Slashdot Mirror
MyDoom Windows Worm DDoSing SCO
We mentioned the myDoom Worm just a few hours ago, but more information is available now, mainly that its ultimate goal is apparently to DDoS SCO. You can see some more detail at NetCraft. Obviously SCO has a lot of enemies out there right now, but it's always sad to watch someone stoop to this level.
the DOS isn't supposed to start until Feb 1. Maybe this is related to some sort of network "hardening" in preparation. More info
SCO has been under repeated DDOS attacks for months now. Netcraft is most likely showing details on those ones.
Here is the origional story on slashdot:
There is a new virus out by the name of Novarg which can infect all Windows versions from 95 to XP. It has two interesting features - first, in addition to mass mailing, it also distributes itself via the P2P network Kazaa. Second, it can perform a denial-of-service against www.sco.com. Details at Symantec and F-Secure, although neither seems to have finished their analysis." Other readers have sent in links to coverage at CNET and Security Response, and Russ Nelson provides a sample message.
So tell me again, what new information did we learn between now and then. Looks like slashdot just loves SCO stories to me, even if they are repeats.
--
In London? Need a Physics Tutor?
American Weblog in London
On the bottom of the netcraft report you can see an OS history of www.sco.com - apparently they switched from SCO UNIX to Linux in August 2002...
The hammering of SCO doesn't start until Feb 1 though. Supposed to be Feb 1-12.
I received three of these yesterday, and it's been ages since I received anything with a virus. Must be massive.
Campaign finance reform is national security.
Note that the DDoS attack is timed to be performed between 1st and 12th Feb, 2004.
Free XBox, PS2
Yes it does use outlook (the typhoid mary of the internet) to spread itself. I suggest you stick with windows as being a Linux administrator is a very lonely job. It is very much like being a Maytag repairman, nobody ever calls.
Got Code?
ripped straight from www.sophos.com:
W32/MyDoom-A also drops a file named shimgapi.dll, which is a backdoor program loaded by the worm. The backdoor allows outsiders to connect to TCP port 3127 on your computer.
the s/foo/bar command will replace all instances of "foo" with "bar". In this example, it changes "this" to "their".
Whoever stated that signature sizes should be limited to one hundred and twenty characters can just go ahead and kiss my
s/is/eir
It is a regex statement. Essentially, the string typically instructs a language interpreter (PERL, for instance) to search for a pattern and subsequently replace it.
In this case, it is replacing any instances of "is" with "eir"; thus, the following alteration is committed:
Before: but it's always sad to watch someone stoop to this level
After: but it's always sad to watch someone stoop to their level
Do you like German cars?
The graphs that are linked to in the /. story simply illustrate that SCO's shxt keeps on crashing - which is not really suprising after Darl had to fire the network admin to feed his Lawyer habit.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
... there is no fscking point in sending the "you sent me a virus" panic mail.
Actually, there is... but in sending an email to others who know your email address. For example, I got 3 messages yesterday which contained this virus. Now, from what I understand, this worm pulls email addresses from one's computer, and sticks those addresses in the 'from' field. One of those emails I received was "from" the United States Air Force Band's Singing Sergeants Yahoo Group. That's pretty specific, so I sent everyone I know (who runs windows) a message saying, basically, that if you know of the Singing Sergeants, or these few other email addresses, then it's likely you have this worm.
Sending a "you gave me a virus" email to whomever is in the 'from' field is pretty useless, but the above tactic may prove helpful for this particular worm. At the very least, it lets other (possibly less-informed) folks know there's a worm about, and reminds them to practice good email usage (not opening unexpected attachments, etc.) and to update their anti-virus software.
The dDOS was just aimed at the first one, whilst all links (web and local) to Windows Update point at the other one. The attack was therefore not hugely disruptive, especially once a nice layer of properly hardened computers was in the way.
According to NetCraft, SCO is currently pinging at about the 16 second mark - are there really that many computers with fast clocks, or is it bad coding, or is something else happening here? Feb 1st is supposed to mark the start of the GET storm.
The Slashdot Paradox: "100% Overrated"
I just created and installed a Postfix remedy for this recent deluge, and thought I'd pass it on.
In main.cf, insert this:
body_checks=pcre:/etc/postfix/virus_body_checks
Create a file virus_body_checks containing this:
/^UEsDBAoAAAAAA...OzDKJx\+eAFgAAABYAA/ REJECT Attached zip file appears to contain a virus.
If anyone has an improved solution, let me know, but this seems to work.
Roses are red, violets are blue, most poems rhyme, but this one doesn't...