UN
ALERT - SEP 24,
2001
NIMDA
AFFECTS AUTOMATICALLY EVEN WITHOUT OPENING ATTACHMENTS
People used to ask specialists
about what to do in order to don't get infected with email virus.
The answer always was: do not open attachments. This was a good
rule, until one crazy mind has created a virus that can be executed
without opening attachments. With Nimda, this day came.
Summarizing to prevent dull details
technician: to infect a computer, a virus needs to be executed.
And for this is necessary open it (load in the memory and execute)
the archive that contains its code. Until recently, if the user
adopted the intransigent politics to never open attached files,
the code that spreads the virus would never be executed and the
user would be protected. Unhappyly this is not more truth.
At least for who it uses the programs
of e-mail of the MS, Outlook or Outlook Express (first integrant
of the package Office, second distributed with Windows). This
because with intention to become them more attractive, the MS
allowed that certain codes present on the messages can be executed
when they are shown (that's how that "funny" musics
when opening certain messages had appeared). A total superfluous
function, evidently. But it has people that likes.
Result: it did not took a long
time so one idiot has discovered a way to skirt the steps taken
for the MS to guarantee that only secure codes were executed when
showing messages. The result is the Nimda (Admin., abbreviation
of Administrator., backwards). Worse thing is that if the Outlook
or the Outlook Express is configured to keep open the auto visualization,
it is not even necessary to open the message, is enough to select
it: the simple exhibition in the auto visualization is enough
to contaminate the machine.
The Nimda still explores other
weaknesses of programs from MS, also one of its IIS (Internet
Information Server, used for internet providers to manage its
servers of Internet) that it allows to contaminate machines with
a simple visit of internet pages in the Internet (exploring a
known deficiency for web traversal exploit it can insert a malicious
code in the page of such form that is enough to visit it to be
contaminated - MS already developed the correction for the web
traversal, but it is necessary that the internet provider install
it to solve the problem) and can spread even in machines that
use other programs of e-mail (but in this in case that it is necessary
that the user opens the attached file, in general named Readme.Exe).
Nimda certainly is one of the
viruses most dangerous already created and will give damages of
billions of dollars (the attributed damages only the four virus,
Melissa, Anna Kournikova, Love Bug and Code Red, assemble the
four billion dollar ammount). And everyone in the Internet is
now questioning how can be protected of this and other similar
virus.
Well, to prevent the contamination
is necessary that the internet provider that is hosting the page
that you are going to visit use the IIS install the correction
in its servers. The correction is available in the MS website
for free download, therefore it does not have excuse not to install
it. On the other hand, it is important to the user to bring up
to date the archive of definition of virus of its antivirus: the
problem caused by the Nimda was so great that all antivirus companies
already does have the Nimda definitions on the update files (and
if you already got infected, probably will find some utility to
remove it). For those who does not use the Outlook, must continue
grasped the practical rule of never open attachments.
Well, that's it. In our days nobody
is safe anymore, even those who never transige the rules of never
open annexes. The world is moving. E moving for worse...
|