NEWSLIB TROUBLES: the Klez Worm

May 2002 NewsLib thread

Date: Wed, 8 May 2002 10:57:40 -0400 (EDT)
From: Barbara Semonche
Cc: The NewsLib mailing list <newslib@listserv.unc.edu>
Subject: Re: [newslib] Virus Using My Name?

Hello, Skye

--      Your email address  has been co-opted by the Klez worm. Get together with your inhouse network administrator for how to contain it. There is also information on the web. Here is an excerpt from Symantec Security Response about Klez:

                ************************************

"W32.Klez.E@mm is similar to W32.Klez.A@mm. It is a mass-mailing email worm that also attempts to copy itself to network shares. The worm uses andom subject lines, message bodies, and attachment file names. The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message in which it is contained. Information and a patch for the vulnerability are available at http://www.microsoft.com/technet/security/bulletin/MS01-020.asp .

The worm overwrites files and creates hidden copies of the originals. In addition, the worm drops the virus W32.Elkern.3587, which is similar to W32.ElKern.3326.

The worm attempts to disable some common antivirus products and has a payload which fills files with all zeroes."

          ****************************************

Date: Wed, 1 May 2002 12:43:49 -0400 (EDT)
From: Barbara Semonche
To: NewsLib@listserv.oit.unc.edu
Subject: NewsLib Troubles: some preventions

Greetings all!

-- Ok, troops, bear with me on this. I've spent some time this morning working with our champion campus network administrator. He and I have examined recent NewsLib postings and came to these conclusions.

        1. We do have a virus invasion on NewsLib. I'm also assured by our campus network administrator that our servers do have the very latest anti-virus software in place and working on all 9,000+ electronic discussion lists.

        2. So, you are asking, how is this virus getting through?

        3. I'm told that it comes through infected computers of our NewsLib subscribers. Not all of our subscribers have virus infected computers, but some do and this is at the crux of the problem. This latest virus is making its way onto NewsLib because the NewsLib email address is in subscribers' email address files on the infected computers. Sneaky things, these new computer viruses.

        4. The quick and easy way to prevent these virus-infected messages from being posted to NewsLib would be to "close" the list. That is, force all messages destined for our list to pass first through to the NewsLib list administrator. That's me. I would have to approve/disapprove *all* messages addressed to NewsLib after reading the entire contents of each and every message. It would be possible to automatically refuse *all* messages with attachments, but even that approach would not offer completely security. Perhaps I will have to take that harsh stand and move NewsLib to a closed, private status. But for now I'd like to avoid that drastic step. I'd like to keep NewsLib a public list. It just seems the right thing to do for our community. That approach is subject to review at a later time. [Note bene: Not that just anyone can post to out list, one must be a subscriber first.]

        5. Why can't the list administrator (that's me again) require all new subscribers to get approval from the list administrator *before* being allowed to subscribe to NewsLib? Yup, that's what we are doing now. However, that wouldn't entirely solve this problem. Messages with viruses are coming from folks we know and have been long-time NewsLib subscribers! 

        6. Well, what can be done? For now, the first step is for each and every one of NewsLib's 1,600+ subscribers to check if they have NewsLib's email address in their email address book file. If so, delete it. Keep it out of your electronic address books. Keep it handy elsewhere, but *not* in your email address book. Inconvenient? Of course!  But that is the only way we can manage this problem at this time. I hope you all agree and will support this approach.

        7. Is there another possibility for avoiding these virus attacks?  Yes. But I should point out that some of these "viruses" are more annoying that damaging. Some are merely tiresome marketing ploys and we should realize that no solution comes without side effects. Here is an option our campus network administrator and his staff are evaluating:

        "We are exploring a type of computer virus protection in the form of a filter for our lists. This new software application would read *every* email message (searching for viruses) destined for our 9,000+ lists on this campus. This type of software, as it exists now, brings some other problems. It would be difficult to maintain rapid delivery; we don't know how much it would slow the traffic. Also, it might be capable of deleting/destroying harmless messages. We should have something ready to test by summer 2002. I'll keep you posted on our progress."

        So, there you have it. Probably more than you all really wanted to know about this event, but I offer it nonetheless.

        Thank you all for your suggestions, support and patience. Your continued comments are always welcome. You are all wonderful professionals to work with.

        Barbara Semonche, NewsLib list administrator

  **********************************************

Date: Wed, 1 May 2002 13:48:23 -0400 (EDT)
From: Barbara Semonche
To: Tim Rozgonyi <rozgonyi@post-gazette.com>
Subject: RE: [newslib] NewsLib Troubles: some preventions

Hi, Tim

        Thanks for bearing with me, Tim. The problem is always recognizing what is a virus. If it is the "Klez" virus, sure, that is detected and dealt with, but if it is the annoying marketing type as with the "game" type, well that is a bit harder. Of course, these anti-virus programs do a good job most of the time, but if they were perfect, then one's own in-house system would recognize them. <sigh>

        However, thanks for taking precautions with your email address book. I'll check on the "footer" to NewsLib messages.

        More anon. Cheers!

                Barbara Semonche, NewsLib list administrator       

On Wed, 1 May 2002, Tim Rozgonyi wrote:

> Barbara,

> Even a virus-engendered e-mail message, such as the one we just got, would have to pass through the NewsLib servers, right?

> If that's the case, shouldn't your server have intercepted the infected item?

> In any event, I will delete newslib from my address book forthwith.

> Is there any way you can append another line to the bottom of each NewsLib e-mail along the lines of

>       To post a message to NewsLib, send an email to newslib@listserv.unc.edu

> Just a thought, not for today.

> Hang in there.

**********************************

Date: Wed, 1 May 2002 14:27:13 -0400 (EDT)
From: Barbara Semonche
To: sbolhafner@post-dispatch.com
Cc: The NewsLib mailing list <newslib@listserv.unc.edu>
Subject: Re: [newslib] Re: NewsLib Troubles: some preventions

Hello Stephen, Tim, Michael, and all:

        Things are never as simple as one hopes. The concept of stripping attachments to NewsLib postings is a good one and may even work on some other listservers.

        However, my campus list administrator told me that this option is not possible for our mega listserver. Apparently, our list software doesn't look for "attachments;" rather it notes file size and we can do something about identifying over-large messages.

        We could filter NewsLib postings over a certain size.  One of the problems with that is that the respondents to NewsLib posts may simply add their response on top of the others thus elongating the "thread" and increasing the size. I know this happens because I cache some of the high-interest NewsLib threads.  Also, not all destructive attachments are big.

        Other problems emerge. More than a few NewsLib subscribers have home computers and frequently swap/forward files and messages between them. Unaware, users infect both machines. Ergo, the best approach is to get and update anti-virus software on your machines. You can find such applications on the web. More than a few good ones are free. 

        Regrettably, such precaution doesn't prevent all viruses from infecting your computers. Example: The virus "jdb....xe" (purposely typed with elipses) is not detected with either McAfee or Norton.

        Best anti-virus protection practices?

        1. Control, reduce, or eliminate your email address book

        2. Obtain, update anti-virus software on your personal computers

        3. Keep in touch with your in-house network administrator about suspicious emails

        4. Follow good list subscriber behavior by keeping your postings concise and on topic

        5. Avoid sending attachments to NewsLib (or any other email discussion list. [Note: contact individual first to see if attachments are accepted.]

        Other suggestions? Please contribute. I'll be making a synthesis of this thread to load onto the NewsLib Lyris web site. http://www.ibiblio.org/journalism/newsliblyris.html

Thanks again. You are all good folks!

                Barbara Semonche, NewsLib list administrator


*************************************************

Date: Wed, 1 May 2002 14:56:52 -0400 (EDT)
From: Barbara Semonche
To: Tim Rozgonyi <rozgonyi@post-gazette.com>
Cc: The NewsLib mailing list <newslib@listserv.unc.edu>
Subject: Re: [newslib] Re: NewsLib Troubles: some preventions

Hi, Tim

        Thanks so much for your contribution. It will go into the thread I'm caching. Cheers!

        Barbara Semonche, NewsLib List administrator

On Wed, 1 May 2002, Tim Rozgonyi wrote:

> Barbara,

Since you're caching this thread, I figure I should clarify the issue of viruses that propagate without attachments. Below is a chunk of a page from Symantec about the Klez virus that addresses the issue.

> Another thing to keep in mind - Users in an organizational setting, one that presumably has anti-virus software in place, need to be especially careful when accessing web-based e-mail accounts such as Hotmail or Yahoo. We were hit here last week with a couple virus infiltrations that were caused by employees accessing their web-based e-mail accounts. We just had a discussion today about enacting a policy wherein people are not allowed to access any web-based e-mail accounts from work. (To quote M. Jesse, "Ouch!")

> Here's the chunk from Symantec:

> W32.Klez.gen@mm is a mass-mailing worm that searches the Windows address book for email addresses and sends messages to all recipients that it finds. The worm uses its own SMTP engine to send the messages. The subject and attachment name of incoming emails is randomly chosen. The attachment will have one of the following extensions: .bat, .exe, .pif or .scr. The worm exploits a vulnerability in Microsoft Outlook and Outlook Express in an attempt to execute itself when you open or even preview the message. Information and a patch for the vulnerability can be found at http://www.microsoft.com/technet/security/bulletin/MS01-020.asp   W32.Klez.gen@mm attempts to copy itself to all network shared drives that it finds.