Slashdot Log In
IRC Networks Unite in Fight Against Fizzer Worm
Posted by
michael
on Wed May 14, 2003 09:38 AM
from the why-cliff-got-klined dept.
from the why-cliff-got-klined dept.
Dave writes "Over the past few days, IRC Networks across the internet have felt the brunt of the Fizzer worm. In an unusual display of geek solidarity, representatives from dozens of IRC Networks, including EFNet, IRCNet and DALnet, have gathered to create a Fizzer Task Force. Interesting, and mostly productive results have occurred so far from such a meeting of the IRC minds."
This discussion has been archived.
No new comments can be posted.
IRC Networks Unite in Fight Against Fizzer Worm
|
Log In/Create an Account
| Top
| 337 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
The battle has ended. You've got worms! (Score:3, Funny)
(http://www.initialized.org/)
Now, miniscule web servers, you will feel the brunt of the Slashdot behemoth!
Interesting, and mostly productive results have occurred so far from such a meeting of the IRC minds.
And, once this story is published, we'll observe the various effects of futile desperation!
As Well They Should ... (Score:5, Insightful)
(Last Journal: Wednesday October 22 2003, @02:14PM)
-A.M.
Re:As Well They Should ... (Score:4, Funny)
Rich
Re:As Well They Should ... (Score:5, Funny)
(http://communistposters.com/)
mIRC (Score:1)
Re:mIRC (Score:4, Insightful)
(http://profiles.yahoo.com/pecosdave | Last Journal: Thursday June 26 2003, @01:09PM)
Re:mIRC (Score:5, Informative)
The fizzer worm that's currently spreading, spreads through outlook and Kazaa. It also has a IRC backdoor, through which presumably the virus author can access infected computers. This IRC backdoor connects to a list of several irc servers, and sit in a channel.
As the number of infected computers (Please people, update your Anti Virus software!) is growing, this puts a higher load on the irc servers. This is what it's all about, to find a way to get rid of the trojans from the servers, so that nobody can abuse them for DDoS or looking for CC numbers or other private info on infected machines, in a way that doesn't put too much stress on the IRC servers.
Re:mIRC (Score:4, Interesting)
Re:mIRC (Score:5, Funny)
(http://bostonbeerguy.com/)
That is compelling evidence, of course... the virus was written by Microsoft. Next week they plan to release Fizzer XP Service Pack 1 which will fix those issues.
Yeah! (Score:3, Funny)
Let's help these guys out by /.'ing their co-ordinating page!
d00dz n07 1337 570P (Score:1, Funny)
(http://profiles.yahoo.com/pecosdave | Last Journal: Thursday June 26 2003, @01:09PM)
*Ahem* (Score:5, Funny)
(http://wolf.cheats4u...st/index.php?ref=893 | Last Journal: Thursday January 08 2004, @10:14PM)
Systems Not Affected: Macintosh, OS/2, UNIX, Linux
Heh. Clearly the work of an evil genius.
GF.
Re:*Ahem* (Score:4, Informative)
(http://www.askarel.be/)
Seriously, wine is getting better every month and can run a wider lot of window$ software, it is not surprising that it will (could?) run windows worms/viruses (which are software written by human after all) and put our supposed-virus-free-OS [insert your preferred flavour of unix here] at the same level of risk than windoze users.
Please think about it if you install such a software...
possible perps (Score:4, Interesting)
(http://technocrat.net/ | Last Journal: Friday November 30, @09:27PM)
Anyway, that's how I think with crimes, use flatfoot 101, "who profits?".
death of irc? (Score:2, Redundant)
(http://abdullah.net/)
From the official Undernet note in the link:
"At this point, the future of the Undernet and IRC remains uncertain."
Re:death of irc? (Score:4, Informative)
interesting (Score:1)
I hope it works!
okay, time to update (Score:2)
(http://newsdee.com/ | Last Journal: Sunday April 22 2007, @03:01AM)
if there is such thing...
Mainstream media seems to report that the virus comes out of Outlook attachments ONLY, which shows how ignorance can be dangerous if this worm is effectively spread through filesharing networks...
Re:okay, time to update (Score:5, Informative)
a free cure for the windows virus. (Score:4, Funny)
(http://lists.clickers.org/linuxsig/index.html | Last Journal: Friday December 07, @12:48AM)
PEBCAK (Score:5, Insightful)
(http://slashdot.org/)
But even running around nekkid, I don't think I'd have caught more than a handful of viruses to begin with. Why the hell is it that people open up all the crap executable stuff they get? I think the best hope is a new generation that has grown up with SPAM, viruses etc. and don't fall for that kind of bullshit. Teaching old dogs new tricks doesn't work, but they will die eventually...
Kjella
You've missed something - (Score:4, Insightful)
(http://nervalhi.net:8080/ | Last Journal: Thursday June 26 2003, @03:16PM)
Just because you don't think you have a virus doesn't mean you don't have one that's good at hiding. Try loading an AV and seeing what it finds. It might do you some good.
Personally, I have an updated one that I keep disabled most of the time except when I get up and leave it on; then I tell it to scan. Hasn't turned up anything. Good sign...
Re:PEBCAK (Score:5, Insightful)
(http://membled.com/)
You may object that things like Word macros (and their associated viruses) blur the line between files and executables. But that is another instance of the same problem: 'opening' such a document should be split into the two questions it implies: do you want to *view* the file contents? do you want to *execute* the instructions in the file?
If user interfaces and especially mail clients bothered to present this distinction to the user then a lot of the worm problems would go away. Some people would still have virus checkers, mostly companies who don't trust their employees not to execute dancing_elephants.exe. But even in those cases, it would be simple to lock down mail clients to not allow execution, as long as they bother to make a clear distinction between viewing and executing to start with. (And as long as the applications they launch, such as Word, do the same.)
One way of explaining this in non-technical language is: 'If I sent you a letter and it said "please jump off the nearest cliff" and you read it, would it do any harm to you? Why should the equivalent message sent to a computer be any different?'
Re:PEBCAK (Score:5, Insightful)
(Last Journal: Saturday October 26 2002, @11:28PM)
"Users should *not* have to be scared of using their computer. The computer should simply stop them from doing anything wrong."
Now how do you feel about that?
I'm not agreeing or disagreeing with you here - just food for though.
Not your usual "task force" (Score:5, Funny)
(Last Journal: Sunday April 11 2004, @07:41PM)
"task force"
Heh
Re:Not your usual "task force" (Score:5, Insightful)
And trust me you can cause more pain to more people by dumping thier net connection than you ever could with a swat team.
First there's the pain for lusers that find thier mail IM and file swappers don't work, then there's the pain in the call centre when harrased techs try to explain to consumers what's going on, then there's the pain felt by the BOFH's with management hovering over thier shoulder, then there is further pain caused by the many minor bumps and niggles and repeats as the systems cope (or not) with the backlog built up in the down time. And after all that, if it was a good one, there are the recriminations on support boards, the calls for compensation, customers leaving, no end of replanning from the management team.
Ahhhh
The beauty is that a good DDOS is a gift that just keeps on giving.
Truly Cthulhu is amongst us
Lock em down (Score:3, Interesting)
(http://www.servergrade.com.au/)
Are there any programs that allow processes to be "locked on"? It would be useful to restrict attempts to kill certain processes, to people that can provide the root password.
There are probably heaps of this kind of thing, and another layer of security is always welcome.
cheap web site hosting [cheap-web-...ing.com.au] from 3 semi-mongrels a month
Missing from the discussion so far: (Score:4, Insightful)
So, what did Microsoft do wrong that allowed this to happen? 200 words or less. 5 points off each for use of either "dancing monkeyboy" or "Borg".
Re:Missing from the discussion so far: (Score:4, Interesting)
(http://slashdot.org/)
Actually, it doesn't use the Windows address book. I know this because I (under firewalled, very controlled conditions) ran it to see how it worked. One thing I noticed is that it was sending e-mails out to addresses I did not know. That computer does not have an address book, nor any outlook express smtp/pop3 server settings (I never configured it).
Though the track record of OE and its address book is pretty bad, it isn't always to blame.
DMCA protects the virus data (Score:4, Insightful)
(http://townlines.com/blog | Last Journal: Tuesday January 24 2006, @09:49AM)
It stores encrypted data on your PC. You cannot use any method to decrypt this data to determine what keystrokes were collected and potentially transmitted.
Gotta love stupid laws.
Re:DMCA protects the virus data (Score:4, Interesting)
(http://slashdot.org/)
I hope noone takes this as a defense of the DMCA, it is an evil law. The DMCA makes it a crime to sit motionless and think certain thoughts. I really wish it would get struck down as unconstitutional already.
-
IRCnews (Score:1)
(http://www.anti-dolphin.org/)
I... (Score:3, Interesting)
This worm was hitting us badly. I personally spent at least six or seven hours slamming the fuck out of the clients (they connect with a very distinctive hostmask/realname/nick) since they started hitting us on Sunday, and we have ~1500 akills for distinctive IP's set up now.
As you may imagine, manual akills just wasn't cutting it after a while. We all have actual jobs, and sitting on IRC whamming worms is something we don't get paid for. We've fixed our problem with a small Perl script one of our server admins wrote. I don't have the link where he placed it online right now, but I'm sure he'd be okay with sharing if anyone's interested. At the very least, it'll give you some heuristics to work from (the fundamental pattern is a nick with one, two, or three numbers on the end, a real name consisting of two capitalized words, and an identd response made of those two words reversed and conglomerated).
If there's any other admins of networks out there, pop onto irc.kdfs.net and join #helpdesk. Mention that you're looking for Puffy (me) or Danzak (script writer) and you're interested in our virus client killing bot.
No false positives so far. :)
mIRC != IRC (Score:3, Informative)
(http://slashdot.org/~nurb432/ | Last Journal: Friday August 27 2004, @03:24PM)
And just sounds like people need to use some common sence, and update signatures.. None of these things should be a huge deal..
Symantec tool (Score:3, Informative)
(Last Journal: Sunday October 09 2005, @12:15AM)
Removal tool [symantec.com]
Cleaned up my office yesterday very nicely.
Info (Score:4, Informative)
McAfee Avert Stinger (Score:1)
(http://www.greplaw.org/)
Impact . . (Score:3, Interesting)
(http://www.ods.org/)
The point is that I've seen these botnets around for months and months now. Almost a year at this point with almost no coverage. I believe the days of smurf attacks are numbered, this is the new way to conduct DoS attacks. They're very effective as well, having seen the attacks targeting servers of mine.
Refreshingly Amazing (Score:1)
(http://www.shortconsulting.com/ | Last Journal: Sunday November 09 2003, @04:28PM)
I also think that posting how to crash the FIZZER's was posted along with what channels they were in. That's like saying, here you go... have fun, don't put anyone's eye out.
Block it! (Score:1)
Stopping the worm is actually fairly easy. (Score:1)
(http://www.nenolod.net/)
Also, By ctcp pinging them, a lot of them will crash, from what I have heard. The website also states this.
nenolod, OpenIRC Network administrator.
How to get rid of it (Score:1)
*********START FILE remove.bat*********
@echo off
cd \
cd %Windir%
echo . Uninstall.pky
echo Please wait 30 seconds
pause
if ProgOp.exe exists echo You didn't wait long enough.
*********END OF FILE remove.bat********
IRC dying? Nah. (Score:1)
(http://searchirc.com/)
Why not change your mail client? (Score:1)
(http://www.dagelijkswoord.nl/)
If companies would trade Outlook Express for another lesser known mail client, for instance The Bat [the-bat.nl], 99% of modern 'viruses' would have no chance.
Well, at least until it becomes main stream, and viruses are developed for this client's address book.
My perspective (Score:2)
(Last Journal: Tuesday September 24 2002, @02:32AM)
The bots tend to join "random" channels (not really random because ~40 or so will collect in each channel) and they sit there. Now get this.. they spit out random English/German gibberish. No joke. Things like "Money is a diabolical power" and "Religion is an oppressive force"; things of that nature. Some of it is in German also.
As an admin previously posted, they use random "real" sounding nicknames, usernames, etc. Their host addresses span across the world. At first, we had no idea what they were until one of our opers broke into one of the random Win2k servers the bot ran on and went through the registry and process list. From there, after some google search, we found out about Fizzer.
We let them collect for awhile to look for any threats they might pose. We also checked their reconnect delay. None; they don't reconnect to the same network. In other words, banning them is a waste of time. I try to avoid placing thousands of network bans, and in this case, it would certainly be wasteful. After a few masskills to wipe the channels clean most of the bots disappeared as quickly as they came. Now, on to my IRC rant. I've been waiting for a soapbox. If you're from DarkFire, get ready to cringe because you've heard this before..
IRC's future is one that a *BSD is Dying troll might say. Over the years networks have had to put up with an increasing thread of DDoS attacks that are provoked by the slightest change in breeze. DALnet went through hell and back; the aggregate bandwidth they had to absorb from the attacks is insane. IRC was turnd into a warez and botnet haven within a few years, and the future looks bleak.
Whenever I mention IRC to someone that's never really used it but keeps up with tech news almost always gets the impression that it's just a ubnch of warez and botnet networks. At one point when I was getting DoS'd, I spoke to someone at MFN to get a filter in place and he asked me if I had any idea why I was beign attacked. I mentioned that I run an IRC network and he immediately reminded me that it's a massive DDoS magnet. I had to agree.
I'm getting sick of the whole situation. About a month ago, we decided to shut off the network to public access and require registration with confirmation of a code being placed on an image (Yahoo reg style). The decision doesn't mean it was an overngiht process. We'll probably be done coding it in June, and that's when we'll go in.
We prove a public service, and we volunteer hours. That alone will not convince our upstream provider of why it's worth it for them to lose service along with us because of a DDoS that is almost always related to IRC. Over the years, we've tried in every way not to provoke attacks, and we've really only been hit about 5 or 6 times since we opened in April of '98. However, enough is enough. If someone doesn't want to take the 10 seconds to copy a code from an image on our webpage to verify registration, then they can find a different network to use.
Excuse the typos, I tend to typo more in rants
The Good Old Days (Score:2)
(Last Journal: Friday February 13 2004, @10:23PM)
I remember one time, we had a channel that filled itself up with gibberish bots, several hundred of them. All they did was sit there though. Didn't talk, not even to each other. Didn't join other channels. Rejoined if you
The one thing they did do is spit out text into channel if you
Anyway, the netadmin, myself, and every other competant oper sat around for a while, experimenting, trying to figure out what they were about, but in the end, we just gave up. We used services to rename some of them into furniture, and the opers used the rest for target practice (kill, masskill, whatever we could think of), and just sort of hung out in the channel until they dwindled off and stopped coming altogether.
Those really were good old days.
--Dan
More windows address book hacks! (Score:1)
(Last Journal: Thursday October 23 2003, @11:50PM)
Re:method (Score:1, Informative)
Re:method (Score:5, Funny)
(Last Journal: Tuesday November 02 2004, @12:06PM)
Dammit, when are worms going to get interesting again? This "exploit the hell out of Outlook" routine is getting old.
Re:method (Score:2, Informative)
Through outlook, and by the user downloading warez from Kazaa.
See this f-secure article [f-secure.com]
Re:My solution, presented years ago (Score:1)
And IRC would have died where it stood, full of elitist assholes and those with hacked clients lying about their OS.
Re:Simple solution. (Score:2, Informative)
Re:My solution, presented years ago (Score:2)
(http://fredrikj.net/)
There are way over one million IRC users today.
Re:My solution, presented years ago (Score:2)
(http://s87365085.onlinehome.us/ | Last Journal: Tuesday October 28 2003, @04:22PM)
Re:Is this a first? (Score:1)
(http://riazon.fireclaw.org/)
Re:My solution, presented years ago (Score:2)
Re:The majority of these worms, however... (Score:2)
(http://slashdot.org/)
identd is a bit past its time since the explosion of unix boxen that are administered by the very same end users. The age of trust(how silly) in the admins who run servers is long over.
Re:The majority of these worms, however... (Score:2, Interesting)
(Last Journal: Sunday November 11, @09:31AM)
Name some good H4X0R t00lZ for windows. Not so easy, is it?
All the portscanners, eggdrops, warbots, and other bullshit is linux based.
I guarantee the fellow/group behind fizzer connects with his linux box to control all of his 7337 bots.
The windows users are the leghumpers who keep asking you "a/s/l".
So why ban the victims? Ban the jerks.
You should really ban any scriptable client to 'save IRC'. There are enough stupid linux users to download "megascript for IRC-II" and have no idea what it's exposing to the mega h4x0rs of DALNet.
Your OSism is pretty much, like all prejudices, ignorant of the real issues. Just like the poor white hillbilly who thinks blacks are the cause of his problems, you sit pointing fingers at windows.
The thing to do is to simply realize that IRC is simply an insecure telnet hack. It always will be.
Recreate is based on ssh or something.
The windows users have all moved on to AIM and ICQ anyhow. IRC is old news.
Re:Sure (Score:1, Offtopic)
Obviously you are not a linux user, or if you are, your not a very good one. There are many data managemnet tools for linux that dont work from the command line, and you do more typing to login than i do to grep my address book.
Agian, clearly you dont actually use linux.Or know antyhing about it. Otherwsie you would know of the existance of KDE 3.1.1, whos GUI rivals that of windows xp.
Fizzer is nothing more than downloading format.com from somewhere and running it and ruining yourself. It's a program for crying out loud, and any idiot who downloads it and runs it deserves to be hit with a lot more than having an email sent out to all his/her contacts. It's not windows. It's mIRC at best and even then only because it has an "Open" button for files downloaded.
Ok, apperntly you dont know much about windows ethier. Ever wonder why that jpeg will display in the email? Its because there is a MIME type in the email that windows/outlook uses to see if it can display the file in your email message, if i change the mime type to the appropriate value, I can attach "format c:
Re:Sure (Score:4, Insightful)
(Last Journal: Sunday November 11, @09:31AM)
I mean, it propogates by dorks who download the exe and run it. If every Joe Dipshit ran linux, then it wouldn't change.
You'd just get a message box saying "you must install this hot sex program as root for the ultimate hot action!" and they'd happily comply.
Or people compiling or installing binaries without knowing what they are.
It's an exploit of the users, not so much the OS.
Re:Simple solution. (Score:1)
Re:Simple solution. (Score:1, Offtopic)
(http://freefall.homeip.net/)
Wish they'd use the windoze "Documents and Settings" for the config file by default though.
Re:Sure (Score:1, Offtopic)
havent touched linux cince the early 80's have you?
This is what really get's me... every one of you that bitches about linux and it's difficulty and ugliness dont even have a clue as to what you are talking about and are worse than technical writers.. Making crap up as you go.
Linux todays is as easy to use as your beloved OS. Get off your lazy butt and look at it, touch it, use it. if you are deeply in love with the windows style of operating use KDE... if you adore Mac use Gnome (Yes Gnome is more mac like when properly configured... not like how redhat set's it)
I have taken the attitude at work to publically humiliate people who say something is difficult when they really dont know what they are talking about. I suggest that other do the same.
You sir know absolutely nothing... so you have ZERO credibility... please come back when you can talk without making things up or lying.
Re:My solution, presented years ago (Score:1, Offtopic)
Windows bashing is fine in my book, but making ridiculous suggestions is exactly that.. ridiculous.
Re:My solution, presented years ago (Score:1, Flamebait)
Re:Darwinism For IRC (Score:2)
It could be worse. At least linux IRC clients tend to filter out mIRC colours, and there are decent win32 IRC clients. You should see what those Outlook and Outlook Express users do to Usenet posts. *shudder*
The best part of it is that Outlook and Outlook Express demangles its own creation, so that the post is only broken in every other news client on earth, which leads to "dude, your client is broken", "looks fine to me" threads.