Slashdot Mirror
Kama Sutra Worm Could Make For A Bad Friday
mikey1134 writes "CNN is running a story about the Kama Sutra worm, a virus that is coded to overwrite files of the (potentially thousands of) infected computers. They provide some background on this viral outbreak and warn users to protect themselves" From the article: "And even for home computer users who have never taken such precautions before, security experts say now would be a good time to back up your most important data, like financial information and family photographs, to CDs, DVDs, zip drives, or an external hard drive that you know is worm and virus free. Unlike a lot of malware that exploits vulnerabilities in the Windows operating system, there is no 'patch' that can be downloaded to ward off Kama Sutra."
The best backups are those written to only once. Burn to a write-once only CD or DVD. Don't back up to an external hard disk. As soon as you plug it in anything can happen, either from Windows itself or from malicious software (redundant, I guess).
In the old days we backed up to tape and flipped a switch so the tape couldn't be overwritten. Today it's burn-once disks. Don't trust anything but physical protections from disk writes.
Developers: We can use your help.
This is the virus that MS has a patch from their fancy new Remote System Control program, right? Simply agree to download and blindly run any code they decide to send, let 'em take a peek at what you're running from time to time, and send regular status reports to the nice windows home base -- and then, we'll protect you from the nasty viruses!
And remember, kids... that's a nice computer. Would be a shame if something were to "happen" to it, you know what I mean?
like totally unhelpfull..I didnot understand a word of your post or the links
Surely, there is a simple answer to this question:
if i scan my hardrive tonighte with avg or macafee or norton, am i protected ?
where do i download the patch ?
if not, this surely demonstrates that the protection companies aint worth a tinkers damm
Sure. But I reckon gradually corrupting small parts of them is still worse. You might only realise you were infected months later, when the quarterly financial figures come out totally whacked, and you'll spend the rest of forever in the company of accountants and auditors trying to track down the correct figures.
Fragging out a file all at once? Then the victim realises something's up, gets the machine fixed, loses some work. Imperceptibly corrupting the file? Victim keeps spreading the virus, and every version of every file he works on is suddenly untrustworthy...
Real Daleks don't climb stairs - they level the building.
I wouldn't call it a Microsoft insecurity issue, but a stupid user issue. The user has to install it for it to work, the user actually has to be involved and allow it onto their box. The same type issue can be had for a Linux box and you don't even have to be a root user to be affected; someone emails you unknown app and like these windows dumbasses you run it can wack all of the Openoffice documents you have been using to write your disertation for the past year is gone.
A stupid user is stupid user, the article summed it pretty well: "Unfortunately, there is no way to patch user ignorance, and the way this virus propagates is through user ignorance,"
Step 1: Go into Date and Time properties Step 2: Click on Internet Time tab Step 3: Uncheck Automatically Synchronize Step 4: Click on Date & Time tab Step 5: Change the date to the 4th (saturday) Step 6: Click OK Step 7: Wait until it really is saturday and turn automatically synchronize back on. I'd reccomend this for everyone, whether you think you have it or not, just to be on the safe side.
There's no patch because it's not a vulnerability, it's a virus. The only thing you can patch is the users that still won't follow directions and not open executable attachments. The OS is working as intended when it executes code you ask it to, which is how this virus gets on.
This "OMG MS won't patch t3h systems!!!11" stuff on Slashdot is getting old. No, they won't patch it because there's nothing to patch. Duh. They have decided to add it to the malicious software tool, which is a mini virus scanner akin to Stinger from Mcaffee, which scans for a limited subset of viruses, but that's not a patch. Windows OneCare, which is NOT a remote control system by the way, does find it because, well, it's a virus scanner just like any other. It catches it just like AVG, F-Secure, Norton, and so on, which is to be expected as it's a competitor.
So let's leave off the bullshit ok? There are two easy methods to prevent this from hurting your system:
1) Don't run random programs that some with e-mails. If you use Outlook Express, it'll even tell you not to (twice).
2) Get a virus scanner. Doesn't need to be MS's, there are many good ones out there. I recommend AVG, it's fast and free.
It will most certainly affect any writeable permanent redirected shares, AKA mapped drives, since the whole point of mapped drives is to create something that looks like a regular local storage volume.
It will *probably* walk the local network and affect nay shares it can access.
But - why take the chance? Always assume it will affect anything it could possibly write to.