NWA-PCUG Newsletter Article, October 2005
Lessons Learned Too Late –
Another Attack of the Killer Worms

by Ira Wilsker, APCUG Director


WEBSITES:
http://www.microsoft.com/malwareremove
http://vil.nai.com/vil/stinger
http://www.aladdin.com/esafe
http://www.microsoft.com/technet/security/bulletin/MS05-039.mspx
http://housecall.antivirus.com
http://www.bitdefender.com

You may have recently heard reports in the media about some strange computer worms that attacked thousands of computer networks, effectively shutting them down. In a society that likes to place blame for every negative event, blame has been placed on a variety of places, such as Microsoft for creating vulnerable software, to the users who had not properly and immediately patched their operating systems, or updated their antivirus protection. As it is often typical in these circumstances, very little blame has been placed on the miscreants who created and released these computer worms.

While the financial damage done by these worms, commonly called by the names Zotob, PnP-worm, Rbot, and several other monikers, was less than some of the more disastrous worm and virus attacks, it was still substantial. Media reports account for thousands of computer networks and systems shut down for various periods of time while IT staff attempted to identify and repair the damage. Typical of the damage reported, caused by these computer worms, was the 50,000 employees of 13 Daimler-Chrysler assembly plants in Illinois, Indiana, Wisconsin, Ohio, Delaware and Michigan, who were idled for nearly an hour while technicians restored the computers which control the plants. Up to fifty thousand lost man-hours of auto production can easily amount to significant production losses. Other victims of this same series of computer worm attacks, as reported by the national media were SBC Communications, Associated Press, ABC and CNN networks, the New York Times, Caterpillar, U. S. Customs, and many others. SBC reported that the computer utilized by its customer service employees kept rebooting as a result of the worm infections. U. S. Customs Service reported long delays in processing international passengers as its computer center in Virginia was effectively shut down for about five hours, resulting in major delays at locations as diverse as Miami and New York as Customs agents utilized printed lists or backup computer systems. The county wide 911 emergency phone system in Jefferson County, Washington, was disrupted for about 10 hours. These are but a few of the examples of the damage and inconvenience caused by a recent attack of computer worms.

What these worms all have in common is that they all rely on a recently disclosed vulnerability in several Windows operating systems, and exploit a security hole in Windows’ “PnP” or “Plug and Play” service, a feature intended to detect new hardware installed on Windows computers, and automate the configuration process. An August patch (MS05-039) intended to close the vulnerability, which Microsoft labeled as “critical”, was released on August 9, shortly before the worm attacks, but the time between the release of the patch and the attacks was so short, that countless organizations had not yet installed the patch on their computer systems. The concept and crude code of a computer worm that could exploit the vulnerability was posted to a security website often read by hackers and crackers on a Wednesday evening, and by Saturday morning the first variant of the Zotob worm, named Zotob.A appeared in the wild and started its attack. Within a matter of a few days, several other variants of Zotob have appeared, along with a slew of similar worms, such as the Rbot, and began wreaking their havoc.

Some commercial computer networks using sophisticated antivirus software that depends heavily on “heuristics” or software behavioral patterns, rather than the digital signatures commonly utilized by most of the retail antivirus products intended for home use, escaped damage, because they work proactively before an attack can take place, rather than reactively, after attacks have been reported. One of the examples of such commercial software that protected companies from attack proactively was Esafe, from Aladdin Software (http://www.aladdin.com/esafe).

Acknowledging that there are still Windows computers that are infected with the major forms of malware, Microsoft released a free utility that can remove Zotob along with its variants, and several other major viruses and worms. This utility can be downloaded for free at http://www.microsoft.com/malwareremove. It should be noted that this Microsoft utility will only remove a few dozen of the most common worms and viruses and their variants, such as Bagel, Sober, and Netsky, but is not a substitute for a properly updated antivirus program. The antivirus software publisher McAfee also had a similar free downloadable utility at vil.nai.com/vil/stinger. The free online antivirus scans, referenced in a previous column here, such as those from Trend Micro (housecall.antivirus.com), BitDefender (http://www.bitdefender.com), Panda (http://www.pandasoftware.com), and others, can detect and remove much more malware than the limited downloadable utilities.

Sadly, pain is an excellent teacher, and hopefully we have learned our lesson. It is now more imperative than ever that security patches be promptly and properly installed both on our home computers as well as distributed throughout our vast commercial computer networks. It is also imperative that appropriate protective software, such as antivirus, firewall, and anti-spyware software be installed and updated constantly.

With proper and timely protection, we can do much to protect our systems from more devastating computer virus and worm future attacks which are sure to come.

There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author. The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.

Click here to return to top



==================================================================