Thursday, February 27, 2003

Jeem

Description:
An interesting trojan in that it contains a mail server and a web proxy. Often installed by another 'downloader' trojan. Often pulled down from a website.

By default, opens three ports. The port number appears random but is based on the time zone and operating system number of the local OS. The lowest number will be a simple SMTP open relay which the attacker will often use to relay spam to the rest of the planet. This lowest port may contain the string 'jeem.mail.pv' in the banner if you telnet to the port.

The middle port number will listen for instructions to the trojan which can include direction to connect to a specific IP/port or to listen on port 9000 for further instructions. The higest number port has the ability to act as a HTTP proxy.

This can be a very annoying worm to be infected with. It has the ability to turn a lowly workstation into a spammer's dream: an open mail relay.

Capture:

Telnet'ing to the trojan's port, whatever it is, returns the following:

[root@intmgmtws1 root]# telnet 192.168.101.100 8281
Trying 192.168.101.100...
Connected to my.domain.com (192.168.101.100).
Escape character is '^]'.
220 jeem.mail.pv ESMTP
quit
221 jeem.mail.pv
Connection closed by foreign host.

Note the SMTP codes and the line '221 jeem.mail.pv'.

Sources:

Wednesday, February 26, 2003

Malicious code review

As a side project, I'm going to review various bits of malicious code (mostly worms and trojans) that I come across at work. Mostly it'll be the "view from the outside" as I don't have access to most of the systems other than what I can see via open ports. I'll add shortcuts to each "review" to the menu (on the left). Hopefully, it'll help someone out.

Note: Please bear with me while I get a standard form hammered out.

Tuesday, February 25, 2003

Pissin'

Hey, I didn't say "Vents" were limited to my own dumps:

Jeremy Zawodny's The 10 Habits of Highly Annoying Bloggers (and various pot shots back at him).

Monday, February 24, 2003

Content Management Systems web site

Found the following while searching for Postgres info:

cmsInfo is an internet community of users and developers of Content Management Systems. Dedicated to provide news and information of the Open Source weblog niche.

Sunday, February 23, 2003

Do one job and do it well

The Fishbowl has a good short on why writing single purpose software is a "good thing".

Saturday, February 22, 2003

Asleep at the wheel

I really haven't been paying attention to the booklists lately. How did William Gibson put another one out with me not noticing? Guess I have been busy!

Also, Neil Stephenson's QuickSilver is due out March 7th! And while we're at it: a couple online works by Neal:

Friday, February 21, 2003

The next (Really, Really) BIG thing

Just when you thought your bandwidth was being taken up by MP3 file sharing, along comes ShareReactor which specializes in sharing MPG's of television shows. Avg size of one download is well above 200M.

Ouch.

Technically, they don't host any of the files (their claim). Rather they index various MPG's in users' eDonkey clients. So they're blameless?

Thursday, February 20, 2003

Cow-etic Development

Some people will pun at the drop of a hat. Okay, me too! A partial explanation of how odd behavior sometimes develops in a work environment (bad hearing and thick accents?).

Tuesday, February 18, 2003

Sunday, February 16, 2003

Oh please!

The only successful way to fight any issue is education. Here's an example of people going in the other direction. I wonder what's going to happen in about six years when the school tries to teach the kid about sex, has to open her history book and read about war, or finally figures out all the other stuff her parents tried to ban. (And those are just the three-letter words!)

Please remember: there IS a bit of truth in the pastor's daughter stereotype.

Thursday, February 13, 2003

Stumble and Flub

Things just didn't work the way they should have, this week. Here's my list:

  • turns out you can go around XP security by using a Win2K disk and forcing the Recovery Console. You even get extra abilities that Administrator wouldn't normally have in the Console.

  • SpamAssassing flags this month's
    Cryptome
    as spam.

  • The country with the highest average bandwidth "into the home" is suing Microsoft for the damage done by the Slammer worm.

  • Do we really need a Linux Virus HowTo?

  • Commercial blogging, anyone?

  • ... and finally something really scary: Seems that Microsoft is suing "hackers unknown"" for supposedly breaking into Hotmail and harvesting e-mail addresses. I wonder what's going to happen to the next identifiable spammer that heavily targets HotMail.

Migration from Exchange

In searching for some plugins, came across a link to the Exchange server replacement howto.

Sunday, February 9, 2003

Interesting Places to Live

Over the years I've lived in/visited some interesting places. (Sometimes it's the Chinese definition of "interesting".) Here's a few comments about where I've been:

  • Buffalo - Way too spread out. You need a car just to survive. Typical mix of New York and Canadian tourist drivers. Being near two of the Great Lakes, gets way more than its share of snow every year. Favorite restaurant: Schwables' (the best roast beef on the planet) (people will stand in line out in the snow for this place).

  • Charleston - Most severe case of blight I've ever seen. Once the Navy moved out, entire sections of town are empty. Heck, even the criminals avoid the area. Also best downtown recovery. Tourist section is fantastic. I recommend taking one of the graveyard tours on Halloween. Favorite restaurant - just about anything in the historic area.

  • Chicago - Sends its snow to Buffalo, keeps the wind. Winters here are bitterly cold. Decent train system in that you can live/get around without a car. Restaurants believe in oversized portions. Favorite restaurant: Gojo's (low-price/great service) Harborfest a "must do".

  • Honolulu/Pearl Harbor - Oahu considers politics a form of entertainment. Supporting actors are (I'll provide the links as I re-find them):

    • the Chief of Police who was arrested for fixing tickets,

    • the Mayor who was arrested for (more than once) getting drunk and pick a fight on an overseas flight,

    • Emelda Marcos (after Ferdinand) who periodically claimed that living in the U.S. was like living in jail (she was living in her friends $3M mansion),

    • a whole slew of lesser able-minded politicos

    • morning rock jocks who make their living poking fun at the above

    Having a car here is an extreme financial burden. (4M people on one island) There's no where to park, only one road on the island has a speed limit of 55 mph. Three others (that I've been on) are 45 mph. Everywhere else is 35 mph or less. Quickest way of getting around is by bus. One fare will get you within walking distance of most anywhere on the island. Favorite restaurant - the roach coach behind the motor rewind shop on the sub base (ask for the Bento).

  • Naples - Scariest place to drive a car. Scariest place to rent a cab. Scariest place to ride a bus. Stop signs are considered advisories. Procedure for approaching an intersection: honk horn; listen; if you hear a bigger vehicles horn, stop, otherwise ignore the stop sign. Favorite restaurant: Momma's (in the Gut)(probably closed by now) Don't drink the water! Watch where you step! And yes, that IS Vesuvius to the east that looks like it's smoking.

  • Orlando - Yet another city where you need a car to survive. The buses run everywhere, just not often enough. Cabs are expensive. Yet another town where the Navy has left. The city itself is surviving much better than Charleston because of the proximity to Disney World, the shuttle launches, and many other tourist attractions. Places to visit at night: Orange Blossum Trail. Places to avoid at night: Orange Blossum Trail. Favorite restaurant: closed about 20 years ago.

  • Hampton Roads (aka Tidewater) - Not an actual city (in either case), these are the names for an area made up of five
    While not even close to Oahu's view of politics as a form of entertainment, it has its own collection of the odd, offbeat, and dangerous to poke fun at:

    • the state's most dangerous intersections. Because of the high number of transient military in the area, the populace has never settled on a style of driving. Very nerve-wracking during rush hour.

    • Pat Robertson - whose Founders Inn closes down every year to avoid allowing anyone participating in Gay Pride Day to enter the restaurant. Same campus houses Regent University, and the Family Channel studios. Bigger satellite dishes (transmission types) than the local television stations. Also owns the housing development next to the largest active garbage dump in the area (which is rented out to the teachers at R.U.).

    • the national headquarters of P.E.T.A. (yeah, all that gets cooked up here) - an interesting and not-well-known fact: P.E.T.A. does not take care of any animals. Their goal is to educate people, nothing more. Guess that explains having an entire office building on prime Norfolk waterfront.

    • the Edgar Cayce foundation (but you already knew that)

    • a city council member who has declared himself & his family as being out of the city police's jurisdiction and who has been the recipient of not one but two federal tax leins for back taxes. (I hereby nominate him for a position in the state or local government in Hawaii!)

    • various morning shock jocks who poke fun at the above

    Yet another place to live where you have to have a car to survive. While there are buses, they don't run everywhere. Chronic political campaign is "light rail" (politicians offer it up in referendum, it gets voted down). Second slowest road construction I've ever seen. Favorite restaurants: Franky's Ribs (voted "Best of the Beach")

Friday, February 7, 2003

Bitch! Bitch! BItch! - The Treqel

From late January:

Okay, I'm officially on the list entitled "Troublemakers". After listening to a consensus that signatures should start with two dashes and a carraige return, I snapped.

Signature files are supposed to show off your personality (at least in informal traffic). It borders on being "art". I was never meant to display your conform-o-nimity (NAW)*.

There are now plans to embed iframe content in our signatures. Never mind attacking at dawn. Fire at will!

* NAW = not a word

Monday, February 3, 2003

Ipaq Linux

Decided to re-take the plunge and installed Familiar Linux on my Ipaq again. Previously, .5 installed badly on a cutting edge 3835. The fonts were so "off" that I had to re-install Wince (yes, I know it should be WinCE).

After seeing that .6.1 was out, I decided to retry it. The documentation states that you need bootloader 2.18.1 or better. That part was wrong. 2.18.1 couldn't handle the new kernel on the 3835 (it kept crashing on boot). However, as soon as I upgraded the bootloader to 2.18.54, the kernel that I'd installed on the old bootloader worked!

So far, I happy with it. Even rotating the screen to a landscape view appears properly. Now to find a few apps for it and to get wireless working!

Bitch! Bitch! Bitch! - The Sequel

From January:

Okay, it's getting funny. The anal retentive types are getting serious about the "proper" way to post to the local user group's mailing list, including:

  • top or bottom posting
  • proper format for signature
  • and making the subject line reflect the content of the message (never mind the thread it's in)

A militant rebel group is forming to top post as much as possible with blank subject lines and 20-line signature blocks.

We attack at dawn.

Spam Filters

As my grandmother used to utter: "Ach!!! Tsch! Tsch! Tsch!".

My ISP could use a spam scanner (and mine needs updating). I'm the proud recipient of porn spam from Korea with only the "From:" line being forged. There are only two "Recieved" lines in the header, both legitimate. The entire message amounted to a few bits less than 1K.

Poetic Justice

From the old blog's December entries:

Concerning Alan Ralsky's supposed victimization by those horrible people who put him on every snail mail list possible:

As the recipient of 1000's of misaddressed spam messages, (I'm postmaster for ~30,000 customers), I think it's appropriate justice that he have to haul a ton or two to the curb on garbage day.

Sunday, February 2, 2003

Bitch! Bitch! Bitch!

Another from November:

I must be getting old. When I first started attending the local users group, I used to hear other members bitch about Linux users creating graphic web pages (the purists believe you should surf using lynx or links).

After a few years with capable browsers and cheap memory upgrades, there's entirely new generation of users bitching about people who "top reply". Geez! Listening to them, I long for the day when posters bitched about signature lengths.

Y'all have two choices that I can see:

1. Get over it!
2. or put a government in place that will employ corporal punishment for not thinking the same way you do.

To tell the truth, I old enough to remember bitching about wasted bandwidth and being able to read faster than the data transfer in progress.

Oddly, I thinks there's an idea for an article in this. Hmmm...

The History of Whining & Bitching on the Internet

Whattaya think?

SANS/NIAL

From November:

Had a blast at the SANS/NIAL conference. Got to put faces to quite a few Internet voices, the most notable (to me) being Chris Green of Snort.

I hereby retract any previous comment about Steven Northcutt. He seems to have mellowed in the last 5 years. The "Ego of the Decade" Award is hereby transferred to Ed Skoudis, this year's "star" of the conference.

For those of you that haven't heard Ed talk, his "theme" is doom-mongering the coming super-worms, capable of everything from polymorphism, multi-os attack, multi-vulnerability exploitation, zero-day exploits and pre-scanned target lists (all rolled up into one tight package). This is the sort of thing that kept people awake at nights during the 60's when there was a sure danger that Russia had suitcase bombs and pony nukes.

Ed is ignoring the fact that most of the super-worm's spread can be minimized with proper egress/ingress filtering (i.e., does your MS SQL server really need to allow outside world access or just to the local web server?), proper monitoring, and using operating systems with "proper" security models (there's a paper somewhere on this web site about using the proper tool for the job at-hand)(i.e., use Microsoft on the desktop if you have to, but don't use the same operating system in your border equipment and Internet servers [a monolithic network]).

Anways... Because the NIAL conference was hosted by the SANS people, we got to participate in a few of the BOF's and classes on Wednesday night - Friday. One of the things that make discussion lively at the evening BOF's is the free beer (as in free software!). (Heh, always wanted to say that.)

Another one of those days...

Again, from October, but still funny:

Got a phone call late this afternoon from another sysadmin. Seems that every printer in his building was spitting out paper with a couple lines of gibberish on each page (a feature of the Bugbear worm). He thought that he'd covered all of his bases by having a firewall and up-to-date virus scanners.

Turns out the infection vector was one not planned for: web-based e-mail.

Yet another reason to ensure your users are NOT using web mail services which do not have virus scanners/content filters.

Book Crossing and War Plugging

In researching "war chalking" on Google, came across Book Crossing which amounts to a grass-roots library without the building. It's hard to explain, visit the site and read more about it!

Also came across "War Plugging", including a message (or advertisement) in your SSID for netstumblers.

Saturday, February 1, 2003

Stop the bus! I want off!

I know you can opt-out of the telemarketing and UBE attacks on your life. My question is: How do I opt-out of the sales pitch and invasion of privacy at the check-out counter. Yep, that's right folks. A certain large computer hardware/software chain now wants to know your zip code when you check out (I was paying cash for a stack of CDR's). They also wanted to know if I was happy with my current service provider.

I'm a certified expert!

This is acually from the old site and from October of last year but it is so hilarious that I had to include it:

Jeez! What a week! High point was a non-customer calling me for help with his e-mail (reverse lookup failures) and then wanting to argue that the explanation I was giving him (which he'd already received from three other disparate sources!) was incorrect. Quote of the week award goes to him for saying: "I am a DNS expert! I'm a certified MCSE!".

Anyone else see the comedy/horror/tragedy/folly/big "hit me" sign in this? I really hate talking to point-and-click systems administrators. There oughta be a law: you should have to understand the techonology before you're allowed to touch the mouse!