Slashdot Mirror

← Back to Stories (view on slashdot.org)

Internet Security Warnings

Posted by CmdrTaco on from the we-have-a-code-yellow-people-this-is-not-a-drill-omg-freak-out dept.

Juha-Matti Laurio writes "Internet Storm Center's Diary reported today: Due to a number of very well working Windows exploits for this weeks patch set, and the zero-day Veritas exploit, we decided to turn the Infocon to yellow. The following Internet Threat Level meters are at level 2/4 because of Windows Plug and Play vulnerability's several exploit codes too: Symantec ThreatCon as a part of global DeepSight Threat Management System saying Increased alertness and Internet Security Systems X-Force with Increased vigilance at AlertCon."

63 of 296 comments (clear)

  1. It hate to say it... by confusion · · Score: 5, Funny

    But it's been a while since we've had a good/effective worm.

    Jerry
    http://www.cyvin.org/

    1. Re:It hate to say it... by ciroknight · · Score: 4, Insightful

      Eh, just wait for Vista.

      Oh, but of course that's a troll, so I've gotta say something constructive.. Microsoft's been doing a lot better with security now that everyone on earth is making a buck off of "securing" Windows. As more and more security-related technologies such as antivirus, firewall and antispyware make their way into Windows, however, lots of these companies will die or be bought by MS, and they'll be held a lot more responsible for security, and thus, when Vista rolls around, security is likely to be absymal again. Maybe it'll be just what's needed for a huge evacuation from the MS dependency...

      Here's for hoping..

      --
      "Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
    2. Re:It hate to say it... by confusion · · Score: 4, Interesting

      It means that I'm not looking forward to another worm, but I'm realizing that the circumstances are right for one to happen.

      That's what I meant.

      Jerry
      http://www.cyvin.org/

    3. Re:It hate to say it... by ciroknight · · Score: 5, Interesting

      No drugs here, but then again, my argument does make sense; Security left in the hands of Microsoft is security that should be questioned.

      I mean just look at the terrificly terrible job they've done with the Xbox, or the bang up job they've done to date with patching well known security issues in Windows. Their attempts at security seem half-assed at best, as most of the more critical bugs are found by companies outside of Microsoft, and as Microsoft acquires more of these companies, I doubt if their advisories will ever make it out the front door.

      Thus, I believe when Vista comes out, there will be a million new exploits, just as were delivered with Windows XP when it came out. And as most of these exploits will be retroactive (as the NT platform is known for carrying bugs for years without them being detectable), WinXP and 2000 will be at risk as well. It's only an opinion, but it's a well thought out one. At this point it's all speculation.

      --
      "Victory means exit strategy, and it's important for the President to explain to us what the exit strategy is." G.W.Bush
    4. Re:It hate to say it... by tomhudson · · Score: 4, Insightful
      Maybe it'll be just what's needed for a huge evacuation from the MS dependency...
      My "threat meter" isn't even plugged in - but then again, I'm not running Windows.

      What are the chances of Microsoft making a secure anti-virus or a secure anything? Remember their last "security push?" 1 month of "emphasis on security" isn't a magic wand to fix 20 years of code; nor will it change the underlying corporate culture. It was all for the media. And they ate it up, being too lazy (or too addicted to free meals - see the story on groklaw about that) to bother telling the truth. http://www.groklaw.net/article.php?story=200508121 9304040 or, for those too lazy to click, Microsoft is offering free pizza:

      Speaking of FUD, I have a copy of the email Microsoft sent out to journalists inviting them to lunch.

      Here's a snip:

      Why spend 10 bucks on a burger at Moscone when you can have a slice on Microsoft? Come join the Microsoft Embedded group at Moscone Pizza (across the street from the Moscone Center) on Tuesday, August 9 from 1pm - 4pm for lunch and discussion on the Windows Embedded operating systems. Product managers Mike Hall and Dan Javnozon will be available to provide demos of Windows Embedded developer tools and answer questions about Microsoft's strengths in the embedded space.

      For instance, did you know... .

      - Microsoft embraces shared source, and makes more than 2.5 million lines of source code broadly available to customers, partners, developers, governments, academicians and other interested individuals. In fact, more than 275,000 developers have downloaded Windows CE Shared Source

      - Microsoft offers a shared success model that translates to low up-front investments for device makers, in addition to faster time-to-market. The Windowsembedded motto? "We don't make money until you do."

      - Windows Embedded designs, on average, get to market 43% faster, on average, than embedded Linux designs - 14.3 months with embedded Linux vs.. 8.1 months with embedded Windows; 14.2 engineers with embedded Linux vs.. 7.9 engineers with embedded Windows (Embedded Market Forecasters, November 2003)

      - Windows Embedded designs, on average, cost 75% less to bring to market than embedded Linux designs. (Embedded Market Forecasters, November 2003)

      I'll be in touch to gauge your interest in setting up a one-on-one briefing with Mike or Dan during the lunch.

      A little nauseating, don't you think (love the carrot -- a one-on-one -- which is hard for journalists to turn down), to set up camp across the street and trash talk Linux at LinuxWorld?

      Burns also mentions that the Microsoft Linux Lab session was well attended. I believe that falls into the category of keep your friends close, but your enemies closer. If I had been there, I'd have attended that session too, even though I would prefer that Microsoft never be given a platform at any FOSS conference, personally. Shared source is not Open Source even, and it for sure isn't Free Software, and don't ever kid yourself about it. It's Brand X, and there is no reason to settle for so little.
      Anyone guillible enough to believe there really is such a thing as a free lunch deserves what they get.
    5. Re:It hate to say it... by advocate_one · · Score: 4, Informative

      the final two paragraphs you quoted are not from the email, but are PJ's comments on the matter... please give proper attribution NEXT TIME... for our regular readers, here's the link to the proper article he quoted from...

      --
      Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
  2. How does this affect my PowerBook? by Anonymous Coward · · Score: 2, Funny

    Oh, I guess it doesn't, ror.

    1. Re:How does this affect my PowerBook? by buro9 · · Score: 4, Insightful

      Erm, it DOES affect your powerbook.

      IIRC we're all plugged into the same internet. A potentially mid to high level set of Windows exploits raises the *Internet* Storm Center's alert level to yellow.

      This should tell you something. Ideally it should tell you that when X million Windows boxes are exploited, that there will be a noticeable degradation of quality or service on the internet. That the resultant poor quality traffic and noise created by a large scale (poorly written) worm will degrade the connection your PowerBook is enjoying.

      Don't ever forget that we're all in the same boat, and it does little good to sit at the stern and laugh at the suckers at the bow as they dip gently under the water for the Nth time.

      Damn, I posted, and I had mod points to burn too.

  3. Another color-code system? by green+pizza · · Score: 5, Interesting

    Seems to me these color coded systems do more to confuse than they do good. Should I relax if we're at green? Should I be paranoid if we're at Red? Should I even care since I run UN*X rather than Windows? Every day there are at least a few new sploits. Every few weeks there's a sploit that affects me as a sysadmin and requires my attention to preserve the security of my servers and internet-attached LAN. Given this I still don't understand the value in these color coded alert systems. Yellow? What does that mean? Wake up an extra hour early to read the logs? The terrorists can attack just as easily if we're at green than if we are at red. I'm uncertain of the value in the announcements at the airport every 15 minutes to remind me that we're at yellow or orange.

    1. Re:Another color-code system? by confusion · · Score: 2, Informative

      To the security departments of companies the elevated levels mean that we have something new to pay attention to that we haven't been looking for before. Certainly being green doesn't mean that we can let our guards down.

      Applying these alert levels doesn't make any sense at the individual level, for the exact reason you gave.

      Jerry
      http://www.cyvin.org/

    2. Re:Another color-code system? by toddbu · · Score: 2, Insightful

      The current threat level is brown - meaning that I don't give a shit. Just patch your systems when the patches are available and you should be good to go. Your users are a much bigger threat than the new exploits based on vulnerabilities that have already been patched.

      --
      If you don't want crime to pay, let the government run it.
    3. Re:Another color-code system? by Ingolfke · · Score: 3, Funny

      Seems to me these color coded systems do more to confuse than they do good.

      I totally agree w/ you. We need more clear statements about what the problem is and what we should do about it... like this.

      Symantec ThreatCon as a part of global DeepSight Threat Management System saying Increased alertness and Internet Security Systems X-Force with Increased vigilance at AlertCon.

      LOLOMGWTFBBQ? At least with the colors you can say, oh well red is bad, and green is good... and so that's that. When AlertCons are X-Forced w/ 3 points of Increased Vigilence and 1 point of Vitality, whose to know what could happen or what arcane anti-sploit knowledge you should call upon.

    4. Re:Another color-code system? by saskboy · · Score: 2, Funny

      At least they didn't raise it to threat Level Fuschia, the level at which the gayness of Linus converts even the most hardened heterosexual to the likes of *nix programmer.

      I'm sorry, after seeing the lunacy of coloured threat levels hyped for decades, and the /. phenomenon of claming linux users are homosexuals, it only made sense that I combine the two into a semi-constructive joke to link the two cliches.

      --
      Saskboy's blog is good. 9 out of 10 dentists agree.
    5. Re:Another color-code system? by lgw · · Score: 3, Insightful

      I don't think the alert level has been below yellow since the system was invented, and I've never heard such a thing. There are occasionally announcements saying somehting to the effect of "we're being particularly vigilant right now", but I'm not sure that's tied to anything.

      You do get searching of vehicles at the airport entrance when the threat level is orange, however, or at least of vehicles with ferners in 'em.

      None of these color codes is intended to be useful to the common man - they're indicators for security professionals, in whatever field is relevent. The media can't go 3 days without a "crisis" however, so they're good for a scare on a slow news week. I'm not sure why people still pay attention to media hysteria, but apparantly it still gets ratings.

      --
      Socialism: a lie told by totalitarians and believed by fools.
    6. Re:Another color-code system? by briancurtin · · Score: 5, Funny

      threatcon? infocon? alertcon? "hey bob are you going to be at the meetingcon about threatcon at infocon in room z-force? theres an x-force alertcon for the internetcon."

      --
      My UID is a palindrome, that must be good for some type of prize.
  4. Windows Threat Assessment by joelparker · · Score: 5, Funny
    It would be cool to have a little app that reports the current Windows threat level.

    The app could download data automatically using IE and ActiveX, format the data using an Excel Macro, then email results to me using Outlook.

    Because I care about security.

    1. Re:Windows Threat Assessment by Anonymous Coward · · Score: 2, Funny

      Maybe clippy can get in on the action.

      "Hi, it looks like you're fucked!"

  5. Color for security level is great by Unsus · · Score: 5, Funny

    On related news, the US puts it's security level color at pink. Again, on related news, Bobby's mom chooses to wear an orange shirt. No need to actually read the security threat -- we have colors for that.

  6. Plug and Play vulnerabilities already known by Parallax+Blue · · Score: 2, Informative

    Correct me if I'm wrong but haven't there already been warnings about Plug and Play prior to this? I know at least one security website that had warnings about Plug and Play a long time ago, along with a handy utility to disable it. See below.

    http://grc.com/UnPnP/UnPnP.htm

    You'll notice this was circa December 2001, fully 4 years before these new exploits.

    1. Re:Plug and Play vulnerabilities already known by insecuritiez · · Score: 4, Informative

      That link refers to UPnP, Universal Plug and Play, a networking based technology for device discovery and configuration. The vulnerability concerning the ISC is a PnP vulnerability. Plug and Play is used for internal device discovery and configuration. The two are totally different. Microsoft, in a fit of brilliance though that exposing the internal PnP via RPC to the rest of the world was a good idea. As it turns out there is an unchecked buffer than with Windows 2000 machines in accessible via a NULL Session. In XP and 2003 the buffer requires a valid account or even and admin account to expose. The threat of a Windows 2000 based worm in the next few days is very real. All of you with XP and 2003 aren't in immediate worm danger.

    2. Re:Plug and Play vulnerabilities already known by homesteader · · Score: 2, Informative

      This is not an old exploit. It's quite fresh . . .

      August 9th Release, which is 4 days ago. Exploits were reported in the wild on Friday, 3 days after the release. There's also a remote exploit in the Spooler service, which is of course enabled by default on all Win2k/XP/2k3 machines. I approved this patch on Friday, hopefully Monday won't bring scores of hosed machines.

      Microsoft Security Bulletin MS05-039 (899588)
      http://go.microsoft.com/fwlink/?LinkId=48900/

  7. Alert level to Yellow by rossdee · · Score: 4, Funny


    "Are you sure, sir? It means changing the bulb...

  8. Netcraft Confirms It. by bmo · · Score: 5, Informative

    Windows is dying.

    Well, it's deathly ill, mostly. The average Windows end user is in a never ending battle against the baddies. They buy their systems at the Best Buy, bring them home, run for a couple of months, and then complain that they can't login.

    Then they call me, or someone like me. With disdain, I inform them that I'm wicked busy but I'll do it "this time".

    When I get my grubby hands on their machines, they're fubar. It's not for lack of trying either, because there are multiple Virus, Trojan, and Firewall apps, all fighting over the same machine, including the odd fake anti-trojanwares. You know the one's I'm talking about. We've all seen them. "Click here for a FREE security scan!" and then the machine gets YET another bit of evil.

    I simply don't know what to do anymore. I clean them up, set up security, knowing - just KNOWING that it's all in vain. Just yesterday, I got an "e-postcard" in the mail, and it was just an overt attempt at infection. There wasn't anything that would trip an AV or firewall in the mail, just an obfuscated link that actually pointed at a crypically named .exe. I know far too many people who are e-card addicts, and I am SURE they would have clicked.

    Toast. Totally goddamn toast. The fact that Windows programs have their execute bit as part of the filename is probably the worst thing ever to happen to an OS. One click, and yet another "svchost.exe" process. No lube, no kiss, no reach-around, just total PC anal rape.

    And without a total redesign of Windows or dumping the platform for Apple or Linux, Joe and Josephine User are SOL. Vista is going to be more of the same, as it's going to be simply XP SP3 with more chrome.

    Ah well.

    If anyone knows anything about a0190313376667.gif.exe, mail me at my alias AT Entropy dawt TMOK dawt com. There's hardly anything on the 'net about it except some German blogs.

    --
    BMO

    1. Re:Netcraft Confirms It. by SnprBoB86 · · Score: 2

      I've actually found that post-SP2 the number of people calling me with issues has substantially dropped.

      Although. it might have something to do with my new payment policy: $40/hr or sexual favors of equal or greater value.

      --
      http://brandonbloom.name
    2. Re:Netcraft Confirms It. by sound+vision · · Score: 4, Interesting

      Windows will never die, not unless something major happens like Microsoft shuts down... not likely.

      It's just that people don't care enough, or don't know enough. "Here's a Mandrake install disc, have fun." Maybe they'll mess with it for a few minutes, but then the killer question comes: "How do I put my kids' <i>Game X</i> on it?" or "How do I use my camera?" I've tried to convert several people to Linux, and there's <i>always</i> a killer question. Some site needs Active X, or some shit company doesn't make Linux drivers for their hardware. If nothing else, "This doesn't look like Excel. How do I put Windows back on?"

      I'm sure you've all read those jokes in the respectable upstanding citizen! magazines like Reader's Digest, about how computers are unreliable. Everyone I talk to has this conception that computers are inherently unreliable machines that will always break. But when they say computers, they really mean Windows. They don't know the difference between a monitor and a modem, they just want to push the little blue button and have their email pop up... viruses and all.

      In summary, Windows will be the #1 OS until a significant proportion of Wal Mart computers come with an alternative OS (not likely unless MS looses their grip) or people get smarter (not likely period).

    3. Re:Netcraft Confirms It. by bmo · · Score: 5, Informative

      I think you misunderstand....

      I am _not_ a professional admin who has a network of machines to maintain or easy access to the machines I fix or the authority to command people to do as I want. I'm "the guy that fixes stuff" for his friends/enemies.

      Go 'round every couple of months requesting that everyone send me their machines for updating the OS? Are you out of your mind? Ghost? Are you out of your mind? These are all individual machines, not something cookie-cutter that I could administer in a sane way.

      Yes, I would love to standardize all these machines with the same Windows distribution. I would love to partition the drives so that the OS resides on a separate partition from the user data, and yet another partition for the extra installed programs. That would be sane. But that would mean I would have to furnish boxed copies of XP at the retail price myself, to be sold to the "customers" so I can do it up right.

      "But I have Windows! Why do I have to buy another?"

      Things were so much simpler when PCs came with full OS licenses and a full set of disks. Now, the only choice is to either manually disinfect for HOURS without disturbing too much of the installation, or format and use the "recovery" cd, and the user is fucked for whatever was on the machine if it was never backed up.

      It's fucking maddening is what it is.

      The day that Microsoft stopped the likes of Dell and HP from furnishing OEM CDs spelled doom for the customer who wanted to have a multiple partition setup. Now if you want that, you need a purchase a full Windows kit that costs 200 bux for XP Home.

      --
      BMO

    4. Re:Netcraft Confirms It. by GroundWire · · Score: 2, Insightful

      Generally speaking, not getting media is a choice you make when ordering the machine (at least in the case of Dell). I know some companies don't offer you the choice, and maybe that's one of the OTHER reasons to never buy from Dell as a "Home" customer..

      Sometimes it doesn't even save you money on your machine, but we all know it increases their margins a little bit - which adds up.

      I do happen to do professional tech work, and since I also run into the "what package of documentation and CDs?" problem - I just keep copies of the OEM CDs, as well as the retail versions.. Everytime I see a new slipstreamed version come through, it gets imaged..

      That way - I can use my loaner media, and their CD key (which is supposed to be attached to the machine).. There is nothing illegal about doing that, since they obviously have a license to be running it.

      - Joel

    5. Re:Netcraft Confirms It. by Emporerx · · Score: 2, Informative

      Hi,

      If I'm not mistaken, that particular executable file is probably one of many created by a program called WinPup(WinPup32?). When I used windows I noticed spikes in CPU usage at about five second intervals. I called up the mighty(HA) task manager and took a look at the processes. Randomly named .exe's popped up every five seconds.

      Do a google on WinPup. It will involve(if I remember correctly) deleting the winpup file from /system32 and editing the registry. Best in safe mode if I'm right. This can be tricky because the registry entry also changes names with the random executables so you must be fast(even in safe mode). It is a bitch. Probably one of the harder ones I had to remove.

      I hope this helps you bmo. Let us know.

      As for the new security threats.. Bah. I run linux, very happily, now.

    6. Re:Netcraft Confirms It. by SolidGround · · Score: 2, Insightful

      I think you just have the wrong approach. If you don't reeducate the people who's computer you're trying to salvage then you're only punishing yourself since 99% of the time they themselves caused the infections and as soon as you turn your back they'll reinstall that cute "dancing pigs" screensaver that comes with 10 trojans.

      It's easy to blame Windows/Microsoft/whoever but if you're honest you know that most of what's there is there because of their doing.

      Get them a software firewall, or if you can convince them of the value, a home broadband router will go a long way.
      Then sit them down and teach them how to install programs using alternate credentials so they can run under a LUA all the time. That takes care of most of it.
      Then convince them not to blindly click or answer 'Yes' to everything that comes their way (by far the hardest).

      I only had a few who didn't want to take the trouble and for those I simply told them they were on their own from then on. Everyone else has been clean ever since saving me countless hours regardless of whether they went with Firefox or preferred to stick to IE.

      I haven't gotten to the point where they'll all update Windows or some other program when I mail them saying they need to but even so they manage to stay safe still.

    7. Re:Netcraft Confirms It. by pmdata · · Score: 2, Informative

      Great post. Part of the problem is just like you say, Windows is dead and should be retired as soon as possible. The other issue is that we are a reactionary society, only "fixing" the problems that become too out of control or after a monsterous disaster. This easily applies to information security Couple that with the fact that everything today has to be easy and intantaneous, and you've got real problems.

  9. Yellow is pretty rare.. by Dynamoo · · Score: 4, Insightful
    A Yellow alert at the ISC is pretty rare, and it has been several months at least since the last one. Generally even a worm outbreak such as Blaster only elevates the threat level to Yellow. Orange is even rarer.. I think that maybe has happened just a couple of times with Code Red and Slammer. There has never been a Red alert level.

    In other words.. the alert level tends to stay stubbornly at green unless there is a real issue - the ISC is usually extremely conservative about threat assessments. If they've raised the alert level as a precaution then it's definitely time to take notice.

    As for me.. I check the ISC at least once every day to see what emergent threat are out there. There are also a number of tools you can use such as a small Windows app that can help to inform you when the threat level changes.

    It's worth having these tools - when Sasser came out I'm pretty sure they saved my backside.. because in that case the short amount of time between the vulnerability being announced and the worm coming out was so short that many organisations hadn't even started patching. Thanks to the ISC we managed to get almost everything secured in a day, so when the inevitable rogue laptop user physically brought a worm infected machine into the office, then we managed to contain the outbreak effectively.

    --
    Never email donotemail@WeAreSpammers.com
    1. Re:Yellow is pretty rare.. by Anonymous Coward · · Score: 5, Funny
      There has never been a Red alert level.

      Red alert sould be used at each Windows release.
    2. Re:Yellow is pretty rare.. by lamj · · Score: 5, Informative

      One happy customer :-)

      You are correct. We want the infocon to stay at green most of the time and only raise it when necessary. Think about this, if we keep it at yellow all the time, it would eventually lower people's perception of the current threat. Trust me, we do try very hard to only raise it when necessary and appropriately.

      Disclaimer: I am one of the ISC guys.

  10. How long? by ErichTheWebGuy · · Score: 3, Insightful

    How long until that "uber-virus/trojan/worm" comes out that deletes the hard disk contents of millions of PCs? On one hand, that would be a great day, because then people would truly pay attention to security and Microsoft would get the attention it deserves.

    On the other hand, it would be bad for obvious reasons. But, IMO, it's only a matter of time. What color will the Infocon be then?

    --
    bash: rtfm: command not found
  11. I'm no grammar Nazi, but by grcumb · · Score: 3, Funny

    "Symantec ThreatCon as a part of global DeepSight Threat Management System saying Increased alertness and Internet Security Systems X-Force with Increased vigilance at AlertCon."

    What. The. Fuck.

    --
    Crumb's Corollary: Never bring a knife to a bun fight.
  12. Alert Level Red? by g-san · · Score: 2, Interesting

    So if the internet should come crashing down, as in the infocon red situation, what is the use of a little hyperlinked gif to their website, a gDesklet , or a systray icon?

  13. Re:The waiting game? by jericho4.0 · · Score: 2, Funny

    Some of you people might be, but I'm just waiting for my gentoo box to compile.

    --
    "A language that doesn't affect the way you think about programming, is not worth knowing" - Alan Perlis
  14. American paranoia at its best by HishamMuhammad · · Score: 4, Insightful

    Isn't "color-coded threat levels" an excessively paranoid way to describe what we've always known as outdated, buggy software? This kind of representation paints a very fake picture -- as if those "threats" are a given and that all we can do is "try to protect ourselves", when in fact what we're dealing with is simply the result of flawed operating system design. These threats are only symptoms, not the root of the problem. I wonder who benefits from making people focus on the former instead of the latter.

    --
    The filesystem is the package manager
  15. Re:The waiting game? by jerw134 · · Score: 3, Informative

    The patches for Windows are already out: click

  16. Infocon goes to yellow... by zymurgy_cat · · Score: 3, Funny

    ...and colorblind admins go on without a care in the world....

    --
    -- Fugacity: Confusing chemists since 1908
  17. Re:And it doesn't help that many legit Windows use by jerw134 · · Score: 2, Informative

    Critical updates can still be obtained without passing WGA.

  18. All Hands To Battlestations... by CoyoteGuy · · Score: 5, Funny

    Data: Captain.. Sensors are picking up localized pockets of Upnp activity in subspace transmissions.

    Picard: Geordi, can we triangulate the originating source?

    Geordi: Yes sir, it's coming from a planetary system 15 light years from our present location. Long range sensors indicate it is...

    Picard: Yes, I know... Microsoft...

    Picard: All hands, yellow alert. Data, set a course for the source of the transmissions. All hands, to battlestations. Worf, put us to red alert upon enterting the system. We don't want another Code Red Incident. And send out a subspace communication to the Federation, all ships, all systems.. We have engaged Microsoft..

    Worf: Yes Captain.

    Picard: Data, we did test our monthly Microsoft patches on the first Tuesday of the month, correct.

    Data: Negative Captain. Unfortunately, there were exploits in the wild which take advantage of the weaknesses in the Upnp service installed on the ship's computer, and the Federation threat level was raised, so we did not test them.

    Picard: Damn Microsoft. Alright, let's be careful. We don't know yet what we're dealing with. Maximum Warp! Engage!

    --
    Slashdot.. Land of nerds, trolls, and FlameBait..
  19. Hey Guys.. by CoyoteGuy · · Score: 5, Funny

    I think the threat level was raised to blue...

    But what does this mean?

    STOP: 0x0000000A (00000595 00000002 00000000 8010da41)
    IRQL_NOT_LESS_OR_EQUAL

    --
    Slashdot.. Land of nerds, trolls, and FlameBait..
  20. Re:This just in... by bmo · · Score: 2, Insightful

    Windows bigots are fond of pointing at Linux and Apple as each having 5 percent of the market, and therefore are "loser OSes that can't do anything".

    So ok, let's use that number, just for shits and giggles. If popularity of OS == abundance of malware, let's do some math.

    Depending on who you ask, there are between 60 and 70 THOUSAND Windows viruses, trojans, etc.

    I'll use the low number, just so nobody can accuse me of bias.

    5 percent of 60,000 is 3,000.

    Where are the THREE THOUSAND viruses that should be out there for Linux or Macintosh? Last I looked, there were 7 for Linux, and NONE of them were active.

    So it's more complicated than just popularity. There are other factors, and I'll let you guess as to what they are.

    --
    BMO

  21. Buzzwords by gverdouw · · Score: 2, Funny

    Wow, that summary is chock full of wierd names, AlertCon ThreatCon etc.

    youd think they could come up with some less... tacky names

  22. Mostly Business as usual... by Fallen+Andy · · Score: 3, Informative

    I guess someone over at ISC had to blow the dust off the colo(u)r sensor (grins), but seriously, not much on the radar to panic anyone right now. Still, if you aren't awake you really ought to add ISC to your
    morning newspaper (wakeup + gallon of coffee) along with some others, so for the sake of people who don't grok the need to be aware (but: go read doug adams and don't panic as well!):

    Here goes: (sometimes costs me an hour in the morning, but it's worth the effort...).

    http://www.dshield.org/ http://secunia.com/ http://vitalsecurity.org/ http://www.f-secure.com/weblog/ - gossip and just
    plain fun (cough) dilbert (cough).
    (many others, but i'm tooo lazy on a sunday morning to write em...).

    Oh, and be sure to replace the windows task manager with the wonderful (process explorer)
    over at the always splendid Mark Russinovich's sysinternals.com (it'll save you when your friends machine gets pwn3d). (hint: it shows tcp/ip connections so you can see if ET is phoning home).

    Finally, no list would be complete without a pointer to "comp.risks" (google groups ok?). Laugh. It helps...

    cheers all,
    Andy.

  23. Why do I love Windows98 SE... by fprog · · Score: 2, Interesting

    Affected Products:
    Microsoft Windows NT 4.0 up to and including SP6a
    Microsoft Windows 2000 up to and including SP4
    Microsoft Windows XP up to and including SP2
    Microsoft Windows Server 2003 up to and including SP1

    It's nice to be a Microsoft "reject"...
    at least when worms come out I don't give a damn.

    Just don't use Internet Explorer and have a good Firewall...

    The only problem with Windows 98 SE, is that most newer machine cannot install it properly, since drivers do not exists!!! arggggg.

    Which means.... hmmm
    maybe I should update my Dell Laptop. =(

    Anyone knows where to find Windows 98 drivers for Dell laptops ?! [Hint: Dell Tech Support are clueless]

    Also, it's funny that all those fine .NET companies,
    which insist on using ASP.NET, C#, ISS crapt will get infected again, again and again...
    why nobody learn... just use LAPP!!!
    (Linux, Apache, PostgreSQL, Perl/PHP)

  24. Too many comic book / bad movie buzzwords.... by shri · · Score: 4, Insightful

    I'm sorry, but if I have to take stuff seriously, can someone put it in plan simple english without these threatening big brother buzzwords?

    "Internet Storm Center"
    "turn the Infocon to yellow"
    "Internet Threat Level meters"
    "Symantec ThreatCon"
    "DeepSight Threat Management System"
    "Internet Security Systems X-Force"
    "AlertCon"

    Sounds like a bad CIA / X-Men / Matrix rip off movie.

  25. Re:This just in... by timmarhy · · Score: 2, Insightful

    people who blab that shit generally have no real technical insight into why these worms become such a problem. thats why the fall back on "windows is more popular, therefore it has more attackers" what they view fails to take into account is there are millions of linux boxes installed on fat pipes doing unoffical mail servers and website, they DO MAKE A BIG TARGET. as an attacker why would i care about infecting someones cable internet with a shitty 25kb/sec upstream, when i can infect a linux box with 100mbit upstream? and i simply don't buy these market share figures, they are all bogus. how do they manage to take into account for boxes built and installed by admins themselfs? those figures of 5% only take into account PURCHASED systems. so as you can see, the idea that windows has a much larger virus potential is bullshit.

    --
    If you mod me down, I will become more powerful than you can imagine....
  26. Re:Windows Update by Fizzl · · Score: 2, Interesting

    I also had the automatic updates set to wait for my approval. For a long time. Then I finally realized that in the years approving the updates, I haven't rejected a single one. I can't remember even researching most of the updates to see if there's something I don't want. To the extent that I didn't even bother reading the descriptions because they always were pretty useless.

    Now I just have it on full auto. What the heck. If they fuck up, I think I'll be reading about it on slashdot within few minutes and some comment will have link to instructions on how to undo the evil one.

    --
    Bot Assisted Blogging
  27. Windows, the final news item to make you smile by matt+me · · Score: 3, Funny

    I just read the rest of this morning's news on /. half an hour ago, and just popped back to read this article. Seems a good order, reminds me of how TV news works. They show the day's 'real' news - war, disasters, etc and then at the end, just before the weather they have something silly to cheer you up, usually animal related - an otter that can surf, monkeys at zoos having triplets, etc

    Here on /. we have the day's real news of interest, software patents, privacy, Google joining Apple, and then at the end when we think all is bleak for free software, there's a short story on Windows to make you laugh. Look, it's insecure! All their sensitive data's being emailed around. Ha ha.

  28. Re: 40 mothers agree: Cleaning Windows is a PITA by homesteader · · Score: 5, Informative

    More often than not these days, the real tough buggers have randomly generated process names. Here's how I clean a machine:

    Tools required:

    Process Explorer(procexp) from http://www.sysinternals.com/
    autoruns.exe from the same, or hijackthis.exe from http://www.merijn.org/
    Any good virus scanner(McAfee's Enterprise scanner is decent. Use a simple scanner if possible, not a scanner/firewall/spam filter/personal servant. It will be generally be faster and simpler.
    Ad-Aware from http://www.lavasoft.de/
    LSPFix from http://www.cexx.org/lspfix.htm/
    Updated Stinger from McAfee http://vil.nai.com/vil/stinger/
    Experience enough to know valid windows processes and files.

    Have all of this on a USB drive or CD. Will probably fit on a 64mb drive, unless your virus package is bulky.

    Boot to safe mode

    Start Task Manager or Proc Explorer and kill anything that doesn't look good, or everything that you know isn't part of windows. You could go to Control Panels:Admin Tools:Services and stop all services first, this will narrow the field.

    Run Stinger, just let it scan memory and running apps. Don't wait for it to do a full system scan.

    Run Ad-Aware, do the same. Just trying to ditch bad things that are actually running.

    If you've gotten this far in 15 minutes, the machine probably isn't in too bad of shape. Dump all temp files, c:\temp, c:\winnt(windows)\temp, c:\documents and settings\username\local settings\temp, c:\documents and settings\username\local settings\temporary internet items

    Update virus definitions and do a full scan. Latest SuperDAT from McAfee or Definitions from Symantec or whoever you use, should also be put on the USB drive or CD.

    So, virus scan didn't deal with it, or couldn't stop/remove it? This is where it gets tricky and completely manual. This is the point where most people give up, since you really need to know what should be where in Win2k/XP/2k3. I'm really not thinking of 95/98/Me, if those are hosed just wipe it clean and move to XP home for $99-199

    Run HiJackthis and look for gremlins. This tool really requires an eye for what is supposed to be there, but pay special attention to startup objects and BHOs(Browser Helper Objects aka evil Internet Explorer plugins)

    Add/Remove programs. Go through it with the client. Anything they don't recognize, or know they don't need, ditch. This can be risky, since people forget, but compared to a reinstall . . .

    Now for the real manual part . . .

    Run lspfix and check for foreign entries. There are normally 2-4 LSP's present. I usually only do this if there are persistent network failures.

    Check Hosts file at c:\winnt(windows)\system32\drivers\etc\hosts There really should only be one entry in here, for 127.0.0.1 localhost. You may have already checked this with hijackthis

    Browse to c:\winnt(windows). Sort by date. On a default install, the file modify dates are going to be a long time ago. If you see anything from within the last few months, get suspicious. Ignore log/text files, but don't ignore those without an extension. Do the same for c:\winnt(windows)\system32 This can be a bit trickier, there are way more files in system32 than winnt(windows), but the same rule generally applies. Anything from the last 3-6 months is suspicious.

    Do the same for c:\program files Delete any empty folders that your previous uninstall didn't remove. You should have an idea what is supposed to be here, after doing Add/Remove programs, so hack and slash the folders that you don't think belong.

    In one of these deleting sprees you are sure to find something bad that won't let itself be deleted, usually a .dll that is registered and can't be removed. Never fear! Write down the .d

  29. Yellow Alert? by Elshar · · Score: 2, Insightful


    Doesn't every ISP already have the typical windows ports blocked already?

    I mean, in every one of my routers I block 135-139,445 TCP/UDP. (Yes, I know, there's one or two that aren't windows specific, but its easier on the FW rules considering its exceedingly rare for any legitimate traffic to go over the 'net on 'em)

    Maybe the yellow alert is warrented, but imo its jumping the gun. And to those network admins who haven't gotten the hint yet and blocked those ports, DO IT NOW! Thanks. Oh, and while we're at it, make some decent anti-spoofing filters too, huh? Only things that should be leaving your network are *your* ips, and conversely the only things entering should *not* be yours. Lets all work together to make a better 'net huh? :)

  30. Re: 40 mothers agree: Cleaning Windows is a PITA by TCM · · Score: 2, Insightful

    Fucking hell! Is your second name Sisyphus? Plus you're doing half-assed stuff like sorting by file date and automatically overlooking old files?

    Save yourself some of your lifespan dude and do what's the only right thing to do to a compromised machine: reinstall from fresh media.

    --
    Of course it runs NetBSD. BTC: 1NT7QvbetmANwaMzhpVL6
  31. Sometimes... by RAMMS+EIN · · Score: 4, Interesting

    Sometimes I almost wished Microsoft's own Internet imitation hadn't died. Then, we would have the true Internet, with the academic publications, some grassroots stuff, and the users of alternative operating systems. And the Microsoft network with all the Windows users, entertainment, flashing adverts, worms, pr0n, and everything.

    Of course, people would probably build bridges between the two networks, and the bridges could probably be exploited by worms...but the vulnerabilities would probably be on the Microsoft side for the most part, meaning that worms could travel from the Internet to the Microsoft network, but hardly the other way around.

    Ah, how pleasant dreams can be...

    --
    Please correct me if I got my facts wrong.
  32. EULA by Skiron · · Score: 2, Insightful

    The thing that really galls me on MS with these issues is the fact that it's THEIR problem, and they issue a security update to patch a product a user BOUGHT under good faith. Then you have to sign your life away/agree to various thing MS can do to your machine to apply it - as if it's YOUR fault and not MS's onus.

  33. Not to sell a used car at a funeral, but... by Kamiza+Ikioi · · Score: 2, Interesting

    Not to sell a used car at a funeral, but... when these worms hit is the best time to push linux, especially to companies who see significant downtime and lost sales. Something along the lines of, "You know, if you were running (Insert *nix and/or BSD distro here), you'd still be in business. Right now, your business is doing as much sales as a liquor store being robbed, because being 'robbed' is exactly what's happening. If Windows is the liquor store, (distro) is the well guarded bank. 'Robberies' can still happen, but they are extremely more rare and the 'crooks' will be caught sooner."

    --
    I8-D
  34. Must read carefully by HangingChad · · Score: 2, Funny
    as a part of global DeepSight Threat Management System...

    Did anyone besides me originally read that as the global DeepShit Threat Management System?

    I think I like it better that way.

    --
    That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
  35. There is at least one worm active out there. by Alejo · · Score: 2, Interesting
    Look for pnpsrv.exe in windows/system32 and /run.

    A large client was affected last night because of it. And they patched almost all servers this week, but how can you keep patching up with thousands of workstations, including home users accessing through vpn?

    Tightening more is not an easy option as people want to do all what Microsoft promises them. When security teams (or just plain support) insist on patching they are labeled as annoying dorks, and when a worm/virus hits because of lame users not patching... just plain dorks!

    Sometimes I wish I liked painting instead of computers.

  36. Re: 40 mothers agree: Cleaning Windows is a PITA by http · · Score: 3, Informative

    You cannot clean a compromised system with tools running within that system, even in Safe Mode. That's like asking your mayor if s/he's been bribed or not and expecting an honest answer just because the question has been posed during a public council meeting. Wipe, and install from scratch. I would count those ~2 hours as lost in the sense that the system may not have been fixed; you'd probably have been better off watching a funny movie with kith and kin.
    Try googling rootkit. *nix has been around ~35 years, and not with a perfect security record. *nix admins hae been dealing with breaches for a long time. While the *nix mindset has come up with clever tricks to detect rootkits I have yet to hear anyone sucessfully defend cleaning any system from within itself. The problem with this approach has nothing to do with *nix and applies across multiple platforms. Because the system is compromised, you can't trust ANYTHING the system tells you about itself, or any tools that use the system to gather information about the system.
    I'm hard pressed to imagine an operating system where this would not be the case, but perhaps others would enlighten me.

    --
    If opportunity came disguised as temptation, one knock would be enough.
    3^2 * 67^1 * 977^1
  37. Never buy from a used car salesman by Anonymous+Brave+Guy · · Score: 2, Insightful

    The thing is, the whole claim that OSS has inherently better security has been exposed as hype for a long time now.

    Some OSS projects have excellent security, because the project leaders place sufficient emphasis on it, and the coders code with that emphasis in mind.

    Other OSS projects do not have good security, sometimes not even as good as Microsoft and co.

    Consider this: I have downloaded patches for more security flaws in Firefox than for IE in recent weeks. Moreover, the IE patches were offered to me via automatic updates within minutes of being available on Windows Update, while the Firefox patches did not show up as automatic updates for several days after they were available from the project web site in some cases. They even had a whole version missed out of the automatic updates, because somehow a release was made that contained serious bugs of its own, and had to be withdrawn.

    This is not intended to be a slam against Firefox; it's great software and the project seems to be run well, the vast majority of the time. Rather, this is intended to demonstrate that nothing's perfect. Trying to convert people from Windows to OSS alternatives, based on security fears, at a time when a worm is circulating, Microsoft has made a patch available, but people haven't bothered installing that patch yet, really is being a used car salesman in the most derogatory sense of the term.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
  38. Here's my assessment by Anonymous+Brave+Guy · · Score: 3, Insightful

    Here are my conclusions about the current Windows threat level:

    Today, 173 users of Slashdot will post comments about how Windows security sucks, they've had enough, and they'll be switching their entire corporate network to Linux on Monday. None of them will.

    Threat assessment: hollow.

    --
    If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
  39. Re: 40 mothers agree: Cleaning Windows is a PITA by homesteader · · Score: 2, Informative

    I fully agree. My home network is made up of 3 OS X machines and one windows box for when necessary. With OS X, I could actually agree that the best fix for a compromised machine(were it to happen) would be a reinstall, since there's nothing user specific in the System directory anyway.