Slashdot Mirror
"Dasher" Worm Brings Christmas Keylogger
An anonymous reader writes "A worm called 'Dasher' is exploiting a flaw in Windows that Microsoft issued a patch for in October, dropping keyloggers on infected machines, according to F-Secure. The SANS Internet Storm Center warned earlier this week about the weird traffic generated by the first version of this worm, which apparently was crippled by programming errors. Washingtonpost.com has some information that indicates the worm appears to have originated in China. It appears from the Microsoft advisory that Dasher is a threat mainly to Windows 2000 users, although it could impact Windows Server 2003 and Windows XP users who aren't running SP2." Update: 12/17 17:20 GMT by Z : Fixed link to SANS center.
They can just go ask the NSA what is going on.
Wouldn't sifting through data from potentially hundreds of thousands of machines (for popular viruses/worms) be difficult-to-impossible? Or maybe there's a way to determine which account are, e.g. admins on large IRC servers or otherwise useful.
Most of the desktops that I know that run Win2k are run by schools, universities, etc. I haven't seen someone's PC running win2k yet. Also, these desktops (the ones run by schools, at the library, etc) are usually either (A) very secure or (B) no one expects them to be secure. So this could be worse, I think.
This could be a major problem if it infected SP2 computers.
http://www.TheGamerNation.com/Forums
As most people haven't upgraded to SP2 yet I guess most XP users are potential victims.
The True FOSS Skype Replacement
Didn't I just read somewhere that Microsoft was upset with the penetration of SP2 for Winxp?
The next day an article comes out saying that only SP2 will save you!
If Fox News finds out some people are calling it a Holiday Keylogger, there could be hell to pay.
From the advisory link:
Affected Software:
Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 - Download the update
...
A holiday keylogger called Dasher. Could we call whoever wrote this a scrooge? Howbout a grinch? The cuteness doesn't stop here folks!
I write some PERL using Vim
Keylog THAT if you dare
The Grinch uses a Mac.
go get it
FTFS: "... The SANS Internet Storm Center warned earlier this week about the weird traffic generated by the first version of this worm, which apparently was crippled by programming errors. Washingtonpost.com has some information that indicates the worm appears to have originated in China. ..."
Offshoring gone wrong?
Looks like viruses (spread by infecting exe files) are mostly non-existant today, replaced by network-propagated worms..
And it just hit me that we'd never get any of this if we were not on-line all the time.. Few years ago when the first internet worms were appearing I was like "ahah, just don't stay connected all the time you idiots".
Now I and the majority of folks around the world are "converted" and hopelessly tied to on-line, making us vulnerable to those attacks.
How many minutes can you spend offline, before the reflex kicks in and you try to google up some info you need?
While this still could be worse, you are correct on one thing: Win2k in schools.
Spent the summer working at a local university. There was superfluous opportunity to embezzle a lot of money; as we were instituting their absolutely awful new HR software--which also meant I got to see how much all the bigwigs and upper-administrators (read: idiots puffed full of their own self importance) made off of hard-working students. (I was brought on as a Data Technician; not support or PC repair or what-have-you)
When the machines in our semi-secret office (All W2K) were infected with a virus (Don't ask me, I no longer remember, but I went & read the writeup @ symanted then, which told me it was able to cross-propogate through the network once it landed on one machine) I of course decided to quarantine the bastard myself first... I then realized what I had most feared--that these machines were all set up to Track who was using them; but not to actually restrict Anyone from Anything. Thats right, Joe Schmoe user could do anything he wanted; from registry-hacking to whatever your heart desired.
So; I managed to isolate this guy and the three other viruses that were wandering through the War-Room (thats what we called it); but I didn't purge, at this point I was too intrigued, so I summoned the IT guys.
4 hours later ONE guy (who looks like a plumber, and not even Mario) shows up, and begins, well, piddling (there's no other word for it.... he threw in an admin password and started checking completely unnecessary settings, then attempting to read the reports that their Tracking software creates, presumably to get to the root of the problem) with the machines after pretending he doesn't need me to tell him what I've done so far. His expression gets more and more bored, and after about another hour and a half, he tells my boss (one of them aforementioned admin-types) that he can't find anything wrong, and she should watch 'that new guy'.
I'm pretty sure they heard my jaw hit the floor on the other side of campus. A week later I had recieved the job offer I'd been counting on from the local cable service provider; and I headed for the hills, washing my hands of the whole situation, and terribly glad the only records tying my name to the lpace were strictly paper-based.
I checked in on it with a friend of mine who's a student there. He moved here from China, and is still a little unpolished with his english, but I heard this loud and clear: "Oh my FUCKING GOD man! Half the computers on campus are FUCKED!"
I can only assume that Mr. Plumber did not get anyone to look into the virus.
I have no idea how much that mistake cost the University; but I do know that once it was cleaned out, nothing changed. They are merrily running the exact same sytems setup the exact same way; probably every one of em mapped off the mirror sitting in the IT department.
So yes, I do believe that this could have MUCH wider-effect than you believe.
A couple fans told me that my last journal entry was mint; give it a shot. Hope you like.
sing along now... ..."
"He knows when you've been sleeping. He knows when you're awake. He knows what you're typing.
remember when it was {of|for|by} the people?
I know that all of my home machines, and all of our business machines are all Windows 2000. I know that a *lot* of businesses stopped with Windows 2000 because there's no real compelling reason to go to XP. Although, since it was fixed more than two months ago, there's really no reason for anybody not to have installed that patch by now.
I don't respond to AC's.
...the first version of this worm, which apparently was crippled by programming errors...
Worms with bugs?
Well, if it's from China, it might be an attempt to get sensitive government info. If that's the case, then you could start by filtering down to only keystrokes from .gov & .mil domains. Then it's a matter of looking for short, 6-12 letter words separated by mouseclicks or presses of the enter of tab keys. For the good stuff, look for words that contain a non-alphabetical characters.
This won't get you into systems with multi-factor identification (like a Secure ID-based password), but it can get you the financial and personal data for government workers who might be subvertible as spies through blackmail, extorsion, or just through a simple offer to help them through a financially difficult time. (This is one reason why your credit history is an important part of getting security clearance.)
Of course, if you're just looking for financial data to rob people indiscriminately instead of something far more sinister, you can look for sections of text starting with people entering URLs for banks and so on. It's not that hard to write scripts to troll through this sort of data using simple shell scripting or Perl. As someone who works at a telecom company, let me just say that grep'ing through gigs of text data for particular strings (like a phone number in a transaction record) only takes a matter of a few minutes. It's something for which you open up Slashdot to read a single article and then come back.
No, sifting through this kind of data wouldn't be a technical or resource challenge in the slightest. Receiving and storing it would be the hardest part of the whole operation after actually writing the code to take advantage of the exploit. Extracting data from text files is monkey work.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Just another scam to 'prove' you need to pony up the cash and upgrade?
---- Booth was a patriot ----
... the big question is why haven't people patched?
Well I will tell you. They don't as Microsoft NEVER EVER release just a `fix' patch. It is bundled with other patches that break lots of things. So people either:
a) Can't as it fubars their system.
or
b) Too scared what it breaks. [I still get very nervy at work when applying these patches to servers - you never know - nor guarantee - if it will ever come back up again or just get BSOD.]
It is about time MS started to just issue a patch to fix ONE of their flaws instead of loading it with other `upgrades' the users doesn't want or need - or even just do 'one at a time'.
The worm posts data collected to a specific server. Isn't that kind of evidence that could be used to determine who's responsible for it?
Spending less time online is not the answer. That's like seeking to decrease the number of car accident related deaths by requesting that people drive less. This latest worm, like many before it, exploits a service that is tied to... wait for it... IIS and MS SQL server. These two services:
A) Have virtually no use to most users (I guess some software uses MSDE *puke*)
B) Should not be exposed on a public IP (a.k.a. you should be running a firewall)
A $55 firewall would significantly impede the spread of worms like this.
IMO, responsible ISPs should distribute network devices that at least perform NAT when issuing IP addresses to computers behind their connection. In FL Bellsouth DSL issues a Westell router/modem. It's a pretty decent little device. It handles DHCP, NAT, offers bridged ethernet mode, and has decent support for port forwarding. You can connect it to a $15 5-port switch and connect up to four computers with zero additional configuration. Cable providers seem to be the worst about issuing modems that pass the public IP on directly to the device connected to it.
To make a long story short, we don't need to spend less time online, we (and ISPs) just need to be responsible about how we connect.
I agree that XP users should upgrade to SP2, But something makes me think that Dasher really does effect SP2 and Microsoft is just trying to get people to upgrade to SP2 regardless... "Dasher is a threat mainly to Windows 2000 users, although it could impact Windows Server 2003 and Windows XP users who aren't running SP2." Either way, I hope they get this fixed soon, thats a little scary that they thought they had this exploit fixed :P
You're safe from keyloggers if you use Dasher.
Escher was the first MC and Giger invented the HR department.
Even if you have the most primitive and complete of keyloggers you can roughly say this about how a login/password pair should appear. A string of characters, usually no spaces, followed by a tab, followed by a string of characters+numbers no spaces followed by an enter. Yup that is the way you fillin an online login.
The kind of sites you are intrested in usually require a number to be part of the password and very few "real" words have numbers in them. Provided you are not keylogging a script kiddie it should be easy to filter out passwords.
Sure attacking them to somewhere to use requires something more especially with this virus where you have no idea what the user is doing unless you also log that. But that should be too hard. Keylogger just sounds nice but if you can install that you can also install a url logger and active window logger.
Why should you believe what I said? Because I once experimented with a setup like this, stricly on my own machine of course, because like you I wondered how practical it was. It quickly became clear that it was very easy to filter out passwords entered to access the local network from emails I typed. Even code was no problem when I realised that most passwords will not start with a $ (unlike variable names) and the login-tab-password-enter combo stands out like a sore thumb to a regex engine.
Remember one other things, this is not about capturing the launch codes to a nuclear arsinal. Get it wrong and all you get is a access denied error. It doesn't have to be perfect same as email harvesters don't have to be perfect or spam randomizers have to be.
It is like those virusses that try to find game keys, they are extremely primitive and often twarted by such dastardly schemes as not installing in C:\Program Files BUT lets say they are only 0.1% effective. With millions of infected pc's that still gives you thousands of keys.
This keylogger virus (if it works) will probably infect a lot of machines that simply have no intresting info to steal. But if they get a thousand working bank accounts. BINGO!
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
http://support.microsoft.com/kb/905915
WTF?
As I said, no wonder people don't apply patches.
Someone put Christ back into network security.
I hear people claim that MS bundle up multiple fixes and updates in patches, and I'm yet to see evidence of it. In fairness, I haven't really gone looking, but it also doesn't seem logical.
... which was a horrific mess you could break by looking at it funny.
If MS was to bundle other (security) fixes in a patch, they would quickly be identified by reverse engineering the patch and used to exploit as-yet-unpatched systems. There are people who look over these patches in extreme detail, both "white hat" and "black hat" types.
If they bundled other fixes / changes, their business customers would get really, really pissed in a major hurry. Microsoft does NOT want to piss these people off, even with the lock they have on the market. Remember that Microsoft's whole sales pitch right now is about "total cost of ownership."
Given this, I'm inclined to belive the "MS bundles other crap with patches" rumour to be most likely outdated. It could also be something that grew out of a misunderstanding of the difference between security patches, hotfixes, and service packs. I'm more inclined to attribute breakage to a combination of (a) imperfect patch QA and (b) badly written software / malware replacing or patching system DLLs/installing drivers that end up being incompatible with "clean" versions of some of those DLLs installed by a patch. Breakage also used to be common causes of breakage in win9x
I've personally never had issues patching an NT-derived system. I ensure they're clean before patching, and I don't use shoddy software ( in so far as is possible ). In fairness, my only Windows server is NT4 (ugh); I'm speaking mostly about the XP desktops I admin at work and the older win2k machines I've run.
That's not to say that things don't go wrong for anybody, of couse... just that in my own experience they don't tend to do so. Perhaps I'm just lucky not to use $BLAH_POPULAR_DATABASE that likes to patch ntfs.sys, or whatever other ghastly hack people might perpetrate.
worms with bugs:
= UTF-8&oe=UTF-8
e =UTF-8&q=parasites+on+insects&btnG=Search
e s.html
http://www.google.com/search?q=worms+with+bugs&ie
parasites on insects:
http://www.google.com/search?hl=en&lr=&ie=UTF-8&o
Brood Insects:
(pick your favorite hated OS maker...)
www.cals.ncsu.edu/course/ent425/tutorial/carnivor
Now, what happened to Slapper? Is slapper "slappin' ass" somewhere?
We're really in trouble if "Gasher" arrives and actually gouges random chunks of memory or disks.
Funny tho that Dasher was not named "Stroker": It keySTROKES ya; it gives you a STROKin' (where you least hope); and it gives you a STROKE...
Now, if Stroker starts strokin' Dasher, Dasher will be a CRASHER and HEAD straight for the ground like a real ground-pounder... Ground deer, anyone?
(How funny: word image is: "crawler"... how "creepy"...)
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
You could be safe from keystrokin', too, I suppose, but...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
You know you have to feel a little sorry for Microsoft, I mean true it is their OS that has the bugs and other problems in it but if all of the morons in the world would simple run Windows Update MOST of these problems would be eliminated or at least greatly contained. I wish that somehow we could fine people for the damages that their computers cause for not being updated.
And again just to clarify I am not saying that Microsoft gets their patches out quick enough to eliminate all of these bugs but they for exampel have definitely had this one out long enough that this shouldn't be a problem.
http://www.schneier.com/passsafe.html
;)
Why not make keystroke loggers useless? I love this software. Just copy and paste passwords
I did some volounteer service this summer for the local State Historical Society and one of my duties was to sift through and file all the mail that one particular department head had recieved during the past year. Most of it was just superfluous, letters between states, letters to magizines and replies, billing and the like. The one intereting piece that I came accross was notifications from the overseers of account numbers for trust funds and expenditure accounts with money stored in them in the hundreds of thousands of dollars as well as employee social securiity numbers and personal information.
I'm not a dishonest person, but asking someone to sort though information like that unsupervised with absolutely no background check or even proof of identity may one day come back to haunt them.
There are 1000s of reasons to stay away from Linux.
:)
Just hug that WinBox and have a nice day
QONQR (tm)
Now Dasher! now, Dancer! now, Prancer and Vixen!
On, Comet! on, Cupid! on Dunder and Blixem!
a new drm business model for the MPAA and RIAA.
Oh crap ... I meant to post that anonymous. Apologies to everyone ;-)
Read Heinlein's 1953 Revolt in 2100, now more than ever.