Tuesday, March 02, 2004

With Bagle, Netsky, March comes in like a worm. By Paul Roberts, IDG News Service Conventional wisdom claims March comes in like a lion and goes out like a lamb. But with new versions of the Bagle e-mail worm and a virulent new form of Netsky virus, March's arrival is looking more wormy than leonine. As of Monday, five new versions of Bagle appeared over the weekend as well as a new version of Netsky that is spreading rapidly on the Internet and generating a huge volume of virus-infected e-mail messages. The new virus versions use a variety of so-called "social engineering" techniques to fool users. Some new variants also hide in ZIP files to slip past anti-virus filters and into users' e-mail boxes, said Graham Cluley, a senior technology consultant at Sophos. Netsky.D, a new version of the Netsky worm, is believed to be the biggest threat in the group. As of Monday, Netsky.D was spreading rapidly on the Internet and flooding e-mail servers with infected messages, according to Cluley. . . . Like its predecessors, Netsky.D affects machines running Microsoft's Windows operating system and arrives in e-mail messages with randomly generated subject lines such as "Re: Document," "Re: Your picture" or "Re:approved." The Netsky.D worm disguises its payload as a Program Information File (PIF) attachment that also has a randomly generated name such as "my_details.pif" "document.pif" or "mp3music.pif." . . . Bagle versions C, D, E, F and G appeared between Saturday and Monday and are variants of the first Bagle worm, which appeared on Jan. 19. All target systems running Windows, harvest e-mail addresses from infected machines and open a TCP port to listen for commands from a remote attacker, according to an alert released by computer security company iDefense. Bagle.C appears to be the most virulent of the bunch. Sophos has received "hundreds" of reports of messages containing that version, which uses a Microsoft Office 2000 Excel icon to fool users. Other Bagle variants use Windows folder icons, Cluley said. Bagle versions F and G also use a password-protected ZIP file to get past anti-virus scanners. Password-protected ZIPs have encrypted contents that cannot be read by even sophisticated anti-virus scanners. However, virus writers must supply the password information in the body of a message before users can open the ZIP and get to the virus file inside, which makes it harder for the worm to spread, he said. . . . Organizations must also invest in user education to stop risky behavior such as opening strange e-mail attachments, he said. Last weekend's round of virus outbreaks is just the latest in a weeks-long scourge that began in mid-January with the first version of Bagle and has spawned multiple versions of the Bagle, Mydoom and Netsky worms. I think it's effectively a blitzkrieg, said Cluley. Despite only modest changes between worm versions, the new Bagle and Netsky variants appear to be the work of the original virus authors, he said. Someone who has access to the source code is creating these, he said. 10:42:07 PM    comment []

Almost Real - connecting in a wired world. A thought provoking comment by Jason Silverman in Wired on the new documentary Almost Real concerning internet driven communities and Living Life in Virtual Reality. The film challenges the assumption that the Internet is a kind of global wonder drug. [Smart Mobs] 10:17:40 PM    comment []

NASA Reports Evidence Mars Was Once Soaked. NASA scientists reported evidence today that the crater where the Mars rover Opportunity is exploring was once soaked in water. By Kenneth Chang. [New York Times: Science] Other reports tell me "soaked in water" isn't what they said. Maybe I should investigate. 9:56:49 PM    comment []

March 02, 2004. Top Twelve Tips for Running a Beta Test. [Joel on Software] 4:55:32 PM    comment []

ACM Washington Update excerpt: [1] USACM Identifies Digital Rights Management Policy Issues In a recent letter to members of the US Senate, USACM cautioned that broad Digital Rights Management (DRM) regulations mandating specific access control and redistribution control technology to be built into computers, operating software, and other digital devices could interfere with many legal, non-infringing uses of digital computing. Proponents argue that DRM mandates and further restrictions on computing are necessary in part to "keep honest people honest" and to provide copyright owners additional control over how digital content is downloaded, printed, passed across a network, or viewed. USACM has concluded that government imposed DRM regulations could threaten the overall security of our nation's information infrastructure, competitiveness of the U.S. IT industry, and continued innovations in software and digital computing. In the letter, USACM welcomed certain DRM related provisions of S. 1621, the Consumers, Schools, and Libraries Digital Rights Management Awareness Act of 2003. The provisions of the legislation highlighted by USACM seek to block government imposed DRM regulations, provide public transparency concerning the commercial use of DRM, and require a comprehensive review of the impact of DRM regulations on legitimate research, education and communication activities. To review the USACM letter to Congress concerning DRM regulations, see: http://www.acm.org/usacm/PDF/drmbrownback.pdf To review additional information on S. 1621, see: http://brownback.senate.gov/LIDRM.cfm 2:39:58 PM    comment []

Surprise! Law enforcement wants more information, not less. BNA Headlines reports: DOJ SIDES WITH RIAA IN REQUEST FOR SUBSCRIBER INFORMATION The Department of Justice has filed a brief siding with the RIAA in its bid to obtain subscriber information from ISPs. The filing comes as part of Charter Communications request to the 8th Circuit to block the recording industry's subpoenas. Meanwhile, North of the Border COURT ALLOWS INTERVENTIONS IN CANADIAN FILE SHARING CASE A Canadian judge has allowed two public interest groups -- the Canadian Internet Policy and Public Interest Clinic and Electronic Frontier Canada -- to intervene in next week's hearing over whether several ISPs should be compelled to provide subscriber information to the Canadian Recording Industry Association. The judge ruled that "this is a new area of law" and that an order requiring the ISPs to disclose the identity of alleged file-sharers could have wider ramifications beyond the 29 unnamed defendants in this case. You can read the Toronto Star story or the press release (pdf). While we're on the topic, the BNA News is not all bad JUDGE SAYS CHAT ROOM CHATS ARE SUBJECT TO WIRETAP LAWS A judge in New Hampshire hearing an Internet sex case has thrown out key evidence, ruling that chat room conversations are subject to wiretapping laws. The county attorney is considering appealing the judge's decision to the state Supreme Court 9:39:04 AM    comment []

Bioethics Shuffle Ignites Outcry. Members of President Bush's Council on Bioethics will likely play nice now that they all agree on embryonic stem-cell research and cloning. But they aren't an accurate representation of American citizens, critics say. By Kristen Philipkoski. [Wired News] 6:30:01 AM    comment []

Web porn, minors, and free speech. Supreme Court hears case on regulating the Web. [Christian Science Monitor | Top Stories] 6:25:20 AM    comment []