Slashdot Mirror
New Worm Installs Sniffer
fmorgan writes "Netcraft just posted a note saying that a new worm installs a network sniffer in the infected computers." When I read these things it kind of makes me wonder why it took this long. Update: 09/13 22:47 GMT by T :
More innovation: Ant writes "The Register has a story about a piece of malware that 'talks' to victims. The Amus email worm uses Windows Speech Engine (which is built-in to Windows XP) to deliver a curious message to infected users.
The message reads: "How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule." ("Gule. Gule" is Turkish for "Bye. Bye". "Hamsi" is a small fish, like an anchovy, found in the Black Sea).
F-Secure has a copy of the sound file generated by the message."
How much longer before worms use their own TCP/IP stack? Wouldn't much suprise me, and might be beneficial for getting around firewalls. Might be a cool little project to make a zoo virus that does it.
Disconnect and self-destruct, one bullet at a time.
The newest MyDoom variant has the author asking for a job...
http://www.vnunet.com/news/1158043
The arnus worm speaks to infected users.
I don't know if I should laugh or cry. I just know I'm getting calls in the next few days because someone's computer says "How are you...".
2. I love the fact that this worm drops itself as BLING.EXE
3. This worm uses carnivore network sniffer and checks for the following strings
As Taco said, I'm surprised it's taken this long. Considering it uses 5 patched vulnerabilities I'd say you deserve what you get in this case.
4. This is particularly... clever? It does all kinds of things that I would put in as feature requests for the perfect worm
- It has 6 paths of infection: 5 vulnerabilities (as above) plus open shares
- It attempts to steal CD keys for some games.
- It installs a network sniffer
- It has an interface with 26 commands that the bad guys can use on an 0wned box
- It can log keystrokes
It doesn't destory anything all by itself, although it probably crashes some boxen through the exploits (was that just Sasser, or is that part of the LSASS flaw?) It still sucks, but it's just an expected evolution.I'm still waiting for the really bad one...
for the "INDUCEd PATRIOT" worm that detects P2P traffic and then promptly shuts down the computer.
"Me fail English, that's unpossible." --Ralphie
This one talks to the infectee through Windows speech interface. Nice!
Life is the leading cause of death in America.
Each other, like dogs at one another's butts. Inside of a week that's all that's going to be out there, and the worms will just be bumping into one another.
BLING BLING. Meet the architecture that's changing everything.
Most networks are switched these days, making this pointless. Why not install a keylogger???
Then the evil person doesnt have to deal with all the encryption mumbo-jumbo.
Pluralitas non est ponenda sine neccesitate
......ran windows update on all infected machines? Would people get pissed?
-Randy
How does Windows XP SP2 Data Execution Prevention handle this? or does it? (sounds like all those buffer overrun/overflow exploits should be stopped)
Not that I'm against encryption or anything. But it won't necessarily stop your passwords from being stolen.
I've been telling my old 'customers' that I'm retired. I then tell them that I will give them support for free for life if they buy a Mac.
This is usually met with, 'Wha? Really?"
Yup. I'm enjoying the stories of crazy Windows happenings, virus mystery, and constant crashing (Yeah, XP is ok, but not when you have 127 viruses, trojans, spyware and keyloggers all vying for a clock cycle and outgoing port.)
And I'm especially loving not working on Windows boxes.
And regarding another thing, how come so many services require a certificate (such as SSL with email, imap, pop, etc) rather than auto-negotiating it like SSH does?
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
This is strange - I found a bling.exe on a Windows machine at work a while ago, as it was spewwing out 445 if I remember rightly - several weeks. I searched for info on it, and I didn't find anything, which I thought was strange.
I think I must have got hit by an early-adopter version.
Get your own free personal location tracker
Switches are all well and good, but you forget about cable modems. While downstream traffic is only sent to the modem, all upstream traffic using QAM encoding techniques is a shared medium, so a sniffer on that wire could get some interesting traffic.
Packet sniffers are not a good thing to have just running, but an auto-propogating one is even worse, and should not be taken lightly.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
And it's the same with worms. Rather than hand-coding them in assembly to get them in under 1000 bytes (or whatever) they can now be developed with good tools, useful libraries, and they can have all kinds of extra functionality built in. So expect worms with more features as we go along.
It's time to really start thinking about security-by-design. VM systems like Java, or capability-based systems like EROS are the way we are going to finally squish these worms. I'm so tired of helping relatives with anti-virus software. There shouldn't be anti-virus software. Operating systems shouldn't allow viruses and worms to exist. Security problems like this are not an inherent part of software.
This reminds me, I'm in the process of building a new pc and want to get the opinion of the shack collective on what is the best antivirus software.
I've looked everywhere, and TrendMicro's PC-Cillin, McAfee AV, and Norton AV all seem to rank high. Is any one of these really better than the others? Have I left the best one off my list?
Obviously finding virii is paramount, but a low footprint is also welcome.
Thanks!
Go here for teh [sic] funny.
Banking info is going to be using SSL. Sniffing SSL traffic isn't going to get you any interesting data. It would be better to use an old fashion key logger.
The most interesting part of this virus is the ability to easily intercept IM and e-mail conversations. I think it's killer app would be identity theft rather than credit card or banking fraud.
I've always wondered about that kind of thing... most especially, what's to stop the antivirus companies from writing their own virii?
Not that they'd need to do it at this point, but talk about your perpetual business model...
Even though this has legal implication, I think that people would be happy to know that their computer has been infected, and how to fix it.
[blue] - The Ministry of Information approved this message...
I had the same thought about spam-control companies. They have no interest in actually stopping spam because that would put them out of business.
Smoking is an expensive, slow, and unreliable method of suicide.
Still I'd be interested to know if SP2's Data Execution Prevention would have stopped this if the holes hadn't been patched.
Doing proactive fixes like this should be better the reatively fixing holes as they appear so it would be interesting to know how well this latest feature works.
Also I never really understood why there are always so many buffer overrun problems in software, I know it's a bit more complex then
while(readdata() && bufferlimit--){}
but still...
Imagine the publicity if an anti-virus software vendor were able to prove that a virus was produced by one of its competitors.
I used to use an encryption program that attempted to get around keystroke loggers...by remapping your keyboard when you were in the password box. A keystroke logger would see gobbeltygook...granted, it was a simple cipher, but since there isn't enough information in a single 16 character password to generate a key for such a cipher, it was still pretty secure.
I stopped using it when I got my mac, because built in AES-128 is just easier than mucking about with encrypted disk drivers and suchlike. I don't have that much to keep secure anyway...just some receipts, beer recipes and incriminating photos
Hey freaks: now you're ju
That would be the biggest risk, to be sure. But tracking down the source of a virus is quite difficult, and that's when it's the work of a single (or just a few) hacker(s). Imagine if some corporate muscle were applied in burying the source. I'd worry about whistleblowers, too. Were I an ethically challenged antivirus company CEO, that is.
AVG if you're cheap, or NOD32 for some dollars. Both are very low on footprint, and NOD32 has one of the best detection rates around. NOD also has one of the only interfaces that doesn't suck. *cough* kaspersky *cough*
:-)
McAfee is slow, and Norton is equally as bad unless you get the corporate edition. Of course, most of the AV companies provide trial versions, so be sure to give a bunch of them a try (NOT all at once) and pick whichever YOU believe is the best one.
nVIR on the early Macintoshes would use the Macintalk speech engine to say "Don't Panic". One source says nVIR got discovered in January 1987.
Perhaps organized crime could benefit from this, but in most cases electronic abuses when it comes to fraud/extortion etc seem to face a harsher penalty. I'm not too worried about criminals as much as I am a more driven and dedicated set of humanity.
I would fear fanatics. Punishment is not necessarily even considered by a driven individual. If there was a file corruption worm on the scale of Codered/Blaster the cost could escalate from the tens of Millions to the Billions quickly. Anarchists, extremists, and environmentalists often try to destroy property to equate a cash cost for organizations for their wrongdoings.
Heh, picture the credit agencies all exploding at the end of fight club.
Duh! They made it themselves of course!
I know that was probably meant to be funny but really it's a little disturbing because it seems like it's actually the case.
Very frequently the major players in the Antivirus market are either having the viruses "before they show up in the wild" or less than "hours" before people start reporting initial infection.
It doesn't take a paranoid individual to conclude the obvious.
"Everything you know is wrong. (And stupid.)"
Moderation Totals: Wrong=2, Stupid=3, Total=5.