Slashdot Mirror
MS05-039 Worm in the Wild
An anonymous reader noted that SANS is reporting that the MS05-039 worm is in the wild. It has been named Zotob.A. Not a lot of information on this one yet except that it's trying to FTP files from a subnet.
← Back to Stories (view on slashdot.org)
And it's detected by ClamAV already, too.
quidquid latine dictum sit altum videtur.
From TFA:
:)
"Windows XP SP2 and Windows 2003 can not be exploited by this worm, as the worm does not use a valid logon."
I think a lot of people were relieved to read this.
Join the Empire! http://www.empirereborn.net/
What a crappy summary, it doesn't even mention what operating system this effects (or how to patch for that matter). "Important facts" from the article:
- Patch MS05-039 will protect you
- Windows XP SP2 and Windows 2003 can not be exploited by this worm, as the worm does not use a valid logon.
- Blocking port 445 will protect you (but watch for internal infected systems)
- The FTP server does not run on port 21. It appears to pick a random high port.
Even though it's linked to in the article, the bit by F-Secure is a bit better written (and more informative):
http://www.f-secure.com/weblog/
Join the Empire! http://www.empirereborn.net/
What drives them is probably a sense of achievement. By creating a working worm they can prove something to themselves, their friends, and/or the world. And it seems to work, some people got security jobs because of the exploits they made.
As for what we can do to make writing worms less attractive...that's more difficult. There is no magic bullet here. Things that probably help:
- give more publicity to when these guys are caught and what they are sentenced to, rather than to how much damage they did
- make it harder to write worms in the first place. Many worm writers aren't extremely brilliant programmers, so chances are this would cause more worms to fail
- don't give them jobs after they are caught, unless they really deserve them! Just because they can write and release a worm, doesn't mean nobody else can. Better reward the people who can but don't, right?
- maybe apply the same punishment to minors that is applied to adults. If you're smart enough to put together a worm, you're smart enough to know you shouldn't release it.
Please correct me if I got my facts wrong.
As usual, trend have thier info strait about this exploit, and good ways to prevent it...a ult6.asp?VNAME=(MS05-039)+Vulnerability+in+Plug+an d+Play+Could+Allow+Remote+Code+Execution+and+Eleva tion+of+Privilege+(899588)&Page=
http://www.trendmicro.com/vinfo/secadvisories/def
...
Indeed, money is a motivation, but it's not the only one. It's also an intellectual challenge.
Back when I had learned to program in my early teens, I myself was quite fascinated by virii/trojans/etc. and wondered if I could create one. I probably could have written a moderately "successful" trojan by the standards of the time. It's not that hard.
Thankfully, I was responsible enough not to, but not everybody is. All it takes is one bad apple...
It is only horribly redundant because the average malware scumbag writer is taking the easy way out and going after Windows machines, taking advantage of end-user naivete and Windows' openness to infection. If they had any guts and were truly 1337, they'd try to get into a source repository on sourceforge and slip their own modded source in to get Linux people to infect their machines or something equally hard and nasty.
Come to think of it, what do we know of the server security at any of the big name OSS-hosting sites and does anyone really peruse the source anymore? Given the difference between being C++ proficient and merely being able to administer a Linux system is like the difference between the average Windows user and a Windows programmer, I'm guessing not too many.
If my grammar and spelling are off, I am [distracted/tired/careless] (take your pick)
What's worse is that today is Sunday, so there's a greater chance of those laptops being used on an unprotected internet connection.
Shucks, the patch for this is only four days old. There goes my Sunday afternoon!
Never email donotemail@WeAreSpammers.com
Which is why we're at this moment here at work patching all servers manually. Good thing it also means a sunday bonus. :-)
home
What scares me is it's only a matter of time and technology until we have this same situation with biological viruses.
Socialism: a lie told by totalitarians and believed by fools.
The rest of these are irrelevant, because they do not expect to get caught. Really. Even if the people around them are going down in flames, they don't expect to get caught.
About 15 years ago I was in the "hacker" scene (the ones breaking into computers, not the ones creating brilliant software). Getting caught never felt real, and never seemed to feel real for anybody else, either. My friends got busted left and right, yet - they'd always been careless about something, and I felt that *I* wouldn't be careless about that.
There's one other thing that could work: Break up the scene. The people need to be shown as ridicilous. And it needs to seem ridicilous to the people close to the scene.
For the tagging (grafitti) scene, it seems to have worked somewhat well here in Norway to use advertising to give them a new, ridicilous name and image.
I therefore humbly suggest we from now on call those that break into computers "Computer wankers".
Eivind.
Doubting the existence of evolution is like doubting the existence of China: It just shows that you're uninformed.
Having some difficulties understanding the self-control aspects of the martial arts, are you?
I bet microsoft secretly loves this, to get at all those people that wont upgrade to XP/2003.
"See, you have to upgrade to be safe, send us money"
---- Booth was a patriot ----