Slashdot Mirror
Zotob Worm Hits CNN and Goes Global
securitas writes "The Zotob MS05-039 worm mentioned on Slashdot last Sunday may be the most recent virus that has gone global, hitting Windows 2000 desktops at CNN, ABC, the New York Times, and many others. The virus is spreading around the world rapidly as compromised systems become bots and propagate the worm, with reported outbreaks in Germany and China. InformationWeek has a decent article titled Zotob Proves Patching "Window" Non-Existent. Microsoft calls it a "low impact" threat and tells you What you should know about Zotob. Symantec has W32.Zotob.D removal instructions. Trend Micro thinks that this is a new, different worm altogether and says it is one of the fastest-spreading infections in history."
Microsoft is not spreading FUD this time; their own products are much bigger threats
and i just sat back :)
A feeling of having made the same mistake before: Deja Foobar
The Internet Storm Center's take on this is also interesting. As far as they can tell, the infection at the three news outlets is more-or-less isolated:
... does it run on Linux?
It doesn't effect Windows XP, so Microsoft will just go "You should of updated". Which will lead to more sales of XP by the masses beliving they need the latest OS to "be safe".
I like muppets.
All of a sudden, a worm makes mainstream news because it invaded CNN's network. I guess that is a sad indicator of what it takes to raise awareness.
C|N>K
As reported by Slashdot t'other day, they raised their threat level from Green to Yellow. They explain why they moved back to Green:
Carousel is a lie!
Dunno if the slashdotting did it, But MS's site now says it's a Moderate Severity risk.
Or code Bert...
Knocked them down also.
hitting Windows 2000 desktops at CNN, ABC, the New York Times, and many others.
Hm, must be a Karl Rove plant.
Or else it's just another victory in the GWOT?
Fuck it
hit the CBC!
thank you, Zotob
a canadian taxpayer
... though a full upgrade to "X-windows" seems to avoid most viruses.
160 dead in Venezuela Crash, Gaza Pull out and Paul Abdul's Idol issues.
I doubt it - yet it's front page on CNN.COM...
EMail: 0110001101100010010000000110001101110010 0110000101111010011011100110000101110010 0010111001100011011011110110
As a Linux user I feel left out of all the seemingly weekly worm fun... I mean, my chosen OS has some of the best hacker (both good and evil) minds behind it and tons of techie users... yet we have no fun worms. Sure, an unsecured and non-updated Linux server box will end up getting hacked into by the script kiddies here and there... but what about us desktop users?
Meh.
This just in, CNN staff have been smoking 20 packs of cigaretts a day to see if it does indeed cause cancer.
duh...
A feeling of having made the same mistake before: Deja Foobar
Guess what Microsoft?,You thought wrong! p0wn3d
... how many computers Apple will sell because of this?
We haven't seen it here yet, though usually our Chinese office picks this stuff up and then tries to spread it through the company. It's still to early in thew morning there.
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
Microsoft calls it a "low impact" threat and tells you What you should know about Zotob.
"Low impact" in the sense of how low you would be if a meteorite impacted you crown-first.
I watched C-beams glitter in the dark near the Tannhauser gate.
Now that media is directly affected, they will start proclaiming that this worm is the worst ever, and has caused billions of dollars in losses for businesses.
.pdf file!
Media worm hype really sucks, is my point.
What I found amusing today were the two alert emails in my inbox. The first one was a warning about the new Acrobat flaw [which makes it a requirment to install a bad version of Acrobat, and then patch it *3* times to fix it!]. Then next email was one about this Zotob worm spreading through the PnP ethernet bug in Windows 2000 - but the information came via a
Saskboy's blog is good. 9 out of 10 dentists agree.
"Gives a remote attacker full control over the compromised computer to perform various actions, including:
..."
Downloading and executing files
Making queries to www.google.com
Making queries to google? Sounds like a very round-about way to search google. What is the purpose of this?
Never let your sense of morals prevent you from doing what's right. --Isaac Asimov
...1000 apple computers were sold in Henrico County, Virginia today...
"CNN is heavily covering an outbreak of a worm in its own network. They are reporting that ABCNews and NYTimes are hit as well. All statements so far make this look like a Zotob variant, even though this variant appears to reboot the system. (Zotob.d ?).
Likely this is an isolated event, which became newsworthy because CNN got infected. We do not see any new threats at this point. Zotob keeps mutating and finding new victims. As seen with prior TCP worms, it is reaching its peak around 3 days after the outbreak.
Speculating: The fact that CNN, ABC and the NYTimes got it may be as simple as reporters from these organizations visiting the same event and connecting to an infected network. While a firewall may have protected their office network up to now, these infected laptops where able to take out the network from the inside once they connected back to it."
Feel free to insert the usual comments about media types overreacting and not understanding anything technical, along with misc sagely advice about defense in depth and perimiter security.
The evil monkey commands you to dance.
Microsoft says this virus has medium impact, not low as the submitter says. Is the submitter perhaps spreading some FUD of his own or did MS upgrade the threat?
i mean, im sure it has it's own malicious intent, but according to the SARC page, it's deleting malware like gator, 180solutions, viewmgr, etc.
just because I don't care doesn't mean I don't understand!
All j00r base are belong to us!
What virus?
The executable in this particular instance is "wintbp.exe". I thought at first it might be a randomly-named executable, but all 100+ systems I'm manually disinfecting at the moment have the same executable. It tries to connect to other systems via port 445, aka the "Magic Windoze Port"(tm).
Apparently all it's doing is rebooting systems, but I haven't done any kind of a postmortem so don't know. I haven't detected any other connection attempts either inside or outside.
Manual disinfection means disconnecting your NIC and then using regedit to delete this value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur
You must then reboot the machine to disable the executable which is:
C:\%systemroot%\System32\wintbp.exe.
Good luck. I'm glad my own systems are Linux....
I have something in common with Stephen Hawking...
Is it's kicking our ass here at The Texas Health and Human Services Commission.
I just got XM in my car. I'm an internet dude. What struck me as I was driving home around 6pm EST was how CNN was covering it, admitted they got infected, and it seemed to remind me of SQL Slammer / Code Red.
Anyway, they kept saying only windows 2000 was affected, but the patch was for pnp on 2000/xp/2003. In a later report CNN did mention it might affect XP too.
This makes me wonder how seriously people (BHPs, IT guys, FireWall guys, etc) take worms. Where I work we have many FWs, push patches very often, and accelerate our pace when things like this are out there. If CNN, ABC, etc, can all get infected does that reveal that they might not take all this PC security seriously enough when it comes to their own networks?
I know we have stepped it up in the past 3 or so years, Code Red, SQL Slammer, and Nimda were all wake-up-calls. Maybe THIS one will make a new set of users/admins/PHBs wake up... We can only hope right? It was front and center on CNN tonight.
-Jon
Silly Rabbit: tricks are for kids.
I was reading through the symantec description of the D varient; and noticed somthing peculiar...
Is it just me or does it primarily remove various spyware-related entries from the registry? (Hotbar, etc)
Is this another example of a virus writer having a positive goal but a crappy method?
That's just yesterdays news. You gotta get with the times man.
Meh.
I work in an AOL call center and we run Windows 2000. We are taking almost no calls and almost all of our computers are down.
why a company like CNN and ABC with billions of dollars in revenue is still running unpatched windows 2000 computers.
did you forget to take your meds?
That would be bad.
On the bright side, Linux and OSX operating system market shares would skyrocket.
Microsoft is calling this threat "low-impact" or "moderate" is that they consider Windows 2000 to be a second-tier operating system at this point and that everyone (and I mean everyone and his dog or penguin) should be using XP. Good points made above for the "variant" aspect of this virus. I'm running XP on a customer's machine (that's my cop-out, anyway), and it's got botzor.exe in the registry.
So it has hit CNN, ABC, the New York Times. Obviously this worm is part of the Vast Right-Wing Conspiracy!
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Staff there are saying that the banks have been hit. They have to bring the network down and clean all the servers and computers. They are certainly not advertising it.
Check your bank book.
CNN is reporting that the worm hit at Capitol Hill. I wonder if Microsoft will get any sympathy from any Senator that has his/her computer distroyed by this.
I'm wondering how much worse this has been made by the new policy of only allowing updates for legit copies of Windows. Can the millions with illegal copies get their fix, or will they just be sitting ducks for this and the next exploit to come along?
"No fair, you changed the outcome by measuring it!" - Professor Hubert J. Farnsworth
Given the total refusal of our net admins to fully patch due to "we haven't tested" some of our craptastic apps with all the patches, I expect to see another round of "no problem" here at work come Friday when I'm back.
New worm comes out...few days later we have widespread network problems & a couple of "minor" server "issues" and "resets", but the True Word is "No problem here".
I don't who's dumber, our MS fanboy head net admin, our "restructured" (4th time?)management or ME for staying there.
(yes, he has actually said, "According to MicroSoft" on many occasions)
Is it time to reapply to Sungard again?
We need to re-think we way we apply security patches. The patches for this problem were available several days ago; why weren't they applied?
The answer is that Microsoft security patches have a reputation for causing things to break. Why this happens, I don't know -- Microsoft certainly has the resources necessary to test their patches before releasing them -- but for whatever reason, patches from Microsoft have developed that reputation. As a result, administrators of large networks have learned to not apply security patches immediately to all systems, but instead to test them on a few machines for some time first -- exactly the same way as other patches are handled.
The decreasing window between patch publication and widely distributed exploit code means that this approach simply doesn't work any more. Security patches must be applied to all affected systems immediately. Don't stop to test them; just apply the patches and reboot if necessary.
Of course, this means that vendors need to do a good job of testing security fixes before releasing them. I'm proud of the fact that in my time on the FreeBSD security team, we have never released a security patch which has caused new problems. While we don't officially recommend this, I know several people who have their systems automatically download and install FreeBSD security patches -- because they trust us to make sure that our security patches will never break anything.
After all... if you can't trust the security team of the operating system you're running, why are you running that operating system?
Tarsnap: Online backups for the truly paranoid
I find it interesting that Microsoft's PnP vulnerability announcement states that all their modern OSs are vulnerable, and need immediate patching (http://www.microsoft.com/technet/security/Bulleti n/MS05-039.mspx), yet their "All you need to know about zotob" they spread conflicting tales of vulnerable versions:
. mspx)
"Important If you have installed the update released with Security Bulletin MS05-039, you are already protected from Zotob.A. If you are using any supported version of Windows other than Windows 2000, you are not at risk from Zotob.A." (http://www.microsoft.com/security/incident/zotob
If only Microsoft would get their act together and tell their customers the truth.
I work for the Information Security department at a major Technical school in Georgia, and have seen this worm infect Windows 2003 Servers, with SP1.
Machines really vulnerable to this are those boxes with NULL sessions enabled.
BTW, I love the confirmation image/word for this posting: spreads
Keep on patching!
When I try to read the informationweek article, my browser locks up and gives an SSL error (Error code: -12281). I'm running the latest FF and Slackware 10.
Anybody else having any problems with the article
"Better to be vulgar than non-existent" -Bev Henson
A worm shut down computers running Windows 2000 software across the United
States.
And that's IT. Ironically, I'm posting this from a Win2k machine. Sorry, all.
Hasn't everyone learned already? This is just plain dumb. Windows is always going to be vulverable to these threats.
I was talking to a friend the other day, and I told him that I wouldn't run anything other than Linux. And that Windows would never be installed on a computer that I owned. He thought I was some sort of hippy or hacker.
But think about it, in order to run Windows, you have to have virus & spyware software running. There is no getting around it.
So now you have all of these apps running, eating up your resources, just so you can surf the web and download pr0n. It just doesn't make sense to me.
Unfortunately, people are too stupid to realize it's Microsoft's fault and that better options exist.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
this is getting ridiculous.
when are non-windows users going to get in on the fun?
or is the fun actually in watching the knuckleheads fix their boxes, share their stories, re-infect each other, etc?
In this case Microsoft have really done everything any vendor can ever do in this kind of situation. They got the patch out there before any exploits were made, they have a complete patch system to distribute it (bordering on obnoxious when it nags you to reboot after updates). No open-source software could have done better, and despite all this the infection is apparently rampant.
Now if only the patching system had been in place when Windows 2000 was first released (on the other hand, how many OS's had automatic patch checks in 1999?) things might have turned out better. Or if the userbase (at least on a bigtime news network that really should have a big staff of system administrators) would actually get the patch system, or at least the patches. But it is just not meant to be I guess.
It's not totally bad... I mean at least it is trying to do the average joe some kind of favour:
n c/data/w32.zotob.d.html%5D
Kind of anyway:
[http://securityresponse.symantec.com/avcenter/ve
Searches for the following files and folders to delete the files and the contents of folders:
%SYSTEM%\pnpsrv.exe
%SYSTEM%\winpnp.exe
%SYSTEM%\csm.exe
%SYSTEM%\botzor.exe
%PROGRAMFILES%\MyWebSearch
%PROGRAMFILES%\MyWebSearch\*.exe
%PROGRAMFILES%\Hotbar
%PROGRAMFILES%\Hotbar\*.exe
%PROGRAMFILES%\MyWay
%PROGRAMFILES%\MyWay\*.exe
%PROGRAMFILES%\180Solutions
%PROGRAMFILES%\180Solutions\*.exe
%PROGRAMFILES%\Common Files\WinTools
%PROGRAMFILES%\Common Files\WinTools\*.exe
%PROGRAMFILES%\Toolbar
%PROGRAMFILES%\Toolbar\*.exe
%PROGRAMFILES%\CxtPls
%PROGRAMFILES%\NavExcel
%PROGRAMFILES%\AutoUpdate
%PROGRAMFILES%\AutoUpdate\AutoUpdate.exe
%PROGRAMFILES%\EbatesMoeMoneyMaker
%PROGRAMFILES%\eZula
%PROGRAMFILES%\eZula\mmod.exe
%PROGRAMFILES%\Common Files\GMT
%PROGRAMFILES%\Common Files\GMT\GMT.exe
%PROGRAMFILES%\Common Files\CMEII
Like, fifteen.
Previously (well, like early-mid 90s) when a site got hacked or a virus was running rampant, there was usually some sort of political message along with it, like a US Gov website getting hacked by a mexican / chinese hacker group that would deface the main index.html to say 'oh these people are doing some bad shit, now we're going to tell you what it is since they wont'
Notice you don't see that anymore? Like, ever? The new world of commonly noticed 'hackers' seems to be a world of mostly spyware / virus infections targeted at data mining and reselling the information gathered to advertisers. Now, with that in mind, from Symantec's description of what the worm does, look at the following:
Ever heard of a virus removing spyware for you? What reasons can we think of for a worm to do this? The one that comes to my mind seems far fetched, but assume that the spyware being removed by this virus was engineered by competitors to whoever made this virus. So maybe now we will see turf battles over drone zombified boxen? What other reasons can the
Does Wine support this worm yet?
“Common sense is not so common.” — Voltaire
I would really appreciate as much pain and frustration as possible.
Don't hold back.
I really mean it no pain no gain.
Consider this legal permission to deliver your worst.
Thanks and best wishes.
No IM gonna wait at my keyboard till my machine smokes. Don't make me wait ya noob haxxors!
I never thought about the fact that if a trusted but infected 2k machine comes into the LAN it will infect XP machines.
Lima India November Uniform X-ray
Leaving aside any questions about monopolies and anti-virus software and so on....
Why doesn't Microsoft release a scanner/fixer/patch combination when this sort of thing hits?
I know there are a lot of actual "whys" but it seems like the logical thing to do...
This Like That - fun with words!
And I quote from the C:\windows\system32\eula.txt
;)
12. DISCLAIMER OF WARRANTIES. The Limited
Warranty that appears above is the only express warranty
made to you and is provided in lieu of any other express
warranties (if any) created by any documentation,
packaging, or other communications. Except for the Limited
Warranty and to the maximum extent permitted by applicable
law, Microsoft and its suppliers provide the Product and
support services (if any) AS IS AND WITH ALL FAULTS, and
hereby disclaim all other warranties and conditions, either
express, implied or statutory, including, but not limited
to, any (if any) implied warranties, duties or conditions
of merchantability, of fitness for a particular purpose,
of reliability or availability, of accuracy or completeness
of responses, of results, of workmanlike effort, of lack
of viruses, and of lack of negligence, all with regard to
the Product, and the provision of or failure to provide
support or other services, information, software, and
related content through the Product or otherwise arising
out of the use of the Product. ALSO, THERE IS NO WARRANTY
OR CONDITION OF TITLE, QUIET ENJOYMENT,
QUIET POSSESSION, CORRESPONDENCE TO
DESCRIPTION OR NON-INFRINGEMENT WITH
REGARD TO THE PRODUCT.
So "lack of viruses" is not covered in the warranty
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
It's obviously a low impact worm. It invaded the CNN network and Miles O'Brien is still on the air.
Well all i can tell you is SBC is down(thats right the phone company SBC)...company wide!(Cingular is not down at this moment)
~~"Of course, that's just my opinion. I could be wrong." ~~Dennis Miller
My gf (yes I have one) had her company fairly shut down by this today. She works for a major drug manufacturer, which makes you wonder :)
People tend to panic when all the PCs around them are crashing every few minutes instead of every few hours or days like normal (depending on patch level and usage pattern). The first assumption they tend to make is that the crashing computers were infected, but in this case that doesn't seem to be happening. A different worm on a different day, of course, might very well crash them after a successful infection, rather than before, so best not to get too cozy because of a small bit of luck.
It hasn't received much publicity, but if you're a network administrator battling this problem, you may have trouble patching your systems because they crash too quickly. You might want to disable NULL sessions on the Windows 2000 systems which haven't been patched yet. It appears that this will prevent an infection of an unpatched Windows 2000 system, allowing you more time to patch. (Patches being larger and the systems not staying up long enough to distribute a large package and whatnot.) I haven't yet been able to determine if the UPnP vulnerability could be exploited with NULL sessions disabled, but apparently the current crop of worms and bots all rely on it.
If you mod me down, I shall become more powerful than you could possibly imagine.
Or perhaps the story summary is just making up stuff. The links provided have no quote from TM saying such silliness.
Where I work, we have classes. And the instructor takes his notebook out and hooks into the network, pulls his powerpoint. During the class a window pops up... Oh, he says, its just a virus, it pops up from time to time, and procedes to reboot and keep going.
After class the computer goes back in the bag for a month, as he has a desktop in his office. The virus hibernates....
Our IT folks must love this..
"The answer is that Microsoft security patches have a reputation for causing things to break. "
Unlike Linux patches that just give weird behaviour that requires a geek to fix.
No, goober. MS05-039 works on Win2K as well as XP, so Win 2000 is still covered. The correct phrase is, "You have have patched."
Zotob might be what most people need to clean up their spyware.....
# Searches for the following files and folders to delete the files and the contents of folders:
* %SYSTEM%\pnpsrv.exe
* %SYSTEM%\winpnp.exe
* %SYSTEM%\csm.exe
* %SYSTEM%\botzor.exe
* %PROGRAMFILES%\MyWebSearch
* %PROGRAMFILES%\MyWebSearch\*.exe
* %PROGRAMFILES%\Hotbar
* %PROGRAMFILES%\Hotbar\*.exe
* %PROGRAMFILES%\MyWay
* %PROGRAMFILES%\MyWay\*.exe
* %PROGRAMFILES%\180Solutions
* %PROGRAMFILES%\180Solutions\*.exe
* %PROGRAMFILES%\Common Files\WinTools
* %PROGRAMFILES%\Common Files\WinTools\*.exe
* %PROGRAMFILES%\Toolbar
* %PROGRAMFILES%\Toolbar\*.exe
* %PROGRAMFILES%\CxtPls
* %PROGRAMFILES%\NavExcel
* %PROGRAMFILES%\AutoUpdate
* %PROGRAMFILES%\AutoUpdate\AutoUpdate.exe
* %PROGRAMFILES%\EbatesMoeMoneyMaker
* %PROGRAMFILES%\eZula
* %PROGRAMFILES%\eZula\mmod.exe
* %PROGRAMFILES%\Common Files\GMT
* %PROGRAMFILES%\Common Files\GMT\GMT.exe
* %PROGRAMFILES%\Common Files\CMEII
The Doormat
If you're not outraged, then you're not paying attention.
From MS:
"If you are using any supported version of Windows other than Windows 2000, you are not at risk from Zotob and its variants."
Windows XP is NOT Windows 2000.
---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"
Where are my mod points when I need them?
Microsoft says this virus has medium impact, not low as the submitter says. Is the submitter perhaps spreading some FUD of his own or did MS upgrade the threat?
I leave the FUD to others. Before accusing someone, check your facts.
That's so funny, it's almost worthy of its own number... maybe Catch 22.314159265 or something impossible to remember.
Another client of ours experienced some small amount of decision-making and communication chaos early in this worm outbreak. Some division managers instructed (many thousands of) users to unplug their computers from the network to prevent infection. This is a reasonable enough strategy, I suppose, but now they are strugging with the question of how to get these people to connect back to the network when they can't... wait for it... check their email!
They are working up phone trees -- an old-fashioned technique employed today mostly by blue-hair bridge clubs, terrorist cells, and desperate IT managers, I gather.
If you mod me down, I shall become more powerful than you could possibly imagine.
Today is Tuesday Aug 16, 2005 8:50 EST
c /data/w32.zotob.a.htmlc /data/w32.zotob.b.html
c /data/w32.zotob.d.html
c /data/w32.zotob.e.html
From securityresponse.symantec.com, the threat assessment included when patterns were released.
Zotob.A Aug 14 http://securityresponse.symantec.com/avcenter/ven
Zotob.B Aug 14 http://securityresponse.symantec.com/avcenter/ven
Visit this link --> Zotob.D Aug 17 http://securityresponse.symantec.com/avcenter/ven
Note the
Virus Definitions (Intelligent Updater) *
August 17, 2005
Virus Definitions (LiveUpdate(TM)) **
August 17, 2005
Zotob.E Aug 16 http://securityresponse.symantec.com/avcenter/ven
Well Hmm... is Zotob D scheduled for release tomorrow.
Perhaps Symantec should invest in some of those Desk calendars to schedule the virus releases.
Seriously,
for the suxxors who rely on Symantec Live update, they will have to wait another day to get virus patters for viruses out TODAY.
While anyone with smarts enough to manually download the so called intelligent updater can have today's patterns.
Just why Symantec waits, I suppose is so Press consumer pain can and is generated about infections which only boost sales. Or presuming no ulterior motives, its because their download servers are weak and can't update same day scheduled over the whole day for their paying user base. I seem to remember AOL being sued ( and end users winning) for over selling service lines and having over loaded networks.
Don't know why this came out as Symantec bashing, just they way the note was written.
By the way after replacing NIS 2003 with 2005 with anti spam, my advertising is %1000 more of a pain in the ass and the Ad trash can is missing from the product.
Guess the ad's spam and missing ad trash can is why this came out as Symantec bashing, guess Symantec's bad karma's just making the rounds.
Major media corp IT depts badly behind in patching their systems, news at 11!
Honestly Zotob is a joke. I work IT for a major university thats 95% win 2k and xp, and so far we've had 0 zotob infections. I wouldnt be surprised if we eventually got 1 or 2 here and there with old boxes that arent tied into the domain, but the vast majority of the workstations auto update themselves and hence this is a non issue for any properly run network.
Lawyers, MBA's, RIAA? A jedi fears not these things!
"People tend to panic when all the PCs around them are crashing every few minutes instead of every few hours or days like normal (depending on patch level and usage pattern)."
I don't know if this was intended to be funny, but it cracked me up. I guess I've been out of the industry so long that I foget that Windows admins take hourly or daily crashes for granted. What a sad sad world it must be.
Actually, its because CNN, ABC and NYTimes got a couple of journalist spying on each other to get the news first! So they connect to other network.
But... they are running windows... pff.
No sig for now.
From symantec, it almost sounds like the worm is trying to decrudify your system. It attempts to kill the realplayer, quicktime, gator, and many spyware/malware/adware toolbars. It alsocleans them out of the registry, and deletes their files.
Too bad it also opens an FTP, IRC connection, and many others, but I do wonder if it's a variant on code originally intended to clean rather than infest?
I also quite like how MS directs you to complain to the Internet Fraud Complaint Center Web site, I'm sure they really appreciate all the extra phonecalls about infected operating systems...
and for hours, only the international edition of CNN carried it on the front page. The US edition didn't. Actually, BBC wasn't much better, with just a small link on the side at the top of its news page.
I'm not really surprised, just sad. Celebrities hold more interest in the US than most other news stories, and forget international news, unless it involves (some of the many) ongoing wars.
I work at a Fortune 500 Health Care company.
We have been brought to our knee's by this thing.
When I left work there where very few computers still working.
"CNN's network admins suck."
Checking my firewall logs, I have zero portscans on port 445.
... and will get more so as all the Mac users laugh their asses off at the stupid WinPC users they still have left.
FUCK MICROSOFT JUST REFUSE TO USE THEIR SHIT
So, MS, who desperately wants the 50% or so of entrenched businesses still on 2000 to upgrade, claims this worm is "low impact" hmm?
Clearly, MS is implying the solution is to upgrade to XP. From their site: If you are using any supported version of Windows other than Windows 2000, you are not at risk from Zotob and its variants.
How convenient! Really, why do I think the first answer to Bill's brainstorming marketing session on "How do we get people to move off 2000?" was some smart-ass saying "Well, we could always write a virus or worm for it."
After all, any notion of "irreperable harm" from security threats has vanished in the onslaught on the Windows hegemony. One little, "not so bad" worm wouldn't really hurt the Windows reputation any more than it already has been, and it sure would be a nice kick-in-the-pants for those businesses sitting on the 2000 fence.
Just saying^H^H^H^H^H^Hpostulating.
I may have been sub-consciously trawling for funny mods.
If you mod me down, I shall become more powerful than you could possibly imagine.
Accusation? RTFP. I asked (a) or (b). Others already answered (b). No need for you to jump in.
works at a call center in Oklahoma for Farmers Insurance, they had all 2000 workstations in their call center rebooting every 60 seconds today.
What is slashdot?
Convenient for this to hit when Microsoft tries everyone to switch to Windows XP.
I know MS is just sitting in a room saying, I told you so!
I know its unlikely, but what if MS is the author of the worm? They have the source so they know how to infect things quickly. Kind of makes me wonder... Is MS preparing for a world takeover?
Ken, my friend: you're not listening in on the right group of "hackers" if they're talking about scanners written in VB script. You would have probably had better luck in #metasploit "eavesdropping" on all the people asking about Windows-related compiler errors..
Well, strictly speaking not forever. They do dabble about with orange now and again.
If you mod me down, I shall become more powerful than you could possibly imagine.
Well, a botnet could certainly be used to perform some Google queries, and simulate clicks on google ads, generating revenue. A relatively small botnet, given relatively subtle enough instructions, might not even trip the Google fraud alarms.
If you mod me down, I shall become more powerful than you could possibly imagine.
No, you're not dreaming. I got the same message when Mozy Suite tried to connect.
The fact that CNN and other companies with large computer networks became infected due to a known exploit should only serve as an embarrassment for their IT organizations failures to apply regular security patches and/or employ adequate security measures (e.g. Up to date anti-virus products on all client machines, regular security patch deployments to client devices, etc.) In other words, these companies should be asking their IT directors why they failed to deploy security updates that ultimately end up costing significant amounts of money in time and resources which would otherwise be productive on other tasks.
Basically, the subject says it all.
Now that Microsoft is checking PCs for valid installation keys before you can get security updates, it won't be long before pirated installs of XP become a host for all sorts of nasty shit. And because it's pirated, they will not be able to prevent further revisions of this virus from infecting their PC and thus spreading it around perpetually.
Fuck, there goes my low ping rate for multi-player gaming due to the increase in traffic...so I would imagine.
Life is not for the lazy.
DISCLAIMER:This comment may be FUD...
Seeing as Microsoft stopped supporting Windows 2000, wouldn't this seem like a nice co-incidental way of "encouraging" users to upgrade to Windows XP??
Of course, one could always go to a pirated version of XP... Why pay for a simple security upgrade, after all?
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
No argument here. But we were talking about a virus. Apple is not releasing patches because it has been attacked, but rather because they (or someone) are testing and debugging their own work. It's quite a differnt circumstance than running around the planet trying to reboot crashed machines or prevent an immediate threat from crashing your machines. Are Apples perfect, of course not. It was just a joke... Someday someone will feel the need to write an Apple virus. Its envitable.
this virus was developed by MS to encourage just that action.
I prefer the "u" in honour as it seems to be missing these days.
Has anyone else noticed that according to the Symantec security response page, this virus removes several common spyware files? kills process, removes registry entry, and deletes. I suppose it does this so that it will have the machine's internet connection mostly to itself, but I find that fascinating.
Emory: Uh..we're still..beta testing that.
Oglethorpe: What you're testing is me and my patience!
anyone notice it is deleting these files;c /data/w32.zotob.d.html
now if it just woulnt reboot the computer.
%PROGRAMFILES%\MyWebSearch
%PROGRAMFILES%\MyWebSearch\*.exe
%PROGRAMFILES%\Hotbar
%PROGRAMFILES%\Hotbar\*.exe
%PROGRAMFILES%\MyWay
%PROGRAMFILES%\MyWay\*.exe
%PROGRAMFILES%\180Solutions
%PROGRAMFILES%\180Solutions\*.exe
%PROGRAMFILES%\EbatesMoeMoneyMaker
as per http://securityresponse.symantec.com/avcenter/ven
When linux runs all of my windows games flawlessly, has support for any $20 802.11g card, and lets me use my sound card without dealing with .diff files and make config(menuconfig)(xconfig) etc.
Only the State obtains its revenue by coercion. - Murray Rothbard
The War Against Terror.
and the like are all in a hard place.
As much as they would like very much to have a stable OS (OS X, Linux, BSD. any stable OS, dag nabbit,) they have developped software on their own for their own purposes (Microsoft doesn't make everything, ya kno',) and their budgets don't allow for the kinds of redeployment costs associated with a new OS or even a new version of an old OS. (The roll out costs to Microsoft's clients dwarfs the cost of the OS. If only it wasn't a POS.)
I was working at a client's who were heart-broken when WinNT got end-of-lifes. They had to gear up for deployment of 20 or 30 THOUSAND systems to Win2K...
And poor ol' Microsoft can't upgrade the APIs like they need to because of clients like mine. (Which is why also Linux is having a hard time getting in. It has to WORK from the 'get go.')
Fuck the GUI, its the API that are the hold up.
And as long as Windows can't change the APIs they don't have the lattitude to change the OS so stupid shit like this worm can't happen.
If Linux can deliver APIs that are the same as Windows, its got it made. Until then, its out in the cold.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
Sincerely,
The People Who Also Care About The Difference Between Theft And Copyright Infringement and The Difference Between Rollerblades(tm) And Inline Skates
I don't know if this was intended to be funny, but it cracked me up. I guess I've been out of the industry so long that I foget that Windows admins take hourly or daily crashes for granted. What a sad sad world it must be.
Really? If my PC had crashed anytime within the last three years I'd of been pissed.
win 2k and win xp properly maintained don't crash.
anyone who says otherwise is spreading fud.
_ _ _ Go for the eyes Boo! GO FOR THE EYES!
you know why they go with old tech.
:-)
It not just that they'e cheap bastards (though they probably are.) Its the APIs.
If you can get Linux systems that can implement those same APIs, they're in. Microsoft isn't everybody's darlin' by a long shot.
And I'm sure the Chief of the Boat who got stopped dead in the water by the divide by zero error in WinNT would disagree with your last statement.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
I mean, if what your saying is true, it does not make ANY sense that the coroporation behind this would do it to the extent that it is.
People from fortune 500 companies, major media outlets and the capitol were hit hard today.. and it's spreading.
There is NO benefit to the attackers (if they are coroparate related).
They (when/if found) will have a black mark on nearly everyones mind, because the attack goes BEYOND removing silly spyware.
Machines are being brought down en-mass and the publicity is NOT good.
Maybe your still right though, after all, marketing companies have not always been known to be the brightest chocolates in the boxen ;)
I will gladly loose all of life's battles.. in order to win the war..
After reading one of the Symantec links, I noticed it appears to remove/disable a number of ad-ware programs.
So, you can tell if your computer is infected by it starts running cleaner!
And does this explain this virus writer's rationale? The end justifies the means?
I love these worms - I really do.
:)
Just goes to show you all the stupid people out there that don't patch their systems
Plus it's good to watch the media get in a big frenzy about it... not to mention all the monetary costs this will incur!
This is what I call entertainment.
We have secretly replaced these Slashdot mods' sense of humor with a rusty nail. Let's see if they notice!!
who hasn't looked at the price in years and who thinks his time is worth nothing.
MSBPodcast.com The opinions expressed here are my own. If you don't like 'em... Think up your own stuff.
Microsoft, a few days ago: "Worms are coming. Here's the patch. Secure your systems."
NYT/CNN/ABC: "Yawn. We don't see any worms. Stop trying to scare us. It's acceptable to lose a few LANs so we don't have our right to pr0n infringed, or something."
Today: Worm hits.
NYT/CNN/ABC: "It's Karl Rove's fault!"
FOX: "Our networks are fine. Who's the dumbass now?"
Microsoft: "Good thing people too stupid to run Windows Update are also too stupid to run Linux."
Well, the virus knocked out a significant part of the Sony Electronics intranet today. I'm just finishing a 16 hour day because of it.
need to 'deal with it'.
I think he runs Linux :)
sooooo, i guess you 'need to deal with it'.. too.
I will gladly loose all of life's battles.. in order to win the war..
I don't know if this was the cause, but all the internet access at IBM was dead from about noon today. This is rare. I think maybe they killed the firewall systems until they had a good ruleset.
There is no
Or do you want to be the one to tell ALL THOSE PARENTS that there isn't one?! ;)
I will gladly loose all of life's battles.. in order to win the war..
May be referring to the release time difference between the vulnerability announcment (and patch) to the exploiting code.
Slammer exploited MS02-039 which had been available 185 days.
Zoton exploits MS05-039 which has been out 4 days...
All women want is honesty, if you can fake that, you're in.
win 2k and win xp properly maintained don't crash. anyone who says otherwise is spreading fud.
Rubbish. Anyone who uses 2000/XP for video editing or other high load applications will tell you it often has problems, crashes and lockups under heavy CPU/RAM utilisation. Likewise, there are plenty of applications, including MS Office, that can take down the OS when they fail.
Anyone who says otherwise is astroturfing.
"I've got more toys than Teruhisa Kitahara."
Making queries to google? Sounds like a very round-about way to search google. What is the purpose of this?
To increase the website hit of this virus creator?
If you delay pleasure infinitely, the pleasure will be infinite. (YM)
on the informationweek.com site? I get an error message box with random error messages each time I try the site. When I close the box Firefox locks up. One error message was about SSL not running and the other was an 'incorrect message or error' from their server.
My first thought was that this was another foolhardy attempt at a white-hat worm, where the intention is to help clean a victim's machine, maybe of a lot of malware...
But having just spent an all-nighter in the office cleaning up the B variant, this new D doesn't do nearly enough to actually fix the damage.
What really pisses me off about Windows, is that this worm somehow has enough permissions to delete other worms in %SYSTEM%, but I, as an Administrator, don't.
Microsoft: please, for the love of god, implement KILL -9. Without a reboot. Thanks.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
So now there is this mad dash by the news corporations because they are probably feeling it worse than the people they are reporting to.
I mean sheesh I just saw Anderson Cooper and he was gripping the table white-nuckled and looking way frazzled.
Been using NT4, W2k, WXP, since '99, NO crash ever. I don't know what bozo does to crash his box, but if you know these types of people, it says more about you than anything.
the vast majority of the workstations auto update themselves and hence this is a non issue for any properly run network.
:)
Ha.
HAHA.
Let me repeat: HAHAHAHAHAHA.
Here in the business world, we have these machines called servers. They, like your workstations, often run Windows. However, unlike a university workstation, they cannot just be rebooted willy-nilly because of an "auto-update". These servers will actually be used, 7x24, by other people, and in order to take them offline to apply a patch, you need to actually co-ordinate this, or you could potentially lose huge amounts of data.
There's also the issue of OS patches breaking applications, which happens a good 3-4 times a year. Sometimes it's no big deal, other times the company can lose tens of thousands of dollars a day in lost productivity. Hence, we need to actually test these patches manually, on many differing systems, in order to know we're safe to roll with it.
For the record, the time between patch and worm was 5 days. 3 of those working days. You have a very bizarre sense of "badly behind in patching".
The real news story is: you work at a university. It matters very little if your shit breaks, which is why this is a non-issue for you. However, in the real world, it matters. It matters a lot. Which is why you're seeing news about it.
Of course, why anyone would run critical systems on Windows is beyond me, but then again, I don't pay the bills. I just write them up
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Ah, the rarely seen autoslashdot effect...
"The virus is spreading around the world rapidly as compromised systems become bots and propagate the worm"
Make up your minds already.
"Oppression and harassment is a small price to pay to live in the land of the free." -- Montgomery Burns.
HO HO. Nice fucking bullshit. Maybe if you just use your computer every once in a while and don't install hardly anything. But no doubt your the hard core power user, and you just happen to be the elite windows fixer upper, and yes, your computer has never malfunctioned in the LAST 3 YEARS. But I call fucking bullshit. How's come I don't know 1 single person who runs Windows XP that has been as lucky as you and others like you with similar claims? Sure, some people I know started off claiming things like that, but as they realized that I wasn't buying it and as I was up front with them about my operating system's flaws, they too became a little more honest. Nice BULLSHIT, though!!!!!!
I was watching CNN Headline News about this, and, although they didn't out-and-out lie, they sure made it sound like Microsoft had released the patch today. Of course, the patch has been out since the 9th.
Anyone dumb enough to run Windows should be smart enough to check for updates daily. . . . wait, does that make sense?
From Microsoft's info page:
Customers who believe they have been attacked should contact their local FBI office or post their complaint on the Internet Fraud Complaint Center Web site.
Ummm...
"Hello, FBI? Yeah, hi. This is Pat. Listen, I've noticed my computer has been running a little slow lately. Yeah, more so then usual... Well, I heard about this new worm virus on the news... Yeah, I know I should run a virus scanner... Yes, I'm aware that the FBI does not troubleshoot and provide support for PCs... No, I don't expect you to launch a huge investigation because I suspect I *might* have been infected... Of course I'm aware that even if I was infected, there's really nothing the FBI can do about my particular case. . . . What do you mean 'Why am I calling you'?? Microsoft said I should!!"
The Internet is generally stupid
but think of it: a worm that hit media sites running older versions of Windows, with lots of exposure, which might cause users to feel compelled to switch to a newer, shinier MS OS. Wonder who released this into the wild?
As if we don't know that answer.
I will gladly loose all of life's battles.. in order to win the war..
I work at UPS processing international packages. Today I was not able to enter invoice data into the computer. The program called "UPS Mainframe" was inaccesible. I could not get the UPS website from my work computer. I could not print tracking labels to stick them on invoices. I could use a scanner to image invoices for customs, but the images would not upload to the server. I had to fax my invoices to a bigger hub so that they would enter them there. They told me just to fax the express invoices not 2nd day air or ground. Other people at UPS had also problems all day because of this. I am not a programmer so I don't know that much about computers, but I know enough.
You might want to run memtest86 on that machine... Every time I've had stability problems with WinXP it's been bad hardware.
-You're only as clean as your towel.
Do you know how long it took me to get my video editing box's stable.
Not even just system tweaking, proper drivers that don't flip out, but just nixing the heat issues.
So yeah, I have fairly stable prem pro 1.5 systems with canopus dvstorm2 cards. It's possible sure, but it takes some planning and work because the load will bring out bugs faster then a workstation that uses word all day.
Haven't yet dived into building HD editing stations, but I'll let the solutions mature (and cheapen) a bit before that.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
Odds are that the "real" techies aren't photogenic enough to put them on the air, or capable of writing plain enough english that CNN could at least give them a pass at their scripts before giving the script to Daniel to read.
If I had to hazard a guess, I'd say the support staff pushed to deploy at least the critical patches to all of CNN shortly after the patches and public exploit code were released (Tuesday and Thursday of last week), but got pushback on any sort of "hasty" deployment of patches to systems "critical to broadcast operations".
CNN is a 24-hour product, so if they couldn't schedule downtime in the past couple of years to migrate off Windows 2000, why expect that they would be able to take an outage in the past week to install patches?
I do not deploy Linux. Ever.
To quote directly from the handler: Funny, ISC has since edited the diary to remove this text?
This is a good point -- looking at network traffic right now, the Zotob variants all target primarily (only?) hosts in the same /8 or /16 network as the infected workstation.
This means that once somebody brings an infected laptop into a mid-to-large sized organization that is built on just one or two highly-populated network ranges, the worm will swiftly infect all available targets in that network.
I could almost speculate that the target generation code is written intentionally to make this a slow-spreading low-impact worm on the Internet overall, but much more effective once it gets inside a target-rich corner of the network (private or public). Almost.
I do not deploy Linux. Ever.
"Do you know how long it took me to get my video editing box's stable"
You keep your video editing box in a stable?
You work at a university, right?
There is only a patch available for Windows 2000 SP4, and everybody know SP4 has many problems that were never resolved.
It knocked out United Parcel Service's Data Aquisition system nationwide.
If your packages arrive late tommorrow, that's why.
"How's come I don't know 1 single person who runs Windows XP that has been as lucky as you?" Because you don't have many friends? Or maybe because everyone you know buys the same crap hardware as you? My home PC only ever reboots when I tell it to, and the uptime is fantastic. Maybe not 3 years, but that's just a retarded thing to say. But then this is /.
No offense intended, but, did you ever turn these machines on?
Think about it. It gives them a sense of purpose and a familiar task to deal with. What's more they're heroes for then working extra to put out the MS-viruses. What's not to like? If they had chosen a system that was immune or at least resistant, then they'd have none of that satisfaction or recognition. How many IT folk hear a thanks for 100% uptime on servers OR workstations?
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
It needs to bring Fox news down also. Of course they will declare it the first round of a new jihad aimed at American values.
Wow, what a friendly virus. Looks like it also tries to clean up some spyware for you.
some smart-ass saying "Well, we could always write a virus or worm for it."
You left out the critical part on the cutting-room floor:
some smart-ass saying "Well, we could always write a virus or worm for it." Bill turns to face the guy who made the suggestion, affectionately known in this InnerCircle as WHiteyHat, and nods and winks almost imperceptibly while saying, "Aren't you supposed to be making a PowerPoint presentation for one of your clients?"
At this point, everybody turns to look at the guy, who still doesn't get it, until the light bulb lights up. Bill raises both eyebrows as if to say, "Well?", and the guy leaves the meeting...
this worm somehow has enough permissions to delete other worms in %SYSTEM%, but I, as an Administrator, don't.
Usually, when I could not kill a task, it was because another one was watching it, and restarting it if it was killed. Rebooting in safe mode and removing the tasks from the registry (HKLM/..../Run) worked.
Microsoft: please, for the love of god, implement KILL -9. Without a reboot. Thanks.
I also prefer ps and kill to the Task manager, but that is just personal preference and cosmetics. In such a case it wouldn't make a difference. In Unix too, if inittab keeps re-spawning a process, kill -9 doesn't help until inittab is fixed.
I guess I've been out of the industry so long that I foget that Windows admins take hourly or daily crashes for granted.
Sorry, but the companies where that happens should really hire competent people instead of letting the secretary manage their IT infratructure. We use winxp, but crashes are extremely rare (say... 1 per year or so). Severely restricting users' privileges to mess with the system helps a lot of course...
If you use decent hardware, and install the OS + software correctly, windows XP can be rock stable too, just like linux (although the latter one tends to be a bit more forgiving in certain circumstances).
(OK, now mod me down with this if you're a linux zealot)
I spent the weekend helping a friend remove various viruses and spyware from her (Windows) machine. A common theme in these is that they write values to the HKLM\Software\Micro$oft\Windows\Run or RunServices entries of the Registry.
Some of these even have background process that will restore their original entry to the registry if you try to delete it. (Of course, once you end the background process, you are able to modify the registry).
My question is: Why isn't writing to the Run or RunServices a restricted privilege? Like when my firewall software detects an unknown process trying to write to a port...a Registry Firewall could warn me about it and let me choose whether to allow such an action or not.
Well i have Windows XP and i wasn't infected. I just update my Windows regularly and don't have such problems. My only real problem is spyware which is a real plague. But last night before i heard the news about this new virus i had a problem with my computer. I was running emule in windows during all day but later when i rebooted my computer to go to kubuntu i had no internet! My ethernet card died. Luckily i had a spare one. Maybe it was the heat that fucked up my card, i don't know.
What you're saying is probably close to true - and a *lot* of ISPs do filter outgoing port 25 traffic.
However, it is beyond me why this is effective. Everyone and their dog will have their e-mail client (for most probably outlook/-express) configured to properly send all outgoing e-mail via. the ISP provided SMTP relay.
If a program uses the standard mail API in windows, those settings will be used and a mail will be transmitted properly through any defined relays. For some reason, the worms choose to implement their own SMTP layer directly atop of the socket layer, rather than saving the work and using the standard API. And *this* alone causes port 25 filtering to be effective.
The first worm that simply utilises the standard mail API will effectively bypass any port 25 blocking.
Why they don't do this already, is beyond me.
I'm in a Fortune 100 company that was crippled by this thing all day on Monday -- we've got security stopping laptop toting people at the door this morning to clean and patch (the laptops, not the people).
If your organization wasn't affected, it may mean that you have top, top IT staff that never miss a thing -- or maybe you just got lucky this time.
At this point it is fairly obvious to me that this is bigger than the Slashdot crowd seems to admit.
clever and amusing sig
Yep, the company I intern at makes its entire business by selling "solutions" to that problem.
Any laptop or desktop logging in without up-to-date virus software and other protections doesn't get access to the network, except for maybe an update server so they can fix themselves.
www.endforce.com
It seems like an interesting concept, at least. I know if they'd required it at my university it would have certainly helped the "plug in an everyone else in the campus attacks you within seconds" problem.
were the mobiles spared ?
If you mod me down, I shall become more powerful than you could possibly imagine.
-If Apple were as popular as Windows, the worm-writers would be writing their worms for Apple
-If Linux were as popular as Windows, the worm-writers would be writing their worms for Linux
-Arrogance isn't funny
This sig is o Unfunny o Funny
Wise man say: "Today is a good day to be using a Macintosh..."
Enjoy your endless punishment, you crazy Winblows users, god created viruses specifically to torture you! It's written in the Bible somewhere. (Big Idiotic Book of Ludicrous Events)
Gadgetoid.com - Gadgets & Games Journalism
Yeah I can attest to the fact that laptops aren't treated differently than desktops.
I'm currently on the last 2 weeks of work at a small business, but we already have a handful of laptops around, and there has been at least one case that my boss has specifically asked a user with a laptop not to plug his laptop in for suspected worm infection, and the user still did anyway, causing an infection throughout the office.
Superficially, it's the (malicious/dangeriously negligent) user's fault. He had done something contrary to what he was instructed to do. But I think the blame should also rest on the sysadmin aka my boss because he should've make sure that laptop users don't have direct communication with the desktops, so even if he did plug it in, it's harder for the worms to spread. For crying out loud, we do have managed switches here that could've done that job.
Sometimes I wonder how many worm infection does it take for an sysadmin to have a somewhat secure setup.
I agree with you here. My personal W2000 system rarely crashed either (because I acted as my own administrator) however other people were often having trouble with their machines and the "official" admins were usually at a loss for what to do, other than replace the persons computer (and when they did that they often forgot to backup/restore the users data resulting in weeks of aggravation). Keep in mind these were people with MCSE certifications who SHOULD have known how to manage these systems better.
My thinking is that the Windows mindset lends itself to sloppy work on the part of the admins. Anything that they can't do with a few clicks seems like too much work for them, and the atmosphere created by existing and past flaws in Windows allows them to often escape responsibility for their poor workmanship... just blame it on hardware or Windows.
To make matters worse, as some of these admins finally DO begin to standardize these systems around a more secure Windows set-up they are often unable to adapt to exceptions. As I've kept in touch with my former colleagues I hear that they often run into situations where the network administrators will centralize controls that prevent them from replacing their own application (i.e. applications that they are being paid to work on) and they treat every user as though the only thing they have the rights to do is open Word or Excel documents. In short, the admins, although there seem to be hundreds of them in a large organization, are total idiots.
This situation, of needing so many admins (because so many of the functions are on thousands of users desktops rather than centralized) and therefor looking for CHEEP admins, is one thing that goes into making TCO for distributed PC systems as high or higher than for the old mainframe systems (especially where the old mainframe has been replaced with a modern equivalent). I think that ultimately much of what we do with PCs will in one way or another be centralized again, whether it is by using something like Cytrix. Or, better yet, a non-Windows solution like LTSP where this concept is more natural.
In the environment I came from, where (1) we were writing our own applications from scratch, (2) security was a BIG concern, and (3) there were tens of thousands of desktops involved, something like Linux using a set of central systems with thin clients for most of the desktops would have been not only a much cheaper solution, but a much more secure and reliable one. One reason I left that line of work was that no matter how many high-priced consultants told them that Windows was the wrong solution they continued to stay with it, always leading me to speculate that something "funny" was going on behind the scenes. Now I can just watch these systems fail from a distance (it usually makes the news) and laugh.
it may be bigger in some networks, and not so big in others. I think it just depends how militant your organization is on pushing patches out. We're very militant in that aspect, and it seems that policy has saved our asses from zotob. Some of the writeups on zoton indicates that if your running win xp sp2, your pretty much immune already. I'd say about 95% of our boxes here are XP sp2, 4% win 2k, and 1% the odd random professor with an unpatched xp sp1 notebook (that eventually i'll have to hunt down and update).
http://www.f-secure.com/v-descs/zotob_a.shtml
Lawyers, MBA's, RIAA? A jedi fears not these things!
> Anyone who uses 2000/XP for video editing ;)
I agree it's a configuration problem
I use windows for the gui, then dump the actual processing to ffmpeg in a X-window I have open from the linux box with the proper config.
Kinda funny that because CNN's IT folks are inept and lazy, CNN's goes out on a limb and publicize this stuff. Had they've got a more responsible sysadmin (eg the parent poster), I doubt we'd be hearing this stuff from them.
But yeah, the bug was reported on SecurityFocus 8 days ago, I recall by Friday, IT new channels already reporting that this bug can become a worm (I went and downloaded the patch. I don't think this was part of Windows Update...). There should've been plenty of time for the admins to respond.
The reason for the fast hacker turn-around, said Ullrich, is that attackers are sharing more and more information. "Malware can only develop as fast as it is developing in this case because of extensive code sharing in the underground," Ullrich said. "The only way we can keep up with this development is by sharing information as efficiently. Read Carefully. The reason hackers develop code quicker then MS is because they share code. Hmmm.. That sounds oddly familiar. ;)
They still have NULL sessions enabled? They still have UPnP enabled? Wow. Next you'll tell me they don't have a policy instructing all domain members to take updates from their SUS/WSUS server everyday.
It's like my plane was diverted to Bizarro World or something.
Or, you don't run Windows 2000. We run Windows 98! muhahahahahaha (financial institutions move slow, and most of our lusers don't know a computer from a hole in the ground ....) Might have something to do with us bein a union shop, too. Luckily I'm not.
It's called, "Living under the Radar."
-FL
If you're in IT for recognition from end users, you have the wrong job. You know you've done well when hardly anybody speaks to you.
Me, I have things to do which are a lot more fun than sponging viruses out of workstations, so I do all I can to keep them from getting in.
Taking my etch-a-sketch and going to hang out in the bathroom till my legs fall asleep.
...the combination of more technically experienced users and less stupidly-designed mail and web clients would make those systems womewhat harder targets, I think.
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
In less than a month, my company has notified over 600 sites that they have been defaced by 'Internet Hackers', and the majority do leave a political message. The flavour of the month seems to be Turkish hackers badmouthing AUS, UK, US and the 'War on Terrorism'.
The remainder are just the equivalent of 'I was here', or 'Our group R0xx0rs'. I think that the reason it has changed is that Internet defacements do not really reach out and touch people like worms do.
InfoSec that matters, when it counts.
Nice...care to pass the "coke-off-monitor" clean up tools?
Thanks for the laugh!
People in cars cause accidents....accidents in cars cause people
If you're in IT for recognition from end users, you have the wrong job. You know you've done well when hardly anybody speaks to you.
Wrong. In my corporation, the people who do the best are the ones with the most "visibility". Those without a lot of visibility get very poor reviews at the end of the year. IT people who spend all their time fighting the weekly virus outbreak get tons of visibility, because they can claim they're heros for working diligently to apply the latest patches and prevent a total catastrophe. They then get awards for this work at quarterly meetings, and usually people who get a lot of awards also get big raises.
Running Linux in this organization would be terrible: the admins wouldn't get any visibility because everything would work smoothly and no one would pay attention. These admins would then get poor reviews because they didn't have any visibility, and would then look for greener pastures outside the company.
It's been a rough two weeks to be using Microsoft Windows 2000. Here is a quick breakdown of the common problems that have surfaced in the last two weeks.
Server: Windows 2000 SP3 with APC PowerChute software 6.x installed.
Issue One: MS05-039.
You have to be SP4 or greater to install. We'll get back to this issue when we're done with everything else that happens if the Fates hate you and you happen to install SP4.
Issue Two: APC Powerchute 6.x
After installing SP4 you reboot...and now you can't reach the desktop. The certificate that lets the powerchute software lauch expired on the 27th of last month. Time to boot to recovery console and disable the APC services. Now you can boot to the desktop again (and update the software later. See APC's website).
Issue Three: Post SP4 security rollup 1
http://support.microsoft.com/kb/891861/
Trying to save time after updating to SP4 you install the rollup to apply several hotfixes in one go. Take a read of the article...there are several things that can happen. My favorite one experienced to date has been the system drive letter changing from C to something else every other reboot. But then again I told the client to not use dynamic disks on the system volume. Anyway, the normal remedy is to uninstall the rollup and wait for the new release (no ETA). So now you're out an hour more time and installing the hotfixes again.
Issue Four: MS Genuine Advantage
For any of the hotfixes you don't have downloaded locally you can always use Microsoft Update, at least if you don't have a pirated version of the OS. To prove this you have another reboot coming to install the latest version of Microsoft update and the Genuine Advantage tool. You haven't done this already for the same reason you're still on SP3. Moving on...
Back to Issue One: you can now install MS05-039 and be secured against the worms.
It's a fair amount of work, but then again the premise either a) you've been lazy or b) the client never got around to testing/validating the software on SP4. Sorry, mainline support stopped a few months ago. That was a wakeup call before the worms appeared.
Just my 2 cents (added to the hourly fee)
Yes, I know the difference. I typically don't make a huge deal to differentiate between the two because they are virtually identical in the PUBLIC conciousness. I guess I just slip into that mode since I deal with non-IT folk all the time.
I agree. Let's streamline the language, since the dumbed down public can't grasp much anyway.
I suggest we refer to all worms, trojans, and viruses collectively as "marklar". I furthermore suggest we refer to those who install, create, use, benefit from, are harmed by, or unnaffect by, said "marklar" "marklar" as well. I would furthermore expand the definition to include all actions by said "marklar" as "marklar", as well (thereby streamlining cause, effect, action, and miliue as one all encompassing, comprehensive concept: "marklar").
Thus, quoting you:
Marklar, Marklar marklar the marklar. Marklar marklar marklar marklar a marklar to marklar marklar the marklar because marklar marklar marklar in the MARKLAR marklar. Marklar marklar Marklar marklar markar marklar marklar Marklar marklar with marklar marklar marklar marklar.
Terminology should always be dictated by, and pandered to, the least common demonintor persons discussing the topic they know nothing about. To do otherwise my be to do the unthinkable: educate the ignornant.
The Future of Human Evolution: Autonomy
That's probably the most generic and incorrect statement I've ever heard.
Want to put a huge strain on your systems components? Go play a first person shooter, like Doom3 or Battlefield2. This is going to tax your system more than video editing will. And if that crashes or locks up, you can take your pick from the typical problems:
1) Cheapo power supplies. Sorry, a $15 power supply is crap. You get what you pay for.
2) Custom cases with little/no ventilation. You need a fan pulling in cool air, at the bare minimum, in combination of your power supply fan exhausting hot air. If you've got a billion hard drives and the latest video cards, you probably should have more fans.
3) Overclocking (CPU, GPU, Memory). Retarded. Enough said.
4) "Enhanced" drivers, or non-WHQL drivers. While WHQL drivers aren't "perfect" (thanks to dis-honest companies) they do ensure that the drivers have met a certain quality level. The tweaked/enhanced driver sets that people install don't have to go through these checks, and do all sort of stupid things (see overclocking above.)
Not All Who Wander Are Lost
If anything Windows will be out in the cold. To secure their system they are going to have to start from scratch with the API. A lot of companies that write custom software, forced to migate their software no matter what, will migrate to Unix-like systems because the API has more of less been set in stone for 20 years, and will remain so for the future.
And should a new API break your code, you can keep running on the old API. It will be supported as long as someone has a copy of the code.
"Learning is not compulsory... neither is survival."
--Dr.W.Edwards Deming
Boy am I glad I still run Windows NT 4.0. :)
We saw some fairly nice areas in both Smyrna and Mableton, and since I work near the Cumberland Mall, they both seemed like a logical place to look for a house.
:-)
In the end, Mableton won.
I'm just south of the EW Connector on Cooper Lake Road. Not in the big new fancy houses, though.
Mainframe/UNIX Bit Twiddler and long time Windows/Linux Hobbyist.
The Theorem Theorem: If If, Then Then.
Oh yeah, let's infect Linux, considering that FOX is smart enough to use that. Or do most /.ers here have a conflict of interest between their views on OSS and politics? Oh yeah, this is /.
Sorry guys, can't have your cake and eat it too (unless you're a conservative who supports OSS, like me.) :)
I agree with your sentiment here. It really bugs me that I can't run my own mail server without having to channel everything through my ISP's mail server just because other people can't handle properly configuring their computers so as to avoid being used as spam launching stations. I purchase internet access, but I don't get internet access... I get a filtered connection that allows me to operate on ports the ISP determines are safe for me to have access to. What comes next? Will my ISP determine what websites are appropriate for me to access, what hours I should be allowed to access, what OS I can use, etc.? I don't like this paternalistic regulating of my bandwidth, I don't think it's necessary, and I think ISPs that do so should be liable for theft of services, but, alas, the only way you can get the bandwidth is to pay what they ask, sign their TOSes, shut up and like it.
-- Gargonia
Never play leapfrog with a unicorn.
Hmm, they're the same company that thinks everyone should be using Internet Explorer. Suuuuurrrree, I'll take their advice. Oh wait my versions of Windows do not have Internet Explorer, let alone any trace of XP. Oh and I don't get infected. Ever. Hmm....
I thought I saw you when we boarded. That was me wearing the Viva La Relativity! T-Shirt.
Yes, not all clients are rational.
If you mod me down, I shall become more powerful than you could possibly imagine.
Now THAT was funny.
That's probably the most generic and incorrect statement I've ever heard.
Um, yeah sure.
Look, I'm sure you mean well, but I've been around video long enough to have played with one of the first Fairlight CVIs to come out. I have nine Windows boxes, two Linux servers and a G4 Mac around the office and edit suite. "Cheapo power supplies", custom cases etc aren't part of this world and neither are FPS games.
Still, since you say so, I'll believe there's some wonderful parallel universe where a magical combination of hardware and configuration settings will let Win 2K/XP work without crashing, and recover cleanly from heavy loads. Trouble is, that world is a long way from this one, where I and my clients spend a great deal of time, money and effort keeping these and other Windows machines up and running.
"I've got more toys than Teruhisa Kitahara."
Can you be more specific about crashing/heavy loads? Like I said, an FPS is going to strain your machine more than any video or audio editing is going to.
Most of the time, when you are dealing with add-in video or audio cards, the companies that make them cut corners in hardware or driver design, or worse, design strictly for Mac (with PC being an afterthought.) This leads to terrible non-WHQL'd drivers, which cause crashes/blue screens/other fun things, and leads people to blame Microsoft when they shouldn't.
Not All Who Wander Are Lost
Worse, my network IDS still catches the various Mickeysoft SQL worms' attempts to propogate. A year later.
Like I said, an FPS is going to strain your machine more than any video or audio editing is going to.
Look, it sounds like you're a young bloke, so no offense, but if you think a few hours playing an FPS is even remotely similar CPU loading to rendering video streams, I'm afraid you don't know what you're talking about.
If you're genuinely interested, there's bound to be a jobbing video pro in your area who wouldn't mind you having a look around - they're generally not too precious about hardware. Just a tip though, try not to be so patronising. We're not all novices out here...
"I've got more toys than Teruhisa Kitahara."
To be fair, crummy third-party software often makes it difficult to run an MS Windows setup properly. And I'm not talking about Sid's Storm Doors and Software Ltd.; I'm talking about well-known products from well-respected companies. Some of them are only well-respected because nobody listens to sysadmin.s anymore.
The world is still lousy with products that have obviously never ever been loaded on a halfway secure box, because when you do, they upchuck and die instantly. Products that have no notion of multiple users. Products that demand world write access to the directories where the program lives, or want everybody to be a member of Administrators. You'd think these people had never seen a modern computer installation.
Windows Installer has been in the field for, what, about *six years* now, and there are still many many big-name products that either don't use it or use it stupidly, making managed installation difficult to impossible. I'm working up a repackage now of a *very* popular product whose latest kitting might have been designed as an example of how *not* to deploy software.
I've taken the approach that our MS Windows setup will be secure *first*, and then the app.s are made to work. We haven't had much instability or many infections, but it's amazing the number of products that won't work out-of-the-box when you set up the platform properly. (It's also amazing the number of tech-support people who will swear up and down that their company's product can't work in an environment like ours, after I've already made it work.)
Bottom line: MS Windows can be stabilized and secured, but when you have a hundred standard app.s stability and security don't just happen; it takes a lot of hard work, a lot of investigation and experiment, and a lot of shouting at suppliers, and it never ends.
I don't know why I keep doing that with the apostrophe lately. I know it shouldn't be there. Damn me. Damn me to hell.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
This article on SC Magazine Apparently there is a war between virus writers and they are all trying to delete each other's viruses. Mikko has provided a lovely diagram to illustrate the point.
The latest gadget news and reviews. www.absolutegadget.com
Heh, yeah. I remember when I lived on campus, at times there'd be warnings not to connect to the internet because you'd get a worm from the other infected hosts on the network. Being a linux user, I just laughed at them.
People tend to panic when all the PCs around them are crashing every few minutes instead of every few hours or days like normal
That's hilarious, in a sad-but-true kind of way. I talk to people all the time who've made the windoze-to-mac switch within the last year, and they marvel at the stability. It's amazing just how low the expectations are among the general population.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."