Slashdot Mirror
Sasser Worm Disruption Growing
thebra writes "Yet another virus is causing problems with Internet Explorer. "Sasser, unlike a virus which travels through e-mails and attachments, spreads directly from the internet."A removal tool can be found here."
I still am of the opinion that it doesn't matter how many patches M$ releases. The fact is, we need an educated user base. So many people continue to use computers without knowing the full risks associated with them.
The Internet is great, broadband is great, computers are great. But as long as people are willing to give up their passwords for chocolate and have no clue what a firewall is or what it does, this problem will continue to plague everyone.
Nothing beats a good educated user.
Proudly supporting the Libertarian Party.
What it tells us about Microsoft, is there are people out there who cannot take care of systems.
This includes Linux boxes and Mac boxes as well.
Wake up and smell the damn coffee, it's not a problem exclusive to Microsoft, as much as some of the Linux rah-rah club would like to think.
Why is it OK for Linux to patch the hell outta itself but a damn near capital crime if Microsoft has to?
Grow up.
Microsoft released a patch, people did not install the patch. Who's fault is that? None of the 1000+ systems in my office were infected because I'm intelligent enough to have policies in place to prevent stuff like this from happening.
The poster called Sasser a virus, then proceeded to give a definition that said it was not a virus. No offense, but was the poster actually reading what he wrote?
What the hell has a worm that attacks through non-HTTP traffic and downloads its body through a built-in FTP client got to do with Internet Explorer?
If you're going to bash Microsoft, at least bash the right frickin' part...
The Slashdot Paradox: "100% Overrated"
It's a strange problem, security. Educated users are key, but because Microsoft has the largest market share, they also get the largest number of uneducated users. What will happen if Linux eventually completely replaces MS products on the desktop? Will they have the same security problems?
Sasser is mostly annoying. It causes your computer to restart repeatedly, while scanning nearby ip adresses and spreading itself to them (if they're not patched). Doesn't sound too bad does it?
Well, even though it's "just annoying" and "poorly written" according to F.Secure, it caused Sampo (a large bank in Finland) to shut down yesterday. Both computer networks and telephony systems were hurt. The same happened to If, a Norwegian / Swedish insurance company, and today another Norwegian insurance company had to halt operations (Vesta).
So even annoyances can stop entire operations, and thus we can say that it's a pretty serious problem until most (Windows) computers are patched.
I'm not sure why everyone is so hopped up on these removal tools. It seems to me that after being infected with a worm that installs a back door, more people ought to look at reinstallation from known good media.
Biggest Windows vulnerability ever, again. How many times have we said that this year? At work, it's begining to feel a bit like a duck and cover drill.
-Peter
. Penguins Surely Ca
Yes. Because Linux IS inherently secure?
Or maybe, just maybe, computers are inherently insecure?
"If we let things terrify us, life will not be worth living."
- Seneca
A. Guy takes home corporate laptop.
B. Plugs laptop into phone-line / uses internet
C. Gets infected
D. Takes his laptop back to the job
E. Infects the entire LAN *FROM THE INSIDE* while the firewall hapilly keeps the fire "IN" (instead of out).
If you fire anyone, please fire the laptop-owner.
This unique sig is intended to make this user more recognisable.
More like capitalism punishment.
If after all the bullshit that companies went through with Blaster, they didn't sit down, get a team of smart IT people together and implement solutions to stop worms, then they don't deserve customers business.
Darwanism at work. Those who don't grow immune to the poison, die from it.
Yes Francis, the world has gone crazy.
Correction; You had a zonealarm that was set up wrong.
Blocking port 445 from inbound traffic secures the computer against this worm.
Also the failure to install a critical patch that has been out for two weeks is called 'stupidity'. Using a windows box connected to the net is already something close to extreme sports. Doing so without regular windowsupdate visits is like extreme sports blindfolded without a helmet. You are *bound* to get hurt.
Microsoft, Linux, Apple - all platforms need to have this drilled into their brains, coding, and documentation repeatedly with much force! Microsoft is a target because they have angered so many with their *business* activities and sloppy coding. How long before Linux joins them?
I am an avid Linux user - The only windows machines I have are for client applications that I can not run on Linux.
Most of us (yes, me included) when we scratch an itch, make it work for ourselves, not for the world in general. If we are to produce Secure, Stable and Safe programs, then we need to have a tool set that allows us to build them without thinking about it, or we need to all think about it with each app released into the wild. Asking Joe User to know enough to run a secure platform is like asking all people to be able to self serve everything in their own cars, appliances and bodies (i.e., no mechanics, repairmen or doctors needed).
'It aint gonna happen!' All of these are way to complex and most are changing faster than most people can keep up with. So, it needs to fall back on our shoulders (the developers) to make this happen. The question today (as in so many other days past) is what can we Linux developers learn from Microsoft's mud? What are the issues that are allowing these things to happen and how can we prevent them? I hope everyone has heard this before.
And, more importantly, how do we get qualified people to itch this scratch to completion? It seems to me that the world in general would benefit most from a programming tool set that built these solutions in, and that is not going to be an easy task. Microsoft is trying to address that with .net, and is still not on target (or anywhere close from what I have seen). Java tried to answer that, but it has fallen far short of what is needed.
I really do not have any answers to this. One of my bet friends has explained to me the complexities of building compiler systems and writing your own languages. Those complexities alone are big issues. I would love to read what other /.ers have to say on this issue.
InnerWeb
Freud might say that Intelligent Design is religion's ID.
Poor programming by Sasser's creator makes infected machines shut down.
That should make the writers happy... that their ineptitude made global news.
I am not impressed with the foo of these cut-and-paste virus coders. There was a time when it was actually difficult to code one of these things, but come on... they are open-source now.
No-kung-foo-required.
A firewall is all well and good until someone brings an unsecured laptop in and plugs it into the network. Are you tell me that no one in your organization has a laptop that they take home with them. What's the chance that they may plug it directly into a high-speed net connection at home without a firewall?
I'm sorry, but even companies that aren't getting hit by this still paid the price.
We ran around frantically patching every $#%@#^ windows box at the company after the patches came out. Installing patches wastes users time, administrators time, everyones time. I know it can be automated, but its still a pain and you have to check every system anyway.
And whether or not you get a worm on your systems should not be the deciding factor of whether you deserve the customers business. Are you really saying that a record company that effectively blocked this worm deserves my business? Please don't start an oftopic rant about the RIAA, its just an example.
A. Guy takes home corporate laptop.
B. Plugs laptop into phone-line / uses internet
C. Gets infected
D. Takes his laptop back to the job
E. Infects the entire LAN *FROM THE INSIDE* while the firewall hapilly keeps the fire "IN" (instead of out).
This actually happend to us last year.
If you fire anyone, please fire the laptop-owner.
Uh, problem being that it's good odds that the laptop owner is the boss of the people wanting to fire someone.
My Karma: ran over your Dogma
StrawberryFrog
All this really resembles me to the Y2K problem.
The difference is, that we could sit down, make a plan, inspect all PCs, have stickers for OK machines, etc.
And there were far less problems than with an average worm nowadays. Imagine if the Y2K problem would have been as big as a usual worm hit. (several middle to large companies affected for a couple of days)
Vajk
If enough machines get infected you won't have to worry about anything. The network will be flooded.
Seriously folks. Microsoft release the patch 21 days ago. If the worm came out before the patch I would be more critical but it didn't. Hopefully Microsoft decided to turn on automatic updates by default in service pack 2 for XP.
It's funny how articles claim that the worm has caused all kinds of damages -- from banks to postal systems, to transit systems. The tone of the article seems to lay blame largely upon the worm itself. This is absolute horseshit. If users (and IT personnel) at these governments and places of business were responsible enough to do their jobs and ensure that computers were adequately patched, this problem never would have occured.
Furthermore, if personnel took a single iota of initiative by installing and maintaining a simple firewall -- these issues would have been far less widespread (although this can still be spread through a network via infected laptops brought in from a home network). The important thing here is that the creators of this worm, the IT groups who let this happen, and the individual broadband users affected really share blame for the spread of this worm. Let me use an example, if you live in a shitty neighborhood and you leave your door unlocked, you are partially responsible for some jerk breaking into your house -- sure, they broke the law, but you helped facilitate that.
OK, one more topic to rant over then I'll STFU. I see alot of Slashdotters blaming Microsoft for this problem -- saying that running Linux or xBSD would solve this problem. Bullshit, fanboys. I am a Linux/Free software advocate and that argument is absolute bullshit. Every once in a while, remote exploits are discovered for these Free products. Most of the time, patches for these apps are released right away -- faster than their commercial counterparts are able to react. The users will still need to be smart enough to apply the patch. Well, in this case, Microsoft's patch was available before an exploit was in the wild. The reason why this worm is so widely distributed is because the user base (and administrative base) is large enough that there is a large cross section of people who have no idea what they're doing.
If Windows went away tomorrow and Linux became the defacto standard, we would have the same issues. All of those MCSE's who allowed this to happen will become RHCE's who will still allow something like this to happen. That certification doesn't make them any smarter -- bad admins are bad admins. Clueless users are clueless users, regardless of the operating system they use. It's easy to blame Microsoft for this, because they have deep pockets, a huge market share, and shady business practices -- but all code has bugs. Microsoft did the right thing, their userbase just wasn't smart enough to do the right thing.
-Turkey
OK this sasser worm can install istelf open a few ports, serve files as an FTP daemon, place itself where it pleases, and gobble up your network.
Other virus's do all sorts of nasty things, but they all seem to stop short of REALLY bad things. Search for files they can delete, look for a network drive and have their way, find interesting files and mail to random people, rename this or that to render the machine useless.....
To me this seems very strange. Is ther some kind of virus writers code that has some small bit of ethic? Is there some undergound society that meets the 3rd wednesday to discuss safe virus exploits? Does Microsoft create these things to get people to upgrade? Maybe McAfee and Norton are funding them and they just want a profitable year?
Now I am not asking for this kind of damage, but as my boss points out he has no reason to switch to anything more secure because nothing really bad happens.
Bah...like Linux or OS X or BSD or Solaris are any better. Nobody really has desktop patches down all that well, the users make the machines too personalized.
Plus, any OS that has 95% of the desktop market is going to attract worm/virus writers, and I don't care how open or closed source the code is. If things were reversed and Linux was had hundreds of millions of installs it'd be hacked to pieces. Even now I get all kinds of patches on my RedHat and SuSE boxes, it's no different than Windows.
It's easy to maintain and patch 10K servers of any kind because you have control over everything. But any kind of desktop support is going to suck major a$$, regardless of the OS.
In reality, computers just plain suck. They're still very young compared to, oh I don't know, combustion engines...the human body...the planet's ecosystems.
>Actually your probably not doing it intentionally but your just repeating Microsoft marketing-speak
8 14 ,92037,00.html
So someone at Microsoft wrote this article and invented all the facts in it?
http://www.computerworld.com/printthis/2004/0,4
And you should know that I am NOT a Microsoft shill.
I'm not excusing Microsoft, I just think someone out there has an agenda that is different that the typical worm-writer's.
I don't know the meaning of the word 'don't' - J
Exactly right about breaking things. I found this patch broke Kerberos Authentication when double hop's are used. It broke a lot of our Intranet applications. Fortunately, we are firewalled and our internal MS machines were patched. I'm waiting on MS to resolve the issue so I can apply the updated patch.
I think you've missed the point.
1: There ARE more web servers out there running Apache than anything else. So, why is it that there is an unbalanced proportion of these boxes remaining intact and and with 99% (sic) uptime than the Windows boxes?
2: Apache runs properly with fewer system resources, hardware and preventative maintenance than Windows. Set & forget, to a great extent.
3: One of the main reasons that many corporate/commercial servers are still running IIS is because of the ease of use in integrating MS SQL and specific data export services from what the desktop is running: Windows. If from your average net admin's perspective, they could easliy and definitively state to their bosses that they could run a given database server on Apache for X dollars instead of on MS for XXX dollars, they would do it. It is difficult for the admins on two fronts: a) persuading their employers that a free product could possibly outrun what the so called market leader has provided, and b) if something goes wrong, fewer heads will roll if they're using MS instead of a "free", "open-source" product that, in the eyes of their employers was a gamble to start with.
This will all change VERY soon.
It's all a mind game....
My point wasn't that M$ has absolutely no guilt in the matter. You bring up a good point by comparing the issue to driving. BOTH parties are responsible for using the product correctly and safely.
The manufacturer should make every effort they can to ensure the product works 100% out of the box. If you know full well that your Ford Explorer has tires that blow up on impact, you should not sell the product with those tires. In the event that you did so accidentally, you should make the public very aware of the situation and attempt to rectify the problem. Now, Microsoft has done reasonably well on the second account (a patch was/is available) but not so much the first. I think that having something similar to a "recall notice" for Windows OS that is very public could be a step in the right direction.
However, it is also the job of the consumer to be educated in their use of the product. A Ford Explorer is perfectly capable of towing a boat, but Ford does not necessarily include the right tools to do so. It may have the hook thingy in the back of the body (pardon my lack of vocabulary) but if you try to tow the boat behind with a rubber band, it is not Ford's fault you were uneducated about that decision. In the same way, Windows is perfectly capable of being an OS that can be connected to a network to transfer data. But if you decide to do so with a DSL modem that has no firewall, that is not Microsoft's problem. In that regard, MS has made the attempt to educate their user base (link) , but it is up to the consumer to read and educate themselves at that point.
When this worm could have been stopped very easily with a properly configured (and inexpensive no less!) firewall, I find it hard to pin all the blame on MS.
Proudly supporting the Libertarian Party.
Their ignorance? What about yours?
A new computer is like a new baby. You need to inocculate it or it'll get sick. If you're putting out in a wild environment without protection -- and a suitably large organization is almost as bad as the internet itself -- you're just asking for trouble. The best way to prevent this is to patch it up to a useful level behind a one way firewall. An even better way is to update your corporate ghost image once a month so you're never more than 30 days behind in your patches.
Furthermore, the days of agressively testing patches should be over for everything but servers. Let your employees run autoupdates and if one of them does break your machines, roll it back. Servers are a special case, because if you lose the TCP stack on your mail server it's much worse than if Ted from Marketing loses his.
Management doesn't want Linux because they don't want to lose days learning an alien operating system when they already have YOU to do the job of protecting them from viruses. What would you say if your plumber told you that to unclog a leak, you'd have to buy a new house?
Hey freaks: now you're ju
This is a very typical mistake. Management, especially senior management does not read 70 page long pamphlets about a topic that they most likely don't understand.
Write a very concise executive summary, comprising no more than two pages, outlining in an easy to understand language why switching to Linux will be beneficial to your organisation. Emphasise on cost and security and explain the interdependencies. Also explain the business freedom your organisation will gain (management decides when to make major changes to your infrastructure, not Microsoft etc.). Preferably get a colleague with an idea of management's language to help you with it.
It's like every business pitch: First you get them hooked with what they really want, then you get the stuff in that you want.
I feel so sig.
In that case, you're just tough out of luck, because there have been plenty of exploitable Linux and OpenBSD patches in the last couple of years. In fact, if you're a server manager, you might look through Slashdot's history for the last year. Somewhere, there was an article pointing out that the majority of the actual server breakins were not on Windows servers. After all, how could they be since there are so few Windows servers. People breaking into servers are more than happy to encounter an unpatched Linux or OpenBSD machine.
I've got both Windows and Linux machines and have them both fully autoupdating. They only time I've ever had anything "break" due to autoupdating was when one of Microsoft's patches about a year ago caused machines running Norton Antivirus to slow down in some activities. Yes, 4 or 5 years ago when NT was the game, it was different and the patches tended to bite you. But it hasn't been that way for a long time.
Overall, I'd say the risk of a patch breaking something on your specific machine (as opposed to a few random thousand of the 100s of millions out there) is much lower than the risk of a virus hitting you while you're "testing" the patches.
I think that the real driver for people using your excuse for not patching is one of responsibility shifting. If you don't patch and get hit by a virus and its not an extreme case like taking more than a year to patch, you can whine about MS even though it was really your choice to bet the farm on 10:1 odds just because whining about Microsoft is a popular thing. If you do patch and you encounter that more rare condition that the patch busted you, you'll catch hell for patching without testing. So, not patching is the safer bet for you, patching is the safer bet for your machine.
If you don't believe me, Google around for articles about patches breaking machines versus articles about viruses breaking machines. I think you'll see that some of the latest viruses and worms hit in the many millions, whereas the problems experienced from patches hit in the many thousands or are not completely debilitating.
You speak the truth. However, as always, the car:computer analogy fits here. If you think about what you need to know to use a car, it's not very complicated. There is a core set of knowledge that you need:
1. Operational (How to turn it on/off, put it into gear, brake, accelerate, speed, re-fuel, etc...)
2. Navigational (How to get from point A to point B. Understand traffic flow and direction. Read signs and street lights, etc...)
That is the bare minimum you need to drive a car. Many people these days seem to just barely know (or care) about any of that. In addition there is extended knowledge:
1. Maintenance (Get your oil and filters checked/changed. Tune-ups. Fluid checks. Cleaning.)
2. Enhancement (Learn more about your engine to get it performing to the best of it's abilities. Understanding the interaction between your car's tires, the road and aerodynamics to get the most out of your car)
3. Interior/Exterior Decor ("Trick Out" your car and add high performance with stickers, spoilers, tailfins and fartcans. Make sure your stereo can tip off Richter scales for miles around, etc...)
Very few people ever get to that level of knowledge. There really isn't any real reason for "Joe Average" to get there. But as far as the core knowledge goes, would you want someone out on the road who can't read directional signs, doesn't understand the concept of direction (N, E, S, W) or speed limits? Trust me, I see people on the road every day who appear to be lacking these basic skill sets and they are largely responsible for the accidents we see regularly.
Apply this to computers, and you can see that we are, indeed, in a sorry state by comparison. Again, there is a core skill set that a computer user SHOULD have to be fairly competent. But it's much more complex than what is required for driving a car:
1. File System - An understanding of how files are organized in an OS is very important at this point. It's a LOT like knowing how to read a map and get from point A to point B. Sadly, most users DO NOT have this skill set. In the interest of being "user friendly", applications like MS Office have attempted to abstract where files actually are located. This harms the user because if MS decides to change the location in a new version of the OS or program (My Documents has moved from where it was in NT 4.0 compared to Win2K and WinXP for example) then the user may think their documents are "gone". Tools like "Find Files" aren't any better at helping either because the user will ignore the path and just double click the file to have it open in Word. Or worse, there will be a "shortcut" in the "Recently Used" section of the Start Menu. I ask you, would you set up a physical filing cabinet this way with post-it notes in folders saying "This file is in Cabinet 35, Drawer B, Divider 2, Folder 12"? Shortucts (and sometimes symbolic links in Unix) are a BAD IDEA.
2. File Types - One of the worst things about most OSes (Macintosh pre and post OS X excepted) is the non-existence of standard file types. Part of this is due to the fact that file types and data types are a moving target. HTML files didn't exist in 1984, so a Macintosh from back then wouldnot have had a built in association with an application that could read them. In the Windows world, the association between application and file was (and can still be) manual procedure that will perplex most users. Considering how much data and file types come and go and change, I am still wondering why there is no DNS type of system for file types that any OS worth it's salt would hold to. Imagine... a central DNS like repository that holds a database that an OS queries: "I have a file with the following type: x-application-doc. What applications should I use?" The server responds to the OS: "mswin-winword.exe, mswin-soffice.exe -writer, generic-unix-soffice, linux-kword, multiosapp-abiword". Then the l
Who is Twirlip of the Mists?
Couple of thoughts in a "windows world"...
- as soon as your baby is born and put in the nursery with the other brand new babies... they would all be infected... where would you suggest we put the new baby right off the bat?
- have you ever dealt with Ted from Marketing? I've found that if Ted is high enough up and he can't play solitaire then the sh*t is going to hit the fan pretty dang fast!
- if a plumber, electrician, and carpenter told you that in the long run it would be a lot cheaper just to buy a new house instead of have them out every other day, wouldn't that make sense?
Of course I think Microsoft should be sued for some of the problems we have. I don't think everything in the EULA will hold up in court in every state. But it's not my decision.
Okay. How about those people who don't even run Windows and therefore have no part in the EULA? Their networks are being ground to a halt because of flaws in Microsoft software and their patching process, as infected machines attack them.
Analogy: car company X builds cars with defective brakes. You didn't buy that car. Your wife and children are driving home from shopping and someone driving X's car runs through a red light because he can't stop, and plows into the side of your wife and kids. Now, not that I'm overly litigious, but there's a time and place for companies to be held responsible for the damage caused by their poor products and designs.
Who do you sue? The guy driving the car with defective brakes, or the company that has a pattern of time and time again making defective products?
Fire and Meat. Yummy.
This explains why IIS is more commonly attacked than Apache, even though IIS is a minority webserver. Possibly even more important than numbers is how "attackable" a platform is and how "malware friendly" it is.
IIRC, the original IIS exploits came from a legacy ISAPI that was there by default... also, that followups where exploiting holes the originals had created...
I usually remove any unused ISAPI filters as one of the first things on an IIS machine, as well as bringing patches to current.
Desiging a worm which will "work" is sveral orders of magnitude easier with the homogeneous Windows population than the heterogeneous Linux population.
It's also easier to write gui software that will work on 99.99% of all windows 98 or higher installations without extensive tweaking, than it is to get running on even 50% of linux installations. Especially if sound is a requirement.
Michael J. Ryan - tracker1.info