New Worms Feed on MyDoom Infections

Get a Mac by BWJones · 2004-02-12 08:16 · Score: 5, Insightful

This reminds me of that old ad which opens with a guy was trying to hook up his laptop at a huge meeting to start a presentation. He is having problems getting things to work and people are yelling suggestions from the audience: "Try c: start!" or something like that. This goes on for some time with different people yelling various suggestions and then at the very end when it appears things are not going to work, someone yells: "get a Mac!" The ad then fades out.... I suppose for the Linux crowd, the yell could be "get a Penguin" or "get a boxen", but the sentiment is the same: Do something.....Do anything......but do not continue to use that unsecured Windows box. You are wasting your time and you are wasting my time and costing companies, businesses and governments big time.

--
Visit Jonesblog and say hello.

Re:Get a Mac by IthnkImParanoid · 2004-02-12 08:20 · Score: 5, Interesting

Funny you suggest either buying a whole new machine, or using a whole different OS, when the MyDoom problem could just be solved by not opening attachments.

I'll just ask: is it possible for a binary file to open ports and send itself as an email attachment on a Mac? On a linux box? Are you sure you understand the problem?

--
It's nothing but crumpled porno and Ayn Rand.
Re:Get a Mac by Matey-O · 2004-02-12 08:22 · Score: 4, Insightful

Bullshit. There's NO reason why a windows box can't be just as stable and secure as any alternative. None (and I mean ZERO) machines on our network were affected by any of the mydoom variants.

Sane creation of a network topology, email subsystem, proactive network monitoring, and general patch management is NECESSARY to operate a large internet connected environment, reguardless of the Operating System of Choice.

(and to head off the usual Mac'noids, show me a mac based application that scans, OCRs, and backs up to multiple Optical drives 20,000 documents an hour.)

--
"Draco dormiens nunquam titillandus."
Re:Get a Mac by Anonymous Coward · 2004-02-12 08:34 · Score: 5, Insightful

Again, parroted on slashdot numerous times -- why hit the less than 1/3 IIS installations out there when you can hit 2/3 with an Apache bug?

popularity isn't exactly directly related to the number of exploits it has. :)
Re:Get a Mac by Dionysus · 2004-02-12 08:39 · Score: 5, Interesting

with my linux box and mac i can do whatever i want - including open attachments... i bought a computer so i could use it.

To be infected by MyDoom, you would have to open the attachment and run the binary.

if you mean, "can i fire up an mta and start spraying email all over creation"? then the answer is only if you have root. and if that virus has root... well, you've got bigger problems.

Eh, no. You don't have to be root to "spray email all over creation". Outgoing connections usually use unprivileged ports. And to accept incoming connection without root, you just need to listen to a port above 1024.

--
Je ne parle pas francais.
Re:Get a Mac by Moridineas · 2004-02-12 08:51 · Score: 4, Informative

Don't mean to be pedantic--but you wouldn't say "get a boxen" because boxen is plural.

etymologically it's an old way (well, old in English) of pluralizing that we only see in a few words...child children, brother brethren is similiar too. Interestingly enough, Persian being an Indo-European language has it too--Taleban (-an) is students (pl).
Re:Get a Mac by dgatwood · 2004-02-12 08:57 · Score: 5, Informative

On Mac OS X, installing a startup item requires you to manually type in your administrator password. Viruses could only become a permanent part of your system if they could convincing people that there was a reason to allow them to install things. Otherwise, such a virus could only run until you rebooted your computer or logged out, making it much less effective.
A virus would not be able to automatically start just by reading a message, as Mail doesn't allow that to happen. More significantly, it could not masquerade as another type of file, since clicking on it would pop up a dialog that says something like "Warning: the attachment 'foo.jpg.app' is an application. Since applications can contain viruses, make sure this was sent by someone you trust." or some such.
In short, even if the Mac platform were the primary computing platform on the planet, it would not have these problems at the same level, IMNSHO.

--
Check out my sci-fi/humor trilogy at PatriotsBooks.

Re:Get a PENCIL AND PAPER by Denver_80203 · 2004-02-12 08:17 · Score: 5, Funny

I hear those are safe too.. and just as useful to me in my busniess as a Mac.

Ooo! by HarveyBirdman · 2004-02-12 08:19 · Score: 4, Funny

Maybe Red Hat or Apple paid for the *virus*. :-)

--
--- Ban humanity.

Re:Ooo! by UFNinja · 2004-02-12 08:21 · Score: 5, Funny

No, if it was funded by Apple it would be called iDoom. ;)
Re:Ooo! by cetan · 2004-02-12 08:37 · Score: 4, Funny

...and you'd have Mac users paying $99 for the upgrade to iDoom 0.0.1

--
In Soviet Russia...michael would be rotting in Siberia!

Proof? by Srividya · 2004-02-12 08:19 · Score: 5, Funny

No proof yet... BBC says MyDoom spread by Linux users to hurt SCO, Linux users say MyDoom spread by spammers to hurt everyone, spammers say MyDoom spread by BIGGER PENIS NOW... Who to believe?

Re:Proof? by Landaras · 2004-02-12 08:55 · Score: 4, Funny

You mispelled 'B1GG3R P3NI5 N0W!!!1111'

- Neil Wehneman

--
My legal education, in nifty podcast format

It proves one thing. . . by UFNinja · 2004-02-12 08:19 · Score: 4, Funny

this proofs MyDoom was initialy spread by organised crime. . .

I think it "proofs" that the editors don't proofread the submissions. :-P

In other news... by FortKnox · 2004-02-12 08:20 · Score: 4, Funny

In other news, by looking at the same day's news from the Netherlands, you'll see they just released "Deus Ex" and "Deus Ex: Invisible War." Conspiracy Theories have quadrupled since.

--
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!

Thread? by $-chavito-$ · 2004-02-12 08:20 · Score: 4, Funny

I hate it when those sneaky Windows worms pose as threads, it makes em that much harder to catch.

DoomNet... by LostCluster · 2004-02-12 08:20 · Score: 5, Interesting

MyDoom's backdoor has been demonstrated by DoomJuice and now the copycats are at it. There's now network of zombies willing to do the bidding of anybody who hacks in... remember, the MyDoom name is based on a typo, the author wanted to call it MyDomain.

I guess the only positive side effect is that some of these DoomJuice variants are closing the back door from the original MyDoom so that nobody else can interfere with them. Now, if only there was a MyDoom uninstaller worm that didn't have another distructive payload...

Is "DeadHat" a reference to .... by Kehl · 2004-02-12 08:21 · Score: 4, Funny

... the now defunct "RedHat" Linux distro?

Way to go on damming Linux users reputation :/

Virus names by Anonymous Coward · 2004-02-12 08:21 · Score: 5, Funny

Do you think people come up with a clever virus name or the virus first?

Re:Virus names by DougWhite · 2004-02-12 08:24 · Score: 5, Funny

Isn't kinda like forming a Rock Band, you pick the name, and the image. The music comes to you after you sell your soul to the RIAA?
Re:Virus names by Erick+the+Red · 2004-02-12 08:37 · Score: 4, Interesting

The anti-virus companies come up with the names, often making fun of the virus writers in the process. MyDoom was named for a variable misspelling: MyDoomain (suppose to be MyDomain).

--
DO NOT WRITE IN THIS SPACE
ok

Re:AIM by ParadoxicalPostulate · 2004-02-12 08:21 · Score: 4, Informative

Funny I was just looking that up for a friend.

This is not MyDoom.

This link may help.

Check that out, may help.

Re:Organized crime? by Trigun · 2004-02-12 08:22 · Score: 5, Funny

When are the nation states going to wake up and start an international war against spam?

When the spammers have oil.

Cyber war? Puleeeze by saskboy · 2004-02-12 08:23 · Score: 5, Insightful

"In the Netherlands there is a newspaper reporting this proves MyDoom was initialy spread by organised crime in a dark plot to wage cyber-war..."

If organized crime was looking to steal data, all they had to do is ask people. Hundreds of people hand over their eBay, PayPal, and credit card information every day to phisher emails claiming to be from a legit company. Making a worm to steal the information isn't even necessary when the user is already the weakest link after being socially engineered.

--
Saskboy's blog is good. 9 out of 10 dentists agree.

I thought that Doomjuice was from the ... by burgburgburg · 2004-02-12 08:26 · Score: 4, Interesting

creator of the original MyDoom and was leaving a copy of the source of MyDoom on the hard disk. The thoughts were that: a) only the creator of the original would have the source to include as part of Doomjuice's payload and b) if "everyone" had a copy of the source on their hard disk, it would be difficult to prove that any one person was responsible for originally writing it (assuming their computer was found/confiscated/examined).

Re:I thought that Doomjuice was from the ... by LostCluster · 2004-02-12 08:41 · Score: 4, Interesting

The problem was, by releasing Doomjuice, that author has effectively released an open source program to exploit what I'm calling "DoomNet", the network formed by the PCs infected with MyDoom that haven't been cleaned up yet.

So, effectively we've got worm-writing for dummies now. No need to write new full-featured virus, nor even the need to know how to exploit an obscure security hole. Just take DoomJuice and add your own payload...

I wonder by bigattichouse · 2004-02-12 08:26 · Score: 5, Interesting

Not that I would condone the activity, but I'm surprised someone hasn't made an email virus that installs an OS on the machine. I would find this in incredible violation of ones choice, but I still won't be surprised when it happens.

--
meh

white hat worms? by Anonymous Coward · 2004-02-12 08:29 · Score: 5, Interesting

I wonder... what are the legalities behind having a worm go around, attack the backdoor created by MyDoom, and cause an alert box containing the infection info to pop-up on the user console? Or, change the person's wallpaper to a similar message so that they dont just blindly hit ok?

A way to deal with worm outbreaks? by gokubi · 2004-02-12 08:35 · Score: 5, Interesting

"Apparently they try to uninstall the MyDoom virus and then take over the PC to start their own malignant work."

When a big worm comes out, wouldn't it be possible to write another worm that would utilize the backdoor, get rid of the worm, and then hang about to make reinfection impossible?

My organization took care of the worm in the first few minutes after it started spreading, but there seem to be a lot of people still out there who aren't protected (if the number of inbound mails my mail server quarantines each day is any indication).

If someone in a white hat wrote a MyDoom imobilizer worm, and then released it, wouldn't that put a speedy end to MyDoom in the wild?

--
I'm much funnier now that I'm a subscriber.

Re:A way to deal with worm outbreaks? by delirium28 · 2004-02-12 08:47 · Score: 5, Insightful

This happened with one of the other worms last year (Slammer or something similar, I can't recall right now).
The problem is that by creating a worm that cleans up the original malware worm, the fix is just as bad as the original virus. You're still using a lot of bandwidth that isn't yours, you're still sending out a program to change someone else's system without their permission, etc.
On the surface it looks like a good idea, but unfortunately it has a lot of serious drawbacks.

--
Who is John Galt?

for the non-dutch by sosume · 2004-02-12 08:36 · Score: 5, Informative

or those who cannot get past the registration links:

Amsterdam - There are signs that the computer virus MyDoom has been brought into circulation by organised crime syndicates. The wormvirus was accompanied yesterday by the evil program 'DeadHat'. Microsoft and software maker SCO have a quarter *billion* dollar in stock to reward the tip that will lead them to its creators.

According to the British research firm mi2g, deadhat is designed to provide its creator with sustaining, long-term control over a system. This power could be abused to hostage websites.

It is also possible to abuse the pc in sending spam e-mail, and the program is capable of harvesting passwords and other confidential information. Deadhat is an intelligent software agent, a program .....

[snip] the really boring part

According to mi2g, deadhat has encrypted intelligence, waiting to be activated. "This definitely looks like the work of organized crime"

Meanwhile, Soomjuice has come to surface. Another worm which seems to battle for control of the PC.

For Newbies, not experienced users. by Azureflare · 2004-02-12 08:38 · Score: 4, Insightful

Talk about overreacting. But, you proved the grandparent posters point. You are obviously not a user who needs to switch to a mac. You know what you are doing.

These people STILL infected with MyDoom don't know the first thing about computer security. They would be MUCH MUCH better off with a Mac than with windows. All they probably do anyway is chat with their little friends on AIM and check their webmail.

It's obvious that windows is NOT the perfect OS for clueless newbie users, because it leaves gaping holes for them to be abused through. Think about it from the newbie point of view, not the experienced user point of view.

Thank you.

Re:For Newbies, not experienced users. by ball-lightning · 2004-02-12 08:52 · Score: 5, Insightful

These people STILL infected with MyDoom don't know the first thing about computer security. They would be MUCH MUCH better off with a Mac than with windows. All they probably do anyway is chat with their little friends on AIM and check their webmail.

And that's great, until Macintosh's become popular enough for viruses to be written for them (at which point its going to be a massacre). A guy I work with owns a Macintosh, and he brags about how he doesn't need to run any antivirus program and how he can open all attachments. If a virus like MyDoom was created for the Macintosh, how much you want to bet my coworker (and people like him) would get infected right away, because they aren't using common sense? Windows may be buggy, and windows may have a lot of security holes, but in this case, MyDoom does not take advantage of any of them MyDoom takes advantage of the traditional weakest link in any security system, people.

Re:Cyber war? Puleeeze by saskboy · 2004-02-12 08:39 · Score: 4, Informative

But nothing is new with MyDoom. Maybe the intent, but there are still dozens of active viruses out there with back door capabilities that could be exploited by crime, or by spammers [which are criminals I suppose].

Why commit computer crimes from your own machines, when you can do it from another person's, and in fact connect to a 2nd or 3rd infected machine from the first infected machine to add another layer of dificulty to any investigation?

The ability to harvest contact information exists in a simple forwarded joke email. This is not advanced "war" stuff. If it was advanced, people wouldn't have noticed.

--
Saskboy's blog is good. 9 out of 10 dentists agree.

Exchange servers beware by t0qer · 2004-02-12 08:41 · Score: 4, Interesting

This could have happened to anyone I guess....

Last week I get a call from another tech friend, "Hey toqer, I got this customer and they got infected with MyDoom. The NAV wasn't set to exclude the exchange store on the server, and it wiped out their calendaring info, the server needs all its logs rebuilt"

I asked him for more info. Logs rebuilt? WTF was he talking about? Apparently they had brought in an "Exchange Expert" to fix the problem. The guy spent about 2 days out there and didn't get anything done. After calling them I went out to see exactly what the problem was.

This office is a lawers office, and they're specialty is wills and trust funds. I was met by a really nice french woman at the door. "Toqer, please follow me and I will show you what the problem was"

She first showed me their main problem. Whenever they would try and modify the big bosses calendar, outlook would spit out some nonsense about unable to connect to his free/busy information. Second problem I noticed was the entire network was running on NT4.0, and the machines were all pentium1 class PC's. "Good thing this is hourly" I said to myself.

Looking at the NAV logs, it looked like it had deleted some files from d:\exchngsrv\mtadata (not exactly, this is best recolection) First thing I did was set NAV to exclude those folders. Good, done.. Now it was time to fix the problem itself.

Now I don't have the exact KB article, but the MS solution was to log in as the affected user. Backup his exchange store to personal folders. Use the exchng32 client to delete the calendar folder, then launch outlook with a /resetfolders switch, and finally re-upload his calendar from the PST. After doing it it worked and they were happy.

It took me 4 hours to fix it, nice little chunk o change in my pocket. Thanks MyDoom!

Cleverer Social Engineering by GillBates0 · 2004-02-12 08:41 · Score: 5, Informative

According to the Symantec Security Response page on the DeadHat (parody of RedHat?) worm spreads through Soulseek disguised as one of the following:

* Windows2003Keygen.exe
* mIRC.v6.12.Keygen.exe
* Norton.All.Products.KeyMkr.exe
* F-Secure.Antivirus.Keymkr.exe
* FlashFXP.v2.1.FINAL.Crack.exe
* SecureCRTPatch.exe
* TweakXPProKeyGenerator.exe
* FRUITYLOOPS.SPYWIRE.FIX.EXE
* ALL.SERIALS.COLLECTION.2003-2004.EXE
* WinRescue.XP.v1.08.14.exe
* GoldenHawk.CDRWin.v3.9E.Incl.Keygen.exe
* BlindWrite.Suite.v4.5.2.Serial.Generator.exe
* Serv-U.allversions.keymaker.exe
* WinZip.exe
* WinRar.exe
* WinAmp5.Crack.exe

This is also a Social Engineering technique similar to the catchy email sent by other recent worms.

The difference I see is that the filenames are catchier and seem to be targetted towards a more computer savvy audience. Normal Windows users wouldn't need to look for WinRar.exe and the other security software cracks/etc...but then, they're the ones who opened the MyDoom attachments in the first place.

Get the dumb users with vulnerable PCs through email attachments, and break the more secure computers/users through enticing downloads!

--
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam

New Welchia Worm by fdiskne1 · 2004-02-12 08:43 · Score: 5, Interesting

Whereas the new Welchia/Nachi worm cleans the MyDoom viruses, sets the hosts file back to just 127.0.0.1 localhost, installs a few Microsoft patches, reboots and scans for other MyDoom, MSBlast and Welchia infected machines to clean. It also sets up a web server on the machine serving a webpage with a cryptic message about various Japanese and Korean massacres. It then disables itself on June 1, 2004, or after running 180 days, whichever comes first.

I don't normally like any Windows virus, but I have a tough time not liking this one.

--
But why is the rum gone?

Hmmm.... by fizban · 2004-02-12 08:46 · Score: 5, Funny

MyDoom: "Who are you?"

DoomJuice: "I'm your Grim Reaper."

MyDoom: "Like hell you are. This is my machine, punk."

DoomJuice: "Prepare to meet thy maker (wink wink)."

MyDoom: "Over my dead process."

DoomJuice: "Look, a little old lady on a Windows 98 machine!"

MyDoom: (turns) "Who? Where?"

DoomJuice: "Your Mom." *BONK* "Muhahahaha! Mine, the world is mine!"

--

+1 Insightful, -1 Troll. What can I say, I'm an Insightful Troll.

Kinda scary by promethean_spark · 2004-02-12 09:09 · Score: 4, Insightful

That a worm that digs for personal information goes active right when people start doing their taxes in the US. There are alot of bank account numbers being typed in right now. A worm that hacks taxact to send an account number the virus writer can access instead of the user's would be quite profitable. It'd probably only work for 24 hours or less, but it could steal hundreds of millions in that time.

Viruses : Cutting Edge of Artificial Intelligence by Pup5 · 2004-02-12 10:10 · Score: 5, Interesting

It's interesting to watch the development of more advanced viruses. We've created the perfect medium for their development, existence within an artificial world.

Food is computing power, which it steals.
Prey are vulnerable computers, with computing power unprotected.
Predators are virus scanning and eradication software.
Reproduction is checked only by environmental factors.
Evolution has developed two clear attributes: transport and payload.

It will be very interesting to watch this area develop, especially considering it's place in society. It's incredible that not only have software companies been given virtual total immunity from the financial impact of their defective products, but that they have convinced the right parties that people who expose their defects are criminals. Truly incredible.

Slashdot Mirror

New Worms Feed on MyDoom Infections

40 of 243 comments (clear)