Security experts and overworked systems administrators for years have implored users to pick hard-to-guess passwords and to change them often. But many users persist in using their names or childrens birthdays as log-on credentials, and two recent worm outbreaks have shown why thats such a risky practice.
Deloder, the latest worm to hit vulnerable Windows machines, as well as a recent version of Lovgate, both use a list of common passwords in an attempt to compromise computers. Lovgate began spreading late last month, while Deloder appeared last week.
Although neither worm has spread as far or as fast as threats such as SQL Slammer or Code Red, both Deloder and Lovgate clearly illustrate the danger inherent in lax security policies.
In Deloders case, the worm tries to connect to random Windows NT, Windows 2000 and Windows XP machines on TCP port 445, normally used by Microsoft Corp.s Active Directory. It then looks for network shares on the remote machine and, if it finds any, tries to copy itself to the shares by using easily guessed passwords to gain access. The worm also installs a Trojan horse and a utility for executing commands on remote machines.
Lovgate behaves in a similar fashion. It spreads from an infected machine using the Messaging API Windows functions by answering recent mail with an infected reply. It then tries to copy itself to network shares and their sub-folders. If the folders are password- protected, Lovgate tries passwords such as “admin” and “123.”
“Lovgate is an opportunistic worm: It exploits what works,” said Sam Curry, product manager for Computer Associates International Inc.s eTrust security unit, in Islandia, N.Y. “It uses several social engineering tricks to manipulate as many users as possible into opening it. It also abuses one of the most common weak security policies in the world—weak passwords.”
Deloder and Lovgate are more of an annoyance than anything else. Neither carries a destructive payload, but that doesnt make them any less troublesome for administrators. Clogged mail servers and infected files are time-consuming problems to fix.