despre worms

User avatar
tulip
senior
senior
Posts: 346
Joined: Tue Oct 21, 2003 10:32 am
Contact:

Postby tulip » Sun Nov 09, 2003 2:50 am

Microsoft a anuntat ca va oferi o recompensa de 250.000$ celor care vor oferi informatii care vor duce la arestarea programatorilor virusilor MSBlast si SoBig. Detaliile despre aceasta recompensa vor fi dezvaluite de catre Microsoft intr-o conferinta de presa comuna cu FBI, Serviciile Secrete americane si Interpol.

Virusii MSBlast si SoBig exploateaza vulnerabilitati ale sistemelor de operare Windows si au infectat sute de mii de calculatoare din intreaga lume. Este pentru prima oara cand este oferita o astfel de recompensa pentru identificarea si arestarea unor cyber-infractori. Nu pot sa nu ma intreb daca banii respectivi nu ar fi putut fi folositi mai bine pentru securizarea software-ului produs de Microsoft...
ce ziceti, ne bagam?
:twisted:

User avatar
LoS
senior
senior
Posts: 274
Joined: Thu Jul 24, 2003 12:03 am
Contact:

Postby LoS » Sun Nov 09, 2003 3:02 am

care se sacrifica pentru restul? :lol:

lasind gluma la o parte, se mai stie ceva de mateias?
N/A

User avatar
Dan
Master of Disaster
Posts: 2869
Joined: Sun Jul 06, 2003 1:59 am
Location: ...on the highway to hell...
Contact:

Postby Dan » Sun Nov 09, 2003 4:12 am

Tulip, nu e pentru prima oara. Microsoft a bagat acu ceva timp vreo 5 milioane de dolari intr-o organizatie care s-ar ocupa cica cu prinsul programatorilor de virusi. Ca si atunci marile corporatii care produc soft antivirus au stat de-o parte, desi chemarea la lupta a MS a fost tintita. Symantec a refuzat sa comenteze aspectul, altii au zis ca nu prea e treaba lor...8)
Eu din muntii mei...
http://www.imed.ro/forum

User avatar
sl0bizz
elder
elder
Posts: 671
Joined: Mon Jul 14, 2003 7:33 pm
Location: Boston
Contact:

Postby sl0bizz » Sun Nov 09, 2003 5:59 am

Cei care scriu virusi sint niste dobitoci pentru ca in nenumarate cazuri fac viata grea si celor care utilizeaza alte OS. Coreea de Sud a cam ramas fara net pe vremea de aur a lui blaster.
MS facuse patchurl pentru Blaster cu doua luni inainte, cel pentru virusul de server SQL era in service packul vechi de 4 luni. Nu MS e de vina, mai ales la blaster. Mi se intimpla sa nu pot restarta calculatorul vreme de doua saptamini, da' se mai ia curentul si tot se rezolva. (Patchurile le instalez imediat ce apar, dar multe nu actioneaza fara restart) Da' chiar doua luni...De la SP2 de XP, Windows Update o sa fie activat by default. Cred ca din cauza astora care se lasa infectati, ar trebui ca WU nici sa nu poata sa fie dezactivat, ca mereu se gasesc "tehnicieni" sa o faca. Ete asa, trecem la trustworhty computing paranoia si va trebui sa lasam pe MS sa faca ce vrea pe PCurile noastre, pentru ca e multi dobitoci.
Nu imi spuneti ca Windows asa si pe dincolo, daca stiti ca update-ul la Mac de exemplu costa bani si acualul OS are niste gauri mari.
De ce sint infectati utilizatorii de windows: pentru ca ei sint mai multi, pentru ca ei sint oameni tonti sau normali (trebuie sa fii geniu sa pornesti imprimanta mea in Linux), pentru ca se fac mai multi virusi pentru windows (din invidie prosteasca - de parca nu tot cu unelte de la MS compileaza; ia sa-i vad eu pe apple cu ce ar compila), pentru ca ai ce virusa (pina si Winamp avea flaw-uri, dar cite media playere de windows sint si cite de unix?)
Probabil ca va trebui sa se ceara certificat de inteligenta la cumpararea calculatorului (si cu ocazia asta ar creste si nr. de utilizatori de linux)
Daca va prisosesc sau va trebuie obiecte, incercati Freecycle Bucuresti. Daca nu va trebuie nimic, ma supar.

User avatar
Tyby
Dungeon Keeper
Posts: 602
Joined: Sun Jul 06, 2003 10:39 pm
Location: Bucuresti
Contact:

Postby Tyby » Sun Nov 09, 2003 9:27 am

sl0bizz wrote:Probabil ca va trebui sa se ceara certificat de inteligenta la cumpararea calculatorului (si cu ocazia asta ar creste si nr. de utilizatori de linux)


good point, numa' ca asta, din pacate, nu se va intampla niciodata ... Iar companiile producatoare shtiu treaba asta ... si se chinuie sa ajunga cat mai aproape de conceptul "om mai putin dotat intelectual proof"... numa' ca-i cale lunga ...

credetzi ca romanii sunt batuti in cap in ceea ce priveste computerele? statzi sa vedetzi prin alte partzi, unde orice om mai putin dotat intelectual care are voie sa conduca mashina de la 16 ani shi are o priza in plus in casa devine peste noapte geniu in computere ... :?

iar companiile AV sa-i prinda pe aia?! LOL ... pai ei din CE mai traiesc? CUI mai dau comanda de vreun Blaster, daca ishi dau oamenii in gat?!

Au fost virusi / exploituri de gauri de securitate de care eu personal sunt convins ca shi-a bagat shi dracu' coada ... dar e greu de demonstrat ...

asta e, traim intr-o societate in care consumul conteaza ...
formerly known as gaurika ...

May the best from your past be the worst in your future!

Tyby out!

User avatar
LoS
senior
senior
Posts: 274
Joined: Thu Jul 24, 2003 12:03 am
Contact:

Postby LoS » Sun Nov 09, 2003 12:32 pm

nah, nu prea sint de acord cu tine, sl0bizz. microsoft nu prea isi securizeaza produsele si la cit costa - si mai ales la ce companie multimiliardara este - ar trebui sa aiba doar jumatate din gaurile de securitate pe care le are. iar gindacii din office & ms.apps sint chiar stupide ca vorba ceea, sint facute de aceeasi companie, de ce naiba nu si-au trimis niste whitepapers detaliate intre departamente?! bine, de acord ca la americani exista o buba mare cu departamentele, a fost un caz recent in care s-au dat in judecata intre ele. dar bine ca avem office assistant in 3-4 feluri by default cu posibilitati de upgrade.

exemplu la bubele de securitate din XP: m-am jucat acum ceva timp cu john the ripper, care are un crack-benchmark. parolele de NT sint sparte de 300 de ori mai repede decit FreeBSD MD5 (XP vs. RH9). cu OpenBSD Blowfish este inutila comparatia deja. intrebare: de ce nu a implementat MS asa ceva? sau cu banii pe care ii dau pe urmaritul hackerilor (ma simt ca in filme deja) de ce nu a angajat cei mai talentati programatori sa faca o criptare si mai smechera?

ah, iar aia 5 mil. $ sint cam praf in ochii fraierilor. daca vroiau, ei puteau de mult sa impuna un standard prin care fiecare executabil sa se autoverifice la start, ev. o baza de date, etc. bineinteles ca nici chestia asta nu era impenetrabila, dar mai reducea din avintul companiilor AV din dat spaga la geeks. numai ca printr-o miscare d-asta probabil riscau sa piarda multe aplicatii care se transferau pe SO alternative.

iar pentru imprimanta si linux, nu terbuie sa fii geniu sa o instalezi, ci doar sa ai rabdare si timp sa citesti nspe mii de pagini pe net. lucru oribil, de altfel.
N/A

User avatar
costin
senior
senior
Posts: 130
Joined: Sun Jul 06, 2003 3:00 am
Contact:

Postby costin » Sun Nov 09, 2003 12:46 pm

sl0bizz wrote:Cei care scriu virusi sint niste dobitoci

Esti chiar asa de sigur? :D Un prieten, cu care sunt de acord in totalitate, spune ca virusii si viermii sunt facuti de pusti de 20 de ani, care de 60 de ani studiaza kenelul. Chiar crezi ca respectivii tineri cu figuri inocente, filmati cand sunt arestati, sunt adevaratii autori. Crezi ca totul e o joaca si ca nu exista un determinant major? Eu ma cam indoeisc.

Exista si virusi, viermi mai exact, si pentru linux. Vreo cateva specii. Au fost facuti pentru a demonstra ca si linux e vulnerabil, dar in nici un caz nu se compara cu windows. Conditia esentiala, greu de realizat, e sa ruleze procesul ca root. Daca nu e root, are foarte mici sanse sa faca ceva notabil. In plus, o vulnerabilitate descoperita traieste doar cateva ore, nu ca pe windows, unde poate trai mult si bine. Daca userul isi pune un 98, fara nici un upgrade (normal, nu?), poti spune ca vulnerabilitatea are 5 ani. Un mediu de cultura excelent.

Asa ca parerea mea este ca numarul mare de virusi pe windows e cauzat tocmai de gandirea din start defectuoasa de care a dat dovada billg@hotmail.com. Chiar recent au spus ca nu conteaza cat de sigur e softul, daca totusi functioneaza. Imi pare rau ca nu mai gasesc articolul.
Image Get Firefox!

User avatar
Tyby
Dungeon Keeper
Posts: 602
Joined: Sun Jul 06, 2003 10:39 pm
Location: Bucuresti
Contact:

Postby Tyby » Sun Nov 09, 2003 12:55 pm

LoS: o parola pe NT aleasa cu cap NU poate fi sparta ... TEORETIC ... datorita hashului care se repeta dupa 14 caractere ... deci, implementarea criptarii este faina ... m-ash aventura sa spun ca-i mai faina decat md5

...ca-s userii batutzi in cap shi-shi pun parola TEST sau LOGIN pe computer - asta e alta traznaie ...

Costin: Cat despre 98 ca-i de-acu 5 ani: pune un linuz de acum 5 ani shi zi-mi cum sta cu patchurile?! Cam cat de gaurit este? :twisted:
formerly known as gaurika ...



May the best from your past be the worst in your future!



Tyby out!

User avatar
costin
senior
senior
Posts: 130
Joined: Sun Jul 06, 2003 3:00 am
Contact:

Postby costin » Sun Nov 09, 2003 1:05 pm

Tocmai asta vreau sa spun: 98-uri exista peste tot, in schimb, daca vrei neaparat un kernel 2.0, vei gasi o versiune adusa la zi. Nimeni nu iti propune sa folosesti 2.0.0-pre3, spre exemplu. Nu zic ca nu a avut buguri, ci doar ca nu au supravietuit. 98-ul pe care il gasesti si azi (k4hvd-q9tj9-...etc) este in aceeasi forma, bine conservat, cu buguri documentate.
Image Get Firefox!

User avatar
LoS
senior
senior
Posts: 274
Joined: Thu Jul 24, 2003 12:03 am
Contact:

Postby LoS » Sun Nov 09, 2003 1:33 pm

gaurika wrote:...ca-s userii batutzi in cap shi-shi pun parola TEST sau LOGIN pe computer - asta e alta traznaie

de acord, gaurika. atita tot ca marea parte a utilizatorilor astia sint! SO-ul asta se adreseaza tocmai lor. altfel, revin la buba mea :)), de ce s-ar chinui sa faca un office assistent? tocmai pentru astia il fac, tocmai pt ei ar trebui sa faca si o criptare mai buna.
N/A

User avatar
tulip
senior
senior
Posts: 346
Joined: Tue Oct 21, 2003 10:32 am
Contact:

Postby tulip » Sun Nov 09, 2003 4:53 pm

in ceea c e priveste parolele de NT, or fi ele de 14 caractere, da ele sunt impartite in doua subseturi de cate 7, si in afara de asta nici nu se prea face diferentierea majuscule-litere mici, asa ca posib de a le sparge creste exponential.
si inca ceva, ce imprimanta ai de ai pb cu printarea, ca eu inca n-am avut pb de genu asta in linux, si am folodit destul de multe variante...

User avatar
Tyby
Dungeon Keeper
Posts: 602
Joined: Sun Jul 06, 2003 10:39 pm
Location: Bucuresti
Contact:

Postby Tyby » Sun Nov 09, 2003 5:00 pm

tulip wrote:in ceea c e priveste parolele de NT, or fi ele de 14 caractere, da ele sunt impartite in doua subseturi de cate 7, si in afara de asta nici nu se prea face diferentierea majuscule-litere mici, asa ca posib de a le sparge creste exponential.
si inca ceva, ce imprimanta ai de ai pb cu printarea, ca eu inca n-am avut pb de genu asta in linux, si am folodit destul de multe variante...


hopa! stai ashe: cum adica:

nu PREA se face diferentierea majuscule - litere mici?!

Pai ori se face, ori nu! io ash pune cateva beri la bataie, dar sa vedem mai intai raspuns!

Cat despre hashuri: da, sunt 2 hashuri de 7 caractere ... din cauza asta, o parola NT de 15 caractere este practic imposibil de spart ...

so ...
formerly known as gaurika ...



May the best from your past be the worst in your future!



Tyby out!

User avatar
tulip
senior
senior
Posts: 346
Joined: Tue Oct 21, 2003 10:32 am
Contact:

Postby tulip » Sun Nov 09, 2003 5:57 pm

din cate stiu eu, in versiunile mai vechi de nt exista o versiune diferita pe passwd.dll cu posibititati "crescute de crackuire. oricum, nici vresiunile actuale nu sunt prea greu de "rezolvat":


Question:
How do I recover a lost NT password?
Answer:
This is simple if your C:\ drive is FAT. Boot up with a DOS disk and type:
--------------------------------------------------------------------------------
C:
--------------------------------------------------------------------------------
CD \WINNT\SYSTEM32\CONFIG
--------------------------------------------------------------------------------
DEL SAM.*
--------------------------------------------------------------------------------
Now the Administrator password is blank. If your C:\ drive is NTFS, you have a lot of work to do. Go to http://www.sysinternals.com/ and download NTFSDOS. Then copy the unzipped NTFSDOS.EXE to your DOS boot disk. Boot up the machine and type:
--------------------------------------------------------------------------------
C:
--------------------------------------------------------------------------------
CD \WINNT\SYSTEM32\CONFIG
--------------------------------------------------------------------------------
COPY SAM.* A:\
--------------------------------------------------------------------------------
This will copy the SAM file to your floppy disk. Now you need to get on another NT machine, go to http://www.l0pht.com/ and download L0phtCrack. Run the program and when it asks you for the SAM file, point it to the file on your floppy disk. Now this is going to be a very long process of finding the password depending on the speed of your computer, but eventually you will find it.

User avatar
Tyby
Dungeon Keeper
Posts: 602
Joined: Sun Jul 06, 2003 10:39 pm
Location: Bucuresti
Contact:

Postby Tyby » Sun Nov 09, 2003 6:12 pm

tulip wrote:[...]
Question:
How do I recover a lost NT password?
Answer:
This is simple if your C:\ drive is FAT. Boot up with a DOS disk and type:


1. pai de ce sa ai FAT?! Ce, linuzu' il pui pe FAT!?

2. am mai scris ... daca parola are mai mult de 14 caractere instrumentul celor de la l0pht e null ... recunoshteau shi ei in FAQ treaba asta ... shi explicau shi de ce ...

3. http://www.l0pht.com no longer is available!

cam asta-i despre l0pht tool ...
formerly known as gaurika ...



May the best from your past be the worst in your future!



Tyby out!

User avatar
sl0bizz
elder
elder
Posts: 671
Joined: Mon Jul 14, 2003 7:33 pm
Location: Boston
Contact:

Postby sl0bizz » Sun Nov 09, 2003 10:19 pm

costin wrote:
sl0bizz wrote:Cei care scriu virusi sint niste dobitoci

Esti chiar asa de sigur?

Nu ca pregatire, ci ca bun simt. Ok, stii un bug, il raportezi, il faci public, in cel mai rau caz, dar nu te apuci sa faci misto de retele intregi. Frecvent cei cu linx injura cind conexiunea lor e floodata de virusi de windows.
Windows NT si 98 nu se mai vind in mod legal. OEMs ar trebui sa ofere CDuri cu SP preinstalat (e vina OEM ca nu o fac si a dragilor de cumparatori ca isi cumpara calculatoarele de la tot felul de firme mizerabile).
MS face publice numele celor care gasesc buguri si in cadrul buletinului exista un link catre situl lor, ceea ce ar face reclama buna unei firme de securitate care s-ar obosi sa transmita bugul, nu sa faca troieni.
Sa risipim dilema: parolele de NT sint case-sensitive: user name-urile nu.
Daca ai NTFS, ar trebui ca SAMul sa fie protejat de drepturile NTFS; din nefericire nu sint asa by default, din nefericire, degeaba sint conturi de useri pe Windows post-NT de vreme ce home-userii prefera sa ruleze ca Admin.
Imprimanta e un all-in-one HP, nesuportat pe Linux. Un proiect open source, sustinut de HP, are drivere numai pentru imprimanta (si a reusit sa deruleze hirtia inapoi - niciodata nu am vazut-o facind asa ceva); altul se ocupa de scanner si nu merge pur si simplu. Imprimanta costa 100 $ si a fost cel mai ushor all in one la vremea ei, acum un an. Probabil ca s-au vindut zeci de mii din acest model. (in timp ce Linus se plingea acum 2 saptamini ca au kernelul incarcat cu foarte multe device-uri care nu s-au prea folosit si nu se mai folosesc de loc.)
Daca va prisosesc sau va trebuie obiecte, incercati Freecycle Bucuresti. Daca nu va trebuie nimic, ma supar.

User avatar
Dan
Master of Disaster
Posts: 2869
Joined: Sun Jul 06, 2003 1:59 am
Location: ...on the highway to hell...
Contact:

Postby Dan » Tue Nov 11, 2003 5:53 am

20 de ani de la primul virus... 8)

BBC wrote:This week computer viruses celebrate 20 years of causing trouble and strife to all types of computer users.
US student Fred Cohen was behind the first documented virus that was created as an experiment in computer security.

Now there are almost 60,000 viruses in existence and they have gone from being a nuisance to a permanent menace.

Virus writers have adapted to new technology as it has emerged and the most virulent programs use the net to find new victims and cause havoc.

Attack mode

Mr Cohen created his first virus when studying for a PhD at the University of Southern California.

Others had written about the potential for creating pernicious programs but Mr Cohen was the first to demonstrate a working example.

In the paper describing his work he defined a virus as "a program that can 'infect' other programs by modifying them to include a ... version of itself".

Mr Cohen added his virus to a graphics program called VD that was written for a make of mini-computer called a Vax.

The virus hid inside VD and used the permissions users had to look at other parts of the Vax computer to spread around the system.

In all the tests carried out by Mr Cohen the virus managed to grab the right to reach any part of the system in less than an hour. The fastest time was five minutes.


Viruses used to travel via floppy
Mr Cohen presented his results to a security seminar on 10 November, 1983.

The creation of the virus gave rise to such consternation that other tests were banned, but Mr Cohen did manage to demonstrate a similar virus working on other computer systems.

In the paper Mr Cohen prophetically wrote: "they can spread through computer networks in the same way as they spread through computers, and thus present a widespread and fairly immediate threat to many current systems."

Soon after this pioneering work viruses written for the IBM personal computer, which had only just been created, started to appear.

The first of these is widely acknowledged to be the "Brain" virus that emerged in 1986 from Pakistan and was, apparently, written to help its creators monitor piracy of their computer programs.

The emergence of Brain kicked off lots of other viruses such as Lehigh, Jerusalem, Cascade and Miami.

All these were aimed at PC users and travelled in floppy disks that passed around as the programs they held were used on different computers. Though they were a nuisance to those they caught out they were something of a rarity.

Windows world

Efforts to spot and stop viruses forced creators of the malicious programs to find ways of hiding their creations sometimes by making them change form to avoid detection.

In 1992 the Michelangelo virus, that was due to strike on 6 March, caught the media's attention but the chaos it was predicted to cause never materialised.


The Love Bug tricked many people into opening it
As Windows emerged virus writers began targeting the new operating system.

This led to an explosion in so-called "macro" viruses that exploited the crude utility writing program in Microsoft Word.

These viruses were much more widespread because people shared far more documents than they did the programs that early viruses piggy-backed upon.

As Windows has emerged in successive versions, virus writers have kept pace with the new technology.

The Melissa virus that struck in March 1999 marked a new trend as it combined a macro virus with one that plundered the address book of Microsoft Outlook to e-mail itself to new victims.

The success of Melissa was largely due to the fact that the net was becoming increasingly popular and the most successful viruses of recent times have exploited weaknesses in e-mail programs or net connected PCs.

Almost every year since 2000 has seen the unleashing of a virulent program that uses the net to travel.

The Love Bug struck in 2000 and was followed by the Nimda and Code Red viruses that swamped net connections.

More recently we have had Sobig, Palyh, Slammer and MSBlast viruses that have spread further and caused more havoc than early virus writers could have ever imagined.


Sursa: http://www.bbc.co.uk, 11 nov 2003
Eu din muntii mei...
http://www.imed.ro/forum

User avatar
Dan
Master of Disaster
Posts: 2869
Joined: Sun Jul 06, 2003 1:59 am
Location: ...on the highway to hell...
Contact:

Postby Dan » Wed Nov 10, 2004 2:53 am

The Register wrote:A Trojan which uses infected PCs to send spam messages to mobile phone users has been discovered. Delf-HA Trojan horse sends spam SMS messages by using the free "Send a text message" facility found on the websites of several Russian mobile network operators. Infected PCs download instructions on the content of junk SMS messages from a separate website.


Only a small number of instances of the Trojan horse have been sighted so far, and the junk message it generates are confined to Russia. SMS messages are sent to numbers with the +7921 prefix (followed by six randomly generated digits) and to +7911 (followed by six randomly generated digits). The attack is significant only in illustrating the twisted ingenuity of spamming scumbags.




Noua era a spamului ... :twisted:
Eu din muntii mei...
http://www.imed.ro/forum


Return to “Software”

Who is online

Users browsing this forum: No registered users and 76 guests