“May you live in interesting times” goes the old curse. Times are interesting indeed in the world of computer security, especially this week. Every day brings another major worm or attack, maybe two, and the outlook looks even worse.
The last few days have shown remarkable fertility among computer worms, as new variants of MyDoom arrived on the Internet. A new worm on Wednesday began crawling the AOL Instant Messenger network. And a new variant of the vigilante worm Nachi arrived on Thursday.
By the time you read this, all of the above may be old news, overtaken by even newer variants doing crazier things.
Of course all of it is less scary than Microsofts announcement this week of a Link security hole in Windows that, as with the Blaster incident from last year, could allow for remote network infiltration without user action.
The most interesting, to my mind, is Nachi.B also known as Welchia.B. Some may remember the A version of this one that came out last summer in the wake of Microsofts DCOM RPC vulnerability.
Nachi.A spread through the DCOM RPC hole and then tried to download and install the patch to fix the hole. It also attempted to remove the Blaster worm, the most significant malicious exploit of that particular vulnerability.
Anyway, Nachi.B attempts to exploit these same holes and some others in order to spread itself. It then attempts to remove the MyDoom.A and MyDoom.B worms and undo some of the damage they cause, such as the overwritten HOSTS file. Nachi basically writes a blank one.
Finally, it attempts to download and install a Microsoft patch for a buffer overrun in the Messenger service.
So its trying to be helpful. Or so it would seem.
However, remember that Nachi.A was funny news at first, but it quickly became for many corporations a bigger problem than Blaster. I note that its still out in the wild.
Nachi.B could easily prove to be as bad. Some persons no doubt will spread it intentionally because its a “good” worm.
Next Page: Decoding Nachi.Bs Political Message.
Decoding Nachi
.Bs Political Message.”>
At the same time, Nachi.B is making a political and educational point. If the machine has a Microsoft IIS (Internet Information Services) Web server and is configured for the Japanese code page, Nachi.B overwrites certain files with an HTML page containing the following text:
LET HISTORY TELL FUTURE !
1931.9.18
1937.7.7
1937.12.13 300,000 !
1941.12.7
1945.8.6 Little boy
1945.8.9 Fatso
1945.8.15
Let history tell future !
So whats all this about? The numbers arent URLs. Rather, they are dates that relate to World War II. Security vendor iDEFENSE Inc. deciphered the page.
Heres the key:
- September 18, 1931. Japan invaded Manchuria, renames it Manchukuo.
- July 7, 1937. The Japanese army attacked China in the “Marco Polo Bridge Incident.”
- December 13, 1937. The Battle of Nanjing ended as the Japanese took the city and commenced three months of atrocities.
- December 7, 1941. The attack on Pearl Harbor.
- August 6, 1945. The United States dropped the “Little boy” atomic bomb on Hiroshima.
- August 9, 1945. The “Fat man” bomb struck Nagasaki.
- August 15, 1945. Victory in Japan (VJ Day) riot in San Francisco while the city was celebrating.
- August 15, 1945. South Korea liberated from Japanese rule.
According to iDEFENSE, this message “may be an attempt to elude[sic] to current activities about countries currently in political conflict with the U.S.”
I find it hard to tell exactly what the authors attitude is.
Still, nothing that has happened so far will victimize an installation that is administered intelligently and diligently. Apply patches and dont be stupid about your e-mail and your site should still be safe.
However, that advice ignores the existing MyDoom and Doomjuice threats continuing to launch distributed denial-of-service attacks on Microsoft and The SCO Groups sites. But thats a different story.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. Be sure to check out
More from Larry Seltzer
