Worm vs. Worm Battle Slows Networks

joel_archer writes "According this article at the DrudgeReport, a worm, apparently designed to patch MSBlaster infected Win2K and XP machines, brings various Canadian networks to a crawl. Hardest hit was the 411 system, Air Canada, and Ontario hydro electric operations. Apparently this is causing more problems than MSBlaster itself."

Comments

hmm, i wonder.

[Pandora's Vox]

MS exploit virus comes out.

mysterious patching virus starts making the rounds. massive consequences.

we should be doing this more often, kids.

-Leigh

Re: hmm, i wonder.

[Black Parrot]

> MS exploit virus comes out. mysterious patching virus starts making the rounds. massive consequences. we should be doing this more often, kids.

Yeah, I'm working on a worm to kill off the worm that was supposed to fix Blaster, but I've been busy and haven't gotten it out yet. Look for it in your mailboxes tomorrow!

Re: hmm, i wonder.

[gfody]

I'd better get started on my worm to kill your worm! er shit, semantec already has a definition file for anti.anti.anti.blaster.win32?!

Re:hmm, i wonder.

[Mr. Bad Example]

MS exploit virus comes out.
mysterious patching virus starts making the rounds. massive consequences.
we should be doing this more often, kids.

That's the worst haiku I've ever seen.

Hm...

[gooru]

So, the question I have is: do you think he was trying to be a good Samaritan and just wrote something that caused serious problems, or do you think he purposely wrote something that would cause problems but would spread wild due to the ostensible good it was trying to do?

Re:Hm...

[zcat_NZ]

Personally, I'd have written a worm that enables automatic updates and XP's inbuilt firewall. If windowsupdate can't handle the load perhaps they shouldn't have designed it in a way that -purposely breaks- normal web caching.

The current round of worms are clumsy and unimaginitive. I think it's only a matter of time before we see a worm that does some -real- damage.

This is exactly why

[Magic Thread]

"cleanup" worms are still bad. Since the original worm didn't do anything except attack a domain name that's no longer in use, the cleanup one may even be worse.

Re:This is exactly why

[admbws]

It's a case of a lesser of two evils. The problem is, there are thousands of exploitable boxes and if nothing is done about it, in the long term, this is going to cause some serious problems. Many of the owners of these systems will never fix or patch them themselves.

It's really a toss-up between a worm that temporarily slows down networks by spreading and patching the systems it infects, then automatically deleting itself after a set date, or a script kiddie scanning the entire internet, picking up these boxes and adding them to his DDoS network, which can slow down all or any network(s) (root DNS servers, anyone?) he or she chooses at a later date.

It is for this reason, IMHO, that these exploitable boxes are a threat to the integrity of the internet, and while writing a worm to automatically patch the systems might be rather militant, something has to be done about it.

Re:This is exactly why

[zangdesign]

writing a worm to automatically patch the systems might be rather militant, something has to be done about it.

Yes, and the proper thing to do would be to contact the system administrator and let him/her know that their system is vulnerable. Releasing another worm to patch the first worm is just as morally wrong and illegal, since it is entering the system by unauthorized means.

Two wrongs do not make a right. Frankly, I hope they find both the guys that wrote those damnable things and throw them both in jail.

The moral of this story is: keep your damn hands off something that ain't yours.

Re:This is exactly why

[sperling]

This worm is just as bad, maybe even worse than the first.

Script kiddies are in fact way safer now than before this good samaritan, since most of the lazy users that have been compromised also by other means than the initial worm now will think everything's fine and leave the additional rootkit installed and running. If this second worm hadn't made things appear normal again, these users would have to reinstall their systems and thus get rid of e.g. the IRC drones that currently annoys most of the major IRC networks, including the one I admin a server on.

In addition, this worm wastes bandwidth on somewhat responsible users that do not trust something using an exploit for gaining access to keep their systems secure. Would you leave your box as is if this worm had "secured" you? Or would you be worried and prefer to reinstall and manually patch?

However good the intentions of this worm might be, it's just adding to the problem.

Re:This is exactly why

[26199]

Er... which system administrator would that be?

I get the impression the vast majority of systems that are still at risk belong to good old incompetent (through no fault of their own) home users. Contact and explain?... not likely to be very effective.

Re:This is exactly why

[Anonymous Coward]

Let me say up front that the IT department at my company is not at all on top of things like massive exploits. The company LAN has suffered the wrath of Nimda (for several days because IT neglected to tell people to shut down Everyone shares), Code Red, and now MSBlast and MSBlast.D.

However, I'm our one man Hosting and Deployment department for our web-based apps, so I am pretty diligent about this stuff.

About a week after MS released the RPC patch, I had it tested and on all the servers used to deliver our products. And, since I don't trust our IT department, I run Tiny Personal Firewall on my own workstation so I can see when somebody is coming after my machine.

We weathered MSBlast pretty well - I detected it fairly early with TPF and was able to get the infected people around me cleaned up quickly. Luckily, all the servers under my control were already patched, so our client-facing stuff was safe.

Then, yesterday, MSBlast.D ripped through the company. It was apparent that a number of people hadn't patched when the original Blast came through and that IT didn't do anything as basic as a LAN/WAN wide scan for vulnerable boxes. Again, I wasn't worried about my machines, so much, but MSBlast.D brought our network to a standstill where the original Blast was just a minor nuisance.

With the LAN nearly dead, I couldn't get to any of the remotely hosted servers for which I am responsible. Our server monitoring software had similar problems and was alarming all day.

Now, I understand that the true fault behind this lies with the IT department for not at all being on the ball about this, but I'm also a bit pissed with the person who thought it a good idea to become a sort of vigilante patcher and create a worm that essentially resulted in a LAN-wide ping flood DoS. The original MSBlast was amusing to me because it was so easy to get rid of. MSBlast.D, however, was infuriating because it affected even machines that were properly secured/patched by bogging down the network.

I think I'll take the bus

[evn]

Flying is hard enough - they tell you it's the safest way to travel. Now we find out it's run by a system famed for it's ability to crash?!

The service is so bad; the management was so bad. The system is just a mess, just a mess. I had my luggage delivered to Toronto, I was told on Saturday, so I don't have anything.

Seriously though, that sounds more like the airline's standard crumby service than the latest Microsoft worm/virus is to blame.

Re:So?

[joeykiller]

Who cares?

Well, according to an article I read yesterday the MSBlast theory of the power blackout in the US and Canada isn't dead just yet. They don't think MSBlast was the reason of the blackout anymore, but that the worm slowed down and crashed monitoring systems. In that way the worm worsened the problem and didn't stop it where it could have been stopped.

If this theory is right I guess 50 million americans without power cares whether incompetent admins can't keep their networks up.

Another article...

[Dark Nexus]

The Register also has an article on this.

Basically the same core facts, but also talks about the ethical issues with "good" worms.

Ultimately...

[metatruk]

ISPs are going to start firewalling off more and more ports because of the fact that Windows is insecure. But more importantly, customers don't care enough about the problems to deal with their own responsiblity: securing their own machines.

Many ISPs already filter the standard windows NetBIOS ports (137-139, i think) because of possible attacks.

I think this opens an interesting problem. If people don't start taking their own computer's security seriously, other people will be forced to -- their ISPs. Will ISPs become liable then if attacks do take place?

Re:Ultimately...

[Tim C]

Many ISPs already filter the standard windows NetBIOS ports (137-139, i think) because of possible attacks.

I see that as a good thing. What possible reason is there to have file and printer sharing open to the internet?

True, it shouldn't be the responsibility of the ISP, and no, I'm not exactly happy with the thought of port filtering becoming common place and extending to other ports (ftp, ssh, http, etc - after all, "it's a home connection, you shouldn't be running servers..."). As an interim measure, though, it at least does help to contain the problem.

If people don't start taking their own computer's security seriously

I think you have that wrong. People do take their computer's security seriously, they just don't know enough about it. They also, largely, expect to be able to just switch their computer on, and have it work, like everything else they use. TV, video, dvd, microwave, car, central heating - they're all made, installed or set up once, and then just work. If they break down, they're replaced, or a qualified engineer is called to fix them.

People aren't yet used to the idea that computers don't quite act like that. You and I may have been working closely with them for years, but most "ordinary" people haven't. So, they expect them to require the same amount of effort as everything else they use.

I think that PC manufacturers could go a long way to helping here - shipping with firewalls and virus scanners preinstalled and configured. Perhaps have a couple of big, impossible to miss buttons on the desktop - "click here if this machine is connecting directly to the internet", "click here if this machine will not connect to the internet, or will connect via another machine on the network", "click here if you don't know what that means", that configures the machine appropriately for its role. That way, the gateway can be secured, while the rest of the network can share files and printers. No, that's not a foolproof plan, but I think it would go a long way to helping solve the problem.

Don't just bitch and moan at the "clueless, irresponsible" users - teach them to know better, and help them while they're learning.

Re:Ultimately...

[iamacat]

Surely operating systems should be very secure by default, as in not accepting ANY incoming connections, no ActiveX, no executable e-mail attachments. One shouldn't have to install security patches every week just to read e-mail and browse the web.

What we have here is one company's lack of responsibility and desire to make a quick buck without working on software quality. Its so fortunate they don't make cars.

Re:Ultimately...

[lightcycle]

I don't think that impossible to miss buttons will help at all. People will click them and be none the wiser what they really do behind the scenes.
What people need to realise is that a computer is not like their microwave or tv. A computer doesn't come with all those limits in what they can do. Therefore, a computer must also be more complicated to use.
Somehow, people that buy a computer must realise that it won't plug and play. They will have to read some documentation (Which should be supplied by the manufacturer, and be easy to understand). If people only realised that to operate a computer they need to clue themselves in slightly, and if computer manufacturers understood the importance of good documentation we would soon see less clueless users.

Re:Ultimately...

[hdw]

This is a discussion that I think most ISPs have had for many many years.

Blocking dangerous ports would be a good thing for most ISPs, they want subscribers and online time, but preferrably as little traffic as possible.
Even more so as broadband/always-on connections multiply.

But all forms of ISP controlled blocks create two problems.

Some people want those ports open, some because they use those ports, some because they se it as an invasion of privacy (it's _my_ port, and _my_ computer, _I_ decide if I want it blocked or not!).

As soon as the ISP start to take 'responsibility' is hard to say where that responsibility ends. "You block port xxx but not port yyy, and because of that 1000's of customers got infected, bad ISP!"
And of course, it does mean more work for the staff, which costs money for the ISP.
But it's not a simple issue.
Most of it also applies to ISP spam blocks.

Article text

[Magic Thread]

Since the article's filename is "flash1.html," I doubt it's staying in that location forever, so here is the text. Posting logged-in because of the insidious article text trolls that have been plaguing Slashdot recently.

COMPUTER WORM THWARTS POWER SYSTEM REPAIR IN CANADA
Tue Aug 19 2003 20:33:34 ET

TORONTO (CP) - A computer worm designed to eliminate an earlier virus brought computer networks to a standstill Tuesday, hindering efforts in Ontario to recover from last week's power outage and forcing Air Canada to check passengers in manually across the country. Vancouver International Airport reported huge delays and long line ups in the international departures terminal as the virus slowed Air Canada's check-in computer system.

Air Canada spokeswoman Laura Cooke said the virus affected the airline's call centre in Toronto and check-in systems across the country.

``It is causing delays in processing customers at airports,'' she said.

The worm also slowed Ontario's efforts to repair the hydro system from last week's blackout.

``The system is under attack from the virus, and we've had more problems with this particular virus this afternoon than any other previous virus in Ontario,'' said Terry Young, a spokesman for the Ontario's Independent Electricity Market Operator.

Inside the terminal in Vancouver, passengers, some of whom have been stranded since the blackout-related problems of last Thursday, were frustrated.

``It's a nightmare,'' said one unidentified woman. ``The service is so bad; the management was so bad. The system is just a mess, just a mess. I had my luggage delivered to Toronto, I was told on Saturday, so I don't have anything.''

The worm targets computers running Windows 2000 and Windows XP and infected with the blaster worm. Once it deletes the blaster worm, the computer attempts to download a patch of the Microsoft update site, installs the patch and reboots the computer.

It searches for active computers by sending a signal across the Internet, which results in significant increases in traffic.

Internet security firm Symantec identified over 600,000 computers on Tuesday afternoon that were affected by one of the two worms.

Telus, the country's second-biggest phone company, saw operations for 411 operators slowed as the worm infected a number of internal systems at the company, while Corus Entertainment's Web site was down until the company was able to clean up its system.

The worm snarled the network at the CBC, slowing the broadcaster's Web site.

The Blaster worm also affected some computers of Ontario's emergency response system dealing with the aftermath of last week's huge blackout across a swath of the province and eight U.S. states.

Dr. James Young, the Ontario commissioner of public safety, said the problem was ``making our job more difficult.''

Symantec assessed the worm a ``Level 4'' threat, the second-highest, due to reports of severe disruptions on internal networks.

``Despite its original intent, the W32.Welchia.Worm is an insidious worm that is preventing IT administrators from cleaning up after the W32.Blaster.Worm,'' Vincent Weafer, senior director of Symantec Security Response, said.

``The worm is swamping network systems with traffic and causing denial of service to critical servers with organizations.''

It was not known where either of the worms originated. However, blaster, also known as lovsan because of a note it left on vulnerable computers _ ``I just want to say LOVE YOU SAN!'' _ also carried a hidden message to taunt Microsoft's chairman: ``billy gates why do you make this possible? Stop making money and fix your software!''

Blaster exploited a flaw in most current versions of Microsoft's Windows operating system for personal computers, laptops and server computers. Although Microsoft posted a software patch to fix the flaw on July 16, many users failed to download the patch, leaving them vulnerable to the worm, which fir

How lame is their IT department?

[nacturation]

From the article:

``The system is under attack from the virus, and we've had more problems with this particular virus this afternoon than any other previous virus in Ontario,'' said Terry Young, a spokesman for the Ontario's Independent Electricity Market Operator.

So basically they haven't yet learned how to block port 135 on their networks? And they refer to a worm as a virus. I'm glad I don't live in Ontario right about now.

Re: How lame is their IT department?

[Black Parrot]

"The system is under attack from the virus, and we've had more problems with this particular virus this afternoon than any other previous virus in Ontario," said Terry Young, a spokesman for the Ontario's Independent Electricity Market Operator.

> So basically they haven't yet learned how to block port 135 on their networks? And they refer to a worm as a virus. I'm glad I don't live in Ontario right about now.

One suspects that the power companies in that corner of the world are oh-so-glad to have any random excuse right now.

Re:How lame is their IT department?

[WoTG]

Or maybe some people actually have a local network that uses port 135! As much as I like to knock the things that go on at Air Canada, I can't really blame this one on them.

You can't usually block port 135 to all local traffic, because it has legitimate uses on MS networks. So, if a brand new worm or virus comes out, few if any anti-virus programs will detect it. Virus scanners, by-and-large are reactionary. They can't (usually) scan for what they don't know exist. It sounds like this particular worm was written to spread extremely quickly, and few had a chance to develop or update their virus definitions.

Given this environment, all it takes is one machine to get infected before the entire network gets hit.

Re: Imminent death of the net predicted

[Black Parrot]

> Every time I hear about a huge new worm, I wonder how long until someone finds some huge exploit or something that will wreak major havoc over the entire 'net. What would the effects of that be, in the end? Seems like that would have a major effect on world economy.

Yeah, people would start getting their work done out of sheer boredom.

Not a good samaritan worm

[Anonymous Coward]

If it were a good samaritan worm, why would it exploit the WebDAV hole, too? Fact is, this is a sneaky worm, not a prophylactic.

It doesn't just kill the other worm. It replaces it. It's several orders of magnitude better at scanning, persists after reboot just like Blaster, and leaves a backdoor open, just like Blaster.

OTOH, if you set your DNS to spoof "download.microsoft.com" and point it to an unproxied web server which gives it a different executable file instead of the patch it tries to pull, it will run that executable just dandy. Interesting things you can do to a worm-infected system besides patching it and leaving the infection intact are legion.

Re:My connection sucks

[Black Parrot]

> My cable went out for about 2-3 hours earlier, and even before it went out everythings been slow, and still is.

Yes, due to the state of emergency we'll all have to shoot for "second post" until this dies down, since the internet isn't physically fast enough to let anyone get a "first post" in right now.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Oh FFS!

[marcushnk]

If they just made sure their bloody networks were patched and firewalled correctly they wouldn't have this issue..

Frankly I think that anyone that complains about this needs a good hard leson in cause and effect.. oh hang on.. looks like they're getting that now!
Lets hope they're bright enough to recognize it.

Re:Oh FFS!

[cbdavis]

We got this crap at work. Firewalls didnt help
because someone in the office took his notebook
home, got infected and then brought notebook
into work. Silent infection. You can build
multiple firewalls but it is worth nothing if
your users dont protect their networks at home.

And this is bad?

[rossz]

So the networks are brought to a crawl due to the large amount of traffic necessary to patch systems because incompetent MSCEs are too incompetent to do the job themselves?

Well cry me a fucking river.

With all the worm and virus activity in the last few months they have absolutely no damn excuse for not being on top of this. Since they are too stupid to do their job, someone found it necessary to do it for them. Personally, I would have considered a disk formatting worm to be fully justified.

Why weren't these systems patched?

[chill]

Considering the original and first variant of the MSBlaster worm made major headlines, why were these systems still vulnerable?

Are each of those systems equipped with a 9-volt battery and a cheap Somebody Else's Problem field?

And don't give me that shit about airline computers having to be 24x7. If that were the case, they wouldn't be running Windows in the first place.

Re: So?

[Black Parrot]

> Well, according to an article I read yesterday the MSBlast theory of the power blackout in the US and Canada isn't dead just yet. They don't think MSBlast was the reason of the blackout anymore, but that the worm slowed down and crashed monitoring systems. In that way the worm worsened the problem and didn't stop it where it could have been stopped.

Supposedly there are "thousands" of people/organizations already working up lawsuits against that one energy company that's starting to pick up the stink. If it turns out that Blaster had anything to do with it at all, someone's going to get creamed for it.

And you can bet that they'll go after $omebody with deeper pocket$ than whatever punk-ass kiddie it was who released it. With 50,000,000 people inconvenienced and a reported $6,000,000,000 dent in business, we're talking about a sum that would be a concern even to $DEEPPOCKETS.

I agree

[kramer2718]

What kind of sick airline uses Windows servers to do check in and track flights/passengers. Is their IT department completely slow? They deserve what they get.

(Disclaimer: I've flown Air Canada. The accomodations were very nice.)

I predict that we haven't seen the last of this...

[sllim]

This new worm, it looks to me like it is being dubbed an anti-virus.

Most of the time I learn about something and think it is new it is not. So I won't act shocked when some /.r comes forth and cites instances of anti-viruses in the past.

However I personally have not come across this before.
I predict that the anti-virus will never be as prevolent as the virus, but we can expect to see them from here on out.

Re:Welcome to the WORM wars

[Black Parrot]

> Send a worm to kill a worm!

Two worms enter, one worm leaves!

Worm vs. Worm - It's a Ripoff!

[teamhasnoi]

I got this on pay-per-view last week and it was totally fixed. MS Blaster dove off the top rope onto MS Patcher, and then kept booting him, and rebooting him. MS Patcher was like, "Huh? What?" until his manager got in the ring and slapped him.

You couldn't tell, but I used the freeze-frame on my Beowulf cluster of Tivos and saw that there was hidden IP in Blasters hand.

I was so pissed, I called Fight Update to complain, but the lines were all busy.

Never again will I pay $179 for a pay-per-view wrestling match...although the upcoming free-for-all cage match between SCO, Linux, IBM, Novell, Red Hat and FSF sounds pretty interesting. I bet that PanIP will make an appearance and beat the hell out of somebody too.

Someone always gets in the cage at the last minute.

Windows servers

[danielsfca2]

At Boston/Logan airport last Friday, I saw on a Delta departures/arrivals screen this Windows error dialog in front of the grid of flights:

"At least one service failed to start..."

I took a photo of it. I thought:

- "I'm glad I don't run Windows." - "I'm glad I'm not flying Delta today."

Re:Windows servers

[media_whore]

You should visit New Zealand some time. I can honestly say, I have never visited an international airport terminal here where there has not been at least one of the arrival/departure screens showing 'This program has performed an illegal operation'. And I visit a fair few international airports.

Re:Windows servers

[BigBlockMopar]

Yeah. It's amazing where you'll find Windows. For the past few days, the local public education cable channel has had a Windows login prompt misdisplayed.

Airport FIDS (Flight Information Display Systems) tend to run Windows. I used to manage a system of a few thousand displays running a weird Continental Airlines and Infax proprietary protocol. There were two big reasons for using Windows, despite the suckage. One is that it's a hell of a lot easier to find programmers who can do custom work quickly in the Windows enviroment. The other is that Windows support for things like multi serial cards and stuff is a lot better; we often didn't have too much choice in the hardware we had to use (strange implementations of the old current loop, on 16 ports, for example... with only one supplier). Airports are very conservative, and with good reason. They really don't like change. Lots of serial cabling and repeaters where Ethernet would have done a great job.

How about this one: The Canadian government's Office Of Critical Infrastructure Protection and Emergency Preparedness runs IIS.

Why, given the nature of the department and (one would hope) its awareness of the threats, would they use IIS while more stable and more secure alternatives are still available?

This is like a fire station which keeps the bin full of oily rags next to the Captain's personal collection of matchbooks from world-famous hotels.

Looking at that site and seeing the fragile infrastructure they're using, I can't help but feel proud to be a Canadian. Jesus wept.

Re:Windows servers

[Feztaa]

Yeah. It's amazing where you'll find Windows.

I work at a gas station, and the computer that controls the gas pumps runs on windows. IOW, if windows crashes, nobody can pump gas, and nobody who has pumped gas already can pay for their gas. It hasn't crashed on us yet (AFAIK -- I've only worked there for a month, and the station has been in service for 2 years).

But, we have had some problems with it. One day, it kept popping up a stupid dialog saying that the computer is too hot and that if we don't cool it down fast then we'll have to shut it off. Yeah, like we're just going to turn off all our gas pumps in the middle of rush hour (the busiest time of day).

Later that same day, it popped up with a stupid message saying that had automatically downloaded and installed updates and patches for us. Seeing that message made me cringe, I was so worried that the patch might have broken something and rendered the entire gas station useless. *shudder*

Re:Windows servers

[adpowers]

When I was in an airport a few days ago, I saw one of their chemical identification things (where they put that little cloth after wiping down your bag) booting up. It was running (I believe) Windows 95 (either that or 98, couldn't see the number). I felt safe knowing that national security is in the hands of Microsoft.

Re:Windows servers

[CurlyG]

Holy shit, your gas station is running Windows and is connected to the internet??

Please, please tell me that the pumps can't actually be controlled from the PC running the station...

Re:Windows servers

[Anonymous Coward]

Ummm... there's this thing called a handle... it controls the 'gas' coming out of the nozzle... ummmm... it's like, a handle. You know?

Re:Windows servers

[JTunny]

In my hiatus from technical employment (over now after 18 long months) amongst other things I've worked as a baggage handler.

The clients for the baggage reconciliation system (BRS - ensures bags travel if and only if the passenger gets on the plane, implemented after Lockerbie) run on Windows 3.1!!!

First thing I thought is, what happens if someone wiretaps the network cable? I'd guess it wasn't encrypted, or if it is, it's a 10 yr old technology, How long would it take to crack it, learn protocols and be able to wreak havoc?

Must by archaic/vulnerable systems like that in key installations everywhere. Scary to think.

Re:Windows servers

[krumms]

But, we have had some problems with it. One day, it kept popping up a stupid dialog saying that the computer is too hot and that if we don't cool it down fast then we'll have to shut it off. Yeah, like we're just going to turn off all our gas pumps in the middle of rush hour (the busiest time of day).

What, would you rather it just packed up shop and died quietly?

Later that same day, it popped up with a stupid message saying that had automatically downloaded and installed updates and patches for us. Seeing that message made me cringe, I was so worried that the patch might have broken something and rendered the entire gas station useless. *shudder*

Since you're so worried about it, I hope you turned this feature off, then - but perhaps it's just as well, since it probably installed the RPC DCOM fix for you: right?

Which leads me to wonder, as an earlier post did: why on earth is this system sitting connected to the Internet?

Re:Windows servers

[Spoing]

Windows is fine for games and light use, but who why would you want to do anything serious with it? Sooner or later, these companies will wise up and move to *nix.

[comic book guy voice] You would think that, but no, no they won't. [puts hands to face and continues to cry]

On a dead serious note, I have personally wasted 2 hours yesterday on this new strain of the worm (it took down a customer's network that one sub-project needs -- they are SOL). Add 10 hours for the original one and it's a big block of my time over the past week...so much so, that my contract has been extended at this site to deal with the backlog multiple departments are suffering with.

Here's the kicker; all *my* computers run Linux...yet, the network uses Windows, so the Linux systems become marginally useful even though they pur along fine by themselves.

Even though I'm not in the IS department on this project, I do get drafted because I know something...and the IS folks are not the cream of the crop here. Some are good, though they all do too much of the 'stand of one leg...no, server is still sick...stand on other leg...nope, is it time? OK, hit the lights and get the chicken while I light the candles.'.

You can bet that I've been pointing out that I have not had a single virus on my machines, though honestly that is a small value since most of what I do requires the damn network!

Re:Windows servers

[leoboiko]

It's amazing where you'll find Windows.

Indeed. My bank's ATMs have a cool touchscreen interface. Sometime ago, I was greeted by the usual window about "illegal operation", etc. The thing then rebooted, displaying what looked like a common PC BIOS, and booted Windows 2000.

This is a case where I think Windows is not too little, it is too much. One wonders how much this (Brazilian, once-public) bank spent with Microsoft licences and hardware when any small, light, specialized OS would do better.

Fortunately, this is changing. At least one bank is already using Linux.

Re:Windows servers

[hdparm]

Which leads me to wonder, as an earlier post did: why on earth is this system sitting connected to the Internet?

So they can act swiftly and download patches :o)

Re:Windows servers

[Shardis]

"Since you're so worried about it, I hope you turned this feature off, then - but perhaps it's just as well, since it probably installed the RPC DCOM fix for you: right?"

Which leads me to wonder, as an earlier post did: why on earth is this system sitting connected to the Internet?


It might've installed the patch, if someone set it up that way. It's probably setup with 'net access for that reason. The clerk who seems to know better sounds like just a clerk though, and is probably (hopefully) locked out of administrative functions.

But then, probably not. Anyone who doesn't know by now not to just automagically update without warning or testing on a system you rely on is just too incompetant to be doing the job.

Re:Windows servers

[dukerobillard]

How about this one: The Canadian government's Office Of Critical Infrastructure Protection and Emergency Preparedness runs IIS.

It's just their website, dude. It's not some mission-critical thing.

This is like a fire station which keeps the bin full of oily rags next to the Captain's personal collection of matchbooks from world-famous hotels.

No, it's as if a fire station's PR firm had the oily rags and matches. Well, if fire stations had PR firms, I mean.

Re:Windows servers

[gristlebud]

Our company borrowed one of those machines from the manufacturer to determine its effectiveness at measuring trace explosives in soil for environmental cleanup.

Because we wern't a paying customer, we were sent the company's test-mule where all the new developments were tried before going into production.

The machine used a lightly modified Windows 98 installation as it's OS. Security was non-existant, as any idiot (me) could go in and monkey with passwords, workgroup settings, and file locations. (I did this to get it to talk to our network for backup) I was concerned about this at first, until I realized that these devices

weren't used with mice or keyboards

and typically had armed guards nearby who took a dim view of people monkeying with the hardware

As far as the installation of windows, we used it for 3 months straight, with absolutely no crashes whatsoever. The only time it was rebooted was when it was shut down for the weekends.

Re:Windows servers

[Mr. Bad Example]

Holy shit, your gas station is running Windows and is connected to the internet??

"Regular, midgrade, premium...CowboyNeal? The hell?"

Is anyone else getting the mental image

[mcc]

...of two huge monsters battling over Tokyo and knocking over buildings in their fight while the puny sysadmins in their tanks futilely try to hurl patches, and one of the huge monsters is Good and one of the huge monsters is Bad but no matter becuase even if the good one wins, Tokyo is getting stomped flat either way?

Okay, I think I've just proven that I've been awake too long. Goodnight..

Re:I applaud the idea.

[Satan's Librarian]

Uhm... no. Sorry. It's a bad idea. See this thread for additional comments from before this one hit.

The original anti-virus virus was probably DenZuk, created to kill the Brain virus. They were both bootsector viruses. Problem is, later on a new format of floppy got introduced - DenZuk trashed users' data when it encountered them. And there wasn't a damned thing the original author could do about it, because it was self replicating, and therefore by definition not under his control.

If you've gotta go vigilante, don't go viral. Do something you can control. Scan all the machines on the net and patch them, or just patch everything that bounces off your firewall - fine. It's likely to get you in legal hot water, and it is on questionable ethical grounds, but at least you aren't trashing random machines with self replicating code that you can no longer STOP, no matter how much you might want to.

Any experienced programmer will know well that code that works on one machine is not going to always work on every other machine - no matter how good of a coder you are. Any smart and experienced programmer will also know that almost any complex program is going to run into a situation it wasn't designed for eventually and create an unexpected and probably very unpleasant result. Spend some time and think about it before acting.

Couple of things - train crashes etc.

[skinfitz]

Firstly during Code Red it got blamed for Internet slowdown, until someone realised that some major net cables were damaged in a train tunnel fire that later turned out to be the real reason.

Secondly, lots of people are (hopefully) going to be scrabbling for WindowsUpdate for patches which will also add to the bandwidth being consumed.

We have yet to see a bad one!

[CB-in-Tokyo]

So far, we rarely see a truly malicious worm or virus. Most of what we see are certainly annoying, can be expensive to clean, and cost businesses in terms of downtime, network slowdowns and data loss, however, they could be a whole lot worse. The worst one I remember is Chernobyl that would flash anything in your computer that was updateable from your video card to your Mainboard leaving you with a (figuratively) smoking lump of useless, twisted metal.

We are always finding out about vulnerabilities. This one obviously existed since the beginning of time since it is exploitable on all post 3.1 versions of windows. If someone years ago had made a worm that infected systems slowly, so as not to draw attention, and then in a given time frame was really destructive such as chernobyl, we could end up having real problems on our hands.

These worms that make us find and patch these holes, without wiping our systems out, are costly, yes, and annoying yes, but they are also protecting us from the really malicious ones, by making us all more aware, and ensuring that steps are taken to prevent. I am not just talking about the cleanup worm, but also MSblaster. It doesn't destroy anything, but it makes us protect ourselves, makes us develop an immune system.

I am not saying I like them, and in my work I am the one responsible for protecting our offices, and cleaning up if something were to get through but I would rather be protecting from MSBlaster, than something really nasty.

Re:Reinstall

[AlphaSys]

Well, considering that you can have no confidence in a system that is known to have had unauthorised remote commands executed on it, I'd have to say that might not be a bad idea.

this is not good worm vs. bad worm.

[htmlboy]

this is a battle of bad worm vs. less obviously bad worm. i don't understand why nobody seems to realize that naichi is also a threat. besides the fact that it's a worm, it leaves behind a pair of services, exposing the "repaired" computer to future exploitation, next time through a more convenient tftp interface.

is it really that much to ask people to read an advisory of how the worm works before cheering it on?

iptables rules

[dmeranda]

For those who run a Linux firewall between a network of Windows boxes and the Internet you should rate limit those IP echo (ping) packets. Refer to my previous posting where I showed some sample iptables rules.

Of course my firewalls have port 135 (and a lot more) blocked. Still, it is very hard to keep out of a large network, it doesn't have to get through a firewall. But once inside it can quickly spread and then your firewall or border router will get flooded with pings. I was seeing well over 1 million pings per minute. At that rate my stateful Linux firewall was crawing on its knees as the connection tracking table filled up trying to remember all those echo requests so it could match them up with the echo responses. It didn't crash Linux, but it did render it near useless.

The scariest thing with all these worms is thinking about what could have been. What if they actually did something much more serious? What if they throttled back on the network scanning just a bit so they didn't take the network completely down and it took longer to notice?

Re:But, but, but..

[Jhon]

The funny thing is that many *nix admins (me included) would react to an exploited/owned machine the same way. Funny.

Re:I applaud the idea.

[danielsfca2]

I disagree. MrP's revision on my idea would:
* Only infect machines already sick with w32.Blaster
* Stop these machines from restarting due to the RPC process being terminated.
* Stop these machines from causing network slowdown by scanning.
Even if there was a problem with the code, it would still do more good than harm, because every machine patched would be one less flooding the 'net searching for machines to infect. It would not increase the traffic, because machines unpatched but uninfected would not be affected by this "good" worm.

While I agree that in many situations, one might worry about releasing any worm into the wild, I think in this case the worst case scenario is it doesn't work. Which is the same as if you don't try at all, so there's little to lose.

> Any smart and experienced programmer will also know that almost any complex program...

Complex? This could be accomplished with a really small app. Its job would be incredibly simple:
1. Kill blaster process, delete blaster app
2. Attempt to download MS patch. If unsuccessful several times, terminate.
3. Execute patch.
4. Open relevant port 5. Wait for a connection.
6. Transmit self to next machine.
7. Has it been a week since last time scanned? If so, terminate.
8. Goto 5.

Sounds pretty simple to me, at least. I think it'd be pretty easy to debug.

just why...

[mahhy]

Why would the "fix" worm be this much worse than the original? They do essentially the same thing, use the same exploit, transmit themselves the same way. The only different I can see is that the "fixer" reboots your PC once, whereas the original could continuosly reboot you PC. Why is the press making it sound (at least in this case) that this worm is worse than the original?!

Perhaps its the worms attempt to download the patch from MS thats causing all the headaches, but the patch *IS* rather small, so I'm not very convinved on that point.

Am I being paranoid, or overreacting or what?

Re:DRM

[Satan's Librarian]

Trolling, or just innocent? DRM could help slow the proliferation of viruses somewhat, but - I doubt it will actually fix worms like this. What it can do is prevent unknown hostile programs from running in the first place - if you're running an executeable directly. I think it is a good idea, but more from a corporate administrative standpoint - no more stupid users installing KaZaa.

But can DRM truly be the solution to prevent exploits and worms? I doubt it. I expect that it will be trivial to exploit a program that's already been verified and make it do something it shouldn't even with fairly well implemented DRM.

Email viruses may be halted in their tracks - but most exploits will most likely not be. You say the Palladium implementation of DRM is sophisticated enough to detect a code change during runtime from a stack overwrite? I doubt it, but if so - just change the data instead. Same effect. It raises the bar, but viruses share a characteristic there with open source - the bar only has to be hurdled once before the flood. See the recent rash of RPC hole worms and exploits - one guy did it, now everyone and their 12 year old can.

And licensing a piece of software for $1000-$2000 so that it could run in the first place is ridiculous. Do you like freeware, shareware, or open source? It'd kill it on that platform. Might be great for the competing platforms, but not the one it's on.

I think the real threat with DRM though is that it'll be used in the ways we've already seen, only more expansive. Wanna play a DVD you bought on an unauthorized operating system? Pay the fee, or, if the owners are too lazy to write software for your OS, just forget about it. And don't even think about writing a program to play it for you if you value your freedom.

If left unchecked, CD's will become that way. Downloadable audio has already started to. Tried to download an mp3 from iTunes on Linux? Find anywhere else you can get the same tunes legally? For now - yes, just buy the CD. For now. Hopefully consumers will be upset enough as use of such copy protection schemes increase to purchase alternatives. I subscribe to E-Music myself - no DRM, but I'm paying for the industry to create more, and mostly to smaller lables (mainly Napalm, if they keep track - bands like Tristania, The Sins of Thy Beloved, etc).

Re:But, but, but..

[FuegoFuerte]

From what I've read, this worm actually does use the same vulnerability. And why block port 135 completely? Doing that risks breaking ish. Breaking ish isn't a good thing. No, here's what a better worm would've done:

1) Once on a box, clean and patch said box.
2) Sit and listen to port 135, waiting for Blaster to rear its ugly pulsing-zit-like head.
3) In response to Blaster probe, install itself on Blaster-infested machine and start over at 1).
4) On some set date in future, or when number of Blaster-probes remains 0 for a predetermined time (say 1 month), remove itself from system.

By only loading itself onto machines which first probe it (trying to spread Blaster), it completely eliminates the stupid network scans. In that way, it only attempts contact with machines which have shown themselves to be Blaster-infested, while leaving the rest of the internet alone.

It's not THAT good.

[chrome]

1) When it infects machines, 99% of the time it is unable to download the patch. This makes it pointless.

No, I don't know why, I guess its because windows update URL has changed? All the machines that we've found with this virus have not been patched and had to have the patch applied anyway.

2) It tries to ping every machine on it's local network as fast as it can, repeatedly. It doesn't just do a single scan then shut up til 2004 (it's expiry date) - oh no, it continually scans. Thats ok if you have 2 machines on your LAN, but when you have a huge switched lan with a few hundred or thousand hosts on a /16, thats a lot of traffic.

I see LOTS of ARP traffic from the machines doing the scanning to hosts on the local network, and I see loads of ICMP echo-request destined for outside our network. Which I filter now.

3) It runs as a service that isn't detected by many virus scanners, for some reason Nortons didn't find it though McAffee did. Again I have no idea why.

The thing did a LOT of collateral damage on our network with a couple of hundred machines. I shudder to think about what kind of damage it is doing to large networks at universities etc.

Totally untrue!

[fireboy1919]

It's not the affending system that is attacked and destroyed, it's the systems that are attacked via DDOS through the hacked boxes using signal propagating viruses.

Have you heard of Dalnet? The network that used to be the largest of the IRC networks? It isn't now. Four months of DDOS attacks against all it's servers brought that to a halt (and there were like 10 of them). It's come back up, but most people have moved to other networks.

Maybe you didn't see this as a real problem because it didn't affect you, but four months can do more than merely wipe data or destroy hardware. They can take down businesses forever.

I'd rather have the "malicious ones" destroy computers owned by users who are partially to blame for letting in viruses than destroy businesses that have no fault at all in the matter.

On an interesting parallel: one of the most destructive viruses (real world) on the planet is Ebola. How do you think it's rate of spreading and death rate compare to AIDS? It's the slow, insideous viruses that you have to worry about, not the ones that are obvious. Not knowing that the virus is there is the best defense a virus has against innoculation or containment, which gives it more time to spread and wreak havok.

Worms are bad, but...

[FireFury03]

Worms are bad. Period. Even if the worm is supposed to be good then the damage it can do in terms of network usage, etc causes problems.

However, vulnerable boxes do cause a lot of problems, so IMHO a better solution is for those people who care about such things to install a system on their firewall that responds to scans - if a machine scans your firewall then you look to see if you recognise the signature of the scan (i.e. the likes of Code Red, ete, have quite distinctive patterns of scanning) and then your firewall launches an exploit against that machine that is scanning you. Once exploited the system would take some action to close the vulnerability and remove the worm (i.e. turn on the auto update stuff, install whatever patches are needed, etc). After it's done that the software that you installed through the exploit would delete itself.
This is a defense - the machine in question attacked your network so your network responded by fixing the compromised machine - no other (innocent) machines are affected by the problem.

ISPs also need to do something to help the situation IMHO - there is no sane reason to use Netbios over the internet so this should be blocked by every ISP (I know some do already, but the vast majority still allow it).

And remembering that 90% of home windows uses are completely clueless when it comes to security, they need to be forced into fixing their systems. The best way I can see of doing that is for all ISPs to look for scans coming from their customers - if a machine is making a lot of scans to lots of hosts all over the internet that matches the signature of a known worm, the ISP should pull the customer's entire internet connection. Infact it wouldn't be too hard for the ISP to intercept all web requests and redirect them to a website with all the patches on it. This is damage limitation - if a machine is compromised and is attempting to compromise other machines then it is essential that machine is taken off the network ASAP. If all the ISPs followed these steps then the spread of worms would be severely reduced.

Windows Emergency Services

[YaiEf]

I served military duty in the Danish Emergency Management Agency and was shocked when I saw they were implementing the entire system for reporting all kinds of disasters and emergencies (everything from tunnel fires to radiation leeks) on Windows 2000. These computers were connected to the net - and knowing the place they would probably never be updated. And even worse - it wasn't even a stripped down Windows 2000 that only ran the necessary services - it was a default (apparently unpatched) installation complete with an autostarting Messenger.

I'm not all that great on securing Windows boxes - but that sure didn't seem right. Considering this would be the first way (and for something like 5 minutes!) to warn the local emergency services of something - which could very well be a tunnel collapse/fire/whatever where 5 minutes easily can make a lot of difference in human lives. The program that was custom-made for emergency-reporting also seemed of pretty poor quality - most likely a case of lowest bidder with noone competent seeting intelligent rules for the bidders.

Re:Windows Emergency Services

[Shardis]

Jeez, troll, hopefully? :P

Granted, Win2k is prolly the best out for windows applications, but c'mon, unpatched/unstripped?

Are you suicidal?!

I've been having problems enough securing my Win2k machine securely, running only required (by me) services, and goddamn fully patched. Even though MS's patches break all my goddamn custom/low level apps.

Five minutes? If you're unware on an unpatched base Win2k install on an older service pack, it takes 5 seconds to hopelessly compromise a default Win2k install if you're unlucky. :P

Re:Windows Emergency Services

[Pig Hogger]

(everything from tunnel fires to radiation leeks)

Note to self: carry dosimeter to my mother's when I'll go there in case she serves me her cream of leek soup.

Re:But, but, but..

[timmyf2371]

Whether a worm is good or bad, you still don't want it executing on your box without permission, IMO.

Perhaps have a stage in there where the "Good Samaritan" worm pop up and explain to the user how it got there, the implications of the security issue, and ask the user if they want to fix their system.

Windows on airport displays

[Anarchofascist]

My wife and I were going through Dublin airport when I noticed that a number of the airport schedule display screens were going through a reboot sequence. I showed it to her : "Hey, looks like that one crashed."

She had to point out that a more alarming interpretation of the word "crashed" may have been made by some of the other people in the arrivals area.

Re:Wasn't this

[Satan's Librarian]

Yep, here's one version of the tale.

Virus history is a bit different if you follow the definition of viruses parasitically infecting files, whereas worms are self-contained and actively spread via network. Here's a paper that covers the early history of both to some degree.

Re:My connection sucks

[Espen Skoglund]

And to make matters worse, you get 1 mail a minute from some remote daemon telling you that there is a virus in a message which is apparently from you. Mail administrators who set up such auto-replies shoot be taken out and shot.

W2K Service Pack 2

[b1t r0t]

The patch for this exploit under Windows 2000 requires Service Pack 2 be installed first. I know that all the downloading for the patch is causing these network problems, but just assume for a moment that the patcher worm gets to a W2K system that has never had a Service Pack upgrade. If it's not perfectly written, it'll download the patch, try to install it, then reboot the computer, right?

So what if it's sitting there saying "This patch requires Service Pack 2", and the worm reboots? The result: a still unpatched system! Even if the worm were to consider its work done, after reboot the computer can be re-infected. Which means another download of the patch gets started! Can you say "Sorcerer's Apprentice"?

Even if the worm were smart enough to download a service pack, we're talking over 100 megabytes. That can take a while if you don't have good broadband, and meanwhile it's providing a nice accidental DDoS against microsoft.com.

21st century version of CoreWars

[DickBreath]

It's the new 21st century version of core wars.

MS Windows Virus Wars. Comming to a desktop near you. Let the evolution begin.

Worm

[Eviscero]

I'm going to develop a worm, that mutates into two different worms...one will be the democrats, the other will be the republicans.

On the first Tuesday in November, one of them will activate and fill your computer, television and radio with loads of bullshit.

disk formatting would be better.

[twitter]

So the networks are brought to a crawl due to the large amount of traffic necessary to patch systems because incompetent MSCEs are too incompetent to do the job themselves?

That's a little harsh, don't you think? People did apply patches, they just did not work. The only incompetent thing it to use or recomend Microsoft in the first place. It should be obvious by now that M$ has no place on a network. More than a year after Bill Gates made security job one, M$ still blows and it always will.

I would have considered a disk formatting worm to be fully justified.

Well, it would require fewer network services and people could get on with the rebuild job they need anyway. Face it, you can't trust a worm to do your job. If you get either of these, it's time to break out the CDs and rebuild the machine because you can't trust a worm to not be trojaned. That would be nicer than making it so no computer can use a network because these broken boxes are spewing their guts out trying to get M$ patches.

The answer is to dump Microsoft all together. Free software is obviously superior by now and no one need to spend good money on bad Microsoft software anymore. Disasters like this just go to show the real TCO of that junk. The colatoral damage to people who don't run M$ at all is unaceptable as well.

You have to wonder if businesses that don't use M$ anymore but were unable to use networks because of it can sue M$ and the dummies that still use them. Sounds like another billion dollar classaction lawsuit followed by thousands of individual suits to chip at the rapidly diminishing M$ pile of ill gotten cash.