Printable View
do any of you guys know if its possible for a virus to spread through a network drive (shared drive that every one on a network can see and access.and if its possible can you tell me how? and which viruses are the scariest nightmares for networks(the one thats spreads the fastest )?
and how can i prevent this from happening
:confused:
Yes.
http://vil.nai.com/vil/content/v_100030.htm
Your questions are covered in great detail here. Just start trolling through the forums and you'll find the answers to your questions.
--TH13
thanks alot . another qustion whats the diffrence betwwen worms and viruses
Textbook answer:
1. A worm spreads
2. A virus infects
There are now hybrids, but mostly a virus will attach itself to files and may try to send itself, or allow you to do it.
Worms just pass along e-mail, network shares etc. They do not infect files, boot sectors or whatever............they just spread themselves about?
Cheers
Nihil:
Ed Skoudis laid this out rather well in his book "Malware: Fighting Malicious Code"... A nice read if you get hold of it.
Virus: "A virus is a self-replicating piece of code that attaches itself to other programs and usually requires human interaction to propagate".
Worm: "A worm is a self replicating piece of code that spreads via networks and usually doesn't require human interaction to propagate".
Skoudis seems to be leaning towards, along with others, that the majority of worms we are seeing recently are all "tests". He describes the makup of a worm, Warhead, (exploit(s)), Targeting mechanism, (scanner and the algorithms that drive it), and payload(s), (the Nasty stuff). I think the theory about "test" worms is really rather justified considering that we have had numerous worms in the last couple of years, they are getting faster and better targetted yet they haven't really done any damage to the infected machines, (yeah, yeah, cleanup costs are "damage" but I'm talking about formatting the box after a while or messing up all the data files it can find on network drives.... That's much more costly. But this all comes down to the payloads carried..... They aren't really carrying a malicious one. Why.... 'cos they don't need one yet????Quote:
They do not infect files, boot sectors or whatever............they just spread themselves about?
Yes, and I fully agree with his position for several reasons:
1) I know for sure that underground groups have set a response time benchmark that they feel once beaten, will render a corp/govt/end user helpless when the real McCoy comes.
2) I know that the benchmark is set at 10 minutes. This is the response time that a top flight organization will have before all machines are protected. The 10 minute window is what these folks are looking to beat.
3) As stated, the propigation times are improving and the delivery styles are being tweaked.
4) I have reviewed worm/virus/trojan code and the latest stuff is, by far, not the work of an ametuer. Compare this to code written 5 years ago and the difference is like night and day.
5) Insiders at various AV companies are expecting the big one to be polymorphic and already are rumored to have code ready to deal with such horribleness.
So buckle your seatbelts and wait because the latest round of annoying remailers are just a prelude to what is coming.
Good to see someone else keeping up with the enemy...... I was under the impression that the "world' propagation time was 15 minutes..... Heck, what's 5 minutes between friends.
The consensus also seems to be not just polymorphic but also blended. It may have multiple warheads, it's own SMTP engine to spread itself in a virus-like fashion, it will be encrytped and polymorphic to make detection more difficult and finally will have multiple payloads.... the payloads may work randomly or in sequence, (DoS a target, (AV vendors come to mind), trash all network docs/ppts/xls/mdbs etc, ......... then trash the box....
So let's think about that for a second..... the potentials are:-
1. Unknown Warhead(s)... But let's be logical, if you want maximum spread in the shortest possible time they aren't going to attack "odd services", they will be common, (mail, web, etc). A multiple warhead worm will probably have warheads for different OS's. It's warheads are either going to be zero day or recently discovered for any attacked OS.
2. It's going to try to spread itself. <Duh> By other warheads or by mail....
3. It's not going to be recognisable by AV, Trojan scanners etc. and even if it "will be" detected it won't be either by the speed it is travelling or because it is DoSing the common AV vendors.
Can we "Pre-mitigate"?
Yes, I think we can.... With thought and knowledge of our own network, what is required within it and to make it work. Some suggestions would be.
1. The oldest one in the book.... If the port isn't required to be open at all times to all IP addresses on the public network either close it permanently or limit it to specific, trusted IP addresses. If it _must_ be open all the time DMZ it... keep it away from your private network, in this way you minimize the number of available resources for the worm.
2. If it is required sometimes, open it when needed and close it immediately it isn't. Preferably have the service in the DMZ. If that's impossible - don't open it when the threat is high - look before you leap - you can always use a CD to transfer that file - the cost of the gas or the Fedex ain't that much if that's what's needed - Remember, there are always alternatives to a file transfer method - pick one that isn't reported vulnerable..... It may not be safe but if it isn't reported within 24 hours of the outbreak it's getting close to being safe....
3. DMZ's..... What are they.... They are the place "outside" your network that is also "inside" it. It requires tighter ingress rules than the public -> DMZ network..... There's no reason to have port 80 open from the DMZ to the trusted..... Then it should be closed... period. It complicates the attackers problem - he has an exploit for HTTP/IIS and wins that battle.... But then he needs an exploit for SMTP to an Exchange server to get from the DMZ to the trusted too.... The automated tool, (worm), may not have that..... Bingo - potential hosts are restricted.
4. Egress rules..... Well, everyone cares about the incoming.... The threats are so diverse that in order to maintain security then you would have to block everything - you can't do that. But let's think about what _has_ to go outbound. We can lock that down a lot. You have no reason to allow outbound SMTP if you run your mail server... so block it except from the mail servers themselves. So what ports do you _need_ to go outbound.... You don't need SSH(port 22),? then block it outbound. It will prevent the "out of OS" exploits from taking place in many cases....
5. The firewall..... Can you strip potentially harmful extensions from the email? Do it.... Use FTP to transfer the needed files and let them sit till your AV has updated.... Can you block them from http too..... might be a good idea if the threat gets high.... Yeah, you might have only a few minutes - but when you know about it, use it.... M$ updates be damned.... Mitigate at the other levels..... It may cost you $1m in lost business.... But the overall cost in "hidden costs" exceed that considerably.... Be smart - no matter what the boss says...... explain the risk in the hidden costs..... can you say stock prices, reputation...... Means a lot in a competitive world.
IMO, this is an issue of prior thought.... Understand the threat..... Keep up with it - it changes you know.... ;) Do what you need to do to only allow the minimum traffic in _and_ out of the network to allow the users to do what they need to do and the public to see what they need to see..... And maybe you just "pre-mitigated" the nasty that will probably be being written today.....
There will be another tomorrow....... :mad:
can you tell me if im correct ,viruses imbed there code in files. and worms just copy themselfs
how do anti virus companies keep up with the newest viruses and worms?
it must be preety hard because with one worm or virus generator a person can make lots of diffrerent worms or viruses
do any of you know what life means.
Are you trying to be insulting or are you suggesting that the virus/worms are mimicking life? which ever one it is please make it clearer in future posts.
Tiger,
It was 15 but the fine folks who write viruses decided to reduce the time since everyone was discussing the 15 minute time frame.
Hoss: Well..... "Bastiges" comes to mind..... ;)
But in the long run let's be honest, anything that can go "world" in less than 2 hours with an initial infection rate in excess of 1% evenly spread across the planet is going to cause a few problems..... After that it's all a tad academic really... The "strong" will survive the initial onslaught but be taken down on the business end of things by the "weak"...... When you can't communicate with suppliers etc. electronically for fear of infection/compromise does it really matter if your mail server still works?
Not that I'm predicting armageddon here..... I just think that previous "losses" may seem a little insignificant if someone actually gets it _really_ right......
In essence, what you are describing is 'cyber warfare'.
And not just the old style hack attack, but a full blooded out and out attack upon our society as a whole.
Quite a shocking thought.
But where would you get the divide ? no longer East v West, although the 'unholy' trinity ( I think that was the description of these from our political leaders ) of Iraq, Iran and North Korea would possibly be at the top of the military mindset,
I would be casting my net around for enemies from the past. Eastern Europe still contains skills that were honed in the cauldron of the 'cold war', and we (UK) have trampled on enough of this planets land mass to have upset practically everyone (USofA inc ??)
And if this IS the case, then we could be in for a HELL of a shock, as our history shows that we prepare for the next war, by practising the strategies of the LAST ONE.
At least this time we get 10 minutes to prepare ? The cold war only gave us a 4 minute warning, and was the subject of things you could do: Boil an egg. But NOT eat it !!!!!
So this time I'll have me egg !!!
As previously stated I'm not suggesting Armageddon, but forewarned IS forearmed.
<me runs off to buy an egg timer>
No, but I know what it is...Quote:
http://www.reed.edu/alife/classes/gameoflife.html
HTH
Steve
Currently, there are *many* groups working toward the same goal (taking out/penetrating core systems) but yet they have different agendas and/or motivators fueling their pursuit. The bottom line is that *any* disruptions to a system that capitalism leverages will be a victory. Now, this is a pretty broad statement so let me jut clarify by saying that it does not cover the ametuer script/virus writers, dipshit students, skiddies, etc.. I am speaking solely of highly skilled and organized groups (the ones you have to really worry about).
After reviewing the security of various core networks and applications, I truly fear what may occur if front line defenses fail (AV, firewalls, etc.).
Well Tiger ol' pal, I hear what you're sayin and I think that we need to prep the fort before the assault arrives. :)
no i was asking how do antivirus companies know how to find the newest worms or virusesQuote:
Originally posted here by PoSer
Are you trying to be insulting or are you suggesting that the virus/worms are mimicking life? which ever one it is please make it clearer in future posts.
to add to there definitions :cool:
lol ; i agreeQuote:
[i]Well Tiger ol' pal, I hear what you're sayin and I think that we need to prep the fort before the assault arrives. :) [/B]
Just imagin if they found out a way to make av useless. i would unplug my computer from the outside world (hide) ::hide-beh
Disturb:
You send them a copy of something that does "funny $h1t" on your computer or network.... Now don't just go sending them everything you don't understand.... They have lot's of stuff to look at and they don't need your "white noise".
Then there are systems out there looking for "aggressive behaviour" etc.
The defense systems are quite big...... they just aren't big enough yet..... OK?
<offtopic>
steve.milner
http://www.math.com/students/wonders/life/life.html
a nice java version of the game of life !
</offtopic>
The same way you and I find out about the virii..Quote:
no i was asking how do antivirus companies know how to find the newest worms or viruses to add to there definitions
1. They get them sent in..
2. They make a signature for them (check if it's a good signature (no false positives etc..))
3. They send out the updated signatures file..
Virus is a program, right?, so a program can be destroy by another program or virus (like natural source of life). No matter what kind of computer language you use o create o destroy a virus. Somewhere in the present there are few scientist (DARPA) that are developing a new structure for destroy virus with a mix of artificial intelligency and virus code, not its a fiction its totally possible.
Like a organic virus they improve their action when come external agent fight them (antivirus) and get more evolution, thats the result of Trojans and Worms(they can be improve with the mix of a destructive virus). The probability tell us that will be possible generate intelligence virus with self choices, so the challenge its to fight them. Virus are the most important warnings for the future of the information.