Slashdot Mirror
New IM Worm On The Loose
elfarto writes "Techweb is
reporting that a new worm that spreads via Microsoft's instant messaging client
began badgering users Monday, several security firms said.
Dubbed Funner, the worm propagates by sending itself to all the contacts listed
in the user's copy of MSN Messenger, Microsoft's IM client.
There is an analysis on
Symantec Security Response Site; apparently the worm tries to download stuff
from www.78p.com and adds entries to the hosts
file pointing to more that 400 Chinese porn sites. The worm also sends itself to
the whole contact list as funny.exe so it requires the user interaction to
actually execute it. "
Had to be the first - I enjoyed the Screen Savers segment!
How is this a bad thing?
Geez, who cares. If a dumbass like me thinks that would be ridiculous, I'm sure everyone else in the world would think so too.
Just like everyone urged their friends and family to switch from IE to Firefox, now could be the time to recommend gaim to them in place of their regular IM client. Except, maybe, those who like chinese porn.
~
~
~
-- INSERT --
Time to cash in!
Is this why MSN messenger seems to have been down for about 12 of the last 24 hours?
Fourty-two million users worldwide verses far more for AIM. The impact shouldn't be too big, although one has to wonder why people blindly accept and run files in the first place. It boggles the mind.
US businesses that currently accept chip and PIN/signature
Guess my workday tomorrow has been planned out in advance. (I have dumb users.)
I'm dissapointed that MS hasn't done a big enough push to get people accustomed to running as a limited user, versus running as Administrator all the time. This is the main reason why linux/OSX are more 'secure' -- programs like these would execute as user, not as root, given the OS's both discourage people from runnin their every day tasks as root. If the users who get this funny.exe were not running as Administrator, their system wouldn't get infected. The app may be able to propagate itself, but a quick log off/log on would kill the virus.
I'm not up to speed on the terminology (yes, I've been living under a rock, and it's very cozy under here). Is it really a "worm" if it requires the user to execute it?
-]Phreak Out[-
"..and adds entries to the hosts file pointing to more that 400 Chinese porn sites"
First good reason i hear to switch to Windows.
host www.78p.com
www.78p.com has address 1.10.5.89
Lawyers, MBA's, RIAA? A jedi fears not these things!
Wow. We've gone from viruses pretending to be porn in order to do funny things to your computer to viruses pretending to be something funny that give you porn.
And they don't run as Admin anyway, so the worm couldn't even infect them if they did click it...
And Microsoft will surely release a prompt fix to address this issue...
So I don't see what the problem is here. :-)
Ohhhh... I see the plan... we slashdot 78p.com, thus limiting the 'worm's damage!
Good thinking, guys!
Just doing my part. ;)
It should be 'more fun', not 'funner'.
------------------
Rate free iPod offers: RateTheOffers.com
(Flat screens and Desktop PCs too)
Well, if you are running as root, well, the answer to your question is EVERY OS. Run your desktop as root, and it'd take me 5 minutes to write an executable that will hose your whole system.
The fact is, Windows has a solid, well implemented, priviledge system. The second fact is that they gave this up in favor of app compatiblity (crappy programs that expect to write to the windows directory just to run, versus to user directories) and ease of use. This is biting them in the ass, and they are working on getting people away from running as Administrators. Just not as heavy a push as I'd like.
Disclaimer: I work for a company, but I don't speak for them.
Other than that, not much info there, except it points out the obvious, that osX users are not affected, since this appears to be a Visual Basic bug.
If nothing else, the listing of some 940-odd asian porn sites on the Symantec page will be useful to someone...
I reloaded twice before seeing it hit the frontpage. Now mind you I have a subscription so I'm counting before it goes "live." -Yazz
Technically it is a virus and not a worm. Virii (physical and electronic) cannot spread by themselves; they need someone else to help them spread. Worms, on the other hand, can spread and multiply without anyone else's help.
Since this virus requires human interaction, it is a virus and not a worm.
I'm watching the show too... "cache" is a bit of a misnomer, I mean, pretty much every chunk of data in Slash is cached, but basically we just post stories n minutes ahead of time. During that time (for n < 20) they are visible to subscribers -- and then they go live for the rest of the world whenever we've scheduled them to.
Is the worm author most benovelant guy or what ?
China rewards porn snitches
1)run windows 2)get infected 3)receive list and fwd to the chineese authority 4)profit!!
Python script to convert photos into "artsy" portraits: http://p2pbridge.sf.net/pyPortrait/
The problem with Windows and these worms is that you do not explicitly have to give execute permission to the file in question. It's just recognized as an '.exe' file by Windows and treated as an executable.
The kind of people who would execute this file, are the same kind of people who wouldn't know how to give some file execute permissions if they were running a Unix-based workstation (probably even OS X).
Does any of you know if this worm might be the cause for the sporadic outage in MSN messenger service yesterday and today? At first I thought it was my Trillian (yay!) client being blocked, MSN's own client was unable to log in as well.
Almost all of my contact list confirmed having the same problem.
No sig
The show will air in rerun tomorrow at 12:00pm EDT/9:00am PDT. (They eliminated the midnight eastern run)
Keep in mind that the show is a shadow of what it used to be. The new host (Alex) isn't near as knowledgable as the host he replaced, though he does seem to be getting better. Also, they put tons of commercial plugs into the show now in the name of "give-a-ways." Ever since Comcast bought it, cancelled half the shows, then integrated TechTV into G4, the show hasn't been the same, though it is getting better. They are also in deperate need for more intelligent callers with questions. So call an hour before the show at about 6pm ET/3pm PT to 1-800-839-7880 with your insightful questions.
With enough publicity the average Joe User will learn safe IMing habits...
The average Joe won't learn safe computing habits until Dell, Gateway, HP, and Compaq start issuing keyboards and mice complete with 10,000 volt negative reinforcement "bad user, no treat" features. People with no computer knowledge are the last to admit their ignorance caused their problems.
"pointing to more that 400 Chinese porn sites"
How do they know that all 400 are porn sites? Did someone actually sit down and visit every one?
Also, are they hiring?
But i would NEVER open something they sent me called funny.exe. I know about their senses of humor.
All Troll + "offtopic" mods are meta moderated as "Unfair", because you abused the system.
What type of file is that anyway, exe file.
A worm that spreads via IM? Or a worm that spreads via stupid dumb-ass users who don't know better than to run a .exe they weren't expecting to receive?
One day, with a bit of luck, people opening attachments/files/emails/whatever like this will be considered much the same as people eating strange pieces of food that they find in the street.
For those in the support side of the field, remember that as long as there are stupid people (and there always will be) security vulnerabilities will always be a poor second cousin to humans. The bulk of your support calls won't come from clever little worms that capitalise on obscure security flaws in a product, they'll come as a result of idiots thinking that "nakedwoman.exe" is actually something they want to see.
Yet another reason we should embed cattle-prods into keyboards... "wow, some stranger sent me some naughty pictures of herself! Pity they're archived, I'll just double-click and let them extract themsel *zaaaaaaaap!!!*"
Knowing that the China gov is kidna tight on pron sites recently, this is a nice way to spread. :)
However it would be even better if the worm would simply redirect those some 400 Chinese pron sites to 127.0.0.1.
Then it would be a SP instead, except for the spreading part.
Yep, I guess that's 1 less vulnerability I have for Windows now, since I uninstalled MSN Messenger. So here's my prediction: Since microsoft's solution to all of their vulnerabilities, they'll just send out a security update disabling their messenger. Little will they know that they're disabling their own product though, because honestly, who can keep track of all of the programs MS makes, especially the ones that have Microsoft in their names?
Linux isn't the only desktop alternative
FreeBSD
OpenBSD
NetBSD
DragonFlyBSD
Music is everybody's possession.
It's only publishers who think that people own it.
Fuck Beta
~John Lenno
Methinks this might have something to do with the recent ban on porn in China...
It's an internal IP address, ie to be found on a LAN behind your firewall to the big bad world outside.
When I was still doing phone cable modem support (I'm the network engineer now) I spoke with more than one person that said they opened the attachement in their email because they wanted to see if it a was a virus. This thing will spread like that goatse.cx guys ass.
First of all, a "user friendly" program for getting a file off the net would certainly turn on the execute bit if it thought the resulting file should have it. So I don't think it's going to offer any protection as long as doofuses are writing the software.
Second, this "feature" is not there for any high-brow security reason. Back when Unix was first written reading disks was *very* slow. And the path tended to contain "." and people tended to pile many files into the current directory. When you typed "blah" at the shell it had to quickly locate the executable called "blah" that was first in the path. The only efficient way to do this was to read all the directories in the path and store the results in memory so you could jump straight to the file rather than read every directory before it in the path (the "rehash" command would re-read the directories if you changed them). Memory was also very expensive, so it was best to get that list as small as possible by eliminating all the files that were not executable. The only fast way to do this was to add a bit to the inode (which had to be checked for access permissions anyway), reading the first block of the file was out of the question. So that is why the execute bit is there, not for any security reason. If it was for a security reason you would need some special permission to turn it on that was different than creation permission.
1.0.0.0/8 is actually reserved by IANA for no particular use (so I guess you're simply not supposed to use those addresses, indeed also not for private networks).
Donate free food here
Was that when some attention-starved sluts starting showing off their boobs...
You sound like you think this is a bad thing.
Anyway, it's not like IM is a professional tool, it started off as a quick way to send little messages and grew. Think about the main user base teenage kids, folks in their early twenties and geeks. Of course it's a reasonable guess to say 50% of that user base is male. So that's geeky males, student males or males going through hormone hell. Of course it became a requsitie when breasts appeared.