Slashdot Mirror
ZOTOB Not Quite as Bad as Expected?
GuitarNeophyte writes "Although the worm hasn't been in the wild for very long, ZOTOB and its variants have already propagated on the internet. Many people have been giving reports that it poses risks of infection to almost all Windows Operating systems, but accorning to this article, the claims are a tad overzealous. FTA, 'The worm only spreads to systems running on Windows 2000, XP and Server 2003, and even then, the possibility of the worm affecting Windows XP and Server 2003 are minimal.' "
overblown? I think it all started at the Michaelangelo virus, where the media was telling everyone to turn their computer off on Mikey's birthday? It's gotten worse since then.
From all that I've read on the news lately, it looks like the various variants are battle each other... so they may be keeping their own numbers down.
Hmmm witty sig or funny sig? Maybe elitest techy sig!
I would like to name August the official Worm month.
August 2003: Sobig
August 2004: Sasser
August 2005: Zotob
What's next?
Nouvelles de jeux et technologies en français. TC
It's been pretty hairy here, inside the walls of a Fortune 500 company. Probably because we have so many variations of Windows in our lab, it was all over the place. People who had kept up to date and patched weren't hit bad (I'm on XP SP1), but we were creating ad-hoc teams all afternoon yesterday trying to get things clean.
In some ways, this was a bigger deal than Sobig.
Tim
Zotob is affecting more than Windows machines. Case and point, the network is really slow (via the Windows garbage) which is making Slashdot load slow for me and I am running Solaris. Grr.
Yes! I listen to NYC Speedcore and do math at 3AM. I suggest you try it too.
The Witty worm spread much faster despite the very small base of susceptible hosts (only about 12,000 total that had some old version of some firewall software). Witty had a doubling time of only a couple minutes and nearly saturated (infected all susceptible hosts) in less than one hour.
A modern worm should be able to spread extremely quickly -- sending out hundreds of infectious packets per second if the payload is small (Witty's was only 637 bytes). If only 1 in 10,000 machine is susceptible, then a worm spewing 100 randomly addressed packets per second should double the number of infected machines every 100 seconds. I'd wager that the number of zotob-susceptible machines was much greater than only 1 in 10,000, so zotob should have spread faster. If anyone ever creates a worm that can infect even 1% of IP addys, it would double every second and saturate the net within the first minute or so.
Why didn't zotob spread faster?
Two wrongs don't make a right, but three lefts do.
It's striking how nice the virus writers are to the antivirus companies. Most viruses do just enough damage to require ongoing spending for antivirus tools and upgrades, but not enough to make users switch to, say, Linux. There are exceptions, like the virus that encrypts data on the hard drive and demands payment in E-gold, but those are very rare. Few viruses erase data. Few do things that would make removal impossible without physically opening the computer, like modifying the BIOS so it can only boot from the hard drive. The mainstream viruses seem to be carefully tuned to optimize the revenue stream of antivirus and upgrade vendors.
Somewhere there's a reason for this.
This malware outbreak received disproportionate media coverage, because it hit media outlets first and hardest.
org.slashdot.post.SignatureNotFoundException: ewg
San Diego County Government had 12,000 workstations crash.
People couldn't do ANYTHING connected to the county.
They had 3,000 systems up today.
Wonder if I can apply for the sysadmin job?
You can't talk about Wikipedia's flaws on Wikipedia
Microsoft's decision to no longer patch pirated installations has a few unintended consequences. There is now a base of unpatched machines that any new worm will likely be able to exploit. If a greater fraction of machines are unpatched, a greater fraction of infection attempts will succeed, and the worm will spread faster. A faster-spreading infection means a more legitimate Windows users will be infected before they patch (although the auto-updating feature of Service Patch 2 will help with this).
And of course, that population of never-patched machines affects everyone who uses the internet, regardless of their operating system.
hard to feel sorry for the people still running windows, how many times does the car have to break down on the freeway before you trade the SOB in for something reliable?
what is it called when you continue the same behavior and expect different results?
If you ask me, I find it amazing that businesses still rely on Microsoft.
/'ers hate all things Microsoft, but Windows 2000 is a pretty solid OS. I used it for years and I really don't notice a huge differance in my XP machine now. As far as businesses are concerned, from my experiance on the job, managers tend to resist change. Sort of like the Supreme court slows the rate of change that the executive or legislative branches can make. Managers have there place in much the same way. If they haven't changed, then the people who's job it is to inform them aren't doing their jobs...I.T. PEOPLE. Either that or they haven't a good enough arguement to change.
I know most
Myself I ended up at work 20 hours on Monday this week patching servers. Given that we have about 500 servers in our environment with one person doing the patching this wasn't so bad.
We ended up with a lot of problem because of this worm... less because it actually caused problems with the machines but more because we could see machines constantly trying to infect one another. It wasn't pretty. Our workstations were most at risk, being the largest installed base but also running Windows 2000 SP3 (not SP4 unfortunately). No patch has been generally released for SP3 WS's, but a custom patch IS available from Microsoft if you request it. Due to other factors in play, we have elected to upgrade to SP4 and install the appropriate hotfixes. This is not going to be pretty over about 10,000 workstations.
See, what some people miss when they say that any infection may be due to bad administration is simply that we're dealing with huge numbers of machines, both servers and workstations that are potentially vulnerable. Due to application compatibility and tested standardized platforms we often don't even get the option to keep stuff up to date. The only reason we even have Windows 2003 servers in place today is because we forced the issue with our Corporate guys when we implemented Active Directory; we informed them that we had a need for functionality not provided by Windows 2000 AD (which was true). There is a project currently under way to test Windows XP for rollout, but honestly chances are that Vista will be shipping by the time we even reach 50% rollout mark.
So, why the rant? Well, it must be understood that jumping on the latest patches is not always an option in the corporate environment. Also, jumping on the operating system bandwagon is rarely an option because there's a lot of regression testing that has to be done. Hell, there are some instances where we're having to push the application vendors to support Windows 2003 Servers in our Citrix environment because they've never tested it. Welcome to the realities of Corporate IT.
Are there solutions? Sure! However, none of them are acceptable to most corporations. Linux is not an option, neither is OSX. In both cases we come back to the legacy support issue. Citrix to share the applications? Great... but you're only redirecting the problem to the server farms, not eliminating it. Real world Corporate IT is not as black and white as people would like it to be, myself included.
This virus gained traction because most corporations work this way. It wasn't helped by the fact that McAfee and Symantec both waited two days after the virus was discovered to release a signature update that recognized it.
One positive thing though; this virus is forcing the management to finally listen to my department's complaints that we need to be more proactive about patch management, and this time stuff might get done. We've got a long way to go, but this should be the start of something better.
Of course all your WinXP machines are screwed if you're using a Win2k domain controller... or whatever it is called now.
The worm has been a serious pain, but yeah, not catastrophic where I sit.
I work at a small Canadian bank. The whole company uses w2k desktops. On Tuesday and Wednesday I spent my entire shifts playing poker while around us computers continuously rebooted. Without net access all kinds of rumours developed about how the worm was affecting the rest of the world. Our only communication with management was occasional typewritten faxes.