Slashdot Mirror
MyDoom.C Making Its Way Across The Net
Iphtashu Fitz writes "eWeek is reporting that the latest variant of MyDoom is now making its way across the internet and may have been responsible for some disruptions to Microsofts website over the weekend. This new variant apparently doesn't spread via e-mail but instead scans for machines with an open TCP port 3127. This version appears to be a very stripped down version of its earlier cousins since it also doesn't leave a backdoor into infected machines nor does it have a shutoff date for when to stop attacking Microsoft." Reader billstewart adds links to reports at Australia's ABC News and carried by Reuters; Unloaded adds a link to CNET's coverage.
Does anyone know if it is slamming the msn messenger service as well? I havn't been able to connect to it recently, and it seems to be a network wide outage, since other people are having problems as well....
--
MyDoom.C's effects seem to already be felt. My girlfriend's been complaining that she can't get onto MSN all night, and sure enough messenger.msn.com is completely unresponsive, as was Hotmail a few hours ago (though, it seems to be up now). I wish I could just convince her to use Jabber.
But Maaa! Everyone else has a
I never understood why viruses/worms/whatever bother to include shutoff dates. "hum, I really hate SCO, so I'm going to DDoS them, but only for a few days" Why?
--I don't want the world, I just want your half.
Really? Kinda like hurricanes and tropical storms then eh? That's kind of a funky analogy.
Are there any real applications that use port 3127, or can we safely block that port at our firewalls?
Unlike MyDoom, which is exploiting Microsoft weaknesses, the interesting thing about Doomjuice and Deadhat (aka Vesser) is that they're scanning for the back doors left by MyDoom.A and MyDoom.B and using them to take over. The good news is that they're only attacking infected machines (and in a way that's easy to block), but the bad news is that parasites like these can add nasty payloads to viruses that were fast but not particularly nasty themselves. (That doesn't mean that these parasites have done that, but they can.) According to the article on F-Secure, Vesser / Deadhat turns off many kinds of anti-virus and firewall software, leaving the machine more vulnerable, and adding a backdoor of its own (but protecting it with crypto, which is the proper thing for an evil virus to do :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Actually, we have the antivirus companies mostly to blame for this one; they discovered it wasn't enough to sell people the software(and that coming up with new features to get upgrades was difficult), but they had to lock them into updates too; pure corporate greed. Instead, people either don't realize they're no longer getting updates, or they think the older definitions will work just fine. I tell people either to update their subscription, or to use a mailer other than Outlook if possible and run any of the various free virus scanning tools(McAfee and Trend for example both have free web-based scanners) on a regular basis or whenever the system starts doing weird stuff.
Lastly- some vendors dragged their feet. McAfee took almost 2-3 days to release "regular" definitions which could either be downloaded to your proxy server and then deployed to all your clients...or downloaded by clients automatically. Until they did it, you had to download special "extra" definition files, put them in certain folders, etc. Ie, impossible for the end-user, and a pain in the ass for small businesses without the tools to deploy stuff like that easily automatically.
Therefore, it's not a far stretch to assume that the 50,000 to 75,000 machines that are still infected by MyDoom.A or MyDoom.B will catch DoomJuice with a 100% infection ratio.
Except for all the systems behind firewalls that got infected because they got the virus via email...
Right now, this patch seems to not have much of a payload.
Who said anything about it being a patch? Ok, so maybe it is- but "not much of a payload" doesn't mean much, since a compressed diff can be very small...
By the way- off-topic rant, McAfee's corporate software sucks. You can run a mirror of their definitions, but you need Windows Server to do it(2k or 2003). You can deploy sitewide policies, but you need to build it into the installer and any further changes require an overblown management system that needs Windows Server AND MS SQL Server. it gets better- unlike NAV and others, you can't do email scanning on anything except Outlook(NAV has supported POP/IMAP scanning via proxy for years). And the best part? If you get a virus alert from the on-access scan, the user can't click any of the action buttons, because get this- and I swear, this was straight from the mouth of a McAfee rep- "they'll always click ignore to make it go away". "So why did you also disable the delete and quarantine buttons as well?!?" NAV and others let you restrict what option set the user gets(so they can delete, but not ignore...or do whatever). Last but not least, their support is mostly based out of india.
Please help metamoderate.
Err Huh?
The only way to find the computers with open ports is to scan them. And this is what is the big problem with the counterworms. They infect a host and go on the offensive, spewing as much traffic as the original infected host did, making us scratch our heads and wonder why.
I wish people would take the high road and let the losers who can't admin their way out of a paper bag wallow around in their own ignorance, but if you feel like you must absolutely write a counterworm, please, please, PLEASE make it only counterattack against boxes that are connecting to the host!
For example, instead of scanning for machines, simply lie in wait on a computer, and when something connects to you on 3127, then attack and clean that computer, and only that computer.
If I have been able to see further than others, it is because I bought a pair of binoculars.
I own two Macs, so don't take this as a troll, please.
Right now, Macs are feeling the effects of this virus, too; it's slowing down internet connections for ALL platforms thanks to the fact that it's indiscriminately flooding networks with "noise" in trying to find other machines with the MyDoom-opened port. To my knowledge, it doesn't stop searching, either.
And a "counter-virus" would only make things worse. Sure, you eventually stop the original worm(s), but you also do more damage and risk opening up a can of worms in doing so. Not only is YOUR "counter-virus" going to add to the network congestion, but it may well become a problem itself if it's not written just right. In other words, the cure might be worse than the disease.
For the short term, we need an education campaign. Teach the standard (and sub-standard) users of the world how to identify a virus, how to prevent getting infected, and why they should care. As the old saying goes, "you can give a man a fish, and feed him for a day, or you can teach a man to fish and feed him for a lifetime."
~UP
Eat the Path.
I was fascinated by the zombifying worms, spreading across the internet making unsuspecting hosts into proxy spam servers, but now I'm beginning to wonder if worm harvesters will have to be written and (by mutual agreement) released onto the net. I still get code red droping by all the time (it can have my default.ida, for all I care; I'm through with it), and new kiddies write them at such an increasing pace that one New York Times article about worms recently needed two slashdot articles by the time it was posted. Might they start (at some point in the future) to actually start to "clog" the internet? Hell, they already do; the network where I work was brought to a crawl more than once over the last year because of them (and the idiots who administer the network, but that's another rant). Anyway, when worms constitute more than 50% of the traffic more than 50% of the time, some regulatory body is going to propose spidering worm-eaters. It'll be like "core wars" all over again (everything comes full circle sooner or later).
grammar-lesson free since 1999. (rescinded - 2005)
He clearly named his worm "Concept Virus(CV) V.5, Copyright(C)2001 R.P.China" in a string in the binary, but the antivirus people called it "Nimda" anyway.
Maybe that's because the name Concept Virus was already taken.
The original Concept Virus was a significant milestone - the first virus written to infect MS-Word documents (using Word's own macro language - thanks Microsoft, we really need all that capability in a word processor). It was the start of an era where macro viruses became the most prevalent method of virus transmission on the planet, surpassing boot sector viruses (remember floppy diskettes?) and other formerly common methods.
You make it sound like a bad thing - it can't get much worse. Instead of corporations, the best hackers would decide who runs America.
Lars T.
To the guy who modded me down from perfect to terrible Karma - Apple haters still suck
But yeah, the anti-virus companies named it.
it's not about the karma, it's about the whuffie