MS05-039 Worm in the Wild

An anonymous reader noted that SANS is reporting that the MS05-039 worm is in the wild. It has been named Zotob.A. Not a lot of information on this one yet except that it's trying to FTP files from a subnet.

Comments

What drives people to do this...

[cameronk]

Every time some new worm is released onto the Internet, I ask myself what drives the sick people who create such things. What can we do to provide more disincentives to keep them from being jerks?

Re:What drives people to do this...

[a_n_d_e_r_s]

Mostly money.

Worms are used to get zombies, who are used to send spam, who are used to lure suckers to spend money on junk.

Re:What drives people to do this...

[Waffle Iron]

I ask myself what drives the sick people who create such things. What can we do to provide more disincentives to keep them from being jerks?

There are 6 billion people on this planet, and it only takes one of them to launch a worm. With a sample that large, there's no way that a worm won't get written if a vulnerability exists and generally known. There's always going to be at least one crazy who'll do it regardless of any disincentives. Peoples' energy is better directed at eliminating the vulnerabilities in the first place.

Re:What drives people to do this...

[lgw]

What scares me is it's only a matter of time and technology until we have this same situation with biological viruses.

miscategorised

[hungrygrue]

Why is this under "worms" and "security" but not under "Windows" and "Microsoft".

Re:miscategorised

[suitepotato]

It is only horribly redundant because the average malware scumbag writer is taking the easy way out and going after Windows machines, taking advantage of end-user naivete and Windows' openness to infection. If they had any guts and were truly 1337, they'd try to get into a source repository on sourceforge and slip their own modded source in to get Linux people to infect their machines or something equally hard and nasty.

Come to think of it, what do we know of the server security at any of the big name OSS-hosting sites and does anyone really peruse the source anymore? Given the difference between being C++ proficient and merely being able to administer a Linux system is like the difference between the average Windows user and a Windows programmer, I'm guessing not too many.

Firewalls offer limited protection only

[Dynamoo]

Remember folks - if you work for any large organisation, your external firewall will ONLY protect you as long as some freaking idiot doesn't bring an infected laptop in. From my experience a perimiter firewall will maybe buy you 1-2 days MAXIMUM in this situation if you have a large number of mobile users. In our case, we do not allow users to connect laptops to non-company networks at all.. but they still do.

What's worse is that today is Sunday, so there's a greater chance of those laptops being used on an unprotected internet connection.

Shucks, the patch for this is only four days old. There goes my Sunday afternoon!

Re:Must everything be handed to you?

[Bald Wookie]

Why should you have to do a Google search? The patch/exploit is the entire basis for the article. I know the quality of journalism at /. is mediocre at best, but expecting readers to search for the most relevant piece of information is asinine.

An attack on Win2000?

[nurb432]

I bet microsoft secretly loves this, to get at all those people that wont upgrade to XP/2003.

"See, you have to upgrade to be safe, send us money"