| May 20, 2000 Show |
|
|
How
do you set up the network? Top of Page
The computers can either be connected with wires
or with wireless broadcasting.
There are several wireless standards groups (Wireless
Ethernet, HomeRF, Bluetooth, and BRAN). Wireless Ethernet (802.11b)
and HomeRF are currently shipping wireless hardware. Bluetooth Wireless
standards are designed to connect peripherals to a computer (like a digital
camera or printer) and are not designed for networking and are still in development.
Broadband Radio Access Networking (BRAN) standards (802.11a) will provide high
bandwidth wireless connection and are still in development. BRAN will be the
technology of the future. Tech Talk recommends Wireless Ethernet
as today's best wireless technology.
The two wired standards that are available are
Home Phoneline and Category 5 Cabling. In an existing home, Tech
Talk recommends Home Phoneline cabling, since it uses existing phone wiring
in the home. In new construction, Tech Talk recommends installing Category
5 cabling with the regular telephone cabling.
All of these wired and wireless standards are
shown below.
How
can you share an Internet Connection? Top
of Page
You must use a proxy server because
you have multiple computers but only one Internet connection and IP address.
If the proxy server also provides port filtering, it is called a firewall.
Three excellent software packages are available.
How
can you share a printer? Top of Page
Most
secure way is to use a network printer, but that is expensive and complicated.
You can use peer-to-peer sharing. First attach the printer to one of the
computers on the network and install the local printer driver as you normally
would. Next install Microsoft NetBEUI (NetBios Extended User Interface) Protocol
under Networks in the Control Panel. On the same Network panel, press the File
and Print Sharing button. Select Printer Sharing, but not File Sharing. Sharing
only needs to be selected on the computer with the printer. Then select Printer
Properties by highlighting the Printer icon in the Printer window and clicking
the right mouse button. Select sharing for everyone. Then go to the other computers,
and install NetBEUI on each. Make certain that each computer has a different
NetBEUI name. Finally install a new Network (not local) printer on the other
computers in the network. Now all computers can share one printer, as long as
the computer with the printer is on turned on.
|
|
Variants
of the LoveBug Top of Page
The
first mutations simply changed a few lines of code and renamed the attachment
and the subject of the e-mail All other features were the same, see CERT
Advisory 2000-04 (www.cert.org/advisories/CA-2000-04.html)
The latest mutation
(VBS/NewLove.A) is far more damaging. It removes the "if, end if lines"
in the infectfiles() subroutine so that ALL files on the hard drive are replaced.
It also replaces the subject with a file from the Recent Documents lists in
Windows. If Recent Documents is empty, it replaces the Subject with the
last infected file. The subject line is "FW: Filename." The
attachment is "Filename.vbs." See FBI NIPC Alert (www.fbi.gov/nipc/alert00-043.htm)
BubbleBoy (www.fbi.gov/nipc/bubbleboy.htm)
is a harmless VBScript shell that is contained in the body of an HTML e-mail
It is activated without opening an attachment as soon as the e-mail is show
in the View Pane of Outlook. This is very dangerous. Tech Talk expects
variants of the LoveBug script to be placed in this shell.
Now that the cat is
out of the bag. Expect variations to be written in JavaScript. Then
both Microsoft and Netscape e-mail systems will be affected. None of this type
have been encountered yet.
Microsoft has announced that it will soon release a patch to prevent scripts
from automatically transmitting e-mail to addresses in the Outlook address book.
Information about this patch is available from Microsoft.
This new patch will prevent users from accessing certain types of attachments
(like vbs), requires permission to read address books, requires permission to
send e-mail, and increases level of default security settings.
What
Can You Do? Top of Page
First -- Install the latest
patch for your antivirus software.
Second -- Install latest patches from Microsoft. (www.microsoft.com)
Third-- Deactivate the Windows Scripting Host until Microsoft can
get suitable protection in place.
If
you need the Host for specific automated tasks, simply turn it on for those
tasks. Then remove it when finished. It takes less than a minute
to activate and deactivate WSH.
To turn off the Windows Scripting Host, take
the following steps for Windows.
How
did Tech Talk Open this Code Safely? Top
of Page
We first deactivated
the Windows Scripting Host. Then we saved the attachment as file with
a txt extension (making certain to delete the vbs extension that it came with).
Finally, we opened the text file with WordPad and printed it.
Overview
of Program Flow Top of Page
We have decided
not to include a copy of the program on this site. Rather we will give
a quick description of how it works. The program contains the main program and
eleven subroutines or functions. It includes 230 lines of code (some quite
long). It appears that more than one person wrote the code.
Some routines are not as well written as others. A complete program printout
uses six sheets of paper. One of the functions is never used (function folderexist).
Program LoveLetter identifies the authors,
provides an e-mail address, initializes a few variables, and then call the Subroutine
Main().
Subroutine Main() copies the virus to three
locations on the hard drive and then calls four subroutines -- Regruns(), HTML(),
Spreadtoemail(), and Listadrive().
Subroutine Regruns() changes the startup
page of Internet Explorer to one of four locations that contain a Trojan horse
program that captures passwords. Regruns() then adjusts the registry to ensure
that the virus will run the each time the computer started.
Subroutine
HTML() creates a web page for transmission to all members on the mIRC buddy
list using a script created by Subroutine Infectfiles(). This web page transfers
and saves copies of the virus on the hard drive of the targeted machine.
Subroutine Spreadtoemail() creates an e-mail
titled "ILOVEYOU," with a copy of the virus attached, and then sends
it to every address in the Outlook address books.
Subroutine Listadrive() locates
all drives on the computer, calls Subroutine Folderlist() for each drive. Subroutine
Folderlist() cycles through each folder of the drive and calls Subroutine Infectfiles()
for each folder. Subroutine Infectiles overwrites files which have specific
filename extensions. This is where the real damage occurs. Infectiles then writes
an mIRC script that sends the page created by Subroutine HTML() to each name
on the mIRC buddy list.
The flow between subroutines is
shown below.
Detailed
Summary of Program Code Top of Page
Program
Loveletter
9 lines of code
Comment "barok-loveletter.vbe <I hate go to school>"
Comment "by: spyder / ispyder@mail.com"
Comment "@GRAMMERSoft Group / Manila, Philipines"
Initializes variables (fso, file)
Calls subroutine main()
Subroutine
Main()
19 lines of code
Changes Windows Scripting Host timeout parameter
Copies itself to three new files on the hard drive
MSKernel32.vbs
Win32DLL.vbs
Love-Letter-for-You.Txt.vbs
Calls four subroutines
Regruns()
Html()
Spreadtoemail()
Listadriv()
Subroutine
Regruns()
28 lines of code
Changes registry so MSKernel32.vbs and Win32DLL.vbs
will run.
Changes Internet Explorer Startpage to one of four
URLs
www.skynet.net/~youngls
www.skynet.net/~angelcat
www.skynet.net/~koichi
www.skynet.net/~chu
Each URL asks for download of WIN-BUGSFix.exe program.
WIN-BUGFix.exe is a password collection program.
Subroutine
Listadrive()
11 lines of code
Locates all hard drives on system
Calls folderlist() for each drive
Subroutinge
Folderslist()
10 lines of code
Scans all folders and subfolders on all hard drive
Calls Infectfiles() for each subfolder
Subroutine
Regcreate()
4 lines of code
Creates objects for editing the registry
Function
Regget()
4 lines of code
Creates objects for reading registry
Returns regget value
Function
Fileexist()
10 lines of code
Tests for existence of file
Returns value (0 or 1)
Function
Folderexist()
10 lines of code
Never used or called
Tests for existence of folder
Returns value (0 or 1)
Subroutine
Spreadtoemail()
33 lines of code
Reads all Outlook address books
Reads all addresses in each book
Send email to every found adresses
Email Subject: ILOVEYOU
Email Body: kindly check the
attached loveletter coming from me
Email attachment: LOVE-LETTER-FOR-YOU.TXT.vbs
Interesting fact : Spells mail as male when defining
objects.
Subroutine
Html()
36 lines of code
Creates web page called "LOVE-LETTER-FOR-YOU.htm"
Contains JScript
program to control window
Contains VBScript
program which transfers and saves virus
Places copies of
virus in two files on target harddrive
MSKernel32.vbs
Win32DLL.vbs
Page Descriptive
Data -- "simple but i think this is good"
Web page sent to mIRC buddy list
Tech Talk Note: mIRC is an Internet Relay Chat client
|
|
| Home Page |