Printable View
2004: the year of...
One word...
SASSER
Thank god SP2 puts the firewall up by default.
Plus the Bagle NetSky war was pretty crazy, especially when NetSky started taunting Bagle. When virus writers start wars with each other, we are the ones left to clean up the wreckage.
Heh, like electronic poloticians huh? At least no one is actually being klilled with the virii guys.
I am casting my vote for me, and castrating any vote against me, because my cousin is an idiot, and I want a coffee mug!
|The|Specialist hands Gore a mug with some smelly & strange brown substance inside.
Nothing more than media hype... what was so crazy about that?Quote:
Plus the Bagle NetSky war was pretty crazy, especially when NetSky started taunting Bagle.
hmm i wonder what that browny substance can be????may be gold or poop?Quote:
The|Specialist hands Gore a mug with some smelly & strange brown substance inside.
any way gore deserves a coffe cup
Hey Hey,
My suggestion steals from what some people have said but I'm going to tie this in with experience.
The great virus Debacle of 2004 (I know.. the name needs work)
Enter HT... a lowly college student who has finished three semesters of school and is due for a co-op semester. Enter the student support desk at HT's college... the perfect place for a down and out IT student to begin his existance (Side Note: The 12 months I have know worked at the office have been the birth place of many of my greatest IT experiences)...
Now before we go any futher let me give you a basic run down of what we support.
1 -- IT Students (All programs are laptop programs... they own their laptop and plug it in in every classroom)
2 -- Certain other students ... same idea as #1
3 -- Residence Students.... bring it from home... plug it in and away you go.
4 -- Online/Elearning students... Anyone using our portal... 30,000 users in total.
I started in December of 2003... and had a week of orientation.... The support desk had just taken over the Residence and the Elearning so this was new to everyone.... We had very little training...
Starting in January everything seemed to be going fairly well.. We had a handle on things.... until we noticed that the 10Mbps pipe in residence was pegged... Enter the viruses..
Most of the viruses at that point (MyDoom, etc) opened ports on your PC... so we would scan the subnets and turn of PCs with certain open ports... This was done manually and wasn't very effective. I ended up firing up python and coding a custom port scanner that we could schedule (Enter PyScan.... there are various tutorials and posts available on the subject). For the next four months my nights consisted of getting a list of infected computers and waiting for the Students in residence to call down.. They'd bring them down and I'd spent 8 hours cleaning the infections.. I'd notify Network Services and they'd re-enable the ports. This was when I started Developing what is now known as our Residence CD.... a compilation of everything needed for cleaning any computer (I had previously in other posts mentioned that I would make this CD available and I'm still working on it). Now another problem arose... our IT students were being infected... and since they constantly changed rooms and seats, we couldn't be effective in policing them....
Enter May 2004.
I was done my first co-op term.. it had gone rather well and I was settling back into my fourth semester as well as working part time in the office...For the start of this semester we decided to run AV checks... The IT students had to have their PCs verified and had to be running up-to-date AV software (You'd be amazed at how many don't think they need AV software because they know what they are doing..... they're cocky SOBs i'll give them that). The summer goes by fairly smoothly.... not many problems.... but we were still cleaning up some of the mess from the first four months of the year.
Enter Sept 2004.
My Second co-op term... by now I've had 8 months in the office, I know everyone and do a fair amount. Network Services starts reporting massive amounts of traffic on port 445... but sasser has come and gone and we managed to quell the problems that it brought with it... What could it be... Ports are turned off and computers are brought down... after longs hours of analysis it's determined to be SpyBot/SDBot/RBot and it's hitting us hard... No one has AV defs.... Not CA's eTrust (our corporate solution)... not Norton, AVG, Mcafee.... all hope seems to be lost... Enter the cleaner... This viruses are identified primarily by Trend Micro but also by Sophos.... using what I learned from their sites and also hands on access to infected machines... I began developing a batch file that used pskill from the pstools kit and reg.exe to remove the viruses... it was a long and tedious task... but it was fairly successful... as new variants were discovered (there are lots of them.. and new ones are still appearing but now AV vendors stay fairly up to date) they were added to the CD.. We worked on cleaning Res. however our 10Mbps pipe was still pegged.... we also had to clean the IT students because this virus spread in a number of ways.. Enter an infection in a student labs... Now student labs were being infected and our coporate AV solution (I sometimes wonder if eTrust really counts as AV or if it's just malware) was still useless.. I passed off my batch file to several of the lab techs and we cleaned all the labs simultaneously... As of a couple weeks ago we were finally starting to get things cleared up in the residence (picture 800 computers... no control other than disabling their port)...So we thing we're ahead of the game... things are getting better...
Enter mugly... what a wonderful virus.... it contains three other viruses... again residence is pegged and they're showing up as fast as we can disable them... students are being infected multiple times... Some actually opened the same attachment on the same email repeatedly... Some AV vendors were up to date on this... others were still behind the gun.. back to updating the cleaner.... Infections of this are also popping up in student labs... now we're working on cleaning this...
2004 was definately the year of the virus for us... However that's just the start of our problems.
In Sept 2003 the decision was made to change our elearning portal... We took over support of the New and Old portals January 2004... In Feb of 2004 my supervisor clicked the wrong button and dumped the database for the old portal (years worth of documentation was gone in some cases..... and there were no backups) I managed to get the classes back up and running and they finished out their year...Enter Aug 2004... Our old elearning portal license had expired... entirely using this new one now. It didn't have propery testing.. features are being implemented on the fly. Randomly generated passwords are used with no password change capability... It's a mess.... and we're supporting it... Then a new online registration system is taking into working order... Again we're the support for it and again it's worked on on the fly...
We had the responsibility of Software Distrobution for students dumped on us 4 months ago... along with other problems... .Now I've got until the end of the semester (so the end of the month) to get the CMU NetReg system operational... so that we can attempt to implement it before the next intake of students during the second week fo jan.
All in all this year has been the tech support year from hell.... although I enjoyed it.... most of the time... There are several occasions that I'd love to spend with my head burried in the sand.
Peace,
HT
SPYWARS EPISODE I - ATTACK OF THE END USERS.
Most of you know that I sit on top of enterprise infrastructure and core services (as a sr. security engineer) for a Govt. entity. As you would guess, we have plenty of dead wood here. To protect end users from themselves, we officially placed a well known URL filtering solution in place. True, we are also looking to prevent information loss, lawsuits, bandwidth starvation and all the other wonderful things that occur when end users are allowed to operate unchecked.
One week after installation, end users became hostile in lynch mob fashion because their once unaltered excursions across the internet had suddenly been blocked. A mob formed outside of our office and I was certain that someone was going to pull out some rope and start stringing up a noose. Well being that end users all suffer from a deficiency in reading comprehension, they all seemed to overlook the enterprise wide approval and adoption of this wonderful new toy. I found it very ironic that employees were upset that they couldn’t slack off during working hours anymore. Only in Govt. will you find this very special type of worker.
Wasn’t life easier when I was a pizza delivery guy?!
SPYWARS EPISODE II - RETURN OF THE MALWARE.
Managing AV is bad enough but add spyware to the mix and your days become long quickly. This year, end users who once hated our filtering solution now relied upon it to block various malware apps from stealing information from them. We also relied on an open source tool for remediation combined with some fancy SMS dog and pony tricks to distribute, scan and remediate malware.
Alas, malware returned with vengeance. Towards the latter half of the year, malware developers spun out apps that were not able to be removed by automated scanners. To handle the volume of issues, we had to amend our support contract with our army of onsite field techs just to keep up with the problem. Management, who clearly couldn't see what the deal was about, needed a lesson in how these applications work before they would allow additional funding. I wonder if the CIO's wife liked the XXXToolbar that was installed on his laptop during our demonstration?
Yep, I think I can hear the pizza truck calling my name.
SPYWARS EPISODE III - THE ENTERPRISE STRIKES BACK.
After showing our fine purse string holders that the internet isn't really a friendly place full of pink bunnies and happy turtles, they quickly began quoting the hip and happening security guys at council sessions. Before we knew it, money was fast tracked to us to "solve all internet security issues". Yeah, apparently the message didn't really achieve a high level of understanding but at least we got the cash we needed. But now how do we deal with the looming spyware problem? Microsoft hosed us (big surprise) with numerous flaws such as my favorite IFRAME buffer overflow exploit, which when combined with other horribleness on Microsoft’s part, gave the keys to the kingdom to spyware apps. Vendors left us in the dust citing that spyware is outside the scope of their offerings, etc., etc...
Yep. I think I want to go home now.
SPYWARS EPISODE IV – A NEW HOPE? OF COURSE NOT.
After being beaten up by viruses, worms, Trojans, spyware, end users, management and vendors I am left an overwhelming sense of futility. Trying to bend applications to fit requirements that clearly aren’t within the scope of features used to be my biggest problem; not anymore. The pace at which the internet is changing is too quick for policy ridden, slow to adapt corporations and Governments. The bad guys used 2004 to “heartbeat” the industry’s response time to security/information threats. They understand now that most of us are going to be sitting ducks. This is evidenced by the prevalence of NETSKY in seven of the top ten worms active around the world today and the alarming rate of malware propagation. Too many places are too slow to adapt/react and for that, 2005 will be the year that many of us pay the price. Let’s not forget the honorable mention to software vendors (you know who you are) for assisting all of the internet creeps by releasing software that seems to have cut through the QA dept at warp speed only to land in our laps like a smoking meteorite.
Anyone want go in on the purchase of a private island?
If you try taking my coffee mug I'm kicking your ass !
If it's a tie between me and Horsey, how about we split the gift grab and I get the Coffee mug and he can have the shirt?
Sirs,
The competition is far from over. I fear the real horror stories have yet to come...
LOL. Yes, but full disclosure would be like having your pants pulled down infront of the cheer leaders right after coming to shore from a long swim in freezing cold water....LOL
;)
I can do that, just mine would shrink to the size of yours ;)Quote:
Originally posted here by thehorse13
LOL. Yes, but full disclosure would be like having your pants pulled down infront of the cheer leaders right after coming to shore from a long swim in freezing cold water....LOL
;)
Now, I thought you wanted stories that made you pull your hair out, but OK, I'll relate the horror I deal with every week:
I don't make this up just for a coffee mug, and a few members here can tell you I'm not making this up as I go along because they listen to me bitch about it every week:
I work in a Cell phone shop my Uncle owns, and my Aunt is another boss pretty much, and now for a little Background:
Edith Bunker from all in the family kind of describes her excpet she's a lot younger, she is in her 40s.
She told me a few years ago she was a "hacker" who liked going into people's systems and fixing them.... Here is where the humor for everyone else starts and the suicidal tendencies for me start:
she's knows **** about computing.
I have gotten into HUGE arguements with her and no matter what you can't win. First off she told me while looking at my Slackware shirt that back in the 80s she was a programmer in College, they used to program in Linux in college is what she said.
I told her "Uhhh, no, Linux wasn't even invented until 1991".
she said I was wrong and she was right because they used to program in it in college.
I said no, and showed her in one of my books and she said "Oh well it was something like Linux I programmed"..... I say how Linux is an OS, not a language and she says "No we programmed in it".
This goes on for an hour until she finally looks at me like OK fine I'll just agree but you're still wrong and says "Well then ti was something like it".
I name off some programming languages and she says no too ALL of them. she then says "Well maybe it was just to old and not in use anymore" and I tell her no again.
she always does this look, and it pisses me off BAD, it's like, she looks at you like "yea sure right, I know you're lying and I'm right". And it's ****ing ANNOYING. I just want to choke her every wekend while I'm there.
anyway, My Uncle, her Husband finally gets back and says "Woman what are you talkign about? You never programmed anything you were in Data entry in college, all you did was type and learn how to do it faster".
I try not laughing and she says that was programming.
It only took 3 hours to find out she's never coded in her life...
Doesn't stop there:
She can't even use Windows 98 without screwing up. At work we have something so people can come in and pay bills and there is a log of all bills paid so if smoething goes wrong you can delete one. Well you have to use an OCR to take some of them and you HAVE to use it.
One day they were both being trained with the new OCR and the next 3 days in a row she wouldn't use it. She couldn't get it to work so she would do the bills all wrong and of course that meant the bill didn't show up as being paid so the people would not get anything to show they had paid it because she ****ed it up.
She did this a week straight and every time, my Uncle had to call them up and fix it which took at least 4 hours each time.
Then one day this lady cmoes in and doesn't even have her damn bill meaning we can't take it. My aunt wants the dollar we get out of it though so she again does it the wrong way and my Uncle sees it while I'm standing there like uhhh you can't do that. So my Uncle says "You can NOT do that! They told you this before and I've had tot ell you every day this week not too and you still do it!" The lady looks at my aunt like wow I wouldn't want to work for him and my aunt does this look like "See what I have to put up with?"
I wanted to choke her because it was her own ****ing fault for being a complete idiot.
Well a while later, there had only been 3 bills ALL day long. That's it. She had screwed one up again, and so all she had to do was click on that ONe bill and click on Delete. Me and my Uncle are talking and she's doing the delete on the ONE whole bill she has to delete out of the three listed. We hear her say "Damn it!"
and what happened? SHE DELETED THE WRONG ****ING BILL SOMEHOW!
So my Uncle has to again get on the phone and sit on ti for 6 hours fixnig it up.
But it doesn't stop there!
I had a teacher **** me out of a grade in College a few semesters ago because he didn't like me being smarter than him. Well, he made everyone email him the test we had just taken, and Yahoo was what we had to use. Yahoo uses HTML email by default, so of course every email contained HTML code. Well, when he came to mine he said I cheated. I had no way of saying no because HTML was there and of course all evidence of me not cheating was gone so I had tot ake a 0 on that test.
My aunt heard about it and I tried explaining it and she said "Well you could have proven him wrong and fought it"!
Uhhh no I can't he got rid of all the evidence and when it's teacher versus student, just like you said, they don't believe the student.
she said well if you can't prove you're innocent you might as well be guilty, stop cheating at school...
I almost snapped.
I explained again that wasn't possible, and again she did that ****ing look like "You're lying and I'm right sure".
I got pissed and she goes on and on about how the HTML could be taken out.... Then she says "Well what is HTML anyway?"
UGH after argueing for 4 hours she doesn't even know what she's argueing about! Damn it!
I show her some HTML on one of the computers at work while she is online and she looks at it and tries again saying I could prove I didn't do anything. She had no idea what it was and stared at it blank like while I showed her...
So now she still thinks I cheated...
But wait there si MORE:
She gets SPAM in her inbox. The email is used ONLY for the business they run but NO NO NO! She replies tot hese ****ign SPAM mails, and believes every ****ing hoax they get in the mail. The machine isn't even updated and is Windows 98 so of course it has a million spywares on it and more because she even opens every damn email they get and downloads and OPEN EVERY ATTACHMENT SENT.
Then she wonders why they get 300 emails a day... My Uncle told me it was never like that until she open up and replied to a few of them one day so he even knows it was her.
So my "hacker aunt" opens any email sent to her no matter what and downloads and opens every attachment.
2 weeks ago while there me and my Uncle were stadning there as she had oepned up a mail saying free coupons (she is greedy as **** and wanst money all day long and would kill for 10% off)
Well, it had a link to sign up for free coupons and of course it was just a SPAM email, and what does she do? You guessed it SHE OPENED THE DAMN THING UP AND SIGNED THEIR BUSINESS ONLY EMAIL ADDRESS UP FOR IT!
My Uncle was pissed he was like damn it woman there goes another 300 mails a day.
She just got pissed at him and said shut up. I wonder how he puts up with it, I really do, he was a smoker and had to quit smoking after 30 years of it, and had to quit drinking so now he has to put up with her sober.
And she gets pissed for no reason and takes it out on him and me.
I haven't been there since Saturday but I got a message left for me from her saying the register was short 30 dollars.... How the hell does that have anything to do with em after 3 days?
This isn't something that happens once in a while by the way, this is seriously every day.
I hate going to work but it's the only way I can pay my bills and even then it doesn't seem worth it.
I had gotten an A on a paper I did for my OS class and she read over it and asked me what BSD was and while I'm explaining she sits there and thinks it was a text editor...
And oh! This has to do with what Horsey said:
about a month ago, the home page for Internet Explorer was changed to some company.... I can'timagine why with all the viruses and spyware that must be running rampant on that machine, but the first thing she did was blame her son, my cousin ray. I was like uhhh, ray doesn't evenuse that thing and he wouldn't set it to that page, what does he care about marketing?
so, instead of listehing to me saying it's spyware because you open all those emails. She calls the ****ing ISP up and asks why her account was cancelled when they sent in the payment for it. Because we all know how when you get cancelled from your ISP you can still get online right? &*Sigh*&
So of course the tech on the other end of the phoen is trying to figure out what she's talking about and I'm in the background saying, your account wasn't cancelled your home page just got changed and of course she doesn't listen to me even though the tech is saying the same thing.... Then I show her how to fix it and she tells the tech who has been trying to tell her ther eis nothing wrong it's just her home page was changed probably from spyware. She says "Oh never mind I fixed it MYSELF" and hangs up.
I wanted to kill her.
Oh, last month, while I was working there, she delets **** on the computer all the time, and when the thing started up saying it couldn't find the modem on the machine, she of course blamed my cousin again....
Never her fault, always mine or My cousin's.
She has me try to fix it and I said well, the driver was either deleted or something corrupted it. So she blames her son again who hasn't even touched the machine and he says I didn't do it. And of course she says "Oh yes you did you're always screwing these computers up all the time".
I don't know how he does it seriously.
I'd die putting up with it longer than I do. He lives with her.
So anyway I sit down and reinstall the driver and she sees me doing it and I say well there is a chance it will work but the driver seems corrupted.
Her reply (Not kidding) :
"Well the system drivers are int he system in a system aren't they? You should eb able to delete the driver system and fix it up shouldn't you?"
First time a BOFH almost had dummy mode turned on.... I don't know what the **** she was trying to say but I can tell you even SHE didn't know.
I try explaining in nice terms "You don't know what you're talkign about" and she just says "Oh so you can't do it huh? I thought you went too school for this ? "
I try not choking her and go outside and smoke.
All of these thins are caused by her being a ****ing idiot and it's never her fault of course, she blames everyone else and pretends she is a hacker and knows what she is talking about.
I've seriously thought about shooting myself instead of going in to work..
If THIS isn't enough to win a ****ing coffee cup, nothign is.
There are more thngs she does but I can't think of them off the top of my head without getting depressed.