Security

Ask something
Discussion Locked

Dealing with MSBlast

0 helpful
17 replies

by debate

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Has your organization been hit by MSBlast? Do you agree with Jonathan Yarden that the use of DNS in worms makes them more difficult to deal with? Share your experiences with MSBlast, as discussed in the Aug. 25 Internet Security Focus e-newsletter.

If you haven't subscribed to our free Internet Security Focus e-newsletter, sign up today!
http://nl.com.com/acct_mgmt.jsp?brand=techrepublic

17 replies

by vaitguy

Since I started playing with computers back in the early 80's in grade school, I have seen computer virii and worms come and go. When thsi one hit and I started investigating, I started thinking, why does MS still allow this to happen?
One of these days, someone is going to make a virus that takes out the entire TCP/IP stack. Then we'll be screwed. So, to Microsoft I pose this: We wouldn't be running around spending billions of dollars for someone to find the hole in the network and attempt to patch it and someone to sit at a computer waiting for the next windows patch to download. Fix your errors the first time!

by elama

I've been working with computers since the old Burroughs mainframes that used keypunch to enter the data, way back in 1968. The one thing I have found is that it is darn near impossible to write a program that is not hackable.

I know people point to Linux as unhackable, but I don't believe this. Virus/Worm/Trojan writers want to disrupt the most lives they can. To do this, they must write for Microsoft which is undoubtably the largest software company. I've worked in shops that used programs designed as Linux/Unix, but still when it came to the desktop what do I see, Windows. Why, because people want instant and easy both, and they don't want to learn new things. Most of the worms, viruses, and trojans that have hit had a patch that would have stopped it had a user kept up with the updates and patches.

As an IT professional, I make sure all of the departments I work with have the updates and patches installed, and at home I do the same. My son has a computer, and he maintains his the same way. Users must learn that if they want the convenience of the computer, they also need to take the responsibility of having one also. It's easy to point the finger, but remember when you point a finger at Microsoft, four are pointing back at you.

by allisonmea

Viruses are programs written by people who didn't make the turn during embryological development. This developmental disability causes the brain to develop in the rectal area.

Such people think they are cool, and actually believe they are intelligent, but they are pathetic vermin that should be put out of their misery.

The viruses they create do things that cause systems to run slow or send a lot of emails, or some other obnoxious krap. Some will run file deletion routines, destroying information, or forcing you to restore from backups.

In short these brain dead slime eating maggot infested scum balls cost other people money, and think its funny...til they are caught...like that wannabee from Hopkins MN last week. His mommy and daddy will whine him out of jail. If they do, I'm going to jellify his ass with a two by four.

by wgraves07

Don't hold back on our account. Tell us how you feel.

Worked with a little twerp who started programming and got into hacking. Quit his job as an Access programmer and then called the new System Admin to tell him he hacked the system. Thought he was all that until the VP called him and told him that if it happened again he would go to jail.

I think of all hackers as dorks that are screaming for attention. I know I shouldn?t generalize, but I do.

Look on the bright side, hackers keep a lot of us employed. Grandmother always said to look for the silver lining???..

by jaystar

A sucess for the virus creator. Maybe you didn't know this when you wrote the article, but Welchia has cause significant damage within SERVERAL organizations. I spoke to yet another one today that is STILL crippled because of this worm. Since the scan rate is so high it is quickly filling most private T1's with ICMP traffic and choking real traffic out.

I have personal knowledge as I have seen the damage and the expense Welchia has caused several organizations. I pray Micro$oft doesn't have any more bugs like this.

by rlangel

This bug crept into newly imaged machines that were only on the network for a few seconds... The image was fine, but after running the scan on the machines, they were infected... The scan rate is incredible in this bug...

by traxmaker

a wonder to behold.It has great potential to recreate MSblast,I have seen this in action.Once
discovered one needs to take very specific steps to expose all of this virus/worm/msblast recreator,then one must go deep into the registry
to find the rest of this culprit.Yes it is a success for the creator and,I think, a wonder in it's makeup.

by mrafrohead

How do you get hit when there is only a few ports you need to block and a patch that you install???

And if your firewall is configured properly to begin with you should have already had the ports blocked, so there shouldn't have even been a problem.

Mrafrohead

by garydw

Even with all the relevant ports blocked a few laptops managed to slip through - These are mostly laptops that are on long term loan that were out of the office when the fixes and AV updates went out.

Not exactly a problem as they never infected more than a handful of machines and were quickly dealt with, The process is now under review to see what we can leave from this problem - How do you stop a user putting his or her laptop on the network until the IT dept can check it out.

Interestingly enough, A review of the firewall logs shows a lot of blaster-type traffic hitting the firewall and being dropped. Looks like there are a still a lot of infected machines out there.

--
Gary.

by mrafrohead

When each laptop connects to the network during bootup, current definitions should be forced down onto them.

I know that it's possible to disable a users connection if they do not have a current definition installed and running.

If they aren't current, they're stopped if they can't receive the update and then the machine would have to be looked at by IS.

Though, you do pose a damn good point and I don't think that a lot of companies do that.

Mrafrohead

by robotech

As a consultant I have to deal with small to medium sized clients. None of mine got any of these latest virii. It's not rocket science, just subscribe to Microsoft Technet, they will tell you when a flaw has been found in the system.
Once you receive that e-mail from M$ then you patch the systems, while the hackers are busy writing code to capitalize on the discovered flaw with M$ software.
Also, configure your router/firewall properly.
The rule I generally follow is: If the port doesn't need to be open keep it closed.
I took a client's infected laptop home to troubleshoot it, and out of the corner of my eye I saw a very consistent flashing on the router. When I checked the router's log I realized that the blaster virus was active. The moral of the story is, monitor your network.

P.S. Because of staying one step ahead of the hackers, none of my home computers were affected by the infected laptop.

by steve.freke

If there was ever a good time to introduce or update these two, now would be it. There should be little resistance to introducing new measures and updating out dated policies, given that many organizations have felt the negative effects on this virus.
If you can leverage some of that concern you should be able to pursuade even your stiffest competition that spending the time tightening up your operational process, is preferable to running around putting out fires.

For a lot of folks this was probably a painful lesson in best practice.

by zip777

[quote]Once you receive that e-mail from M$ then you patch the systems, while the hackers are busy writing code to capitalize on the discovered flaw with M$ software.[/quote]

Just to clarify this one point - it was exactly a RPC flaw disclosed by Microsoft in July that Welcha exploited. Other than that you are right on...

If everyone patched their systems in July they wouldn't have been vunerable in August. :)

by everyoneall

Just a experience learnt from some companies:

Remember to patch your AV server with the latest patches. Some companies' AV server got infected and has to be pulled offline and thus cannot rollout the latest virus definition to all its client.

>> I know that it's possible to disable a users connection if they do not have a current definition installed and running.

That sound interesting, can email me the info? I'm using Symantec AV.

Regards.

by w.aplustech

I agree with your point about looking at the "bright side" as far as our work goes BUT like most of us go I would like to put everyone of these idiots that do this crap, just because they can, in the CAN and for a long time. I see no reason for it. I mean why would Anyone want to be that hurtful to people that they have nothing against. What does it get them...nothing. Not fame, not fortune, not friends, not anyone that would look up to them as some type of hero in there eyes. Nothing, well, I really can't say "nothing" because sooner or later they will be caught just like that punk kid did and then they will get something...legal fees, court costs, their faces all over the newspaper, and tv. Plus they may even have to pay out a huge chunk of cash to pay for the loss of time, files and the work time lost. Let alone the pain that they caused to innocent people sitting at home just trying to relax and surf the web. I, also agree with you that if the clown gets out/off easy he should be taken out and smacked with that 2x4. Twice..the first time to get his attention. The second...to knock some sense into his head.

This discussion is closed to new replies.