Security experts and overworked systems administrators for years have implored users to pick hard-to-guess passwords and to change them often. But many users persist in using their names or childrens birthdays as log-on credentials, and two recent worm outbreaks have shown why thats such a risky practice.
Deloder, the latest worm to hit vulnerable Windows machines, and a version of Lovgate both use a list of common passwords in an attempt to compromise computers. Lovgate began spreading in late February, while Deloder just appeared on the scene last week.
Although neither worm has spread as far or as fast as threats such as SQL Slammer or Code Red, both Lovgate and Deloder clearly illustrate the danger inherent in lax security policies.
In Deloders case, the worm tries to connect to random Windows NT/2000/XP machines on TCP port 445, normally used by Microsoft Corp.s Active Directory. It then looks for network shares on the remote machine, and if it finds any, it tries to copy itself to the shares by using easily guessed passwords to gain access. The worm also installs a Trojan horse and a utility for executing commands on remote machines.
Lovgate behaves in a similar fashion. It spreads from an infected machine using the MAPI Windows functions by answering recent mail with an infected reply. It then tries to copy itself to network shares and their subfolders. If the folders are password-protected, Lovgate tries passwords such as “admin” and “123.”
“Lovgate is an opportunistic worm: It exploits what works,” said Sam Curry, product manager for Computer Associates International Inc.s eTrust security unit, in Islandia, N.Y. “It uses several social engineering tricks to manipulate as many users as possible into opening it. It also abuses one of the most common weak security policies in the world—weak passwords.”
Most Recent Security Stories:
Search for more stories by Dennis Fisher.
Find white papers on security.
For more security news, check out Ziff Davis Medias Security Supersite.