Slashdot Mirror
New Windows Worm Inching Around Internet
helixcode123 writes "The Register is reporting a Windows Worm that
takes advantage of weak default passwords. This
looks pretty nasty, as it mucks with the registry
and disables network sharing." Basically if it finds SMB shares with weak passwords, it drops an executable in the startup folder... for once a security problem that isn't really Microsoft's fault.
I bet they just made a program that tried, "Love, sex, and god".
...for once a security problem that isn't really Microsoft's fault...
Taco: Hell just called. They want you turn back on the heat.
Is the one left open by an Admin who has no business being an Admin....
But (more seriously), doesn't is just scare the hooey out of you that brute force password cracking is now running around as an autonamous virus on the Net???
Yeesh, I get the willies thinking of every user that I've told "you can't use password as the password".
"Please tell me why isn't it Microsoft's fault? "
Please tell me how it's MS's fault that people pick easy to guess passwords?
Unbind network sharing from your external tcp/ip settings.
This should be done by default (but of course, it isn't), and I'm sure 90% of home users don't even realize their network shares are available on the internet. A lot of them probably don't even realize that they have network shares enabled in the first place.
And let's not forget the default hidden shares under win2k....if your admin password is blank, then blamo - full access to your machine.
If you can't beat them, arrange to have them beaten. -George Carlin
I don't remeber there being default passwords on Windows file sharing (have setup multiple filesharing networks, both w/ Win domains/active directory and w/out)....weak passwords I'd expect, but default?
I'm out of my mind right now, but feel free to leave a message.....
If the worm is using default passwords to get in, then I would say that it *is* the fault of Microsoft. There should be no default password. When antype of networking is setup, you should be prompted to create a password. If no password is provided, no service is provided.
Life sucks, but death doesn't put out at all. -- Thomas J. Kopp
Also, even those who know better often seem to leave passwords to default if the system shouldn't be accessible from the outside. A typical example of such a system is an ADSL router / firewall. I know several of these whose password is left as standard. Granted, attacking them will be more difficult (and probably cannot be automated like in this case) but once one of the hosts inside is rooted, it's easy to connect to the router from within the LAN and gain access to the rest of the services.
You can't shut us down! The Internet is about the free exchange and sale of other people's ideas!
There is a reason why intelligent password crackers (dictionary attack) will first try passwords such as "password", "secret", "administrator", "root" or its variants before going through the main database.
/.ers are young (mostly). Most users never needed to know passwords longer than a 4 digit PIN until the last decade.
It isn't only at the PHB's desk that PEBKAC can occur.
Unfortunately, in an employment environment where complicated passwords are just another encumberance and annoyance for most people, this is not going to change any time soon.
Doing the Right Thing should not be preempted by making a buck.
New UNIX password: oliver
BAD PASSWORD: it is based on your username
New UNIX password: jp821968i
BAD PASSWORD: it looks like a National Insurance number.
New UNIX password: rg78kn
BAD PASSWORD: is too simple
Yeh, nothing to do with the password system.
Ok, so that's how my linux box is setup (without post install configuration), why isn't windows setup this way?
thank God the internet isn't a human right.
for once a security problem that isn't really Microsoft's fault.
What!! On Slashdot!! a story that absolves Microsoft of guilt when blind-eyed finger pointing would have been so easy...
Who are you and what have you done with the slashdot editors?!?
--
Dilbert - "If aliens take over your boss's body, is that a bad thing?"
Wally - "It depends on the aliens"
I think I'm going to write myself a little VB app that deletes everything (except itself) in the startup folder once in a while. I'd like to make my own list of things that are permitted in there so I'm not 'surprised' by bs like that.
Note to Microsoft: How about providing the user with a "Are you sure you want this here?" dialog every time something's copied in there?
I'd hate to see a worm built with a password guessing algorithm that just used a dictionary attack with a capitalized first letter and '1' appended at the end.
When the admin requires a password that must be at least 6 characters long, mixed case, and contain both numbers and letters, this is the most standard type of password that is generated by users. Easy to remember.
This isn't a problem with Windows, per se. It's a problem with braindead network administration that requires either nothing in the way of password requirements or such outrageously difficult "strong" passwords that users have to write them on Post-Its stuck on the monitor.
Perhaps the best solution would be biometrics?
I have been pwned because my
xyzzy
on the list of passwords it tries. Guess I don't have to worry about this one.
Best Buy can have you arrested
It's about time someone wrote a worm like this.
If it does enough damage, maybe people will learn, through aversive conditioning, not to use stupid passwords.
I once worked as an SA at a bank. I could guess 90% of peoples passwords in 3 tries. I'd say about 30% were the default "welcome". And the users would bitch (and occasionally get someone fired) if we told them to change them.
If it is clearly communicated that this thing is spread because of weak passwords, maybe people will wake up and start using real passwords.
Or is it just wishful thinking?
Follow the adventures of the new wandering jews
This is the seventh posting on the front page in a row by Taco. And none of them are dupes!
Dammit, I knew I should have built that bomb shelter...
On Sunday, March 09th 2003, Symantec posted AntiVirus updates on their site as well as the LiveUpdate.
LiveUpdate:
Virus Definitions released March 9
Norton AntiVirus Corp. Edition Defs Version: 50309h
Norton AntiVirus Corp. Edition Sequence Number: 21592
Total Viruses Detected: 63225
This is peculiar since Symantec does not post any regular updates to their AntiVirus software on the weekends.
They know something, definitely.
Read the article. In addition to turning off file sharing, it installs a backdoor into the system.
[insert witty quote here]
Let me guess, UDP port 137 is producing lots and lots of logged events?
Thats normal. There are two solutions;
1. Design, build and spread a virus or trojan which will irrevocably destroy all Windows boxes which are connected to the internet without a firewall.
Or
2. Stop logging UDP port 137.
In the free world the media isn't government run; the government is media run.
Because this is slashdot. The fact that your aunt has breast cancer is Microsoft's fault.
St. PAtricks day is this month.
For employees that are forced to change the password monthly picking a holiday from the month is easy to remember...
what about c$? or admin$?
not all shares are manually set.
if the admnistrator password is weak then the system can be comprimised this way with no shares being set (unless things have changed since NT4.0 that I don't know about.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
Um, actually there are a lot of "default" shares laying around ripe for the picking. In win98, I believe it's only the system root and all the drives. I think the same are enabled in win2k. You can disable them, but they come back upon reboot. In win2k, by default, you the service which must run isn't enabled, but under win98, it's trivial to hack around and get any of the default shares. These are ones which you don't see, by the way.
-=fshalor
Go look at your computer's C$ share. This is the default share on a fresh 2K install.
Even if it requires local admin accounts to access this share, just that it is available, and HIDDEN, is a grave security fault!
Doing the Right Thing should not be preempted by making a buck.
What's the maximum or mininum limit for password? I generally go with 6-8 with a combination of letters and numbers, often defering to foreign languages, rather than english.
I was surprised that it didn't include:
Months (i.e. january, february, ...) since I catch people using those a lot
system (i.e. another favorite)
xyzzy
plugh
Tho I do not 'foobar' is in there, but I generally use that on internet sites where I could care less if someone assumes my identity.
A feeling of having made the same mistake before: Deja Foobar
Multidropper/dropper is nasty, I am coming off of an entire weekend chasing this hunk of code.
1. Once on the system it disables personal security/firewall/virus scanning
2. Copies itself to the start up group
3. With virus scanning disabled it drops several nasty bugs.
4. Network traffic/processor utilization goes thru the roof.
5. It then tries to replicate on the next machine...
next DAT release on the 12th will include that def.
Good Luck
McAfee has an extra.dat that fights it, the
Wow, this is really hilarious. Windows, is a very secure operating system, but not out of the box. It requires an amount of time and effort setting permissions and enabling/disabling services and the like. However, Windows users are generally the people who don't know how to do anything and need everything built in and done for them.
On the other hand we've got linux, the do it yourself operating system. You've got to set up, tweak, fiddle, configure, code and compile everything. Nothing is done for you. But of course, it's secure out of the box.
Now we get a worm that is/isn't Microsoft's fault. It doesn't take advantage of a hole in the windows software, like an unchecked buffer or anything. It just takes advantage of the fact that windows isn't secure by default. So who comes out to complain that something isn't automatic and built in? Oh, of course, the linux users who love the operating system where nothing is done for you and you have to write code to make software work.
linux guy: "You're operating system isn't secure by default!"
windows guy: "You're operating system isn't anything by default!"
And dont' get me wrong, I'm a dual boot win2k/mdk9 man, but this typical slashdot hypocrisy cracks me up.
The GeekNights podcast is going strong. Listen!
"Your average user" is why virus like this spread.
*sigh*
Give Microsoft a break. Open source software has its own fair share of exploits and worms that take advantage of unpatched boxes. I subscribe to all of the securityfocus mailing lists and I can tell you that I see a lot more *nix than MS activity.
I feel sorry for those that let their hatred of a company clout their perception on information security.
-Lucas
MS does not provide default user password under NT/2K/XP. If this worm is going around it is because users setup week passwords. MS is in no way responsible for stupid users.
Browsing through my firewall logs, a simple "file://attackeripaddy" in a browser window results in around 80% success using either no username/password, or a simple "guest" username with no password. On occasion, I'll have to throw a "C$" on the end (file://attackeripaddy/c$) but that's only necessary with fools running winNT or winXP instead of win9x. Sometimes it's even obvious that the people with compromised and unsecured computers are spammers...
Banging on my firewall then leaving their own computer open is arguably an invitation to come on in and look around. Leaving a guest account open is a clear invitation to come on in and look around just like having anonymous ftp available is an invitation to enter and at the very least look around. They're both file servers, both well known and documented...
Lock that 80% out of the internet, or even slap them upside the head temporarily, and 80% of the computers whacking away at my firewall will stop. That doesn't sound like a bad thing to me. Stupid/ignorant people who let their computer get used as a DDOS or other worm/trojan client through a basic lack of care don't get any pity from me.
Just to be the devil's advocate (literally
And second, I wonder why Microsoft hasn't jumped on the bandwagon of enforcing secure passwords (eg. password too easy, try again)? Personally, I think SUSE's restrictions are too much, but there must be a middle ground where at least very weak passwords are prohibited.
NO CARRIER
Please tell me how it's MS's fault that people pick easy to guess passwords?
Some systems I haved used in the past have a built in list and/or password analyzer, for the purpose of forbidding use of easily predictable passwords. While users tend to hate what these methods limit them to, break-ins tend to be limited to those people they know.
You can't fault Microsoft for not including such a feature. Chances are, if Microsoft did build in such a feature, someone would be taking issue with it on slashdot.
A modest proposal:
Suggest Microsoft include the ability for the administrator to select a tool (yeah, I know they typically want you to use only Microsoft Brand stuff, hence the aforementioned 'issue') Does Microsoft accept advice from users, or do they only innovate buy buying up a company that already makes such a product, integrating it, then driving all competitors out of the market? (oops, I did it myself...)
A feeling of having made the same mistake before: Deja Foobar
It's not hidden in nt/2k/xp. Though when you try to delete it, you get told it's there and necessary for administrative purposes.
"[A] high IQ is like a Jeep; you will still get stuck, just farther from help!" --Just d' FAQs, c.g.a
Happy Saint Patrick's day!
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
... in other news, Microsoft SQL Server 2000 is now being included in the RedHat 8.2 distribution's default install, and a security bulletin has been released for MacOSX 10.2 Print Services running on the Commodore 64.
"Please tell me how it's MS's fault that people pick easy to guess passwords?"
Please tell me how it's not Microsoft's fault for making both partitions and the system directory shares by default. How the hell else would the worm get access to the StartUp folder? The people most vulnerable don't even know where that particular directory is, let alone how to share it.
Please tell me how it's not Microsoft's fault to make XP users members of the Administrators group by default (the only ones who can access those default shares).
Please tell me how it's not Microsoft's fault that XP doesn't even bother asking for a password for a new (admin!) user account unless the account is made the old-fashioned Win2k way.
The "shiney new" way XP handles user accounts by default is almost as bad as 95/98/Me. By default, all system users are listed at the log-in screen for you to pick. One of them has a password? Move on down to the next in the list. Odds are at least one of them doesn't have a password and yet has admin privileges.
True, no self-respecting XP user would have anything to do with the accounts script in the Control Panel, but the better method of dealing with user accounts is both counter-intuitive ("Performance and Maintenance?" But "User Accounts" is right there!) and practically hidden (Performance & Maintenance -> Administrative Tools -> Computer Management (Local) -> Local Users and Groups), at least as far as former 95/98/Me users are concerned.
No, this is a design flaw in XP, part of Microsoft's attempts to dumb down the NT kernel for the home user. Perhaps MSFT wouldn't have to spend so much money on patching these security holes if they instead spent a little capital on trying to educate users a little about (extremely) basic user accounts security. This current "security hole" has been around since NT 3.1 and hasn't been that much of a problem until Microsoft decided to give everybody admin rights by default.
A worm that isn't Microsoft's problem!?!? Next thing you know you'll hear about airliners falling out of the sky due to flying pigs...
eh, food for thought...
He he, you don't remember because it did not tell you. Filesharing gets set up as part of other software installs without telling you. Nice eh?
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
If I have the Administrator password I can do anything I want...whether the default shares are there or not. I can easily connect to the system and share the drives out myself. The worm could just as easily do that.
XP does not show the user accounts unless you set it up for the family stuff. My XP machines in my domains don't show any user names.
Well, it's not necessarily their fault, but I'm used to my Linux box where I'm not allowed, for example, to select a word in the dictionary as a password. On MS OSes, having some sort of feature to disallow exceedingly weak passwords wouldn't be too hard to implement and could do a lot for the security of the system . . . heck, just a simple routine that disallows "admin" and "password" would probably take care of half the machines that have been infected by this thing.
For example, make it really clear to users enabling file sharing that people can and will try to break in if they connect to the Internet, so strong passwords or other security means are really necessary.
It's a good thought, but consider this:
You should be warned that ena*click*
Are you sure that you want*click*
Sweet. My files are shared.
Withdrawal before climax is very ineffective and those who try this are usually called "parents."
Surprising that the most popular 'simple' password I have come across: drowssap wasn't on the list... either it must not be very composite, or the programmers of the worm are fairly out-of-touch.
Erutangis ym si siht.
"XP does not show the user accounts unless you set it up for the family stuff. My XP machines in my domains don't show any user names."
That's because you have it in a domain, using domain accounts. If you're not in a domain, the default local log-in method is that "family stuff" you're talking about.
However, you are right; I was wrong about the default behavior. Instead of a user log-in, a default XP Home install will automatically log you in to the default account "Owner," an admin account with no password(!!!!!).
uhh... yeah it does, try looking for it. ill give you a hint... Local Security settings
UDP 137 has been logging lots of hits since day 1 for this system. Fortunately I have a firewall and have been very excited to see how many worms are out there trying to find a new host. A few weeks back I examined the log for the few hours I was connected over a dial-up (no DSL or ISDN, just 56K) and found 335 attempts, most of which are aimed at 137. A quick search of this with Google yielded info that this was indeed likely caused by a worm on many computers, scanning IP addresses and testing port 137.
My first log of a probe on 445 was 3/7/2003 at 21:12 (9:12 PM in California) seems they come in pairs or threes. The number of probes has been increasing.
Given what I've seen of my firewall logs, there's no way I'll ever put another computer within spitting distance of an internet connection without a firewall. Like, cripes 'n stuff!
A feeling of having made the same mistake before: Deja Foobar
From Technet article 318751 (HOWTO: Remove Administrative Shares in Windows 2000):
And... From 314984 (HOWTO: Create and Delete Hidden or Administrative Shares on Client Computers) (This is for Windows XP, W2K Pro, WinNT4 Workstation)
These get rid of those pesky administrative shares.These aren't default passwords. They are just bad passwords. Haven't we learned that wide open systems with bad passwords are not a good idea? I bet 90% of the exploited systems have blank passwords. Complex password requirements can be enabled.
I see a lot of people talking about the default shares (C$, D$, etc). To use these you need full admin rights. If I have full admin rights I don't need those shares. I could set those shares up myself. They don't get me anything.
It's about time people figured out that blank passwords and the Internet don't go together. Cheap NAT routers are $30 now. Go buy one. Get one for your mom. Get one for your users that work from home.
This, again, isn't a MS problem. Users need to be responsible. I also think ISPs should be blamed as well. NAT routers are cheap enough they should be built in to cable/dsl modems now. They aren't a "real" firewall but they do the job just fine.
Is the one left open by an Admin who has no business being an Admin....
For 99.997% (Manhattan Project, anyone?) of the cases, I'd agree wholeheartedly. The rest of them, like our Network Admin where I work, are under the thumb of some stupid BEEYOTCH of an IT Director who wants to continue to use the same passwords used by the old Network Administrator (who was shitcanned by her), and refuses to allow the new guy to set newer, more secure passwords. And believe me, it's not a matter of people just not getting along. For Pete's sake, she's even yelled at me for encrypting DSN strings and sticking them in the registry of the server, instead of plopping them in a text file like everyone else, open to the world. And she totally f*cking flipped (when she read the documentation I wrote about the procedure) upon hitting the section that described how every time the DSN was accessed, read, edited, or yelled at sternly the code modified and scrambled it with a new, different algorithm. She described it as "unsafe, and taking things to an extreme that was unnecessary". She also said made some asinine comment about how we would never be able to recover the passwords if the code were ever lost, to which I recall thinking "Well first, that's job security for me, second, don't forget your goddamn passwords, and third, that's what sa access is for, you dumb bitch."
Yep, this type of commentary coming from someone who not only has no business being an IT Director, but swears on a stack of bibles she can reverse engineer MD5 in her head (we have another application that uses MD5 to hash passwords, she simply recognizes the default password hash).
I swear to God I'm not making this shit up. I wish the nasty bitch would stick to pushing pencils and leave the real work to those of us who know.
Spread the RC luvin'
It boggles the mind how the admins who choose passwords like "password" or "1234" can keep a job. These people are supposed to secure systems and make sure they work in harmony. These usually go hand in hand, too. If you have insecure systems and they are breached, obviously things won't be all harmonious and blissful. If you have problems with the network, security won't matter since problems can usually lead to backdoors. If a system is compromised by this worm, I hope the companies that hired the admins give their security and networking department hell. They deserve it. No system should be cracked by a worm that searches for the sort of passwords you'd expect an idiot (or President Scroob) to have on their luggage.
Slashdot is a waste of time. I enjoy wasting time.
What it should do when it is about to install a service that could, theoretically, compromise the system is this (assuming the admin password has not yet been set):
The final thing would be for the OS to perform the same checks on a password when anyone wants to use the control panel tool to change it. Now the premise here is that the OS won't *FORCE* you to pick a good password, but if it made a user jump through hoops like this, you can bet your ass that there'd be WAAAAAAAY less problems with people who used MS products.
Of course, then what would the Linux and BSD zealots have left to bitch about?
File under 'M' for 'Manic ranting'
----CUT HERE----
i ces\lanmanserver\parameters]
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Serv
"AutoShareServer"=dword:00000000
"AutoShareWks"=dword:00000000
----CUT HERE----
Note the italicized line. Slashcode inserts a space there to prevent me from "page widenning". Remove that space. If the lines wrapped, then the line in italics should be one line and not two.
Once the file is saved, right click and choose "Merge". (Or just double click/single click/whatever to cause the default action to take place.) Merge the values into the registry, and this will set the keys mentioned above without the need to play with the registry. Reboot, and you should be all set to delete the C$..Z$ and ADMIN$ shares. Damn those things annoyed me - thanks for the post!
You are in a maze of twisty little relative jumps, all alike.
So set up a share for your mp3s, set only to that directory, marked remote read only. Just as easy when it's done and much more secure.
if the answer isn't violence, neither is your silence / freedom of expression doesn't make it alright
Any local account without a password in Windows XP is prohibited from remotely connecting to that machine.
"disables network sharing."
:)
Thank you god. Now all it has to do is infect our network and all those open Sharedocs shares that WinXP automaticially creates that are full of Nimda are history. Although the PC would most likely be history too.
Either way nimda would be off the network
In Soviet Russia, Trojan exploits YOU!
Good for those Linux boxes! You're using a weak password.
First, the word you selected happened to be on your desk. Most likely it's a not-uncommon term in either English, your native language (if not English), or a technical term. Any good password cracker dictionary will include all three.
Second, any good password cracker is going to try variations on the words in its dictionary. Minor misspellings, appending numbers, or translation into l33t-speak. Trying every possible minor misspelling and l33t-speak variant is relatively cheap compared to searching the entire key space. Expect them to do it!
Any test the passwd filter is doing is likely based on an attack already in use by a password cracker. It would be nice if the program gave you a reason the password was rejected (I've had apparently random password rejected), but ultimately it doesn't matter. If the passwd filter doesn't like it, a cracking program probably will like it.
Search 2010 Gen Con events
It is unfortunate that users often pick weak passwords. One of the student Win2K servers we run at our university got hacked because a remote attacker guessed a local password (=$username). However, we did learn one thing from the experience - we (or rather, I) firewalled our LAN from the internet behind a linux box. It could have been a BSD box, or a Linksys router -- who cares. This is kind of OT anyway.
I firmly believe that the more heterogeneous we keep the mix of systems running on the internet, the more resilient the internet will be to any type of attack. It's like an ecological system in which different beasts catch different bugs -- but hardly ever do they all catch the same bug in the same way, at the same time. Now isn't that smart? I really think the United States and other concerned countries should invest in encouraging diversity of computer systems in order to reduce general vulnerability to a 'cyberterrorism' or whatever attacks.
In either case, to see how our Internet is currently faring check out the Internet Storm Center. Increased probes from this worm were immediately visible on the site. Also worth a read is McAfee's details on this worm.
Is that case sensitive?
Keep Austin Weird!
The shares you talk about, you moron, are administrative shares... If your admin password is 123, you might as well pack your stuff and become a lumberjack or something.
Please tell me how it's not Microsoft's fault to make XP users members of the Administrators group by default (the only ones who can access those default shares).
Same as above, go you lumberjack... GO NOW!
Such a system would just really piss off the average user, who would just OK his way through it anyways and keep his password set to his dog's name, with it posted on a post-it note on his monitor, just in case he forgets.
A Minesweeper clone that doesn't suck
It doesn't take advantage of a hole in the windows software, like an unchecked buffer or anything.
It does take advantage of the fact that Windows allows a blank user password as a valid means of authentication. In fact, it does take advantage of "an unchecked buffer" of sorts, as the "set password" phase of the new account wizard apparently fails to check whether or not there's anything in the buffer holding the new user's password!
Will I retire or break 10K?
The fact that your aunt has breast cancer is Microsoft's fault.
THAT is what I have been telling everyone! Of course they don't believe me, and that is Microsoft's fault too!
DAMN YOU MICROSOFT
A little OT, but do any *NIXes have Kerberos as your default auth service after a fresh install?
--
est modus in rebus
I guess after the 2 years I've been using the same exploit I'll have to learn something new :(
With windows 2000 the administrator password is accully left blank by default if you select the auto login (all users use same login) option on the windows 2000 install. That what makes this exploit so widespread. Its nothing new, Rit.edu had a the exact attack almost a year ago.
Smev
I'd say it was a design goal for XP Home... Try explaining to a typical home user why half of his games don't work if he's not an administrator.
Shit... Tried in Mozilla the "file://IPofanattacker/ Guess what... My own hard drive directory structure is sitting in front of me. I'm running linux and everything is fuck'n rock solid tight. All IP ports turned off. Can anyone else duplicate this. Just enter any IP address into file://(right here). Mozilla defaults to the hard drive of the actual machine it's running on????!!!! Something which I do not like....
"What's your password?" "It's random." "Great, glad you use a smart strategy, now tell me what it is, please." "I told you, it's 'random'" "How can it be random...you have to decide it when you rotate, and of course it's picked at random...so, anyhow, tell me what it is right now... " " it's random....I just told you!!!"
Everyone knows it's because your aunt worked as a secretary on her Windows 3.1 machine for years, and those ugly white windows kept the ancient monitor's CRT burning so hot straight at her chest from 9 to 5 everyday. Sheilding didn't used to be so good, you know.
Everything IS Microsoft's fault. Duh.
CAn'T CompreHend SARcaSm?
Theres something that IS microsofts fault that will let this worm wreak havok. When you install WinXP Home, and i believe Pro, it does NOT set a password for the Administrator account, or it can be bypassed eiasly (ive seen too many boxes w/o one to think its just a random thing).
Thats right. Usually all it takes to break in to a winXP box is to hit ctrl+alt+del x 2 and your back to the normal winNT login. Then type in Administrator, no password, and unless this person knows anything about windows, and often thats not enough, your in.
Add to that that all accounts made are Administrator by default, and DONT need passwords.
What REALLY hurts windows here is not being truely multiuser on a local machine. This can be felt when you try to lock down say a web kiosk, and as you edit the Local security policy, you can watch the system lock down around you, since you CANT change it on a per user basis.
Add to this things like the viral Xupiter, and windows is chock full of holes. And leaving a winXP box in non-admin node is almost worthless, because SO many programs require admin access rendering it a pain in the ass.
While in the article, the poster mentioned its not microsofts fault, it BLATENTLY is. Windows comes SO dumbed down, i have to spend hours locking it down, turning off all the annoying services and popups, etc. Not only that, it doesnt have a default to make sure you password is at least somewhat secure. The options DO exist. From a sys admin perspective, windows is a waste of time. They NEED to have a deafult "im not a dumb user" setting you choose at startup that will among other things, make sure your system is tight and passworded.
They also need to go truly multiuser, clean up permissions w/o making them useless, and make EACH local user have a SEPERATE security policy, with an emphasis on editing it when you first install.
To put thins in perspective, in a public user setting, you leave an XP box out for use for a week, and an OSX box, i guarentee you, even the most basic setup, the OSX box will be exactly how you installed it, with a bunch of crap on the desktop.
The windows box will have every spyware app on it, stuff deleted, etc, etc.
OH, Xupiter just installed itself again, i have to go...
"Stuff... In my home!? NEVER!" - Zim on Invader Zim
"I want the toilet seat!" - Little Dog on Two Stupid Dogs
I don't know about you, but an out-of-the-box RedHat 8 is pretty damn secure, assuming you don't install any services with it. Select 'high security' in the installer, and boom! Instant firewall.
:) Took me about 10 minutes worth of clicking on little boxes, nothing beyond the automatic partitioning that even remotely resembled thought. Bless rpms.
Comes with more software than I've currently got loaded on my Windows machine, period. Office suite(s), games, usenet, web, mail, irc, packet sniffer, firewall, cd-burning,... I could go on, but at 4.6 gigs it's kinda scary
Anyway, your point again was?
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
This is the seventh posting on the front page in a row by Taco. And none of them are dupes!
/. editors have been replaced with the cyborgs that live among us. I for one, welcome our new android overlords. As a trusted /. personality, I can be helpful in rounding up others to toil in thier underground sugar caves.
Along with that, this post observes that Taco posted a story about a worm that did not contain a snide comment about Microsoft.
It's very clear to me now, obviously the
Enigma
If this were RISKS-Digest, somebody would comment that blaming the users might be fun, but building a system that encourages users to do obviously dumb things (or permits them) is usually a Bad Idea. (Somebody else would comment that that's not always true, because enforcing some kinds of standards without thinking about the side effects, such as Yellow Sticky Notes, is often a Bad Idea too.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I see we have the expected collection of replies from people who think they're experts on passwords because they've turned on all the security settings on their debian box and ran a cracker over a shadow file. *sigh*
Here's the straight dope: passwords suck. No, seriously, I mean they really really suck. A password is either insecure because it's too "simple", or it's too hard to remember for anyone but us nerds who breezed high school without having to learn anything due to amazing powers of recall. Hard passwords are nearly always written down somewhere (how many of you carry passwords, or obfuscated passwords, in you wallet/purse, eh?). You can enforce really "hard" passwords, but all you'll do is make your users hate you. And watch you don't actually end up reducing the search space!
But hell, it doesn't matter anyway, because a complete brute-force search of the 8-character ascii domain is feasible, and is only going to get easier. (Longer passwords? Great, until you find a system you need to support that truncs at 8 -- suddenly you've got an even less secure password because the randomness in the first 8 chars wasn't an issue. Or you have to let people use phrases, and English's entropy isn't that high. What, you mean you don't manage domains of hosts with common auth? Sit back down then.)
The good news is, this doesn't mean shit. What are you trying to protect? Most people don't need uber-secure passwords. Who'd want to hack into my mother's webmail account? The effort involved wouldn't be worth any payoff.
But:
- mib
p.s. Useradd/passwd is not account management.
Funny this, but "God" specifically doesn't show up in this set of 260k users.. But there are 143 words containing "god".. Here are the top ones. :)
:)
22 godzilla
5 godfathe
4 goddess
3 godsmack
3 gods
3 godiva
2 sungod
2 netgod
2 iamgod
2 goodgod
There were 294 words with "sex" in them, the top ones are:
84 sexy
25 sexx
17 sexsex
8 sexual
7 sexo
6 sexe
5 sussex
5 sextoy
5 sex4me
5 ilovesex
And 278 with "love" in it..
86 love
33 lover
21 lovers
14 loveme
13 iloveyou
10 loveit
Oddly enough, root came in very low.. The highest one is "rootbeer" with 7.. That'd make it ranking around 3540.. I feel unloved.. If one person had "iloveroot", that would have made my day.
Serious? Seriousness is well above my pay grade.
since the worm doesn't try the most common password: ******
Aw, it's not always Microsoft's fault.. If it isn't, we can blame the stupid users for using easy passwords. I work with Point Of Sale systems occasionally (when people ask for help), and find stupid stupid stupid passwords there. Store ID's (like as printed on your receipt), the owner's name, or just "password".. Like, they want to make it easy for the stereotypical TV hacker to get in or something.. The best one that usually gets me stuck is just hitting [enter]. I usually start off with the assumption that they used *SOMETHING* as a password. Sometimes they don't.. "It's too hard for the staff to remember."
Hey buddy, it's your security. If I come in when your cashier is on a smoke break and no one is looking, I'll just hit enter, cash out, and leave.. No problems here.
I usually go into a 15 minute speech on how secure passwords are important, and how they must mix upper and lower case letters with numbers and characters, so as to *NOT* make dictionary words. "Password" doesn't count, duh. I've gone back to the same stores months later, and tried the old password, and it worked.. I don't even have to ask for access to their system, I just get in and start fixing for them..
Good thing I'm a good guy.. I could just log in as their admin user, ring up a no-sale on all the registers, and leave.. I could even mark their logs that *THEY* cashed out all the drawers like they closed the day.. {sigh}
We can't blame Microsoft for making their customers stupid. Its just like blaming AOL for making their customers stupid. They didn't. They marketed to stupid people who would buy anything.
I don't even want to hear one word back from an AOL person on WinXP using MSIE.. You're their sucker.. You fell for getting the stupid AOL 9.999 CD and 100000 free hours, you bought Windows, and happily agreed to their licenses, and you probably bought a whole stack of beautifully hologramed Microsoft products right along with your new Microsoft taxed computer, but you'll still bitch that it crashes, and wonder why I just look at you funny because my Linux machines never crash..
I wish we had the time to educate people just a little bit.. But some of them are so dense it isn't even funny.. How do you tell them "Stop using AOL. You're paying $29.95 for a $19.95 service..". it's like saying they're paying $30 at K-Mart for a cheap toy, when they could spend $20 for the a toy that looks the same, but goes faster and is more fun to play with..
Stupid consumers will still spend $30 because the TV Ad told them it's the best..
You're the same people that will pay a couple hundred dollars for the next version of Windows that will still crash, and you'll still cry that it doesn't work.. You won't even consider that you've already bought Win3.1, Win95, Win98, Win2k, WinME, WinXP, and none of those have worked right. Maybe the next one will work properly? I have a beautiful bridge in Brooklyn to sell you too.
Shall I rant?
Serious? Seriousness is well above my pay grade.
I use the diceware system. I generally end up with 25+ character passwords, and when mixed up cases, swap letter for number and word separator special chars are used, it gives very high strength passwords.
Then just use memory path tricks to store them in the old' grey matter, nuff said. I use the same rules every time for character substitution, so I don't have to remember the coded password, just the diceware phrase. Apply the coding, and there's the password.
Tequila - drink of the gods.
I can't say I keep a high security for my computer as I should (and I really should...to much pr0n to lose), but for internet banking, really important stuff online, I have a pretty foolproof system.
What I do is I take the name of someone I know for every month of the year. I associate a date with them, like birthday, day i met them etc. Sounds stupid so far, but here's what I do next
I then associate the date with the current year and decide how to mess about with the numbers. Do i just take the date at face value, or do I use date seperatrs / . and - in some sort of combination and use them as mathematical operators to generate a number? What ever I decide to do I convert the number into hex (because some passwords require numbers) and then attach it to the name of the person concerned in what ever way I choose and voila, password generated. Keeo in mind that if you use the same combination of operators when the year changes, you password is not going to change a hell of a lot for corresponding months between the years
The beauty is I've told you my system and you can't figure out any of my passwords. Better yet, you don't actually need to remember your passwords, more likely you just need to remember the mathematical operators because names and birthdays should come off the otop of your head. I can't remember my slashdot password though, I chose that before my system. Thank goodness for cookies.
"I just can't sit while people are saying nonsense in a meeting without saying it's nonsense" J Watson, Sci Am 288:(4)51
Cantral Command (also known as the Vexira Anti-Virus people have a good bit more detail -- including a password list. If historical data is any indication, I'd expect about a 10-20% hit ratio just with the password 'password' (and simple variants thereof).
OS Software is like love: The best way to make it grow is to give it away.
What mechanism is more responsible than click-thru software EULAs for training computer users to believe that they should expect to regularly see large blocks of text emphatically declaring dire warnings and that they should just click "OK" without reading when those blocks of text pop up?
Apart from everyone complaining and joking about the strength of the average user's password i read nothing about the actual worm this is about.
The worm comes in using port 445 (this is the samba over TCP port) and tries some simple passwords (the most effective being the empty password). After the infection the worm drops the file dvldr32.exe in the startupfolder so that next time the machine is restarted the worm/virus will be installed onto the machine.
What the worm does is:
- Start scanning and infecting other random ips, it does this on a very high speed (i.e. 100's of ips per minute)
- Installs WinVNC (a vnc server for windows) that allows remote control, see the vnc webpage.
- Connects to some private IRC servers and joins a channel with some high ascii chars in the name (chinese?) and a password. The IRC server is modified so that it does not give back any information to the client, but anyone on IRC can request the ips of all the infected machines. When i tested this there were about 8000 infected machines on IRC (8000 was the IRC client limit so there are probably alot more infected machines out there).
Note that this is quite a big threat as even passive attackers can get ips of infected machines by watching their logs for connections to port 445. Most of the machines making such connections to you are either machines in your local network or infected machines (unless you do alot of samba over tcp/ip over the internet).
One can easily access the harddisks of these machines using the Admin$ share (which you know has no or only a simple password) either to get files from the users or computer or get a copy of the worm itself (it's located in \winnt\system32 folder and named dvldr32.exe). Once you have a copy of the worm you can obtain the vnc password using some good old reverse engineering tricks (which i will not give out here because that would help out scriptkiddies just a little bit too much). I tried out the password i obtained using this analysis on one of the hosts that scanned me and guess what the guy was doing on his pc, yep he was downloading porn using KaZAA.
From the looks of it this worm has already infected alot of machines. I get about one connection attempt to port 445 every 2 hours.
For some more info about the worm checkout the antiy website
Let's see how long it takes before all ISPs block their vnc (5900) and their microsoft-ds (445) ports to stop the worm or microsoft issues a security update that forces strong passwords upon users or asks for permission everytime something new is put into the startup folder.