Slashdot Mirror
"Dasher" Worm Brings Christmas Keylogger
An anonymous reader writes "A worm called 'Dasher' is exploiting a flaw in Windows that Microsoft issued a patch for in October, dropping keyloggers on infected machines, according to F-Secure. The SANS Internet Storm Center warned earlier this week about the weird traffic generated by the first version of this worm, which apparently was crippled by programming errors. Washingtonpost.com has some information that indicates the worm appears to have originated in China. It appears from the Microsoft advisory that Dasher is a threat mainly to Windows 2000 users, although it could impact Windows Server 2003 and Windows XP users who aren't running SP2." Update: 12/17 17:20 GMT by Z : Fixed link to SANS center.
They can just go ask the NSA what is going on.
Wouldn't sifting through data from potentially hundreds of thousands of machines (for popular viruses/worms) be difficult-to-impossible? Or maybe there's a way to determine which account are, e.g. admins on large IRC servers or otherwise useful.
Most of the desktops that I know that run Win2k are run by schools, universities, etc. I haven't seen someone's PC running win2k yet. Also, these desktops (the ones run by schools, at the library, etc) are usually either (A) very secure or (B) no one expects them to be secure. So this could be worse, I think.
This could be a major problem if it infected SP2 computers.
http://www.TheGamerNation.com/Forums
Didn't I just read somewhere that Microsoft was upset with the penetration of SP2 for Winxp?
The next day an article comes out saying that only SP2 will save you!
If Fox News finds out some people are calling it a Holiday Keylogger, there could be hell to pay.
From the advisory link:
Affected Software:
Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 - Download the update
...
A holiday keylogger called Dasher. Could we call whoever wrote this a scrooge? Howbout a grinch? The cuteness doesn't stop here folks!
I write some PERL using Vim
Keylog THAT if you dare
Looks like viruses (spread by infecting exe files) are mostly non-existant today, replaced by network-propagated worms..
And it just hit me that we'd never get any of this if we were not on-line all the time.. Few years ago when the first internet worms were appearing I was like "ahah, just don't stay connected all the time you idiots".
Now I and the majority of folks around the world are "converted" and hopelessly tied to on-line, making us vulnerable to those attacks.
How many minutes can you spend offline, before the reflex kicks in and you try to google up some info you need?
While this still could be worse, you are correct on one thing: Win2k in schools.
Spent the summer working at a local university. There was superfluous opportunity to embezzle a lot of money; as we were instituting their absolutely awful new HR software--which also meant I got to see how much all the bigwigs and upper-administrators (read: idiots puffed full of their own self importance) made off of hard-working students. (I was brought on as a Data Technician; not support or PC repair or what-have-you)
When the machines in our semi-secret office (All W2K) were infected with a virus (Don't ask me, I no longer remember, but I went & read the writeup @ symanted then, which told me it was able to cross-propogate through the network once it landed on one machine) I of course decided to quarantine the bastard myself first... I then realized what I had most feared--that these machines were all set up to Track who was using them; but not to actually restrict Anyone from Anything. Thats right, Joe Schmoe user could do anything he wanted; from registry-hacking to whatever your heart desired.
So; I managed to isolate this guy and the three other viruses that were wandering through the War-Room (thats what we called it); but I didn't purge, at this point I was too intrigued, so I summoned the IT guys.
4 hours later ONE guy (who looks like a plumber, and not even Mario) shows up, and begins, well, piddling (there's no other word for it.... he threw in an admin password and started checking completely unnecessary settings, then attempting to read the reports that their Tracking software creates, presumably to get to the root of the problem) with the machines after pretending he doesn't need me to tell him what I've done so far. His expression gets more and more bored, and after about another hour and a half, he tells my boss (one of them aforementioned admin-types) that he can't find anything wrong, and she should watch 'that new guy'.
I'm pretty sure they heard my jaw hit the floor on the other side of campus. A week later I had recieved the job offer I'd been counting on from the local cable service provider; and I headed for the hills, washing my hands of the whole situation, and terribly glad the only records tying my name to the lpace were strictly paper-based.
I checked in on it with a friend of mine who's a student there. He moved here from China, and is still a little unpolished with his english, but I heard this loud and clear: "Oh my FUCKING GOD man! Half the computers on campus are FUCKED!"
I can only assume that Mr. Plumber did not get anyone to look into the virus.
I have no idea how much that mistake cost the University; but I do know that once it was cleaned out, nothing changed. They are merrily running the exact same sytems setup the exact same way; probably every one of em mapped off the mirror sitting in the IT department.
So yes, I do believe that this could have MUCH wider-effect than you believe.
A couple fans told me that my last journal entry was mint; give it a shot. Hope you like.
sing along now... ..."
"He knows when you've been sleeping. He knows when you're awake. He knows what you're typing.
remember when it was {of|for|by} the people?
I know that all of my home machines, and all of our business machines are all Windows 2000. I know that a *lot* of businesses stopped with Windows 2000 because there's no real compelling reason to go to XP. Although, since it was fixed more than two months ago, there's really no reason for anybody not to have installed that patch by now.
I don't respond to AC's.
...the first version of this worm, which apparently was crippled by programming errors...
Worms with bugs?
Well, if it's from China, it might be an attempt to get sensitive government info. If that's the case, then you could start by filtering down to only keystrokes from .gov & .mil domains. Then it's a matter of looking for short, 6-12 letter words separated by mouseclicks or presses of the enter of tab keys. For the good stuff, look for words that contain a non-alphabetical characters.
This won't get you into systems with multi-factor identification (like a Secure ID-based password), but it can get you the financial and personal data for government workers who might be subvertible as spies through blackmail, extorsion, or just through a simple offer to help them through a financially difficult time. (This is one reason why your credit history is an important part of getting security clearance.)
Of course, if you're just looking for financial data to rob people indiscriminately instead of something far more sinister, you can look for sections of text starting with people entering URLs for banks and so on. It's not that hard to write scripts to troll through this sort of data using simple shell scripting or Perl. As someone who works at a telecom company, let me just say that grep'ing through gigs of text data for particular strings (like a phone number in a transaction record) only takes a matter of a few minutes. It's something for which you open up Slashdot to read a single article and then come back.
No, sifting through this kind of data wouldn't be a technical or resource challenge in the slightest. Receiving and storing it would be the hardest part of the whole operation after actually writing the code to take advantage of the exploit. Extracting data from text files is monkey work.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
... the big question is why haven't people patched?
Well I will tell you. They don't as Microsoft NEVER EVER release just a `fix' patch. It is bundled with other patches that break lots of things. So people either:
a) Can't as it fubars their system.
or
b) Too scared what it breaks. [I still get very nervy at work when applying these patches to servers - you never know - nor guarantee - if it will ever come back up again or just get BSOD.]
It is about time MS started to just issue a patch to fix ONE of their flaws instead of loading it with other `upgrades' the users doesn't want or need - or even just do 'one at a time'.
The worm posts data collected to a specific server. Isn't that kind of evidence that could be used to determine who's responsible for it?
You're safe from keyloggers if you use Dasher.
Escher was the first MC and Giger invented the HR department.
http://support.microsoft.com/kb/905915
WTF?
As I said, no wonder people don't apply patches.
I hear people claim that MS bundle up multiple fixes and updates in patches, and I'm yet to see evidence of it. In fairness, I haven't really gone looking, but it also doesn't seem logical.
... which was a horrific mess you could break by looking at it funny.
If MS was to bundle other (security) fixes in a patch, they would quickly be identified by reverse engineering the patch and used to exploit as-yet-unpatched systems. There are people who look over these patches in extreme detail, both "white hat" and "black hat" types.
If they bundled other fixes / changes, their business customers would get really, really pissed in a major hurry. Microsoft does NOT want to piss these people off, even with the lock they have on the market. Remember that Microsoft's whole sales pitch right now is about "total cost of ownership."
Given this, I'm inclined to belive the "MS bundles other crap with patches" rumour to be most likely outdated. It could also be something that grew out of a misunderstanding of the difference between security patches, hotfixes, and service packs. I'm more inclined to attribute breakage to a combination of (a) imperfect patch QA and (b) badly written software / malware replacing or patching system DLLs/installing drivers that end up being incompatible with "clean" versions of some of those DLLs installed by a patch. Breakage also used to be common causes of breakage in win9x
I've personally never had issues patching an NT-derived system. I ensure they're clean before patching, and I don't use shoddy software ( in so far as is possible ). In fairness, my only Windows server is NT4 (ugh); I'm speaking mostly about the XP desktops I admin at work and the older win2k machines I've run.
That's not to say that things don't go wrong for anybody, of couse... just that in my own experience they don't tend to do so. Perhaps I'm just lucky not to use $BLAH_POPULAR_DATABASE that likes to patch ntfs.sys, or whatever other ghastly hack people might perpetrate.