Slashdot Mirror
LovSan Clone Let Loose
JMullins writes "According to Kaspersky Labs the LovSan virus has been re-released in a new form that has changed the appearance of the worm. It looks like the outbreak continues to get worse and worse, with no real end in sight until people can patch their systems. Net slowdowns are expected over the weekend when both versions of the virus start their attack."
Don't let the legislature get wind of this story.. They'll try to use it as justification to ban cloning.
"It looks like the outbreak continues to get worse and worse, with no real end in sight until people can patch their systems."
To be fair, the media's not going to be interested in reporting that it's not as bad as it seems.
(Note: I'm not saying it's not that bad, I'm saying don't trust the media to tell is its dying.)
"Derp de derp."
that an antivirus lab announced that a new clone was on the way, not spreading but on the way.
Banaaaana!
I'm starting to feel left out.. Maybe I'll install Windows on a box and join the fun.
When the source is open, the possibilities are endless.
The RPC vulnerability this worm exploits was patched at least three weeks ago. Maybe if people would get it through their skulls that Windows ships with a BIG WINDOWS UPDATE LINK in the Start Menu for a REASON, and maybe if people would at least check for new, fun things weekly, these viruses wouldn't spread quite so far. The news outlets that focus on the "horrific" damage instead of the easy fix are doing their subscribers a disservice.
Besides, even if you don't care about security, you must at least admit it's fun to see a new "This vulnerability could allow an attacker to execute malicious code"-patch every week. I wonder what'll happen when Microsoft's numbering system overflows...
We recently had heard in the office over one of the Yellow Machine that's made by Anthology Solutions.
"Linux has its own problems. But you mod them -1 under the rug until the fsf site gets hax0red. troll but true. "
That was true like a year or two ago, but since this has come up I've been amazed at how things have changed here. It's not that it's turning pro-Microsoft, but the "Everything Linux does is perfect" attitude has settled back down to realistic levels.
I agree with you, though, Linux is a root password away from being ssh'd to hell.
"Derp de derp."
"All Kaspersky Labs products effectively detect both modifications of "Lovesan", without requiring an update."
Guess they were just damned lucky there.
If we're lucky the power will be out and the worms won't be able to carry out their attack.
Sheesh, evil *and* a jerk. -- Jade
Those in the US north east and south east Canada.....
OK you'd have to be a cyber terrorism nut to believe the power blackouts were caused by the virus but some friends at Con-Ed have told me the virus isn't totally innocent, apparently the trouble ticketing / work management system some of the affected power companies are using is running on a load of windows servers and not all of them managed to get patched in time. So the recovery operation is being hampered a bit by the worm.
And I thought those guys were just exagerrating things.
SCO declares that it holds the copyrights to LoveSan and demands that all clones pay a $1500 licensing fee.
B:
C:
The new C means that the scan that we use to get the original out of the registry has to be modified so we can find this C variant.
Get Firefox!
Microsoft have released a tool to scan your local network (or the whole net if u really wanted to).
Download
Network admins have fun.
Point taken, but badly stated. The FSF cracking incident was due to an application that runs on Linux, and does not ship with most Linux distributions--it has to be intentionally downloaded and installed.
So are we going to start adding all securities in third-party apps that run on Windows to the "Windows vulnerability" list? That's crazy.
Linux is a kernel, yes. But the fact that it's available in that form if that's all you want is an advantage, not a technicality. Try getting Windows without a GUI, or SMB.
i was wondering about the motivations of the person(s) that wrote this. they seemed to have a mad-on against microsoft. what seemed weird was that if this had been a 'quiet' worm that spread, there would have been a lot more machines that were infected on dday. ms being hit by a large number of zombies and having to *beg* people to clean up their systems would have been pretty funny.
i saw the news about the second (and third) versions and i just wondered if these (all three) we just a distraction. i wonder how many people looked for an awfully obvious process and if they did't see it, well, that was the end of the story?
somethings smells here.
eric
You know here's an cool idea, seeing as the biggest problem with virii is that people don't keep their systems up-to-date.
When someone finds out about an exploit, they tell the company about it (aka MS) and give them time to come up with a patch. Then after sufficient time has passed for security concience people to patch their systems, a virus is released that takes advantage of the exploit to either inform the user that their system is vulnerable and that they should install the patch, or simply install the patch for them.
Alot of times it seems to take a big attack for busy system admins to roll out a system wide update. I have talked to people whose work computers have been hit pretty hard by virii and I just wonder what would have happened had they been hit by a truely malicious virus, not just these annoying but easily recoverable ones. It scares me.
This is getting extremely annoying - I'm still getting hits daily from Code Red & Nimda. I'd like to personally line up each person who hasn't patched thier system and slap them.
Along with the idiots at microsoft who don't make updates for IIS available though windowsupdate. (in my experience, ymmv.) C'mon, it's shipped with the OS, you've got automatic updates on by default, so make them patch the goddamn webserver.
We at CodeWeavers are proud to announce our new product: Crossover Blaster. This new piece of software for the Linux operating system will provide the same quality that you've come to expect from Crossover Office, but this time with the very popular Blaster worm (known to some as LovSan). It will even work with clones of the worm.
Finally, all the Linux users who have felt left out can participate in the reboot fun. It is a bargain for $50. See www.crossoverblaster.devnull for more details.
Disclaimer: I do not work for CodeWeaver. My views are purely my own.
Most common "problem" I have seen is that people do the following:
1)Get a computer, with OS and some software installed
2)Use the computer
3)If buy commercial software, install it, hitting OK every time it appears
4)If download arbitrary software from the net, install it, hitting OK every time it appears
5) If computer seems sluggish or something seems wrong, do one or more of the following:
- Go to the Program Files directory (of course it's Windows) and delete one or more directories containing programs you recall having installed recently
- Hunt around the hard disk and delete things that don't look right
- Buy software that supposedly fixes your system, and run it several times consecutively, choosing different options each time
- Reboot
- Re-install the operating system
6) Go to 2)This algorithm is run continuously for several years.
Hey AV experts, just wait till the 17th to post a fix, please?, in the meantime, have fun, enjoy the beach, watch windowsupdate.com as it goes DoSed, what a wonderful life!. At last a virus that goes to the source of the problem. hehehe I think I'll get some Karma for saying this, well, some Karma is not too bad!.
One major manufacturing facility in Taiwan that I work with had its internal network hit including control devices running on Windows NT. It probably caused between 1 to 2 million dollars in damage because of production delays.
I had to stay up till 12am trying to figure what the crap was going on with my equipment when it was communicating with those stupid NT servers. We're running Redhat and I was sitting there using tcpdump trying to figure out what was wrong with the packets.
It looks normal from the Redhat side, but you'll get no responses from the Application layer on the NT side. It must flood the send pipe in the TCP/IP socket layer on the NT side.
WARNING: If you're running Linux in the Enterprise and you're interfacing NT, you'll be blamed first. Just know it ain't your fault.
Damn if you are going to write a worm make it do some damage. You back hats are really starting to bore the shit out of me.
For instance take this worm and add the ability for it to seek the network for every single excel spread sheet it can find and randomly mix up a couple of cell values. Then have it set the access time back to the original.
Hell just write a few bytes to a random location in any file you can access.
Come on black hats, quit boring me!
Got Code?
While some companies in the AV industry have shown (ahem) questionable ethics in the past, I think it's stretching to say they WRITE the viruses, rather than just hype them.
... some of our ideas would have been quite evil indeed. And most of us were pretty good programmers.
...
For one thing, there are plenty of idiots out there quite willing to write a virus for free.
For another, if the viruses/worms/trojans were written by the AV firms, they'd be MUCH better. My co-workers and I would regularly discuss how one could, hypothetically, write the ultimate virus
Contrast that with the true nature of most successful 'in the wild' viruses -- most of which aren't that well written
The desktop world is ruled (by numbers, anyway) by Microsoft. Any potential malware s'kiddie can knock together some malware in a few hours, dump it into some unsuspecting newsgroup somewhere or email it to his Outlook-using mates and start an epidemic relatively easily. The sheer number of vulnerable machines makes that easy.
The installed base of Windows boxes also means that, despite MS not opening up their code to anyone (except governments and universities willing to sign away their first-born as insurance against breaking the NDA), large numbers of people spend vast tracts of time throwing McValue Meal-sized URLs at web-servers and mutant packets at RPC interfaces.
Lots of people x Lots of time x Lots of machines = lots of vulnerabilities found...
Now consider *nix. It has a number of advantages straight off the block:
- It's open source. Code that finds its way into the kernel goes through the best peer-review system available; public scrutiny.
- Generally, the people who run *nix are more tech-savvy than an average Joe Blow.
- Any vulnerabilities that are found get acknowledged and fixed very quickly.
But what would happen if *nix had the sort of desktop penetration that Windows does? How quickly would the kind of person that thinks a computer case is called a 'hard drive' apply a *nix security patch? If *nix was that popular, how many more people would devote vast tracts of time to finding obscure security holes and vulnerabilities?Just a thought. Now flame away ;)
Windows Tweaks
There are massive legal rammifications to this.
:
Firstly, the second strain of the virus is clearly derived from
the first strain. This is blatant piracy, and a violation of the
cherished IP of the original authors.
The original author of the virus is now in a position to reap a windfall, by
- Suing the second author to the tune of $3Bn for having blatantly stolen their code.
- Suing the thousands of owners of infected machines because they may be running pirated code in violation of the DMCA.
- Offering infected users a $699 licence fee for running the derived virus, which will protect them from any further legal action.
What the authors of the second, derived virus have done is abominable, and shows a callous disregard for the IP rights of the original authors. They are nothing but pirates, and a threat to the wholesome values of benign free-trade capitalism.
-----------------------