Nimda To Strike Again 523
Seabass55 writes: "Researchers say Nimda is set to propagate again after rechecking Nimda's code. God help all the MS boxes ... again." Looks like the owners of unpatched IIS machines have until 9 p.m. GMT (1 a.m. ET) to get ready. I'd like to see a nice double stockade for the writers of Sircam and Nimda, and maybe some fireants. Update: 09/27 22:45 GMT by T : Temporal confusion -- that's 5:00 GMT, sorry :) Update: 09/28 00:14 GMT by T : Carnage4Life contributes this link to a command-line tool from Microsoft to list patches already installed or still needed, if you think your Windows machine may be vulnerable.
9 PM? (Score:3, Flamebait)
Again? (Score:2, Interesting)
Mind you, I've not seen a significant dropoff in my firewall hits (hits doubled after Nimda first hit), but perhaps I've not been checking properly.
Re:Again? (Score:3, Informative)
It's quite obvious if you look at the graph I have here [ofdoom.com].
One moment, the nimda hit count is heading straight up, the next, a sharp bend to the right as the rate of new hits drops to almost nothing...
Re:Again? (Score:2)
Re:Again? (Score:3, Insightful)
somewhere around a year and a half.
Patch your damn servers! (Score:5, Funny)
Maybe just corn syrup and regular ants for the admins who still haven't patched their servers.
Re:Patch your damn servers! (Score:3, Insightful)
The usual punishment of:
- a hosed server first thing in the morning, before coffee,
- a stack o mail from other irate sysadmins that are getting hit on by the infected zombie to which your name is attached,
- some urgent voicemails and pages from users and from your management asking what the !&%$ is happening.
The usual...ho humm.Otherwise, Friday morning would have been relatively pleasant.
Here's how I'm getting them patched (Score:5, Funny)
What I do is go connect to the offending box via smb
Usually they have a printer attached to it so I print out a page of A4 with :
"YOU ARE INFECTED WITH NIMDA, SORT IT OUT
here's how : http://www.antivirus.com"
on it in 72 point text
it's working so far
if they don't have a printer then they usually have an open share that's world writable so I leave text files called
you are infected with nimda.txt
and put the url inside them
that's closed a couple too
(I also found a keygen I'd been looking for so that was a bonus)
I'm not sure if nimda resets the passwords but which might not lead to a surprise of how far you can go with
un : adminsitrator
pw :
have fun
Re:Patch your damn servers! (Score:4, Funny)
I'd recommend 25 years of indenduted servitude at Microsoft. Possible outcomes:
Either way, we win.
Not Me (Score:4, Interesting)
Are you kidding?
Legislation shows that people have a hard time differentiating what's a serious offence and what isn't.
For one thing, taking this out on someone hard, would only lead to approval of laws like the proposed law to make a bunch of kids in HS "terrorists" for winnuking each other.
We KNOW that these aren't hard to create, kids with no formal training can crank them out like they're nothing. To a 14 year old kid who needs to show off to his friends (and almost all of them do), it's IRRESISTABLE. I can't picture throwing someone behind bars for more than a couple years just because they're virus is effective.
If anything, they need counseling to know WHY what they are doing is bad, that it affects other people and that it isn't just a game, but certainly making an example of these people sets a precident for the treatment of all of us.
In other words, turn some silly kid with a script for making viruses into a real criminal, when people are getting in trouble for stupid stuff like scanning someone's ports, and soon you'll see anybody without corporate backing thrown in jail for having a debugger.
Re:Not Me (Score:3, Interesting)
But this is really an argument in favor of different sentencing for juveniles than for adults (an idea that I support, and feel that recent laws are incredibly stupid to ignore) not against heavy potential penalties for writing viruses. IMO, writing a virus is the ethical equivalent of starting a fire, and deliberately releasing one is the moral equivalent of arson. Like a fire, a virus has the potential to spread completely out of the control of its originator and cause tremendous damage along the way. Little kids are not generally sent to prison when their playing with matches burns something down, but adults who do so are- and deserve to be- treated quite harshly. IMO any person who is legally competent to understand the consequences of releasing a virus and does so anyway deserves a nice long vacation at Club Fed.
Re:Not Me (Score:5, Interesting)
Despite the fact that I thought we were patched and secured, the Nimda worm hit our servers. Oops - missed one of those MS security bulletins. My bad.
The cost in real dollars (not "gartner dollars" or "TCO dollars) to clean it up was around $25,000. For one small manufacturing company.
If a naughty kid threw a rock through our window and did $100 of damage, the police would yell at him and call his parents to pick him up. If he threw a bottle of gasoline through the window and did $25k of damage, he would be prosecuted for a felony.
So exactly how is this Nimda bomb not a "serious offense"?
sPh
Re:Not Me (Score:2)
I've always been curious - exactly how was this value arrived at?
I know that one of the major factors that goes into the usual "damage" estimates is actually people's time, but if you have a sysadmin on staff, it's not costing anything real, it's just changing his tasks for the day (to arguably do something he should have done already).
Not meaning to flame you, I've missed my share of security bulletins too. I'm just honestly interested in where that figure comes from. I understand if you don't want to mention specifics due to corporate interest, but even a rough breakdown would be enlightening.
Re:Not Me (Score:4, Informative)
Maybe this isn't the case where you work, but where I work people use the computers to get useful work done rather than just to provide employement for a sysadmin. If a virus or worm causes down time, or the DDoS-equivalent of all those scans causes people to be unable to reach the internet to do their jobs, then everybody in the company sits there twiddling their thumbs doing nothing. That costs money. So do lost orders because people attempting to reach your web site get a defacement message and probably a copy of the worm instead of your orders page.
Re:Not Me (Score:2)
People posting damage estimates should included some indication at how they were arrived at: its just a part of gaining credibility. 50 different companies are going to estimate it 50 different ways, and everyone from consultants to law enforcement will have their own definition.
Re:Not Me (Score:3, Informative)
Well, I'm a bit busy at the moment
We are in the middle of an ERP implementation. I (who serve as the IS Director, IT Manager, business analyst, and project manager) am six weeks behind on some critical tasks. Fixing the worm took 5 days of my time (about 100 hours - but I won't charge for the lost sleep). I had to bring in several temps to key data that couldn't be pulled from our reports server, bring in our networking consultant on short notice from out of town, pay overtime to the other members of my staff to assist in the cleanup, buy two additional machines to use as recovery servers. We missed several customer shipments because part of the shipment processing system was down, for which we will probably have to pay penalties. We had to pay our EDI vendor to fax us transactions that should have EDI'd in, and Customer Service and Accounting people overtime to key them in manually. We may be charged penalties for not to the customer for not completing the EDI transactions. And so on.
There are real dollars involved when business processes fail. Normally I am not the most even-tempered person in the world, but this time, every time I started to get angry I thought to myself: "and how do they sysadmins on Wall Street feel?", making my problems not seem as critical. But it was a very ugly week.
sPh
Re:Not Me (Score:2, Insightful)
Why don't you have a secure firewall to protect your servers?
We are living in the time that 100 years from now people will look back and think we must not yet have evolved properly. They will look back and think, "Why did they put up with that idiocy? Were they just stupid back then?" And parents will shrug and grandparents will say "It was like the frontier!" and kids will think "Wow. Those guys were stupid."
Don't bitch about the lack of govenment protection when all you have to do is install appropriate security which costs NOTHING. I don't want my taxes paying to protect you from your own laziness.
25K lost? Serves you right.
Re:Not Me (Score:2)
Why don't you have a secure firewall to protect your servers? "
There's something to that argument, and I have already abased myself in front of the owners of the company.
OTOH, we DO (and did) have a firewall and virus scanners of reasonable strength. I also own a house on a fairly heavily travelled street. Should I have to put up 3m walls with razor wire and install bullet-proof glass, as they do in Jo-burg? Is that a pleasant way to live? And what about personal responsibility on the part of the felon who did, in fact, actually cause the damage?
sPh
Re:Not Me (Score:4, Insightful)
Oops indeed! All of Nimda's exploits were old. You had what? Five months? At a total cost of $25,000?? Damn, I hope you have some money put away, because if you were one of my employees, you'd be working at half pay to reimburse the company for your negligence. That's on a good day. On a bad day, you'd be fired, and I'd call Legal to have them sue your ass once it cleared the doorstep on your way to the unemployment line.
Rule 1: If you're an NT admin, you have to stay on top of *EVERY* patch. You don't patch, your company loses money because of your negligence. If you don't patch, you deserve to lose your job.
Now, if you're one of those companies that has lost a lot of 'good men' to rule 1, perhaps you should not use Microsoft products? Perhaps they're not everything the Microsoft rep told you they would be...
Re:Not Me (Score:2)
sPh
Re:Not Me (Score:2)
You are assuming that you, and the security vendors, fully understand Nimda and all its vectors. I am not quite so sure myself.
sPh
Re:Not Me (Score:5, Insightful)
You apply SP6 to NT4 the day it comes out. Your company's Lotus Notes system falls on its arse. You lose your job.
Admins have a hard enough job keeping a known, stable system running without applying day-0 patches every time Microsoft figure they're screwed up again. Applying patches immediately and automatically isn't a black and white issue, and all your sound and fury won't make it so.
Re:Not Me (Score:3, Funny)
We've know about these exploits for many many years. There are even patches for them, fire retardant materials and bullet proof glass. For some strange reason though, it is still the bottle thrower who is at fault and punished, and not the poor facilities guy who didn't upgrade the bits that make up the windows to something that cannot be attacked.
Why the double standard? In the 'real world' good-enough security is, well, good enough. In the computer world, good-enough security gets laughed at and scorned.
Re:Not Me (Score:2)
We didn't. But even if we had done that, it would still be a felony offense to do 25k of damage to someone else's property. And the person who created Minda was not an innocent kid who didn't know what he was using. "I'm sorry - I didn't realize that a bottle of gasoline was dangerous". Yeah, right.
sPh
Re:Not Me (Score:2)
For the most part, yes. However, Nimda behaves in some very strange ways indeed and I think may have been the work of a pro. I have seen it spread through 2 methods which are completely undocumented and through software which is supposed to be immune, such as IE 5.5 SP2 or IE6.
I saw it write to a share which had write permission denied to everybody. Furthermore, it somehow executes itself through that share. So we have one patch which was supposed to work and another vulnerability for which there is no patch. That makes me suspect that the virus uses 2 previously unknown vulnerabilities.
FWIW, I did the following to secure my system at work (unfortunately MS OS) and have not had problems since:
1: Remove the following groups from NTFS permissions: Authenticated Users, Everyone.
2: In the security tab of IE, click custom and either disable javascript, or file downloads...
What? (Score:4, Funny)
Re:What? (Score:2, Funny)
Presumably they already have to attend Microsoft pep rallies, where Steve Ballmer may dance again. Haven't they suffered enough?
SysAdmins....wake up (Score:2, Redundant)
And when shit hits the fan, the management is sure to turn around and bite yelling "But we all knew about it..Why didnt you do it ?"
Patch those boxes up..and do so in a routine manner. Sure its pathetic and time consuming. but its your data and your hardware..
Re:SysAdmins....wake up (Score:5, Informative)
"I put the computer on the network to install Norton, and it keeps getting infected before I can get the updates"
Ok, TWO THINGS:
1) If your going to install IIS, do not plug it into the network you've shut down IIS. Then go download the updates.
2) Norton isn't going to stop you from getting infected, it will only warn you about it during a routine check. If you want your machine to stay healthy, PATCH YOUR GODDAMN SYSTEM.
Seriously, Microsoft has a little utily called HFNetChk that will scan any local or remote system and will tell you what patches need to be applied. This includes system, IIS, and SQL Server, and IE.
Not all updates are listed on the little automatic update website.
Sigh...
Re:SysAdmins....wake up (Score:3, Interesting)
Thats then thing that really pisses me off, we spend the time to lock down and secure our netowkrs, hours patching systems and making usre virus scanners are up to date and then we get slammed by servers we have no access to or control over - yet we are the IT dept.
If we cant maintain it and gurantee it safe then it should not be on my network dammnit !
Re:SysAdmins....wake up (Score:4, Informative)
Also, eEye has a neat little NIMDA Scanner [eeye.com] which will do up to a Class B net looking for exploitable machines. Sometimes finding a machine that COULD be infected is harder then finding the actual infected ones.
URLScan is nice, but you really need to know what your doing to run it, as it's easy to mess up a webserver thats running fine.
But the most important thing to do is to get on those security lists, NTBugtraq, MS security lists, etc. As well as hitting the big security related sites out there before your morning cup of coffee to make sure nothing new has come up.
It's all basically common sense, but every now and then you need a nice reminder.
Re:SysAdmins....wake up (Score:2)
You are assuming, of course, that all the vectors of infection are known, all the behaviours of the worm are understood, and that patches exist for all of them.
It's typical terrorist tactics to hit the same target twice 20 minutes apart. That way you get all the rescue workers and gawkers too. The IRA figured that out years ago - the WTC killers just perfected the idea.
So perhaps Nimda was designed to throw a scare into everyone, cause them to run around and download lots of patches, expend lots of effort - and then 10 days later do its real dirty work.
sPh
Learn Internet Security Or Get Off The Web! (Score:5, Informative)
(Plain-text link):
http://www.wired.com/news/business/0,1367,47037
Somebody please show Gartner this article (Score:2)
Read between Gartner's lines (Score:5, Insightful)
If a company wasn't hit by both, presumably their security policies and procedures are either already up to scratch, or capable of being improved sufficiently. But if a company was hit by both, their procedures are probably beyond repair, and they'd be better off with a server that's more secure by default.
So I think Gartner was absolutely correct. Not only that, but people who didn't pick up that subtlety from the Gartner report are also more likely to need to switch servers, so the report works either way! :P
The myth of regular patches (Score:3, Interesting)
But does IIS really need patches as frequently as you imply? Code Red, Code Blue, Nimda et al exploit the same security hole that is almost a year old. The problem is that for every security hole, there are several waves of worms because IIS admins simply never patch their boxes.
If you disbelieve me check out Netcraft's security survey [netcraft.com] which shows how long several IIS boxes have gone unpatched and that about 12% of SSL sites (meaning they are probably eCommerce related) running IIS have been "rooted".
Patches, and security principles (Score:2)
Apache is more secure than IIS because it does not trust itself to police itself-- it allows the OS to police it too! This is the problem behind Sendmail and BIND, and it also exists in many competing web servers, including Tux, Websphere, etc. I do not know enough about iplanet to comment about their security model.
That being said, there are some places where IIS may be the most secure alternative (where the security needs to be integrated into the user-level security on a domain, f. ex). I just believe that the world of serving pages to public networks is not it...
sircam may me feel warm today though... (Score:5, Funny)
that means that someone actually had it on their computer, and that made me feel all fuzzy.
god bless sircam, and its glorious resurrection and distribution of great software titles.
Re:sircam may me feel warm today though... (Score:5, Funny)
EWW.....
Re:sircam may me feel warm today though... (Score:2, Funny)
Re:sircam may me feel warm today though... (Score:5, Funny)
Re:sircam may me feel warm today though... (Score:5, Funny)
I went to a someone house to find out why there PC was running slow, they had a program I wrote 8 years ago, and they were still using it! I did ask him why he never sent the author the shareware money(10.00). he said "I'm sure he made so much money he won't miss my 10 bucks".
then I told him it was me, and NO ONE sent me ANY money. boy did we laugh. Of course he still hasn't paid me my 10 bucks...rat bastard.
Fight back (Score:5, Informative)
Re:Fight back (Score:2, Insightful)
Wouldn't this script, if widely employed, bring forth massive tidal waves of email as well?
Imagine an admin's joy at finding that not only are 20 of his servers infected and/or destroyed, but he has an inbox full of thousands of messages that are now swamping his mailserver.
Given that the communication of the email is not secure, could a malicious party not monitor traffic for copies of your script's message, and thus know exactly which servers can be exploited?
Perhaps a better solution would be a secure central registry / database of known-infected systems, which exposed a secure known-infected system reporting mechanism (even a simple XML message protocol via https for example). Just thinking on the fly here...
Anyway, the intention is noble...
Re:Fight back (Score:2)
Please! As a patched NT admin, let the unpatched be DOS'ed off the face of the planet.
Why the sudden infux? (Score:3, Interesting)
Is their widespreading mostly helped by the recent influx of cable/dsl users? Instead of the usual MS bash, could we try to explain some of the factors that make these stories so common on
Of course, we can't escape that it was Microsoft that published exploitable code but I'm sure their software has always been as bad so what else is behind the current surge?
Fireants (Score:2)
I'd like to see some fireants for the server admins who still haven't patched for this thing. What kind of rock do you have be living under not to have heard of this by now?
Math? (Score:5, Interesting)
9pm GMT -05:00 (EST) is 4pm EST.
However, the time mentioned in the article is 1am ET. Hazard a guess that it is really EDT they are citing, making 5am GMT zero hour. It will be 12:00am (Midnight) EST.
Re:Math? (Mea Culpa) (Score:2, Funny)
Sorry about that.
timothy
Re:Math? (Mea Culpa) (Score:2)
Nimda cost me Microsoft. (Score:5, Interesting)
Is this a Microsoft problem? You bet.
Microsoft OSs do not have a complete, common set of system administration tools built in. This results in haphazard machine administration.
Microsoft and other companies sell useful administration tools, but these are high priced tools that only do a piece of the job. And since they aren't included with the OS, very few sysadmins have expertise with them.
So Microsoft, get on the ball. If you want to sell an OS, it should be ready for the enterprise.... including enterprise administration.
In the meantime, we're porting our apps from IIS to Apache. Yay!
Re:Nimda cost me Microsoft. (Score:5, Insightful)
Our organization didn't do squat because we spent five minutes researching commonly accepted practices for securing IIS and NT boxes before we ever put our first box on the net. We do the same for every piece of hardware and software, exploits are not an MS-exclusive thing. The simple act of unmapping unused extensions in IIS has saved us countless hours (or days) of agony on many occasions. I suspect your organization may not contain the level of security-conciousness necessary to properly maintain systems connected to the internet since such security-awareness would have included remedial research into the securest method of presenting a piece of hardware or software to the internet. In other words, if your organization knew what they were doing, the issue you experienced would not have occurred. It's not an apache/IIS issue, it's a poor administration issue that will plague your organization, unless corrected, regardless of what OS and web server software they choose to deploy.
Hope this helps,
maru
www.mp3.com/pixal
Re:Nimda cost me Microsoft. (Score:4, Insightful)
Unfortunately Nimda spreads itself over shares, too -- so our server was well-maintained, but every shared directory on there was filled with the
All it took was a single person on our network who had disabled their antivirus to spread it all over ever network drive in the place.
Re:Some advice to cut down on the runnin around. (Score:2)
snip!
Just so happens more people are writing them for MS
Gee, why do you think that is? They don't exactly have a monopoly on the server market. Saying they have 30% is a error in their favour.
*gasp*
Do you think it's because they write a hole-riddled bit of software?? If 70% of the market is someone elses, and yet 100% of the exploits that make the news are written for MS, that does not bode well even in the most conservative analysis.
*gasp*
Now, if they did write a hole-ridden bit of shit, that does make it their fault! Damn, the logic train just keeps going... And just like MS, the verdict of the logic train ain't in your favour.
Re:Some advice to cut down on the runnin around. (Score:2, Interesting)
From the OpenBSD website: "Four years without a remote hole in the default install!"
Now, with the resources that M$ has, there's no reason why they shouldn't be able to say the same. The simple fact is that they've determined that they can make the public believe that they are not at fault, so it is more cost effective to add another "feature" to the os. If general motors didn't put airbags into their cars so that they could put in extra cup holders, would they be at fault? After all, it is the other car that actually caused the fatalities, right?
Dangerous Viruses?? (Score:5, Interesting)
We seen a number of highly infectious viruses in the last year (Sircam, Code Red, Nimda, etc), but none of these were actually very destructive. Sure they are a pain to get rid of, and may spread a little information around, eat up bandwidth, or compel you to reformat just to be sure, but they aren't flattening people's systems.
Whatever happened to the anarchists out to destroy the system? Now admittedly I don't want to encourage people to be more destructive, but it seems almost trivial to think of ways that viruses and worms could easily be made more destructive. For instance, upon infection, delete everything in the "My Documents" folder. Or, change default web page to a share of the whole computer. Or even wait a couple days and then wipe the person's hard drive.
I haven't been vulnerable to anything to come along lately, and I'm glad, but I'm also glad to note that the truly skilled black hats out there seem to have moderated how much damage they actually intend to do. I wonder if they are scared what the law might do to them if their attack truly was evil.
Re:Dangerous Viruses?? (Score:2, Insightful)
Most successfull viruses don't kill their hosts right away, or ever, as by doing so they destroy their own method of propogation. Even if they did no harm for some amount of time, you'd find that the number of vulnerable systems would be down very quickly once that timer hit on a large scale, whereas with non-destructive viruses, you're almost garunteed to have repeat outbreak becuase of lingering infections out there that never get cleaned up, or are left for long periods of time.
In general, the more destructive a virus is, the shorter it's overall lifespan, and the lesser the overall damage.
Re:Dangerous Viruses?? (Score:2)
Viruses in nature are developed through evolution and mutation and thus long term survivability makes sense. Computer viruses are intentional creations of people, and it doesn't seem to me that virus writers would neccesarily focus on making them last in the wild for a long time. There are people who just like destroying stuff right? And depending on what you destroy or how you do it, it isn't neccesarily immediately obvious to the user, or going to stop the worm from seeking new hosts.
Also with the IIS worms, they tend to just about saturate all vulneralbe machines within the first few days if not hours. Once you've got 98% of what's available to get, then shutting all those down doesn't cause much loss in total reach. Especially since after a point the infection rate goes down due to patching faster than it increases from finding still uninfected machines.
Some people say they write viruses to demonstrate vulnerabilities, well it doesn't seem like a huge leap, by that logic, to decide to start taking out vulnerable software.
Re:Dangerous Viruses?? (Score:2, Interesting)
The new worm/virus phenomena is more of an annoyance. I keep my servers patched and protected, but I get 20+ emails a day from my users (all properly paranoid) about the new virus they heard about while driving in to work. That is the worst part.
Re: How can I protect myself? (Score:3, Informative)
To put it mildly, YES! While it's true that Microsoft products are no less secure than those of other vendors, Microsoft's position as market leader makes them a prime target for hackers, virus writers, and other internet terrorists. You really have no business running a web server until you learn something about security. You can start by reading up on Nimdahere [microsoft.com].
Re: How can I protect myself? (Score:2, Informative)
You're Trolling, right? It's been over 3 years since the last remote root exploit in Apache, and IIS has had several this year!
If you're not Trolling and you actually believe what you just said, you'd better do some research.
Re: How can I protect myself? (Score:2)
Hmmm (Score:2)
Market leader?? If that was it, I think that Apache would be three times the can of worms that IIS is. You must admit that the default installation of Apache is MUCH more secure than the default installation of IIS.
IIS has the same design flaw that Sendmail does, an dit has enough market share to be a viable target. It is also true that many other vendors make the same mistake (including Red Hat and IBM)but lack the market share to be reasonable targets.
Moral of the story: If you want to use IIS, tell it only to listen to IP address 127.0.0.1. If you can't figure out how to do this, please install Apache instead. (www.apache.org)
There is blame for Microsoft as well (Score:2, Funny)
I'd like to see something similar for the IIS developers along other selected members of Microsoft.
Stockades all around (Score:2)
Nimda, and maybe some fireants.
Yes, and a special one for those who roll out vulnerable server software. Ideally, with all the attacks, IIS should get stronger, as a body's immune system does with constant testing, however, it would indeed be a sad body which has been so patched. Make Frankenstein's monster look like George Clooney.
If you follow good practice... (Score:5, Informative)
Then you're not vulnerable to either.
Good practice in this case means keeping your systems updated to the latest patches, not having open shares at all, and updating software to the latest version. It also includes not using software known to be not only a security risk, but basically an open door to "hackers". Note the quotes, please. They indicate sarcasm.
If you have patched Win2k to SP2, are running IE6 final, and do not use outlook, you have protected yourself from every vector these worms, except for the "Web Folder Traversal" issue. That's a minor quick fix, though it shouldn't have been necessary.
Why am I willing to specify not using outlook and not specifying not using IIS? Because it became abundantly clear that outlook was unsafe well over a year ago, whereas IIS could have been terms "more or less okay" until recently. Also, you just can't walk away from NT/IIS webservers and jump on the *[iu]x bandwagon right away, because there's all that ASP code lying around.
Until M$ rewrites outlook, outlook express, and IIS from the ground up, you should immediately (or as close to immediately as you can get) stop using them. Given that IIS sucks anyway, you might as well stop using it permanently. I understand the allure of outlook, and the interoperation between it and exchange, but consider a web-based scheduling/collaboration system. Exchange is pretty lousy anyway, for a whole bunch of reasons I won't bother going into here.
And finally, this is not anti-microsoft FUD, this is all based on reality. I'm not against microsoft on the desktop, or microsoft servers to serve microsoft clients. But we've seen time and time again how running microsoft windows of any flavor as a web server platform incurs a much higher cost than unix, because unix just doesn't tend to break as often -- Or be compromised. While this is not an OS-level bug, you really only have one choice as far as performance and support goes for a webserver on windows, and it's not a very good choice.
Re:If you follow good practice... (Score:5, Funny)
Fortunately I was able to boot into Linux and delete all those .eml files, then download a virus remover from McAfee or someplace. But let this be a warning: Before deleting a .eml file, TURN FILE PREVIEWS OFF!
Re:If you follow good practice... (Score:2)
The IE6 issue can be prevented by disabling file downloading in the security settings, and the share issue can be resolved by removing the everyone and authenticated users groups from the share and NTFS permissions of shares.
Re:If you follow good practice... (Score:2)
What's sarcasm?
Re:If you follow good practice... (Score:2, Informative)
I run w2k pro sp2 with IE6 at home (dual-booted with slackware), with all of the various MS patches installed, behind a firewall - I know the dangers of IIS.
Last week, I was browsing through some UK web agencies, and one of them had been infected with Nimda. Unlike most other people who got hit by Nimda, when I hit that IIS server, I didn't get a "save as..." dialogue. My firewall didn't notice anything amiss either.
All that happened was :
My desktop background changed to a chessy pic of a skeleton over a forest background.
My machine started grinding away like hell.
I muttered "Oh fuck." under my breath and whipped the cable out of my ethernet card so my girlfriends machine didnt get affected, as far as I could manage.
I'm no sysadmin guru, but I'm a pretty savvy user, and had patched my system up fully, and I still got dicked. Yes, it wouldnt have happened if I was under *nix, but I do a lot of work with Shockwave and Flash, so 9 times out of 10 I'm running win32 rather than linux.
It blows.
Let's all simply block Microsoft IIS (Score:2, Informative)
Well, I suggest that we go farther. We already block harmful and suspect viruses at our perimeter and throughout the enterprise. Why not instruct our routers, firewalls, and proxies to block any packets that indicate the content is coming from IIS - and block any M$ Internet Explorer broswer? Just drop the packets?
OK. I'm speaking toungue in cheek, but I could actually make a justifiable argument that such use has PROVEN twice in a month that those tools are demonstrated security risks and should be defined as dangerous activity.
I am so sick of this (Score:5, Insightful)
I work in a Corporate Travel Agency in NYC, they just decimated my entire staff and I have me and one other guy who has been relegated to inputting ticket refunds.
I DON'T HAVE TIME FOR THIS! My lone IIS server has been patched since the first day. Lotus Notes doesn't care about these dumb ass viruses (virii) and my Norton's are all up to date.
My USERS got this crap from infected web pages!
We're losing a machine a day in the field b/c these bozos can't figure out how to click on a button called VIRUS_FIX on the corporate intranet.
I am ready to frigging quit and become an English Teacher fuck the money! If the whole MS world can be brought to its knees everytime some kid in Sweden has the day off then we're all fucked.
CIOs who continue to use Outlook/IIS deserve whatever happens to them. (We HAD to use IIS for a 3rd party software app.) Micorsoft SHOULD ABSOLUTELY BE PAYING IT'S CUSTOMERS BACK FOR THIS! HOW DARE THEY GET READY TO RELEASE YET ANOTHER VIRUS RUNTIME OS.
It is seriously time for the MCSE farms to be shut down and for corporate America to move to another OS. Fuck the users; guess what they don't know all that much about the OS they are on switching them now will have no lasting impact.
Re:I am so sick of this (Score:2, Funny)
> I am ready to frigging quit and become an English Teacher fuck the money!
Read up on "run-on sentences" before you quit your day job.
Stocks, Stockades & Pillories (Score:2, Informative)
Take a look here: Stocks and Pillories [geocities.com]
I summon buckets of fireants! (Score:2)
-Jayde
Reading the code is one thing. (Score:2)
How long until someone drops the bomb? (Score:3, Interesting)
FORMAT C:
as the ultimate payload of a nimda-like worm, and all hell, and I truly mean all hell is going to break loose.
I think that it's absolutely shocking that no one knew until right now that the damn thing is going to start up again tomorrow. What else don't we know about the program? I certainly hope that the experts who are now giving us some six hours notice (at night!) that the damn thing is about to restart haven't missed any other little details of the worm's operation.
The entire ISS/Outlook security situation is absolutely shameful. Microsoft has been fucking around for years piling on layer after layer of buggy, insecure active this and executable that into the Windows mail system, and pretending that it doesn't matter, and the result, today, right now, today, is an internet that's about as secure as an airport with no guards, and half the locks in the terminals and on the planes flat out nonfunctional.
Someone is responsible for this mess, and it ain't the folks who wrote the RFCs!
How to install patches without a network? (Score:2, Interesting)
Anyway, as soon as we were done (installing while his home network was live), we tried getting to windowsupdate.microsoft.com to install patches. However, we soon discovered that we were already infected! Two freaking minutes after installation!!
If you don't install behind a firewall, how the hell are you supposed to get updates to all of Win2kPro's problems without getting infected?
Re:How to install patches without a network? (Score:2, Informative)
Now reinstall and try again.;-)
Administration tools (Score:3, Informative)
Those who are forced by circumstance to be responsible for administering IIS and other microsoft software should look at St. Bernard Software's UpdateExpert. It's a little pricey, but it doesn't cost nearly as much as even one full day of nimda / CodeRed / etc. infection.
It simply keeps a list of all patches released on the Microsoft support site, and lets you roll them out to machines on your network without the users knowing about it. It's saved my bacon a few times now.
I smell an ASP migration product opportunity (Score:3, Insightful)
Has anyone written a product yet to translate Active Server Pages (ASP) code to PHP, JSP, or some other format? Most of the basic scripting language concepts should translate pretty nicely.
Even if someone has built their IIS / ASP application 'correctly' (cough cough) isolating middle-tier logic to MTS or something similar, wouldn't Perl / Java / whatever wrappers to those COM / COM+ services also be straightforward to write?
Or has someone done this already? Isn't there (or wasn't there) a Chilisoft implementation of ASP that you could run on Apache and Linux?
killer app (Score:2, Funny)
spark the next information revolution.
I'm looking forward to Microsoft's first foray into creating actual worms, instead of just
providing the infrastructure.
One day we will all look forward to the next MS worm with all the enthusiasm that we now share for the next Windows.
It is not so simple as just blaming lazy admins (Score:2, Informative)
I have not used W2k much (set up a test server at work, and reboot it now and then when it fails mysteriously), so I guess by default there is no automatic "Your Software needs updating" dialog that pesters you. If MS had their SW configured to do a weekly check and let users know that updates were available it would help. I know that Mac OS 9 and Mac OS X do this and it is useful for making sure systems stay current, and I wrote a few scripts that run as cron job on my Debian box at home that do apt-get update weekly, and mail me if there is a security update.
Maybe something like this is already there in W2K (though if it is it sould be surprising), and I just have never seen it, I apologize if I speak from ignorance, but if there is not, then MS needs to get on the ball. Their software is causing a lot of problems, and they need to be more active in making sure that their boxes get updated.
Re:It is not so simple as just blaming lazy admins (Score:2)
I myself have helped at least five people uninstall IIS. None of them even knew what it was. One person asked me if they would still be able to view pages on the internet, like Yahoo... No I am not kidding.
Serves You Right. (Score:3, Insightful)
I bet you have security guards, fences and cameras to protect your buildings from 14 year old kids.
Why don't you have a secure firewall to protect your servers?
We are living in the time that 100 years from now people will look back and think we must not yet have evolved properly. They will look back and think, "Why did they put up with that idiocy? Were they just stupid back then?" And parents will shrug and grandparents will say "It was like the frontier!" and kids will think "Wow. Those guys were stupid."
Don't bitch about the lack of govenment protection when all you have to do is install appropriate security which costs NOTHING. I don't want my taxes paying to protect you from your own laziness.
25K lost? Serves you right.
Re:Serves You Right. (Score:4, Insightful)
Nimda is a tough worm to keep out of a network! (Score:4, Informative)
Unlike 'Code Red', Nimda does not spread by pushing the worm binary in the HTTP request. The worm uses HTTP to find a vulnerable IIS server, then causes the IIS server to make a TFTP request out to the attacking host to retrieve the ~64K binary.
Most normal 'secure firewall' products aren't tuned to block outbound requests from the protected servers to internet hosts. Mine are, but that only gave me about 72 hours of lead time before it came in another way...
Even when firewalls block the IIS scanning, Nimda spreads by email, file shares, and by putting a copy of 'README.EXE' in the root of the IIS server and adding Javascript to all web pages on the server, pushing the worm at users of the infected web site server.
My firewalls block _all_ UDP packets, but my network still got hit hard, and probably incurred more like $60K in 'paper losses' -- lost productivity, bandwidth, overtime, etc.
We haven't found 'patient zero', but we have two good suspects, in both cases a user with a laptop that did not have updated anti-virus software and that got infected from one of these routes:
The common thread here is user error.
The best firewall is no protection against malicious, or just plain ignorant, users. Blame also falls on local admins for failing to push virus signature updates and keep up with system patches.
I've only ever seen around a dozen inside hosts from which the work was actively scanning HTTP, but the worm traffic from those dozen machines alone was enough to severely degrade WAN and firewall performance.
Profit from it! (Score:2, Funny)
Like T-shirts...
"I've been attacked by Nimda and all I got whas this T-shirt"
"Chicks dig Nimda"
"(front:)IIS (back:) you are dumb"
Or posters...
"Internet map of Nimda infected domains"
New 'Inc DeMotivators' poster
We should inform Thinkgeek [thinkgeek.com] of this nifty plan
Don't want the attacks clogging up your logs? (Score:5, Informative)
SetEnvIf Request_URI "^/default.ida" attacks # For Code Red
SetEnvIf Request_URI "^/scripts" attacks # For nimda
SetEnvIf Request_URI "^/c/winnt" attacks #
SetEnvIf Request_URI "^/_mem_bin" attacks
SetEnvIf Request_URI "^/_vti_bin" attacks
SetEnvIf Request_URI "^/MSADC" attacks
SetEnvIf Request_URI "^/msadc" attacks
SetEnvIf Request_URI "^/d/winnt" attacks
CustomLog
CustomLog
This will dump all the "attacks" into a file called attack_log and leave your normal logfile clutter free.
eh... actually I'm glad about these viruses (Score:3, Interesting)
Re:9PM GMT == 1AM EST??? (Score:2)
-sam
Re:what do you mean again? (Score:3, Interesting)
Terrorists? (Score:4, Interesting)
1. They take hostages
2. They kill people
3. They make demands
4. They invoke terror in their victims
In no way do these "hackers" fit the description of a terrorist except for maybe #4. These are generally just people who find a whole in security and take advantage of it. They can be really annoying, and people who make these types of viruses should be tried for damages, but I don't think they fit the desciption of a terrorist.
But more important, I think Ashcroft isn't talking about virys writing hackers, but any type of hacker. Essentially, if you mess with a system at all, then you're a terrorist accroding to Ashcroft.
Boy, my parents must be disappointed in me now, rasing a terrorist..
F-bacher
Re:Terrorists? (Score:2)
Hackers find security holes. Crackers take advantage of them.
Re:Thanks, guys (Score:2, Funny)
So we know what shelf to sit on?
Re:What about Microsoft? (Score:2)
Re:A Tribute To Laxness or Stupidity...? (Score:2, Informative)
When you log attempts on port 80 from infected boxes go and have a look with a browser.
The majority will show the default "this site is under construction" page, the rest show the Code Red defacement page.
Re:Thats it ... time to go (Score:2)
Of course you realize that Linux hasn't had nearly enough exposure to back up that claim.
Re:Why treat this so flagrantly, Tim? (Score:3, Informative)
That is what everyone says. However, I have a hard time believing it because I have seen it hit systems with those patches on it.
I even saw it hit an XP system with a read-nly share (NTFS Permissions denied write access) and IE6 (which is not supposed to be vulnerable. IIS was not involved in either case, nor, surprisingly was Outlook, at least not directly...
Re:Windows Update?! (Score:4, Informative)
You might also want to read the directions for the tool you are using before jumping to conclusions about what the "WARNING" means. Read the security bulletin, and try to figure out why they made it stand out from all the other patches.
So, in summary... MS used to release Service Packs for fixes/updates/additions/bloat/etc. Although this is adequate for non-life-threatening issues, it has quickly become inadequate for security. MS releases a free tool to be used AS A SUPPLEMENT to Windows Update, which will allow you to apply each new security hot-fix as they release them, instead of being forced to wait on the next Service Pack.
"CRITICAL UPDATES" are where Service Packs are placed. Those 8 hot-fixes are part of SP3, but you can download them now since they relate to security making your system vulnerable to certain viruses and trojans.
With the increasing awareness of security, I'm surprised that you assumed anything, when you could have taken 10-15 minutes on MS's site to find out how clueless you were.