Slashdot Mirror
The Birth and Battle of Conficker
NewScientist has an interesting look back at the birth of the Conficker worm and how this sophisticated monster quickly grew to such power and infamy. "Since that flurry of activity in early April, all has been uneasily quiet on the Conficker front. In some senses, that marks a victory for the criminals. The zombie network is now established and being used for its intended purpose: to make money. Through its peer-to-peer capabilities, the worm can be updated on the infected network at any time. It is not an unprecedented situation. There are several other large networks of machines infected with malicious software. Conficker has simply joined the list. The security community will continue to fight them, but as long as the worm remains embedded in any computer there can be no quick fixes."
But I think we all saw that one coming.
The security community will continue to fight them, but as long as the worm remains embedded in any Windows computer there can be no quick fixes.
Fixed that for ya.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
If your ISP provided a free service where it would text or phone you and offer to help clean up your systems if it detected malware-ish behavior coming from your computer or network, would you sign up?
The only gotcha is that you would be inviting the ISP to watch your traffic.
OK, this is slashdot, so most people would say "no," but how many regular people would say "yes" and would that make much of a difference?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
My God! It's full of anti-worms.
Help stamp out iliturcy.
If only we consider more thoroughly what single thing they all have in common, we might be able to find a cure.
Help stamp out iliturcy.
Botnets, worldwide botnets.
What kind of boxes are on botnets?
Compaq, H.P., Dell and Sony, true!
Gateway, Packard Bell, maybe even Asus, too!
Are boxes, found on botnets,
All running Windows! Foo!
Guaranteed! This comment 100% Anthrax free!
If you read the article, the problem isn't Microsoft failing to offer patches and fixes, it's the failure of users to install them. Conficker was detected in the wild *after* the patch to remove the vulnerability became available, but people didn't install it. I suspect a few of the monthly malware removal updates deal with it as well (though I don't know for certain). What do you want MS to do, deploy goon squads to forcibly patch people's computers?
$_ = "wftedskaebjgdpjgidbsmnjgcdwatb"; tr/a-z/oh, turtleneck Phrase Jar!/; print
What I thought was interesting was the internet telescope mentioned in the article. No wonder we're running out of IPv4 addresses, someone's wasting millions of them!
I routinely encounter people who have disabled windows update because they believe Microsoft is out to get them. They worry that the updates their computer nags them about are filled with unnecessary crap. Crap that will spy on them, display advertisements, install toolbars and hijack their machine. I think this is largely due to some weird cultural concept that Windows is both evil and necessary. In truth, it's neither.
I've got it... It's people!
And more specifically the sort of people who would install stuff just because a pop up tells them they are infected and they should install "Antivirus 2009".
And those who would type in passwords for encrypted zipfiles to decrypt them and install the stuff inside them...
In theory they're not actually morons ;).
;).
Because in theory it's impossible to solve the halting problem.
In theory users have to figure out whether a program is safe (analogous to "halt") even though
1) They don't have the actual true description of the program
2) They don't know the full inputs of the program
And that's a harder problem than the halting problem
While you could say - nobody should install anything that's "Not Expert or Vendor Approved", to me that's a rather dismal state of things.
Things could be so much better. Really.
For instance if you had an O/S that will require applications/applets to list out the type of access they require.
Then the O/S can provide a meaningful and TRUE description to the user of what the application might do.
And the O/S can also enforce the limits of the access.
So if something says it's a screensaver, it's only going to get screensaver access. It's not going to be able to make recordings from your microphone and webcam, and send them to Elbonia behind your back. It's not going to be able to write to anywhere other than it's own designated scratchpad area, not even your USB drives.
And that would be a secure modern O/S.
Then you can tell your "morons" - "You can install whatever stuff you like, unless the O/S gives you that red warning dialog box about the program requiring full user or system privileges".
In terms of security, most current O/Ses aren't even better than what was available 40 years ago. Heck, Unix is a watered down Multics.
They're just decorated with fancy graphics and animations so most people think they're advanced.
Yes, Vista does have some sandboxing, but the way MS has implemented stuff makes many people turn off many of the protections. So they'll become the next hosts for the next Conficker.
As for Linux, Apparmor and SELinux don't appear "Desktop Ready" yet.
As a computer consultant that (has to) advocate Windows, allow me to answer this.
The average computer user in a company doesn't know jack about his machine. Fortunately, he's not required to do administrative tasks, but he's required to work with it. And he's required to produce. Trying to convince management that they should toss out all Windows machines and install Linux everywhere is something you should only try if you always wanted to take over bolder duty from Sisyphos.
Second, the average computer administrator in a company doesn't know jack about Linux. Why? Because he was hired to administrate Windows machines. More often that not, he can only do that, too, because Windows offers an easy to use GUI that forgives a lot of errors and asks at least 10 times before you can break something. If you hand these people Linux servers, you're opening a can of worms. No pun intended. They can, maybe, keep a Windows environment halfway stable and secure if you hand them the right tools and a good explanation how to use them. At least 'til you come the next time.
If you press them into Linux, you will come back to Linux boxes that have been crowbared open because "else it didn't work".
And, bluntly, security-wise I prefer a fairly well secured Windows server environment to completely insecure Linux boxes. Insecure, not because the system wouldn't allow it, but because the administrator is completely overtaxed by the task of securing them.
Yes, hiring another admin would be a good idea. Try rolling that bolder towards management, please.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
> Do you have even the faintest idea what you're talking about? Didn't think so.
;).
That's not a nice thing to say. Why did you say that? Did I hurt you somehow before?
> The worst they can do is to nuke their own files.
Nah. As I've been saying - they could run the wrong program and then the bad bad things could happen.
While having their own data destroyed is typically far worse than losing their entire operating system, that's NOT the worst that could happen when a user runs the wrong program.
1) Their data could get silently corrupted. Silent corruption is often far far worse than complete data loss. When you have complete data loss, it's obvious. So you restore from backups, or deal with it in other ways. When something tampers with the data, you could be screwed so badly and not know why. By the time you realize something is wrong, all your backups could be of the corrupted data.
2) Their secrets could get exposed and abused.
3) Their computer could get taken over and used for illegal stuff. While they might eventually be exonerated, the pain and damage involved is likely to be more than mere data loss.
Plus it's probably easier to live if people think you're some incompetent loser who went out of business because of massive data loss, than if people think you really downloaded, stored and shared all those illegal and _disgusting_ porn.
I'm sure others can think of many other things worse than "nuking their own files".
e.g. they could unknowingly help Skynet survive and grow in strength