Slashdot Mirror
Storm Worm Rising
The Storm worm has been an increasing problem in the last few months, but a change in tactics may mean something big is going to happen. The article discusses a bit of back story about the worm, including the somewhat frightening numbers about the millions of spam emails carrying the worm payload. They estimate between a quarter and a million infected systems usable for spam or DDOS attacks.
Seriously though, how does one go about estimating these numbers? Is it something as simple as an estimate of what proportion of infected e-mails are expected to result in an infected desktop? I doubt that would give a very accurate figure.
If they can't find a way to reach customers and get them fixes for the rampant insecurity of these machines that are compromised. The silent majority of customers are getting frustrated with this sham of a performance, and while saner heads recognize that Redmond does a lot right and some wrong, the emotional response is going to shove them out of dominance in operating systems. Maybe that's why they're better on spacy Web3.x "cloud" and "distributed OS" technologies instead of what made them big, which was getting things done the hard way consistently.
technical writing / development
I remember freaking out 10 years ago every time I saw someone running that cutesy little "fireworks display" email attachment. Despite my best efforts, I couldn't get the users to stop unzipping and opening it*. Glad to see that things haven't changed much.
SNAFU (Situation Normal: All F***ed Up)
* Before I get 10 million suggestions for a decade-past issue, yes we did find more effective ways of blocking it.
Javascript + Nintendo DSi = DSiCade
Now I've got your attention worm style, click this link for more information:
http://en.wikipedia.org/wiki/Storm_Worm
biopowered.co.uk - catalytically cracking triglycerides for home automotive use since 2008. Just say no to big oil!
As the publisher of two fairly popular websites, this is something to worry about. Recently all our sites spread across a few dedicated servers in one data center were down. Not because of a direct DDOS attack, but because of a peripheral attack which swamped the network infrastructure at the center. Really, if these guys decided to do more frequent DDOS attacks, anyone could be a target and calling the FBI is cold comfort since in the meantime your sites are down and out.
Newsfollow.com
http://en.wikipedia.org/wiki/Storm_Worm
...names ranging from "postcard.exe" to "Flash Postcard.exe,"...
.exe attackments at the MTA? Also look for a service running called wincom32 on infected machines.
Shouldn't everyone be blocking
http://www.teamfurry.com/wordpress/2007/07/19/suns hine-on-a-stormy-day/
That is why I always do my online banking BEFORE I browse for porn
I dunno - maybe this is what we need ~ a botnet big enough to do some real damage could actually catalyze some public awareness. Imagine if they DDoS'd MS, or Amazon, heck, Google? Maybe these guys (esp. Google) could handle this kind of slamming, but they've got lobbyists now. I really wouldn't mind seeing a well-funded FBI task force with the express purpose of rooting out botnets and going after their creators. Yeah, yeah, most of them are not on US soil. I know. However, imagine legislation that actually required the disconnection of infected bots from an ISP until it was cleaned, and a public awareness campaign that painted users who allow this to happen as idiots, and the ISPs as protectors of the rest of the internet users. Most people are concerned that there would be a backlash against the ISPs and they would stop complying for fear of loss of business, but that's where the legislation comes in. It's a quarantine situation - just like IRL, if you've got something nasty and contagious, the CDC can legally quarantine (forcibly, if you're an idiot like the TB guy) you because you're endangering the lives of others by going out and exposing them. Same thing here - don't give the botnets a chance to expand, cut them off, force a windows-cleaning (ISPs could offer a cleanup disk, $5.95 plus tax, or something, to help make it worth it for them - don't want to hurt the small ISPs, even though I think TW and the rest are bastards), and let them reconnect afterwards. Simple, painless, and will definitely make sure people learn their lesson for next time.
Shouldn't everyone be blocking .exe attackments at the MTA?
.zip files looking for .exe's.
... I don't get my code. I know its nitpicky and a make clean or a thumb drive will cure my problems but I'm forgetful which tend to preclude both.
NO! It's annoying enough that Google rapes through my
If I'm working on a c++ program at work and zip it up and gmail it home (lock the computer while it uploads) and forget to 'make clean'
From the article: > For spam, a million-strong botnet might be overkill. > But botnets can do much more - like launching denial-of-service attacks. > These attacks aim to overwhelm a Web site or Internet server by sending > it a constant stream of garbage data at a particular Web site or Internet server.h tml?articleID=197004237
which were described at the time as "possibly featuring millions of computers".
A few years back there was a spate of DDOS attacks on root servers, for example: http://www.informationweek.com/news/showArticle.j
So, is this really such an enormous number? There seems to be a precedent for botnets of this scale....
No. "The silent majority" believe that this is the way computers just "work".
They've been shown that in countless movies and TV shows and by "experts" on the news.
They're the ones you see claiming that Linux and Mac's will have the "same problems" as their market share increases.
With all the past outbreaks on Windows machines, anyone who wanted to migrate has already started their migration. This won't change anything for anyone else.
Let's look at DDoS attacks.
#1. Spoofed IP addresses - not that common anymore. It used to be that you'd tie up a machine by having it send replies to machines that did not initiate the connection. There is a simple solution to this. Anyone assigned a block of IP addresses has to make sure that all outbound traffic references IP addresses on that block.
#2. Thousands of machines eating up your bandwidth - the most common type now. This is where the zombie army each makes continued requests of your machine. For webservers, they can request a page over and over and over until they use up all your bandwidth and legitimate visitors cannot get through. This is more difficult to fix. It can partially be handled by blocking the range of addresses that host the zombies. Such as Comcast and Verizon and so forth. There are more complicated attacks. Such has sending half a request.
There's not much that can be done with #2 until a law gets passed saying that the person paying for the Internet connection is responsible for $X of clean-up charges. Then people will have a financial incentive to look at more secure systems.
Yesterday, a non-expert computer user I know sent me an email warning about emails with "postcard for you" in the subject being a carrier for the "worst virus ever". It could erase your entire hard drive!!! The histrionics convinced me it was bogus, so I blew it off. But seems there is something going on after all? That email now looks like it was deliberately timed and edited to ride the next wave of panic.
Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
It's well-known that the Chinese government has an active computer warfare department. A botnet on this scale is way beyond anything needed for mere industrial blackmail. But if you wanted to bring down large chunks of some nation's Internet quickly, without the attack coming from an obvious (and blockable) source, this would be a great weapon. Let's say you wanted to disable the Internet in Taiwan, or South Korea, or Japan, or all three, just prior to military action. Or let's say you wanted to disrupt financial markets to be sure that your intentional crashing of the dollar had maximal effects.
"with their freedom lost all virtue lose" - Milton
http://en.wikipedia.org/wiki/Storm_Worm I'm interested in something from that wikipedia article; it mentions that the source code to storm specifically avoids infecting Windows Server 2003 boxes. Anyone know why the author would go out of his way to not hit 2K3 boxes?
Perhaps to avoid infecting government servers (and upping the ante, if he got caught)? That's the only thing I could think of. I'm sure there's a very logical reason, but I have no idea what it might be.
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
Why wait?
Why not take a few pro-active measures? Such as emailing all your clients with the new rules and offering to assist them in evaluating their systems
Why would you need to know about the newest worms? The focus should be on the security of the system.
A default installation of Ubuntu does not have any open ports. It is immune to all worms except anything that might attack the TCP/IP stack itself.
It's still susceptible to trojans, but even those can be mitigated.
And it is easy to check most Linux distributions with a Live CD. So the idea is to limit the possible avenues of attack and have a system in place so that successful attacks can be recognized and removed.
Hi. Worshipper has sent you a greeting card.
See your card as often as you wish during the next 15 days.
SEEING YOUR CARD
If your email software creates links to Web pages, click on your card's direct www address below while you are connected to the Internet:
http://682.81.0.23/?9907cd64e28cae3d7703a3b01bda de (Poster's note: This URL has been altered to protect the rampant mad clickers amongst us)
Or copy and paste it into your browser's "Location" box (where Internet addresses go).
We hope you enjoy your awesome card.
Wishing you the best, Administrator, americangreetings.comMake it a Federal Law that ISPs must disconnect infected computers, and users would be forced to fix things very quickly.
Then if a botnet attack comes, turn off the overseas pipes as needed. Yeah I am a dreamer, but I am at least half way practical.
...until software companies are forced to include normal consumer warranties (as in suitable for purpose, ability to access the internet with better security out of the box) and until individual zombie owners can get charged with "maintaining an attractive nuisance". The software sellers don't give a crap, as they have zero liability because of their ridiculous EULA and because the law let's them get away with it, and big corporations are scared to sue the 800 lb gorilla over this issue obviously-buncha pansie asses if you ask me), and the people who get infected don't care enough to do much about it, as the last decade has proven over and over again. Make it hurt both parties there financially, you'll see better coding and much reduced malwarez. And I could care less if this means much longer release cycles and the engineers take precedence over the marketing weasels and the PHB investor class. It will have to *hurt* those folks deeply in the wallet to get them to enter the 21st century and assume normal adult business responsibility for their alleged "products".
Without those measures, we'll never have any sort of decent widespread security, it will always be too little, too late, catch up crap and the big dogs still raking in the billions for perpetual beta-crapware
Now free software I don't have as much of a problem with, as they don't charge any money for it, but the stuff that costs serious folding money-needs a normal consumer warranty.
"We can categorically state we have not released man-eating badgers into the area." - UK military spokesman, July 2007
Do you realize the kind of productivity spike we could get if the 'net was down for, say, a week? One day would be lost to people trying to get back up, admittedly, but then we'd all just start doing work, checking the 'net connection more and more infrequently. After a week, we'd probably run out of work on our desks that didn't need internet lookups, though most of us still have paper catalogs around so it wouldn't be a total loss. Faxing would get popular again, as would phones and voicemail...but no outside IM and email to deal with.
I'm going to call it a net win for productivity and busniess in general. Which means that it's most likely that big business is behind the internet shutdown...and the Storm worm.
Shit, where'd I put that damned tinfoil hat...
Is it just my observation, or are there way too many stupid people in the world?
They could indeed. Probably not those particular ones however. The show is callled Grumpy Old Women and takes a handful of the BBC's more curmudgeonly female celebs and gives them free rein to gripe about the things that wind them up. Not as good as Grumpy Old Men (IMHO) but that could be down to gender bias on my part.
The "silent majority" however (and no, it's not my choice of phrase, either) don't on the whole do such things. Most of the non geeks I've spoken to use their computer for surfing, p2p, messaging, email or WP. That's not generally a controversial opinion, even among the Redmond faithful.
If that was what I was doing, (and I don't accept that Linux is deficient in comparison to Windows) then I'd be more likely to use the term "disingenuous". But you know, saying that Windows is better because it has software which little old ladies may someday want to use to program their knitting machines.. well that's like saying Linux is better because they may someday decide to learn C and write their own device drivers. I suppose each argument has merit to the extent that the relevant scenario is possible; I just don't think either probability to be particularly high, which renders the arguments rather less than compelling.
On the other hand, sooner or later someone is going to write a Linux package to drive those knitting machines. Of course windows may get less annoying in the same time frame. But there are people who don't have knitting machines who might prefer not to wait for either occurrence.
Don't let THEM immanentize the Eschaton!
The idea has been put forward and dismissed a number of times. The virii are either too ineffective or (unintentionally) destructive on their own.
Calling someone a "hater" only means you can not rationally rebut their argument.
Here's a notice to the education sector and what the Storm Worm can mean to universities: http://listserv.educause.edu/cgi-bin/wa.exe?A2=ind 0708&L=cio&T=0&F=&S=&P=4540