Slashdot Mirror
Lessons Learned From Blaster
CowboyRobot writes "It's been nearly a year since Blaster struck, causing hundreds of millions of dollars in fixes and lost revenue.
Jim Morrison of Symantec goes step-by-step in looking at how the Blaster worm got out of control so quickly, and what lessons can be learned from that event, by studying how one utility company dealt with it." The story is written as a fun, technothriller narrative; here's an snippet: "The laptops, usually out in the field, were always a hit-and-miss proposition to find on the network and deliver a patch or to have the user take the machine to a field office. That meant that on the 16th they could see a flood of traffic launched against Microsoft. The second phase of Blaster, launching a DoS (denial of service) attack against windowsupdate.com, was imminent."
Back when Messenger Service popups happened and started using $80 hardware firewalls that doubled as Internet sharing boxes.
When Blaster hit I was sitting pretty and so was every client that took my advice.
*yawn*
Use Evolution instead of Outlook? Bewa
First off... I personally agree with that statement.
Second... I was working a dead end call center job for an ISP when Blaster was running rampant.
Even though this was a Windows problem (and should have been sent to Microsoft), we trouble shooted it since it did technically stop a customer from getting online.
I think after that, nearly every Joe 6-pack finally realized that the thing in his "Start Menu" called "Windows Update" was something to use often.
I use OSX since I never get virii or worms, but they are coming to the mac soon enough. Although, everyday I am using windows less and less and only for Oracle development (OAF/JDEV) because of my job.
;)
I guess the only thing to learn from the blaster worm is to switch to OSX.
GroupShares Inc. - A Free Stock Trading Community. Over a 100 active members daily!
-------
artlu.net
If it gets really high, eg 50 or so (your average AOL user) automatically turn on the Windows Firewall, and include a flag on every outgoing packet indicating that the user cannot be trusted to operate their computer in a safe fashion. Webmasters can then block traffic from these PC's at their discretion - Problem solved.
Making the moon less necessary since 1998.
Automatic Updates and Norton...and try to minimize office guests access to the network...
See Sig! See Sig Zig! Zig Sig Zig!!!!!
http://www.giac.org/practical/GCIH/John_VanHoogstr aten_GCIH.pdf
VPNs can be owned too so can "tursted" links to remote controled system. We had a (XP?) box deep inside our network get compromised with a virus that stayed in memory. It got there over a remote control system from another PC that was sometimes hooked to the net. The box deep inside the network then started hunting for other boxes to own, and it found a NT 4 server that could make outbound connections to the net and it set up a nice little email proxy. Lucky for me, my test network isn't as open as it appeared and my freebsd box clampled down on the outbound smtp traffic. A few new rules later (to let the SMTP traffic appear to go out) and the NT box was trying to spam AOL as fast as it could.
There are some tricky things out there that will take advantage of "internal trust" so my new rule is no PC talks to anything else but its samba, proxy or email server. Windows PC's can't talk to any other Windows PC.
What I found outrageous is that they disconnected customers. Even though they knew there was a payment issue. Surely the first thing to do would have been to put all disconnections, late fees etc on hold until after you know what the situation is.
They didn't include the cost of alienating customers or destroying their own brand image in the post mortem. But then again it would be a breath of fresh air to find a utility company that shows compassion or cares about its own image.
Yes, my only tool is a hammer. And you're starting to look like a nail.
Good quality routers, eg. HP2524 can be configured for 'port to port security'. So it is actually very easy to configure a system to prevent PCs from blabbing to each other.
If the PCs can only see the servers and the servers are all Linux or Mac boxen, then the system is remarkably robust.
Oh well, what the hell...
One day, in a galaxy...never mind...One day, internet connections won't even be possible with an exposed PC address. DSL/cable won't even be permitted to connect directly to a PC without DHCP/NAT interposed between. The sky will be clear of pollution. All people will clasp hands in a show that we are all from the same human family and we all have rights......
I'm getting loopy. It must be those packets I solicited from that guy downtown.
Denial of service by cache poisoning!
A 1W.html
I guess it's an example of the kind of attack suggested in http://www.securiteam.com/securityreviews/5AP0V0A
The general idea is that you attack an application by exploiting differences between its average performance and its worst-case performance.
Here's the reason they weren't: You have to hire REAL programmers to write a QNX program, your MCSE visual basic hacks can't drag and drop their way to an application on QNX.
Religion is a gateway psychosis. -- Dave Foley
The millions "lost" were a better educational lesson than the same "millions" spent on "continuing education training".
It did nothing to the files, just rebooted the computer, and waited for a precise date to attack Microsoft site. I wanted to participate to this huge distributed computing effort.
To do this, no patch was required: just open the control panel, clic on ugly icons, and go to the RPC panel. Here, I was surprised to see that the main annoying comportment of this worm was due to a default windows setting!
The default option on RPC failure is to "restart computer"! So I chose the "restart service" option for every failure and that worked fine! All my friends could now live with this worm and contribute to this distributed computing effort!
Default options in Windows are users' worst choices: restart the computer on every failure!! The most funny, an stupid, one is the default restart computer on... boot failure!
To Fix every virus under Windows, put a Knoppix CD in your box and then restart your computer for the last time.
9.5 for style, 0 for content.
Patching is dead. In a world where worms can spread faster than patches, patching is by definition a failed paradigm.
Of course, too much so-called security business depends on the model of adding layer after layer after layer (each layer another product that can be sold) to achieve "security". Whereas security (without quotation marks) is often reached by reducing rather than increasing complexity.
My bet is 18 months or less before a worm uses some exploit in an anti-virus or anti-worm software to propagate.
Assorted stuff I do sometimes: Lemuria.org
We got hit by Nachi/Welchia at the end of August 2003 while I was on holiday with my daughter.
I came back to work to find the place in chaos (the volume of traffic that critter produced on our network was astounding).
I knocked up a KiXtart script which, when run remotely with Administrator credentials using Sysinternals.com's PSExec detected the presence of the worm, killed the process if it was running, ran McAfee's Stinger and patched the workstation.
A modifed version of that script which detects over 100 common viruses is now run on every workstation when the users log in.
In my experience, there's a residual 2 to 3 percent of workstations which, for a variety of reasons, refuse to be patched remotely (usually no ADMIN$ share, sometimes in need of a service pack).
Every month I use the same techniques to push out critical patches to our 2000+ desktop PCs.
It's amazing what you can do with free software.
How bad would it be for the router to be tracking state on EVERY packet for EVERY internal customer?
An alternative would be to go stateless, and just block incoming SYN packets. That would leave UDP open. How big an exposure would that be, or how big a burden would it be to go pseudo-stateful on UDP, blocking incoming SYN on TCP?
But then again, I don't want to solve ISP problems like this, because I'd like to have remote access to MY systems at home.
The living have better things to do than to continue hating the dead.
my isp (small mom and pop outfit) is also a whitebox shop and has a big sign out front that says "we will fix your viruses". I think they like they can make a nice chunk of change off of relatively simple repairs, it's a steady business model. AFAIK talking to the guy who runs it, I'm the only linux user he has. Not saying this is true for all ISPs, but it's like "you" as joe homeuser getting them to do an oil change and tuneup and tire rotation for these shops, and most of them I have been in charge a pretty snazzy rate for de infesting machines and applying patches-all things the owners of the PCFs could do themselves, but most users choose to remain ignorant it appears,and don't make the effort, so the fixit repair shops take advantage of that, at least the first few times the users get nailed. Say 50$ or something a pop to have your box cleaned, it adds up. I imagine a lot of /. readers here make some nice loot off of windows insecurities and viruses, especially the ones who get hired to run networks or who get called in to fix stuff. No problems and everything running smooth = much less money made in *some* cases. I know that's a bit cyncical, but I bet it's true.
I think after that, nearly every Joe 6-pack finally realized that the thing in his "Start Menu" called "Windows Update" was something to use often. I have a friend thats an economics major. Very intelligent. In terms of calculas knowledge he probally knows more than anyone here without a master in CS. or a BA in pure math.
I had to tell him how to hook up his speakers to his computer. He had a simple 3 speaker system. He never owned a non USB keyboard so when he saw the PS/2 looking connector that was supposed to connet his right speaker to his subwoofer he paniced and IMed me.
Its not a matter of creating an idiot proof system. The users aren't idiots, they just don't get it.
--- Justin Dearing http://www.justaprogrammer.net/ We're just programmers.