Slashdot Mirror
New Windows Worm Inching Around Internet
helixcode123 writes "The Register is reporting a Windows Worm that
takes advantage of weak default passwords. This
looks pretty nasty, as it mucks with the registry
and disables network sharing." Basically if it finds SMB shares with weak passwords, it drops an executable in the startup folder... for once a security problem that isn't really Microsoft's fault.
Please tell me why isn't it Microsoft's fault? Shouldn't the service be turned off by default and when it is turned on, FORCE the user to set a proper password?
Unbind network sharing from your external tcp/ip settings.
This should be done by default (but of course, it isn't), and I'm sure 90% of home users don't even realize their network shares are available on the internet. A lot of them probably don't even realize that they have network shares enabled in the first place.
And let's not forget the default hidden shares under win2k....if your admin password is blank, then blamo - full access to your machine.
If you can't beat them, arrange to have them beaten. -George Carlin
I don't remeber there being default passwords on Windows file sharing (have setup multiple filesharing networks, both w/ Win domains/active directory and w/out)....weak passwords I'd expect, but default?
I'm out of my mind right now, but feel free to leave a message.....
If the worm is using default passwords to get in, then I would say that it *is* the fault of Microsoft. There should be no default password. When antype of networking is setup, you should be prompted to create a password. If no password is provided, no service is provided.
Life sucks, but death doesn't put out at all. -- Thomas J. Kopp
Also, even those who know better often seem to leave passwords to default if the system shouldn't be accessible from the outside. A typical example of such a system is an ADSL router / firewall. I know several of these whose password is left as standard. Granted, attacking them will be more difficult (and probably cannot be automated like in this case) but once one of the hosts inside is rooted, it's easy to connect to the router from within the LAN and gain access to the rest of the services.
You can't shut us down! The Internet is about the free exchange and sale of other people's ideas!
There is a reason why intelligent password crackers (dictionary attack) will first try passwords such as "password", "secret", "administrator", "root" or its variants before going through the main database.
/.ers are young (mostly). Most users never needed to know passwords longer than a 4 digit PIN until the last decade.
It isn't only at the PHB's desk that PEBKAC can occur.
Unfortunately, in an employment environment where complicated passwords are just another encumberance and annoyance for most people, this is not going to change any time soon.
Doing the Right Thing should not be preempted by making a buck.
I think I'm going to write myself a little VB app that deletes everything (except itself) in the startup folder once in a while. I'd like to make my own list of things that are permitted in there so I'm not 'surprised' by bs like that.
Note to Microsoft: How about providing the user with a "Are you sure you want this here?" dialog every time something's copied in there?
I'd hate to see a worm built with a password guessing algorithm that just used a dictionary attack with a capitalized first letter and '1' appended at the end.
When the admin requires a password that must be at least 6 characters long, mixed case, and contain both numbers and letters, this is the most standard type of password that is generated by users. Easy to remember.
This isn't a problem with Windows, per se. It's a problem with braindead network administration that requires either nothing in the way of password requirements or such outrageously difficult "strong" passwords that users have to write them on Post-Its stuck on the monitor.
Perhaps the best solution would be biometrics?
I have been pwned because my
I wasn't aware that any versions of Windows shipped with Samba.
What the hell are you talking about?
St. PAtricks day is this month.
For employees that are forced to change the password monthly picking a holiday from the month is easy to remember...
Wow, this is really hilarious. Windows, is a very secure operating system, but not out of the box. It requires an amount of time and effort setting permissions and enabling/disabling services and the like. However, Windows users are generally the people who don't know how to do anything and need everything built in and done for them.
On the other hand we've got linux, the do it yourself operating system. You've got to set up, tweak, fiddle, configure, code and compile everything. Nothing is done for you. But of course, it's secure out of the box.
Now we get a worm that is/isn't Microsoft's fault. It doesn't take advantage of a hole in the windows software, like an unchecked buffer or anything. It just takes advantage of the fact that windows isn't secure by default. So who comes out to complain that something isn't automatic and built in? Oh, of course, the linux users who love the operating system where nothing is done for you and you have to write code to make software work.
linux guy: "You're operating system isn't secure by default!"
windows guy: "You're operating system isn't anything by default!"
And dont' get me wrong, I'm a dual boot win2k/mdk9 man, but this typical slashdot hypocrisy cracks me up.
The GeekNights podcast is going strong. Listen!
"Your average user" is why virus like this spread.
*sigh*
Give Microsoft a break. Open source software has its own fair share of exploits and worms that take advantage of unpatched boxes. I subscribe to all of the securityfocus mailing lists and I can tell you that I see a lot more *nix than MS activity.
I feel sorry for those that let their hatred of a company clout their perception on information security.
-Lucas
MS does not provide default user password under NT/2K/XP. If this worm is going around it is because users setup week passwords. MS is in no way responsible for stupid users.
Browsing through my firewall logs, a simple "file://attackeripaddy" in a browser window results in around 80% success using either no username/password, or a simple "guest" username with no password. On occasion, I'll have to throw a "C$" on the end (file://attackeripaddy/c$) but that's only necessary with fools running winNT or winXP instead of win9x. Sometimes it's even obvious that the people with compromised and unsecured computers are spammers...
Banging on my firewall then leaving their own computer open is arguably an invitation to come on in and look around. Leaving a guest account open is a clear invitation to come on in and look around just like having anonymous ftp available is an invitation to enter and at the very least look around. They're both file servers, both well known and documented...
Lock that 80% out of the internet, or even slap them upside the head temporarily, and 80% of the computers whacking away at my firewall will stop. That doesn't sound like a bad thing to me. Stupid/ignorant people who let their computer get used as a DDOS or other worm/trojan client through a basic lack of care don't get any pity from me.
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Shit, I should go change my root password now.
I wondered about that one, too. I'm guessing that's what happens when you hold down X until the buffer is full.
Just to be the devil's advocate (literally
And second, I wonder why Microsoft hasn't jumped on the bandwagon of enforcing secure passwords (eg. password too easy, try again)? Personally, I think SUSE's restrictions are too much, but there must be a middle ground where at least very weak passwords are prohibited.
... in other news, Microsoft SQL Server 2000 is now being included in the RedHat 8.2 distribution's default install, and a security bulletin has been released for MacOSX 10.2 Print Services running on the Commodore 64.
While, admitedly, the admin who left a default password in place deserves a beating with a big foam cluebat, the very fact that there is a default password in the first place is a major security flaw that traces its origins in Redmond.
A properly constructed security scheme would prompt you for a password upon activating the feature at the very least.
But MS is only following the Marketroid mantra "The users can't be bothered. They don't want to know. They don't want to understand."
That mantra might even be mostly true; but it still begets bad security. Users need education, not bad security.
For that matter, most features that end up having big security implications in Windows are not needed by the vast majority of the users out there, and activation (or better yet installation) of those features should be an explicit act.
-- MG
Oh good, you found a way to blame Microsoft. I was worried we would have to go an entire discussion thread without blaming them for anything.
These aren't default passwords. They are just bad passwords. Haven't we learned that wide open systems with bad passwords are not a good idea? I bet 90% of the exploited systems have blank passwords. Complex password requirements can be enabled.
I see a lot of people talking about the default shares (C$, D$, etc). To use these you need full admin rights. If I have full admin rights I don't need those shares. I could set those shares up myself. They don't get me anything.
It's about time people figured out that blank passwords and the Internet don't go together. Cheap NAT routers are $30 now. Go buy one. Get one for your mom. Get one for your users that work from home.
This, again, isn't a MS problem. Users need to be responsible. I also think ISPs should be blamed as well. NAT routers are cheap enough they should be built in to cable/dsl modems now. They aren't a "real" firewall but they do the job just fine.
But the editor is still making an insulting comment not really related to the article and not backed up in any way. It seems there are one of these lines at the end of every article related to . . .well. . .not related to Linux. The comments never add to the article. Please leave them off.
The masses are the crack whores of religion.
I liked a friend of mines way of dealing with this, he ran a dictionary attack against the password database and a couple other tools, if your password was guessed the account was disabled and a note put in as to why, then when you called to have it re-enabled the helpdesk did an internal charge of $100 to your department, most managers would only let one crack go =)
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
MS should be punished because some users pick weak passwords.
"5... 4... 3.. 1... OFFBLAST!"
Ofcourse unix has more bugs than MS , MS makes /begin list .net /end of list
...
:)
:))
:))
win95,98,win2k,winXp and
unix is sco,irix,aix,redhat,debian,gentoo , solaris,sunOS, net/open/free bsd's , tru64,hp-unix , and probably many more
don't say linux flavours are all 1 os, if then i'd say all microsoft os's are 1 os ->
16bit viruses on 32 bit platforms, and currently developing 64 bit viruses on the latest hardware.
i'm not counting the applications on them
think Msoffice and IE+outlook express, it will outsum all the bugs.
Microsoft is very good in its own way, they have an excellent gui and very easy to use system, *HOWEVER* does not mean anything if you are compromised and have your financial accounts on the same disk you browse the web with
I'd give Microsoft a big break, infact I'd break it into kazillion pieces
My own survey of 267,000 passwords, here are the top ones.. If we've found them abused, they've already been changed, which I believe is why "password" is lowered from the #1 position to #2.. :)
:)
:) I figure if it took me 30 seconds with a buzz, it's probably too easy. BTW, there are all kinds of interesting options to set on those machines. :)
505 1234
494 password
319 6969
241 harley
231 123456
201 golf
180 pussy
169 mustang
169 1111
143 shadow
135 1313
134 fish
130 5150
127 7777
121 qwerty
120 baseball
118 2112
116 letmein
114 12345678
114 12345
Other than these, the users name, with the variations of a leading or trailing numeral, or the name spelled backwards also rank very high, but of course, don't show properly in this list..
Sadly enough, people very frequently try to pick the same userid and password, which we no longer allow. We have some people who are *VERY* into their cars, and one who was upset because he couldn't have the name of his favorite car (Honda).. I pulled a quick report of the car manufacturers I could think of.. There are lots of variations on Chevy and Ford and their models. On one site, someone even has the userid of "Yugo".. I guess you have to have pride in what you drive.
If I had coded the worm, I would have gzip'd in a good dictionary file just to make things simplier.
The web site password crackers that I've seen use dictionary files, and for the passwords they try:
word
drow (word backwards)
[0-9]word (read as regex, not literal)
word[0-9]
[0-9]drow
drow[0-9]
Then they try the above with all caps, alternating capitalization, and swapping numbers for letters. (like zero for "oh", or three for "ee")
Anyone who reads this and now realizes that I hit your userid:passwd, *CHANGE YOUR PASSWORD*. You're using a stupid password, and if it's anything someoen wants to get into, they will. Even if it seems simple like a password to a web site, your web Email, or your Windows file share that no one is suppose to use.
BTW, in-store machines, like cash registers and those self-serve photo stations use words that are just as simple..
I had a few drinks before I went shopping the other day. My friend was waiting for them to find his cigarettes, so I was standing by one of the Kodak scanning stations. I tried the basic ones (1234 - 4321 - 12345), so I looked at the sales reciept. I found the store number, and voila, I was in.. I didn't bother to do anything else, I was hungry, so I went home.
Serious? Seriousness is well above my pay grade.
Such a system would just really piss off the average user, who would just OK his way through it anyways and keep his password set to his dog's name, with it posted on a post-it note on his monitor, just in case he forgets.
A Minesweeper clone that doesn't suck
If it does enough damage, maybe people will learn, through aversive conditioning, not to use stupid passwords.
Just like Melissa, and ILoveYou, and Klez, and Goner have taught the users to be very careful when opening e-mail attachments.
They that would sacrifice their
Actually...that's not entirely true...at least in the case of email or website login passwords...especially if they use either of those for business purposes. I think most of the time people just don't think of the possible problems that could arise from someone getting ahold of their password.
NeoChichiri
http://www.neochichiri.net
Everyone knows it's because your aunt worked as a secretary on her Windows 3.1 machine for years, and those ugly white windows kept the ancient monitor's CRT burning so hot straight at her chest from 9 to 5 everyday. Sheilding didn't used to be so good, you know.
Everything IS Microsoft's fault. Duh.
CAn'T CompreHend SARcaSm?
That was an interesting post. But I'm replying more to what you said afterwards.
/24 or another.. I striped out whitespace, added lines, I almost gave up, but one word finally made it click..
:(
You spent good time giving an informative message, which when you hit submit, it honestly should have taken..
At the risk of sounding off-topic, I agree with you completely about the lameness filter.. Sometimes switching your input type from "Plain Old Text" to "Code" will help, but there's another filter it'll frequently be caught on bitching about too much whitespace or redundant lines. Last time, I was trying to show examples of our our DNS worked.. 18 lines with word "Address: ", and half starting with one
I can't imagine what would happen if I actually posted a significantly long chunk of code for someone, that I *COULDN"T* strip anything out of.. What do I do, write a novel behind it just to fill space to make their percentages match what a normal message should read like?
I do sympathise with them though. We get abusers on our systems all the time too, but in our case, we have an abuse button, where an abuse moderator can dump the message because it was bad.. It would seem to be an easy enough mod for here. If something gets modded down to -2, it never shows to anyone (effectively deleted). I know I should have some outragously high Karma by now (now only known as "Excellent")
They still need to do some work on here.. Too bad the bugs show up when we try doing in depth posts..
Serious? Seriousness is well above my pay grade.
If this were RISKS-Digest, somebody would comment that blaming the users might be fun, but building a system that encourages users to do obviously dumb things (or permits them) is usually a Bad Idea. (Somebody else would comment that that's not always true, because enforcing some kinds of standards without thinking about the side effects, such as Yellow Sticky Notes, is often a Bad Idea too.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I see we have the expected collection of replies from people who think they're experts on passwords because they've turned on all the security settings on their debian box and ran a cracker over a shadow file. *sigh*
Here's the straight dope: passwords suck. No, seriously, I mean they really really suck. A password is either insecure because it's too "simple", or it's too hard to remember for anyone but us nerds who breezed high school without having to learn anything due to amazing powers of recall. Hard passwords are nearly always written down somewhere (how many of you carry passwords, or obfuscated passwords, in you wallet/purse, eh?). You can enforce really "hard" passwords, but all you'll do is make your users hate you. And watch you don't actually end up reducing the search space!
But hell, it doesn't matter anyway, because a complete brute-force search of the 8-character ascii domain is feasible, and is only going to get easier. (Longer passwords? Great, until you find a system you need to support that truncs at 8 -- suddenly you've got an even less secure password because the randomness in the first 8 chars wasn't an issue. Or you have to let people use phrases, and English's entropy isn't that high. What, you mean you don't manage domains of hosts with common auth? Sit back down then.)
The good news is, this doesn't mean shit. What are you trying to protect? Most people don't need uber-secure passwords. Who'd want to hack into my mother's webmail account? The effort involved wouldn't be worth any payoff.
But:
- mib
p.s. Useradd/passwd is not account management.
My website only stores encrypted passwords. Anyone on Slashdot who stores plain text passwords should be ashamed.
Follow me
What mechanism is more responsible than click-thru software EULAs for training computer users to believe that they should expect to regularly see large blocks of text emphatically declaring dire warnings and that they should just click "OK" without reading when those blocks of text pop up?