- NANOG - lists.nanog.org

RE: in case nobody else noticed it, there was a mail worm released today
by Michel Py 29 Jan '04

29 Jan '04

In-line... > Christopher Bird wrote: > Please pardon my ignorance, but I am > *mightily* confused. >>> Vivien M. wrote: >>> and ISTR one patch for Outlook 2000 that blocked >>> your ability to save executables was released) >> Michel Py wrote: >> It default in Outlook XP and Outlook 2003, which >> has prompted large numbers of persons to download >> Winzip, which as not stopped worms to be >> propagated as you pointed out. > Christopher Bird wrote: > The bit I don't get is how a zip file is created > such that launching it invokes winzip and then > executes the malware. When I open a normal .zip > file, winzip opens a pane that shows me the > contents. After that I can extract a file or I > can "doubleclick" on a file to open it - which if > it is executable will cause it to execute. I > haven't seen a case where simply opening a zip > archive causes execution of something in its > contents unless it is a self extracting archive > in which case it unzips and executes, but doesn't > have the .zip suffix. The point is, if the user opens the zip file in the first place, and if the file name it contains does not look suspicious, the user _will_ also double-click on the file within the winzip window, which extracts the file in a temp folder _and_ executes it. > Sam Stickland wrote: > I don't think that was the point Michael was trying to > make. I believe he meant that MS stopped the ability to > _even_ save executables attached to emails to disk in > some forms of Outlook, Yes. If you send me an .exe file, I can _not_ save it nor execute it. Outlook deletes the attachment, and now Exchange 2003 deletes it on the server as well before it even has a chance to get to Outlook. > but this did nothing to stop the spread of viruses. > People simply sent executables as zipped files, which > people then had to extract to run. Dispite the fact > that an external program has to be used to get to to > the executable, people still run them. Exactly. Actually, there are faster ways to send executable files without zipping them: rename the file as .txt, and put a little note in the email saying that the .txt file is in reality an .exe and must be renamed. Don't even need Winzip. Voila. This latest worm is all about social engineering; remember: some users still fall for the hoaxes that claim Norton or McAffee does not detect a virus and instructs to delete a system file. Gee, some even fall for that herbal stuff that promises to put a foot in their pants. Given the number of people that have fallen for the "Microsoft update" and the "7-bit ascii" we are seing these days, they would rename the file and run it if they believe they have to do it. Three years ago, I opened an .exe that contained a virus. At lunch with my colleagues, we discussed the Florida ballots. In the evening, I receive an email from one of my co-workers whose subject was "Florida ballots" containing an .exe file; given that the "saddam.exe" he sent before was rather entertaining, I executed it. The anti-virus signature was not available yet, busted. Social engineering it is. The bottom line is this: no matter what safeguards you put in the system, and no matter how many times you instruct users to be careful opening attachments, the one and only thing that make users think is when they open a worm and get screwed/lose data/look stupid. Michel.

1 0

RE: Don't Panic II (Re: updated root hints file)
by McBurnett, Jim 29 Jan '04

29 Jan '04

I wonder if Someone from Microsoft is here and will add this to an update for the Active Directory DNS that will most likely be the user of the old addresses in 5 years..... FROM: Bill >I wonder how many systems will _still_ be trying to get to b.root-servers.net >at the old address in 5 or even 10 years.

1 0

Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Dave Temkin 29 Jan '04

29 Jan '04

>>> >>> >>> >>> : They rate of it is quite surprising. By the description, the trick >>> / >>> : method of infection does not seem all that different than past worms >>> : viri. Makes me wonder how many people in a room would reach into >>their >>> : purse/pocket on hearing, "Wallet inspector" >>> >>> >>> Every single person that still opens these damn attachments! :-( >IN WINDOWS! So? Had the virii been an application compiled for RedHat and everyone ran RedHat instead of Windows and they downloaded it using Evolution and double clicked on it, it would suddenly be RH's fault instead of MIcrosoft's? Or is it sendmail's fault because it was listening on port 25 and allowed the worm to connect to it? Newsflash: Even those using Netscape Mail, Lotus Notes, etc. on the PC were still potentially infected due to the nesting of the virii. The worm was not spread through any vulnerability in the operating system, unlike NIMDA/SQLSlammer/etc. This worm was propogated through pure user stupidity, and that'll follow any operating system that Dell/Gateway pre-installs for them. If everyone wants to flame MS, at least do it in a way that doesn't show your own ignorance. -Dave

12 12

RE: in case nobody else noticed it, there was a mail worm released today
by Michel Py 29 Jan '04

29 Jan '04

> Vivien M. wrote: > Someone made the argument to me privately that the > problem is that MS lets you run attachments from > Outlook, while other clients would require you to > save the files to disk. That's not a solution: if > these people are like my parents used to be, they'd > dutifully save the attachment, open up a file > manager, and open it up to see the "cool new > screensaver" their best friend sent them ("hey, > even if it's a virus, I have an antivirus" is the > usual excuse). Sure, that's three steps instead of > one, but for as long as the HUMAN behind the > keyboard wants to open the attachments, whether it > takes two clicks or fifty keystrokes, that >attachment will get open. Indeed. I remember the good old days when I was working with an OS called Flex, which was designed mainly for S-100 machines running the 6809 processor (ISTR that it was a competitor to something called OS/9). Anyway, when one wanted to delete a file or do something like that, it asked "are you sure" and your had to type "y" and then it asked "are you really sure" and you had to type "y" again. After a while our brains rewired our fingers so whenever the "y" key was required it was hit twice in a row, which eventually led to new words (spell check was unknown at the time) such as yyankee, honeyy, new-yyorker, and so on. We ended up hacking the kernel so it did not ask twice.... > and ISTR one patch for Outlook 2000 that blocked > your ability to save executables was released) It default in Outlook XP and Outlook 2003, which has prompted large numbers of persons to download Winzip, which as not stopped worms to be propagated as you pointed out. Michel.

3 2

Re: Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Dave Temkin 29 Jan '04

29 Jan '04

> > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > james > Sent: Wednesday, January 28, 2004 4:02 PM > To: nanog(a)merit.edu > Subject: Re: Misplaced flamewar... WAS: RE: in case nobody else noticed > it, there was a mail worm released today > > > > : What's that got to do with today? > > > I might be reaching here, but I understand some people never upgrade or > patch. True, but that happens regardless of the OS. I'm sure if we looked really hard we could find some ancient versions of bind & or sendmail (complete with open relays (speak of old bad defaults...)

1 0

Re: Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Dave Temkin 28 Jan '04

28 Jan '04

>>: Also, for reference to other people - the preview pane does *not* >>allow >>: the execution of attachments unless they're double-clicked on and >>: acknowledged. Again - we're not talking about another OS or Outlook >>: exploit, only a stupid user exploit. >The "feature" has been fixed but it **did** at one point run apps. >James Edwards >Routing and Security Administrator >jamesh(a)cybermesa.com >At the Santa Fe Office: Internet at Cyber Mesa >Store hours: 9-6 Monday through Friday >505-988-9200 SIP:1(747)669-1965 Right, and at multiple points bind and sendmail allowed the execution of code from remote systems without the system owner interacting at all. What's that got to do with today? -- David Temkin

2 1

Re: Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Dave Temkin 28 Jan '04

28 Jan '04

On Wednesday 28 January 2004 08:37, Dave Temkin wrote: >> So? Had the virii been an application compiled for RedHat and >> everyone ran RedHat instead of Windows and they downloaded it using >> Evolution and double clicked on it, it would suddenly be RH's fault >> instead of MIcrosoft's? >If RedHat, by default had you running as root rather than an unprivledged >user, it sure would be. > >Most Windows boxes are running with administrative privledges. That >makes >Windows a willing accomplice. The issue isn't that people click on >attachments, but that there are no built in safeguards from what happens >next. > >-- >Robin Lynn Frank | Director of Operations | Paradigm-Omega, LLC Cry >havoc, >and let slip the dogs of war! Email acceptance policy: >http://paradigm-omega.com/email_policy.php You're the second person to say that and it's still wrong. The virii, once resident, opens a connection to port 25 on an open SMTP server, whether it be the user's ISP relay or local server. Sure, it can't install itself into /etc/init.d, but it sure can launch itself bg instead of fg and be running until the user either kills it or reboots the box. Also, for reference to other people - the preview pane does *not* allow the execution of attachments unless they're double-clicked on and acknowledged. Again - we're not talking about another OS or Outlook exploit, only a stupid user exploit. -- David Temkin

2 1

None
by Dave Temkin 28 Jan '04

28 Jan '04

On Wednesday 28 January 2004 08:37, Dave Temkin wrote: >> So? Had the virii been an application compiled for RedHat and >> everyone ran RedHat instead of Windows and they downloaded it using >> Evolution and double clicked on it, it would suddenly be RH's fault >> instead of MIcrosoft's? >If RedHat, by default had you running as root rather than an unprivledged >user, it sure would be. > >Most Windows boxes are running with administrative privledges. That >makes >Windows a willing accomplice. The issue isn't that people click on >attachments, but that there are no built in safeguards from what happens >next. > >-- >Robin Lynn Frank | Director of Operations | Paradigm-Omega, LLC Cry >havoc, >and let slip the dogs of war! Email acceptance policy: >http://paradigm-omega.com/email_policy.php You're the second person to say that and it's still wrong. The virii, once resident, opens a connection to port 25 on an open SMTP server, whether it be the user's ISP relay or local server. Sure, it can't install itself into /etc/init.d, but it sure can launch itself bg instead of fg and be running until the user either kills it or reboots the box. Also, for reference to other people - the preview pane does *not* allow the execution of attachments unless they're double-clicked on and acknowledged. Again - we're not talking about another OS or Outlook exploit, only a stupid user exploit. -- David Temkin

1 0

in case nobody else noticed it, there was a mail worm released today
by Paul Vixie 28 Jan '04

28 Jan '04

my copies (500 or so, before i filtered) are in a ~7MB gzip'd mailbox file called http://sa.vix.com/~vixie/mailworm.mbox.gz (plz don't fetch that unless you need it for comparison or analysis). there's a high degree of splay in the smtp/tcp peer address, and the sender is prepared to try backup MX's if the primary rejects it, though it appears to try the MX's in priority order.

8 7

How does one reach a human being at Yahoo?
by Eric Brunner-Williams in Portland Maine 28 Jan '04

28 Jan '04

A friend of mine died suddenly over the holidays, his bio is here http://triballaw.wabanaki.net/archives/000030.html He had some lists hosted by Yahoo, a native grad student list in particular, which I'm informed by someone who should be next as its manager, is no longer accessible. Basically, I need someone with clue at Yahoo who can roll up a tar ball of one or more indian (feathers, not dots) mailing lists and put it where I can move it to tribally operated unix boxen. Contact clue greatly appreciated. Eric

1 1