Next-Generation Nachi Worm Offers Political Message - ' Decoding Nachi' (
Page 2 of 2 )
.Bs Political Message.">
At the same time, Nachi.B is making a political and educational point. If the machine has a Microsoft IIS (Internet Information Services) Web server and is configured for the Japanese code page, Nachi.B overwrites certain files with an HTML page containing the following text:
LET HISTORY TELL FUTURE !
1931.9.18
1937.7.7
1937.12.13 300,000 !
1941.12.7
1945.8.6 Little boy
1945.8.9 Fatso
1945.8.15
Let history tell future !
So whats all this about? The numbers arent URLs. Rather, they are dates that relate to World War II. Security vendor iDEFENSE Inc. deciphered the page.
Heres the key:
- September 18, 1931. Japan invaded Manchuria, renames it Manchukuo.
- July 7, 1937. The Japanese army attacked China in the "Marco Polo Bridge Incident."
- December 13, 1937. The Battle of Nanjing ended as the Japanese took the city and commenced three months of atrocities.
- December 7, 1941. The attack on Pearl Harbor.
- August 6, 1945. The United States dropped the "Little boy" atomic bomb on Hiroshima.
- August 9, 1945. The "Fat man" bomb struck Nagasaki.
- August 15, 1945. Victory in Japan (VJ Day) riot in San Francisco while the city was celebrating.
- August 15, 1945. South Korea liberated from Japanese rule.
According to iDEFENSE, this message "may be an attempt to elude[sic] to current activities about countries currently in political conflict with the U.S."
I find it hard to tell exactly what the authors attitude is.
Still, nothing that has happened so far will victimize an installation that is administered intelligently and diligently. Apply patches and dont be stupid about your e-mail and your site should still be safe.
However, that advice ignores the existing MyDoom and Doomjuice threats continuing to launch distributed denial-of-service attacks on Microsoft and The SCO Groups sites. But thats a different story.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. Be sure to check out eWEEK.coms Security Center at http://security.eweek.com for the latest security news, views and analysis.
More from Larry Seltzer
