mean shit. What are you trying to protect? Most people don't need uber-secure passwords. Who'd want to hack into my mother's webmail account? The effort involved wouldn't be worth any payoff.
But:
- mib
p.s. Useradd/passwd is not account management.
They're usually badly implemented, and almost *always* implemented in closed systems with closed-source code and opaque programmer interfaces. The special hardware that they use does keep getting cheaper, but most of it doesn't provide enough documentation to know what its real weaknesses are. Do you know what it's doing with your fingerprint data, or how well that's protected? That's not only an issue of your _personal_ security, it's also a risk that somebody who can hack one device with your fingerprints can hack all the others. And fingerprints are something you've at least got 10 of -- Don't look into laser beam with remaining eyeball...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
since the worm doesn't try the most common password: ******
In two early chapters of that book, one of the protagonists is trying to crack the password of his vanished colleague's computer. The machine persists in asking: "Do you have the password?" and lots of permutations and magical incantations are tried.
SIGBUS @ NO-07.308
if the hackers need any help, here are the most common passwords for my website...
;)
Alright, but whats your website address?
She doesn't realise that if our firewall doesn't work, there is nothing between us and the internet except those passwords. I'm luck that making a password strong enough to pass Linux means that her password is ok for Win.
See my journal, I write things there
I swear!! I was doing some repair work on ~8 year old lab computers at my school, and of course nobody knew the bios passwords. I got so bored trying to guess it I tried *s and it worked! Wish I remembered the bios make/version. It was probably some old proprietary crap.
So, what does that turn security into?
an absolute fucking mess?
Now you could have one password for all the plebs(the people who will probably have the most password problems).
I've worked for a couple of companies that do this:
Keridge used to have a pleb password that changed daily.
Where I work the door code changes every month
The mainframe access codes for external companies are shared amongst the staff of that company.
etc...
Anyone who needs more than basic, 'you can't do much' access will need to choose (or be assigned) a different password.
Just did. What the hell is up with that?
*sigh* Ce la vie, Mozilla.
I use the diceware system. I generally end up with 25+ character passwords, and when mixed up cases, swap letter for number and word separator special chars are used, it gives very high strength passwords.
Then just use memory path tricks to store them in the old' grey matter, nuff said. I use the same rules every time for character substitution, so I don't have to remember the coded password, just the diceware phrase. Apply the coding, and there's the password.
Tequila - drink of the gods.
Start -> Programs -> Administrative Tools -> Local Security Policy -> Account Policies -> Password Policy -> ....
That is what I call user friendly.
I am not a Linux expert but I guess you have to change a line in a text file to achieve the same results.
IANAL but write like a drunk one.
Here are at least two reasons 99% of the comments on this story are a complete and utter waste of internet bandwith:
k _access.htm
. asp?url=/TechNet/prodtechnol/winxppro/reskit/prdp_ log_oeec.asp
1) http://www.theeldergeek.com/blank_password_networ
2) http://www.microsoft.com/technet/treeview/default
Most of the people who have commented above have obviously never (a) taken the time to understand how to secure windows and (b) enjoy running their mouths endlessly about things they have no clue about. For starters no NT based OS that I know of neglects to present the user with the option to password protect the admin account during installation unlesss specifically instructed not to through the use of extended installation options. Next if any of you bothered to check out the links above you'll see that the fact that Windows XP allows for Admin level users to have blank passwords doesn't constitute a remote security hole at all. Why? Because Windows XP will not allow remote connections to be made to itself using an account whose password is blank.
Am I surprised at how many people here didn't know this? Nope. Am I surprised that a bazillion f-tards talking trash about this subject got modded up by people who are even more clueless than they are? Nope. I'll tell you what did surprise me though. Taco actually gave you people a straight up comment which pretty much hits the nail on the head here.
I never thought I would say this - but thanks a lot Taco. Maybe their is hope for ya afterall. I mean any professional NT admin who has at least one of his boxes infected with this needs to be escorted out of the building immediately. Take his paper MCSE and shove directly up his a*s because thats pretty much all it is going to be good for. Oh and be sure that the door doesnt hit his ass on the way out because it sure as hell wouldn't be worth the cleaning staffs time to have to clean that one up.
Moral of the story: Windows and Linux are just as easy to secure and require an equal amount of vigilance to keep secure. Anybody who thinks otherwise is a retard.
J
I love idealists not because I am one, but because they make life bearable for pragmatists such as myself.
I can't say I keep a high security for my computer as I should (and I really should...to much pr0n to lose), but for internet banking, really important stuff online, I have a pretty foolproof system.
What I do is I take the name of someone I know for every month of the year. I associate a date with them, like birthday, day i met them etc. Sounds stupid so far, but here's what I do next
I then associate the date with the current year and decide how to mess about with the numbers. Do i just take the date at face value, or do I use date seperatrs / . and - in some sort of combination and use them as mathematical operators to generate a number? What ever I decide to do I convert the number into hex (because some passwords require numbers) and then attach it to the name of the person concerned in what ever way I choose and voila, password generated. Keeo in mind that if you use the same combination of operators when the year changes, you password is not going to change a hell of a lot for corresponding months between the years
The beauty is I've told you my system and you can't figure out any of my passwords. Better yet, you don't actually need to remember your passwords, more likely you just need to remember the mathematical operators because names and birthdays should come off the otop of your head. I can't remember my slashdot password though, I chose that before my system. Thank goodness for cookies.
"I just can't sit while people are saying nonsense in a meeting without saying it's nonsense" J Watson, Sci Am 288:(4)51
Their laxidasical handling of security while promoting ease-of-use instead is the number one reason everyone has so many problems. If Microsoft ever got serious about security, we would hear of DAILY issues.
Your real password is a hash of your "friendly" password. Passwords are munged before being sent over the network, the munging being done according to a unique key in a dongle you stick into a USB port. Just don't lose the... oh... nevermind.
Of course, something like this would have to be built into the operating system. Perhaps there could be a checkbox on the Windows password dialog that said [x] use MungeMatic Password(TM).
I suppose you could store the munger key on a floppy or a CD too, but then the same idiots who use pa$$word would make dozens of copies.
And of course, this can't protect you from people sitting at your terminal with your dongle; but if that's happening, you've got bigger problems anyway.
Another possible solution? Just charge people for password changes.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
OMG just did this to the IP of a webserver and found a load of shares miscofigured, thank god i'm not the admin of that server.. left a note for them though......
Even if you encourage stronger passwords, people use the easy ones. If you force them to use strong passwords via password checkers, they just write the fucking passwords on a sticky note stuck to their monitor. I have seen this way too often to laugh anymore. I just write mine down on a card and lock it in my desk :)
Blar.
The lameness filter can't be removed until the moderation system is fixed. All ASCII art, whatever its purpose, is lame and should be moderated to -1. CmdrTaco knows this, but the moderators haven't figured it out yet, so sometimes they moderate ASCII art up. Therefore the lameness filter is necessary to pre-moderated ASCII art out of existence. When the moderation system is fixed, and all ASCII art is moderated to -1, then the lameness filter can be removed.
You might think to yourself "that's silly", but think about it: what happens if Jon Carmack posts an ASCII-art flowchart of how DOOM IV's engine works. A lot of people would try to moderate that up, but as you've already learned, it needs to be moderated to -1. Only when language, shoot, I mean moderation... only when moderation is perfected will we be free of the lameness filter.
From the story: "for once a security problem that isn't really Microsoft's fault."
I find it to be that most Windows security problems stem from it not being MS' fault but rather the lazy-ass Admins not patching, changing passwords, having sufficient info., etc. Of course the easy answer is for people to stop writing malware, then that would be great, but people being people like to fuck with things.
Cantral Command (also known as the Vexira Anti-Virus people have a good bit more detail -- including a password list. If historical data is any indication, I'd expect about a 10-20% hit ratio just with the password 'password' (and simple variants thereof).
OS Software is like love: The best way to make it grow is to give it away.
Kyle: Let me check my email first. *tap* *tap* *tap* *tap* *tap* Dan: That's a short password...what is it... "chair"? Kyle: *terror* no... Dan: *LAUGH* Kyle: Let me check my email. *tap* *tap* *tap* *tap* *tap* Dan: So...change your password? Kyle: No. Dan: What is it now..."bread" Kyle: fuck you.
"no one knows how to fill in the void called america" --the discovery channel
XP Home adds new users (including the first) without passwords by default, and as Administrators by default. This makes all default shares accessible sans password.
SQL Server is installed by many workstations apps with a blank or well-known-default password.
Many services install vulnerable by default. I had a mate replace Linux with Win2k on his box, hook up to the internet and start downloading updates... and his box was trash 11 minutes later. Needless to say, he's back on Linux.
Got time? Spend some of it coding or testing
Did something new happen in the ME/XP/2k versions of windows? I don't use those, but on my win98 and winNT boxes the netbios ports are 137,138, and 139. Did Microsoft kerberize these services or something?
/etc/services on all my *nix boxen port 445 is undefined, but IANA says Microsoft does indeed own 445. My samba boxes and NT servers don't show the port live with nmap, though.
In
The smoothwall firewall SSL admininstration application runs on 445. That's the only thing I know of offhand that uses it.....
After reading all the posts that people where giving about how many insecure passwords they were finding on their system I decided to check up on the passwords on my system (I work for a web hosting company). After check my system for the standard password, sex, username, blah blah blah I keep getting 0 records found each time. Then I remembered we had a few rules about our passwords: 1. Must be between 6 to 24 characters in length. 2. Must contain at least one digit (0-9) 3. Must not contain your username (or your username backwards) With these simple rules it appears that most of the standard suckie passwords don't appear on our system. So give it a try on your system and stop users from having crappy passwords!
Unstable Apps: Our Android Apps Don't Suck
http://business2-cnet.com.com/2100-1002-991844.htm l?type=pt&part=business2-cnet&tag=feed&subj=ne ws
Is having a password that forces a user to write it down on a little piece of paper or a post-it note really better than one that they can remember?
Assuming a sufficiently strong password, I think enforced password rotation hurts more than it helps. As a user, it's not easy to come up with a good password. Then you want me to make up a new one every 90 days? Right. How about I just start using the same password and incrementing a number at the end ('password1, password2, password3, ...).
If that is disallowed, and I have to choose some different incomrehensible string every 90 days, then what I will do is write down the password, because there is no way in hell that I'm going to memorize something like that on an ongoing basis. What's more secure, a strong (but static) password, or a password on a post-it in my desk drawer?
This reminds me of some of the examples that I've heard Kevin Mitnick give, I think he referred to it as Social Hacking. This worm basically gains access to systems through human weaknesses instead of technological weakness. If this one does do damage, I wouldn't be surprised to see more appear using these methods. -- SA
SA
Clue: md5sum
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Your Binary is wrong
00 = 0
01 = 1
10 = 2
Good day
"It's very clear to me now, obviously the /. editors have been replaced with the cyborgs that live among us. I for one, welcome our new android overlords. As a trusted /. personality, I can be helpful in rounding up others to toil in thier underground sugar caves."
For those of you who don't know, this is a reference to a line in The Simpsons spoken by Kent Brockman.
Episode is called "Deep Space Homer" and is in season 5.
Life is tough. It's tougher if you're stupid. --John Wayne
Comment removed based on user account deletion
Opaserv
network.vbs
There were some others I found before, but I'm not finding them now, probably need to refine my search, but I don't have the time atm.
Here's some more reading material...
911, etc.
port scan
I spent some time reading up on how buffer overflows were used for exploits on this port, UDP packets, and so on. I'm not convinced this is innocent activity, particularly since I do have a firewall configured and don't see any outgoing traffic.
Learning about attacks is an ongoing thing for me and until I have all the facts, or enough of them, I'm leaving it my firewall to keep intruders out. I have seen bursts, usually on weekends when I assume more infected computers have been turned on and the worms are active. At various times I've had as many as 100 hits within 2-3 minutes.
Since I have no current reason for anyone on the internet to access my system, I believe a complete lockdown is a good position to start with. If I put it on a high-speed connection, with fixed IP and fire up services, then I'll allow ports as necessary.
A feeling of having made the same mistake before: Deja Foobar
I've tried to use good passwords, but some sites bar you from using anything but alphanumeric characters, or LIMIT you to 6 chars..can't blame the users under those conditions.
Making an OS that has a port for a certain protocol (namely NetBIOS) available over another *by default* that exposes it to millions of other machines (namely TCP/IP via the 'net) is definitely NOT the way to release an OS that you are claiming is supposed to be so secure.
Who is "the admin" for all of those people who are just regular home users/gamers/students (with no real interest in computers, or anyone for that matter for whom the computer is just another tool?
The answer? Microsoft. Thus, this is their screwup - again.
When you get your license and you buy your first car, does the manufacturer/dealer hold you responsible for knowing how to fix the engine or rebuild it? No - you just have to know how to use the vehicle - ie: drive, add gas, check oil and tires. Just like how every casual (ie: non "admin-type" computer user) expects that with a computer, they need to plug it in, turn it on, maybe defrag it or run a virus scan every now and then, and use their favorite program/game on it... NOT be a network admin for it.
With the Internet "slowly" making it's way into everyone's house - and via faster and faster connections - and the large majority of those Internet users being computer users, default Windows setup should account for that.
Oddly though, each new release of Windows opens MORE ports instead of less - and also even MORE "accidental" back doors.
WebMaster:
BinFeeds
XXX Thumbnailed Image Newsgroups but
Authentication is usually based on some sort of combination of these three factors:
-What you know (username/password)
-What you have (token, e.g. smart card)
-What you are (biometrics)
Username/password is a _good_ authentication mechanism for CERTAIN scenarios. And, as we all know, there is no such thing as absolute security even combining the above factors (users writing PIN codes on a hardware token, etc.) But a heterogenous environment combined with good policies (and judicious application of the clue bat to users every now and then) sure reduce the fear factor with your passwords.
Sort of off topic, but it beats arguing about the problems of passwords.
Cole's Law: Thinly sliced cabbage
What mechanism is more responsible than click-thru software EULAs for training computer users to believe that they should expect to regularly see large blocks of text emphatically declaring dire warnings and that they should just click "OK" without reading when those blocks of text pop up?
There's a checkoff box in the Windows 'networking' control panel to enable or disable file sharing completely. It would be damned hard to accidentally turn it back on if it's not turned on. If it's never been enabled, you need the distribution CD to enable it because the setup scripts need to copy files.
What ever crossdressing eric.
Why not try doing some reall trolling...
No wait..
Why not get a sex change so you can really claim to be a woman.
Oh wait I forgot, you are a shemale and the only person who you will be tity fucking is yourself.
My password is out! nooo!
Nice try, but I know what you changed it to:
****************
Apart from everyone complaining and joking about the strength of the average user's password i read nothing about the actual worm this is about.
The worm comes in using port 445 (this is the samba over TCP port) and tries some simple passwords (the most effective being the empty password). After the infection the worm drops the file dvldr32.exe in the startupfolder so that next time the machine is restarted the worm/virus will be installed onto the machine.
What the worm does is:
- Start scanning and infecting other random ips, it does this on a very high speed (i.e. 100's of ips per minute)
- Installs WinVNC (a vnc server for windows) that allows remote control, see the vnc webpage.
- Connects to some private IRC servers and joins a channel with some high ascii chars in the name (chinese?) and a password. The IRC server is modified so that it does not give back any information to the client, but anyone on IRC can request the ips of all the infected machines. When i tested this there were about 8000 infected machines on IRC (8000 was the IRC client limit so there are probably alot more infected machines out there).
Note that this is quite a big threat as even passive attackers can get ips of infected machines by watching their logs for connections to port 445. Most of the machines making such connections to you are either machines in your local network or infected machines (unless you do alot of samba over tcp/ip over the internet).
One can easily access the harddisks of these machines using the Admin$ share (which you know has no or only a simple password) either to get files from the users or computer or get a copy of the worm itself (it's located in \winnt\system32 folder and named dvldr32.exe). Once you have a copy of the worm you can obtain the vnc password using some good old reverse engineering tricks (which i will not give out here because that would help out scriptkiddies just a little bit too much). I tried out the password i obtained using this analysis on one of the hosts that scanned me and guess what the guy was doing on his pc, yep he was downloading porn using KaZAA.
From the looks of it this worm has already infected alot of machines. I get about one connection attempt to port 445 every 2 hours.
For some more info about the worm checkout the antiy website
Let's see how long it takes before all ISPs block their vnc (5900) and their microsoft-ds (445) ports to stop the worm or microsoft issues a security update that forces strong passwords upon users or asks for permission everytime something new is put into the startup folder.
I actually USE pi as my login... or actually, a long chunk of it from several hundred digits in. I've been slowly memorizing pi for years now by using 15-25 character passwords with digits from pi. After a couple months when I can enter the password without thinking... I move on to the next chunk of numbers in pi. I've memorized about 200 or so digits so far.
Yes it is useless. But at least I'm using the password I need to memorize for some purpose. Ever thought of learning your favorite poem by setting your password to the poem, line by line? Only practical in systems that accept long passwords, such as Netware, Win2K, or anything using Kerberos.
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
My opinion of the car analogy is well documented, so I'll just skip repeating what I've already said. But you ask a valid question, namely: "Who is "the admin" for all of those people who are just regular home users/gamers/students (with no real interest in computers, or anyone for that matter for whom the computer is just another tool?"
You answered MS, but I disagree. MS is not the admin of my systems at home, I am. The car dealership is not responsible for the general mainetence and upkeep (and cleaning) of my car, I am. At some point, a home user must become the admin, take responisbility for not securing their computer, and learn something in the process. The Internet is a dangerous place, filled with scum and villany, and to leave your computer unprotected is just as silly as not having doors on your house--any moron with bad intent can walk right in and take your stuff.
Users, casual, home, grandpa-type users need--nay, must--get a clue that although computers are indeed getting more "user friendly" they're still not something to be taken lightly. And with broadband coming to more and more homes, this is something that needs to be addressed. Microsoft makes their OSes cater to the masses. It's like they took the idea of "all things to everyone" and went nuts with it. That's great, make the OS be able to do it all, wonderful; but what about it leaving open all those holes?
Ask MS and they'll tell you the same thing that I will here: at some point the user has to take control and learn how to protect himself by closing the ports and patching the system when exploits are discovered.
It seems strange to me that when MS does exactly that, by enabling automatic updating, people go crazy about privacy violations! You cannot have it both ways, wanting MS to do it for you and not having to be bothered, or not have someone "else" poke around in your business. By doing a brief nmap scan on a newly installed, but not yet comfigured Linux box, I find that there are a lot of open ports on that one as well. So this is not a MS only problem.
I totally disagree with the idea that a user cannot be empowered. I equally disagree with the notion that people, themselves, aren't to be blamed; that it's someone elses fault. This mentality has to stop! "Don't blame me my kid can't read, it's the school's fault!" (nevermind the fact that the parent was nowhere to be found and didn't spend enough time with the kid); or "Don't blame me that my system wasn't behind a firewall, it's Microsoft's fault!" (nevermind the fact that ICF has been available since Windows XP and can be turned on with a single checkmark) are equally pathetic. Just as parents need to take control of their kids' activities, monitor, guide, and assist--be a part of the learning experience for the child--people need to learn that computers are the same deal: you have to learn, adapt, understand, and protect your systems. That means patches, upgrades, more RAM, security checks, defraging, scandisking, etc.
It's a jungle out there, and just as it takes responsibility to rear a child; it takes just as much responsibility to engage (correctly) in the electronic neighborhood of the Internet.
Ah yes, the old ad hominem attack. Guaranteed to win any argument!
And thats the one to get by foolproof at the school. I never have the time to get around it.
From the original post:
"I ended up disabling the service, but there should be a better way..."
Maybe the lack of security on XP is part of the deal with the Feds to make their collection of information easier. They've got Magic Lantern but they've also got this...
Look at the URL you typed.... file://IPofanattacker/
Look at the first portion: <b>file</b>://IPofanattacker/
Try visiting file:///etc/resolv.conf (or any other file).. it's going to spit back the file on your machine... just like mailto: sends an e-mail to an e-mail address, or ftp: visits an FTP site, file: will show you a file..
not mine... i spent a good 15 minutes writing a script for that comment that counts all that stuff.
thanks for the gratitude for my "informative" comment.
when I was in highschool, my math teacher had this poster of pi that ran along the top of the wall all the way around the room. becuase that class was so boring, I took that precious time to memorize 52 digits of pi, just for the hell of it. now while this is an odd talent, it has come in handy in a couple physics classes where the professor asked if anyone knew the value of pi.. and I'm still waiting for that one woman I know must exist out there somewhere that will think a recitation of 52 digits of pi is better than shakespeare any day. :)
I have a new virus on my computer too. It seems when the Norton Antivirus Updates subscription is not renewed after a year it becomes a virus that pops up a dialog box on your Windows computer each time your start it up for the day and asks if you will renew now or later (later being limited in selection to tomorrow).