Slashdot Mirror
A Worm's Worm
Carnildo writes "There's a new worm out, according to the Register, but one with a twist. This one, called 'Dabber', infects computers by exploiting a security hole in the Sasser worm."
← Back to Stories (view on slashdot.org)
did the sasser writer make it expandable on purpose? this isn't the first time a thing like this has happened.
Just thought about this... With the huge number of machines out there "infected" by spyware, adware and similar programs (and many of them without their users even knowing), how long will it be until a worm is written that exploits a vulnerability in one of these programs?
The revolution will not be televised.
You mean like IE? I've certainly had enough programs try to get me to install that on my computer..
Twenties Retirement
Gosh, this whole mess looks just like Blaster from down here in the trenches.
.
I'm tech support for Tremendously Large ISP. From down here this looks just like Blaster did. Customers calling in complaining that their machine is restarting without their consent. And now someone has a follow up virus that attacks the virus - as some may recall there was a Blaster variant that patched systems AGAINST Blaster. This was terrible - if you got this variant inside a corporate network not only would your bandwidth use skyrocket, but since NAT tends to fubar Windows Update, the variant never managed to patch a system. God that was hell . .
It's almost enough to make you want to write a virus in revenge . . .
Yes, for quite a while.
Quite a bit of modern worms in this or that way provide just a generic backdoor to the infected machine without performing any extra malice. Some of them just open oprts, some trick firewalls and actively "call home", which usually happens to be some random IRC server on some compromised machine (IRC seems to be preferred method for the virii writers for controlling worms, which just act as bots on the channel). Then the virii can upload a spamming software, a DDoS attack plugin, a keystroke logger, a file transfer thing, a tunneling/relay program to mask an attack, or whatever the twisted minds come up with.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
...with some software with the ability to self-replicate. God help the rest of the universe when life finally manages to get off this planet.
Doesn't it make you feel good to know that our freedoms are protected by politicans, lawyers and journalists.
This is an all new low. Now virus programmers will have to make their virus's better so they dont get infected by another virus.
Actually, this sounds like somebody trying to make a disinfectant worm. Look at the description:
- It only infects infected systems, using a flaw in the previous infection.
- It cleans out the infection of the worm that it exploited, and several others.
It does open a new backdoor. But while that might be preparation for some future malicious action, it might also have been the author leaving himself a way to fix things if his initial worm got out with a destructive bug. (Of course it could be the worm cleaning up signs of previous infections in order to hide itself and thus head off other cleanups.)
I wouldn't be surprised to see, on further analysis, that it does other antimalware things (like fix the flaw the other worms used).
(Not to say that it IS somebody trying to fight virus with virus. But it might be interesting if it turns out that it is.)
I think everyone should go ultra secure, the best firewall ever... Disconnect from the net. It would make this all alot easier on us.
Which is exactly what the military does with some of its really secure stuff.
Now if we can just get the Microsoft users to emulate them. B-)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
Does this situation imply that the sum total of Sasser-infected machines outnumber Macs and Linux boxes?
That's something that really depends on the school. I remember my elementary school would have a class that consisted of Logo Writer / Microworlds that I took in the first grade...
My former high school offered a Visual Basic course in grade 10... but that's VB.
However, there's a lot one can learn by teaching themselves from a book, and I think that's where a lot of the talented young programmers get their starts. It may be that writing annoying viruses and worms are just some kid's way of testing and/or proving the knowledge s/he's gained. But I'd like to think that usually the smarter ones find more meaningful applications of their skills.
This was never about doing a good thing. It's plain competition. Any decent worm should be able to remove all other worms and viruses from the system in order to have complete control over it. I bet this will only get more common.
Then again it should be easy to release this new work without the code that opens the backdoor so that it only does the removal part?
There's a little difference ... if you want to use a burglar analogy, then use the analogy of a burglar stealing property from another burglar that stole it from the owners.
Both are illegal, both are prosecutable, but the "victim" burglar can't sue for loss of property from the 2nd burglar because the property belongs to the original owner.
It is more productive to voice thoughtful opinions (reply) than to judge (moderate) others.
This sort of reminds me when I wrote a counter-bug to combat an email worm that had infested an office building I was contracting to. Worked through the ever-so-lovely 'You don't have to really click the attachment for it to go off on you' bug in an older version of outlook.
:)
:P
:)
It sat and watched a users inbox for the big bug at the time and pretty much acted like a counteragent, the instant they showed up, it nuked them off the machine (inbox and all) and undid whatver they managed to do.
Send one copy to everybody in the office, and instantly watch outgoing network mail traffic DROP back down to normal levels and my phone stop ringing.
I seem to recall distinctly 'forgetting' to mail it to key people, however.. *cough*
Would be a real shame if some of the geek-prowess around the OSS world were to start doing such counter-bugs. Alot of these backdoors, trojans, and whatnot, have gaping flaws in them because..well, guess.
Just think:
Infect > Disinfect > Patch > Scan nearby machines (proceed life cycle)> Local Self-remove
Could be the next revolution. Don't bother patching or downloading, we bring the cure to YOU..
My new top secret key -> C>N|KB
I have a very serious suggestion, namely that Agobot, once it infects a host, should patch the host, remove spyware, and remove other virii, and then propogate itself a maximum of 10 times (to conserve bandwidth). Though you are still doing unauthorized stuff to other peoples' computers, if you're gonna make a virus, you may as well make it beneficial. Maybe that way fewe people would get arrested...
Given that it's a GPL project, I can't imagine that it would be too hard to find a few dedicated coders who would be willing to work on such a fork.
Yay for Free Software! (Achoo!)
Is this a beginning of a new virus era? I can see virus programmers making holes in their code on purpose just to release a second virus to take advantage of it. virus 'a' is programmed with a hole - virus 'b' takes advantage of it! A fine case of hit them when they are down!
Copyright (c) yyyy, The Author and Contributors. All rights reserved until yyyy when this work will enter the Public Domain.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
- Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
- Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Any redistribution of the software or derived work in binary form must be accompanied by an offer of the source code, to be valid until the lapse of copyright on the work in question. In case of default on this offer, any affected party may use reasonable force to obtain the source code.
- The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission.
- Modifications on such a scale that they are deemed by applicable local laws to constitute a whole new work are exempt from this licence.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.Je fume. Tu fumes. Nous fûmes!
Welchia perhaps? It doesn't remove spyware and was designed to remove just one worm but that's kind of what you're on about I think.
I ran into Welchia.B the other day which went after MyDoom (SCO) and downloaded 5 patches or so from MS and installed them on the system. Trouble is, that it's still a worm - nobody wants it on their system - it took me a couple hours to identify and remove it then get Windows running again.
Welchia.B was trying to run four different exploits on remote IPs - I sniffed all the traffic it was generating - trying to exploit up to a hundred IPs a second at one point. Max of 10 times to conserve bandwidth...? It has to find the other PCs first.
The patches it downloaded screwed up the XP installation badly, so a reinstall over the top brought it back. I don't want worms that try and fix other worms (get Avast or AVG etc instead).
All binaries come with "source code", machine code. It's a language that most of us don't use, but it's still a language. My CPU uses this "source code" to create a different set of instructions that are executed by the core of the CPU. You can read the machine code and see what the app is doing. DNA and RNA are pretty much just machine code for cells.
-twb