Slashdot Mirror
MS05-039 Worm in the Wild
An anonymous reader noted that SANS is reporting that the MS05-039 worm is in the wild. It has been named Zotob.A. Not a lot of information on this one yet except that it's trying to FTP files from a subnet.
← Back to Stories (view on slashdot.org)
And it's detected by ClamAV already, too.
quidquid latine dictum sit altum videtur.
From TFA:
:)
"Windows XP SP2 and Windows 2003 can not be exploited by this worm, as the worm does not use a valid logon."
I think a lot of people were relieved to read this.
Join the Empire! http://www.empirereborn.net/
What a crappy summary, it doesn't even mention what operating system this effects (or how to patch for that matter). "Important facts" from the article:
- Patch MS05-039 will protect you
- Windows XP SP2 and Windows 2003 can not be exploited by this worm, as the worm does not use a valid logon.
- Blocking port 445 will protect you (but watch for internal infected systems)
- The FTP server does not run on port 21. It appears to pick a random high port.
Every time some new worm is released onto the Internet, I ask myself what drives the sick people who create such things. What can we do to provide more disincentives to keep them from being jerks?
"...What is good for General Motors is good for America." -Charles Wilson, Secretary of Defense and fmr President of GM
Why is this under "worms" and "security" but not under "Windows" and "Microsoft".
Even though it's linked to in the article, the bit by F-Secure is a bit better written (and more informative):
http://www.f-secure.com/weblog/
Join the Empire! http://www.empirereborn.net/
We could tell them to write it in java instead of C/Assembly, that way it will propagate slower as the files will be larger, the code will use more memory and there will be more processing overhead... :)
"I reject your reality, and substitute my own" - Adam Savage
As usual, trend have thier info strait about this exploit, and good ways to prevent it...a ult6.asp?VNAME=(MS05-039)+Vulnerability+in+Plug+an d+Play+Could+Allow+Remote+Code+Execution+and+Eleva tion+of+Privilege+(899588)&Page=
http://www.trendmicro.com/vinfo/secadvisories/def
...
If you haven't patched yet, the update for this vuln is at http://www.microsoft.com/technet/security/bulletin /ms05-039.mspx.
All note the free IDS snort detects this worm.
alert tcp any any -> any 445 (msg:"EXPLOIT SMB-DS Microsoft Windows 2000 Plug and Play Vulnerability"; flow:to_server,established; content:"|FF|SMB%"; dept h:5; offset:4; nocase; content:"|2600|"; depth:2; offset:65; content:"|67157a76|";reference:url,www.microsoft.
alert tcp any any -> any 139 (msg:"EXPLOIT NETBIOS SMB Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset:4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.
alert tcp any any -> any 445 (msg:"EXPLOIT NETBIOS SMB-DS Microsoft Windows 2000 PNP Vuln"; flow:to_server,established; content:"|FF|SMB%"; depth:5;offset: 4; nocase; content:"|2600|"; depth:2; offset:65; content:"|3600|"; offset:110; within:5; content:"|F6387A76|";reference:url,www.microsoft.
What about all the other mega bucks IDS systems?
Stiffu.
Windows 98 still works. You can use it for Internet browsing, email, and word processing. You can run older games on it, too--there are even a fair number of recent games that will run on it--but if you have the money for the appropriate hardware, you'll upgrade Windows.
The point is, not everyone can afford $100 for a software upgrade that's not really necessary, especially if it will probably significantly decrease the speed of their computer.
The grandparent's argument was more like "My 1989 Buick gets me around, but doesn't have side airbags. I can't afford a new car, so I won't." If you had two neurons to rub together, you'd realize that.
What's worse is that today is Sunday, so there's a greater chance of those laptops being used on an unprotected internet connection.
Shucks, the patch for this is only four days old. There goes my Sunday afternoon!
Never email donotemail@WeAreSpammers.com
Which is why we're at this moment here at work patching all servers manually. Good thing it also means a sunday bonus. :-)
home
...until June 30, 2006
A n1
http://support.microsoft.com/default.aspx?pr=Life
> What a crappy summary
Get a browser with support for hyperlinks. Cool stuff.
The naming sceme was designed by CARO (Computer Antivirus Researchers Organization). The naming convention is documented on the caro website:g Scheme/
I d=1/
I d=2/
:)
http://www.caro.org/tiki-index.php?page=CaroNamin
and the original conference paper for the naming scheme:
http://www.caro.org/tiki-read_article.php?article
and there is a new naming convention being proposed as well, see:
http://www.caro.org/tiki-read_article.php?article
It's actually really complicated, and pretty much none of the antivirus companies use more than one or two parts of it, but if you're really interested in digging up more info, those links should be more than adequate
Why should you have to do a Google search? The patch/exploit is the entire basis for the article. I know the quality of journalism at /. is mediocre at best, but expecting readers to search for the most relevant piece of information is asinine.
I bet microsoft secretly loves this, to get at all those people that wont upgrade to XP/2003.
"See, you have to upgrade to be safe, send us money"
---- Booth was a patriot ----
The original poster was talking about "just for the hell of it"-worm authors. I should point out that these blackhats in particular should NEVER get caught unless they are extremely prideful and/or stupid. Worms that "call home" can obviously be traced, but proof of concept and cause-a-lot-of-chaos worms are only ever connected to their author for one brief instant--when they are uploaded. This instant can be when they are connected at a coffee shop from several blocks away during rush hour. Wash, rinse, repeat for all of the popular public hotspots in the area, over the course of a week to ensure that your worm is seeded in multiple locations. Then, after a week (or after your virus is identified in the wild) halt all distribution and watch the chaos unfold. Unless you suffer from supremely bad luck (i.e. hidden camera in the area FIVE BLOCKS AWAY from the actual hotspot manages to catch you in the act and the FBI agents actually check the camera and they actually manage to spot your woktenna through your tinted car windows) there is no way you will ever be caught. You can even be stupid brag about it on IRC to all your buddies and even if the FBI arrests you, you can just say you were being a lying little prick and as long as you've wiped your HD, they'll won't have enough evidence to indite you (what are they gonna do, arrest every script kiddie on IRC that claims they wrote the worm? heh.)
Actually, just-for-the-hell-of-it random crime in general is a lot harder to trace than motivated crime. Nothing short of Orwellian-level surveillence can reliably solve random, profit-less crime committed by smart criminals. Fortunately, these two things--random, profit-less crime and smart criminals--are very rarely connected.
The question is where people gets recruited to be computer wankers. A large amount of these are from the "scene", starting out with just doing it for fun and becoming more criminal with time. By removing the false glamour of the scene, fewer kids will start out as computer wankers, and there will overall be fewer wankers.
Of course there will be some left. However, that will happen no matter what we do. The money spent on securing computer systems is an insurance policy against the costs of a security break. At each point, the question is how this money can be most effectively spent - on social engineering (propaganda, routines, company morale), on technical engineering, or on an actual insurance policies from Lloyds or similar.
Spending it all on the technical side would be wasteful.
Eivind.
Doubting the existence of evolution is like doubting the existence of China: It just shows that you're uninformed.