newsletter@quarkit.com.au | www.quarkit.com.au | issue 2 | November 2004 
Welcome

Welcome to the November, 2004 Quark IT Newsletter.  This month, we discuss one of the most common threats to your system: the Win32/Netsky.Q worm.  We also discuss spam as it is defined in Australia, and how this definition affects your business correspondence.

As we are approaching the summer storm season, it is probably a good time to consider power protection for your sensitive electrical devices such as your servers, workstations and coffee machine.

Next month we'll discuss power protection in detail, however we are available to discuss your particular needs at any time.
  In This Issue...
Important Updates
The latest update for Windows, MS Office, and other important software.
Inside the Netsky.Q Worm
An in depth look at what drives this nasty little piece of work.
Spam!
The ins and outs of what makes some email "spam" and others... well, just another email.
Next Month
Starting next month, we'll start a series of articles that look at the individual features of Microsoft's Small Business Server 2003 (SBS).
Special Offers
Special offers for Quark IT clients. (This link redirects to the Quark IT website.)
Signing Off
Final words.

This Month's Important Updates!
Microsoft Windows Updates
Security Bulletin Number Update Number Severity
MS04-029 873350 Important
Vulnerability in RPC Runtime Library Could Allow Information Disclosure and Denial of Service.
MS04-030 824151 Important
Vulnerability in WebDAV XML Message Handler Could Lead to a Denial of Service.
MS04-031 841533 Important
Vulnerability in NetDDE Could Allow Remote Code Execution.
MS04-032 840987 Critical
Remote Code Execution Security Update for Microsoft Windows.
MS04-034 873376 Critical
Vulnerability in Compressed (zipped) Folders Could Allow Remote Code Execution.
MS04-035 885881 Critical
Vulnerability in SMTP Could Allow Remote Code Execution.
MS04-037 841356 Critical
Vulnerability in Windows Shell Could Allow Remote Code Execution.
MS04-038 834707 Critical
Cumulative Security Update for Internet Explorer.
Microsoft Office Updates
MS04-033 886836 Critical
Vulnerability in Microsoft Excel Could Allow Remote Code Execution.
source: http://www.microsoft.com/security/
m0n0wall Updates
Current Version:              1.1 (20040822)
source: http://m0n0.ch/wall/
NOD32 Updates
NOD32 Base:              2.12.2
NOD32 Internet Support:              2.12.2
NOD32 Standard:              2.12.2
Virus Signature Database:               1.901 (20041021)    (or later)
source: http://www.nod32.com/
What's an Update Number?
Microsoft Knowledge Base Articles

Each update number listed in the table to the left corresponds to a Microsoft Knowledge Base (KB) article ID number detailing what is known about the problem.

The Microsoft Knowledge Base is a database on the Microsoft website of technical articles about Microsoft products and technologies. These articles range from "how to" articles that describe how to complete a specific task to "bug" articles that document known issues with Microsoft products.

You can find out whether or not a particular update is installed by checking the Currently installed programs list in Add or Remove Programs control panel.

Each update that is installed can be found in the Currently installed programs list in the Control Panel program to Add or Remove Programs. The name of each of these updates includes the KB number (the numbers may be preceded by the letters KB or Q). If the update number on the security bulletin matches the number listed on your computer, then you already have the update.

source: http://www.microsoft.com/security/bulletins/update_number.mspx

Inside The Netsky.Q Worm
As you can see from the "Top 5 Threats" shown below, the Win32/Netsky.Q worm has the highest rate of infection for October, 2004. That's its second month at number one. With so many viruses "in the wild" it is almost impossible to know about all of them which is why a good virus scanner solution is vital to the wellbeing of your workstations and servers.

This month we'll take a closer look at the leader of the pack the Win32/Netsky.Q worm.

So what exactly is the Win32/Netsky.Q worm? (For a definition of a computer worm, see the sidebar.) Starting with its name we can tell a few things about it.

Win32 indicates that this particular worm targets 32 bit Windows versions, which includes almost all of the Windows product family.
Netsky.Q tells us that we are dealing with a variation of the Netsky worm, but more specifically the 'Q' variant. There are a number of other variants of the Netsky worm that work in a similar way to Netsky.Q, but with different payloads or infection capabilities.

 Infection
When Win32/Netsky.Q runs, it copies itself to the system folder and names itself FVProtect.exe. After that it makes another file called userconfig9x.dll which is then run. To make sure that it runs every time the system starts, it puts an entry (sneakily called "Norton Antivirus AV" in the Registry (the system database) and points to the file FVProtect.exe that it made before.

Habitat
To make sure that this worm is the only version running, it deletes any entries in the registry that may have been put there by an earlier version to shut them down so they don't conflict.

 Preparation
The worm now needs to set itself up so that it can spread itself to other hosts. Netsky.Q likes to spread itself by email, but it needs a few tools to allow this, so it copies the tools it needs to the system folder. These are all ".tmp" files.

 Surveying
With that taken care of, it now looks for other ways to spread itself. There are many different methods, protocols and applications that can be used to traverse the Internet such as the World Wide Web, ftp, chat programs and so on. An extremely efficient way to move data over the internet is Peer-To-Peer (P2P) networks. Netsky.Q searches your drives for words such as download, ftp, http, kazaa, morpheus, mule, my shared folder and upload.

Should it find any directories containing any of these words it then copies itself to these folders and renames itself with appealing names such as American Idol.doc.exe, Arnold Schwarzenegger.jpg.exe, Best Matrix Screensaver new.scr and many, many more…

This enables the worm to be spread to people who are likely to download files with these sorts of names.
What is a Worm?
A program that replicates itself over a computer network and usually performs malicious actions, such as using up the computer's resources and possibly shutting the system down.
Not content to just use the addresses it finds in your address book, the worm then scours your disks for files with file extensions that it knows may contain email addresses such as .wab, .adb, .eml, .htm, .msg and others.

Construction
Now that it has a list of recipients, it crafts emails using lists of words. It then sets the sender field to an address from those it found earlier, or one it hopes the recipient will trust, such as abuse@gov.us, noreply@paypal.com, or support@symantec.com.

It then sets the subject field to something which it hopes will either alert you or attract you, including Fwd: Warning again, Error, important, Mail Delivery (failure), I love you! and Re: Free porn.

It then rounds the email off with +++ Attachment: No Virus found followed by ++++ Norton AntiVirus - www.symantec.de or another anti-virus vendor in an attempt to make you feel extra sure that there is no virus attached.

It now only needs to add its payload to the email as an attachment using the tools mentioned earlier creating either an executable or a zip file, and names itself one of 100 possible names such as approved, confirm, or a document with the extensions; .doc, .txt, .scr or .pif depending on its format.

This is where modern viruses such as Win32/Netsky.Q are beginning to excel. Traditionally a virus would take one approach to replicate such as copying itself from file to file, or using an email application's address book to find addresses it could send itself to. Netsky.Q however takes what is known as a "blended-threat" approach to maximize the possibility of it spreading. In addition to using this "multi-pronged approach", it uses what's known as Social Engineering by targeting weaknesses or human behavioral traits such as love, lust, fear or greed to increase the likelihood that you'll download the infected file or read the infected email.

While Anti-Virus software can respond to threats after they occur, and some such as NOD32 can use advanced heuristics to detect previously unseen viruses, the weakest link will always be the human element. So, as always, stop and think about what you might be about to open.

 For more information:
http://www.quarkit.com.au/content/view/29/44/

source: http://www.virus-radar.com/dynamic/
dquery.php?mcx=vdesc&instance=top&vname=netsky.q
&ifr_name=Netsky.Q&langname=enu
Top 5 Threats (last 31 days)
Virus   Count
1. Win32/Netsky.Q worm 2 702 837
2. Win32/Zafi.B worm 1 179 795
3. Win32/Bagle.AB worm 835 654
4. Win32/Netsky.D worm 793 938
5. Win32/Netsky.B worm 593 761

source: http://www.virus-radar.com

What Is Spam?
Spiced ham in a can jokes aside, we've all received spam in one form or another. It's almost impossible to have an email address without receiving some spam. Believe it or not though, there was a time when there was no spam and as far as the Internet goes, it's a relatively new phenomenon that has risen alongside the commercialism of the Internet from its academic roots.


Definition

 The Spam Act 2003 defines spam as unsolicited commercial electronic messages. This means that if an email is advertising, promoting or offering to supply goods or services, or referring you to someone else who is, and if you have not asked for this email (or are not reasonably expecting it – for example, from a company with which you already do business) then the email can fairly be considered to be spam.

Sending spam is illegal in a growing number of countries, however the laws vary greatly from one country to the next. In Australia, for example, sending any unsolicited commercial electronic messages via email, SMS, MMS, instant messaging or Voice over IP can be considered as spam and must not be sent. Voice calls made using a standard telephone service and faxes are not considered spam. All commercial electronic messaging must include information about the individual or organisation that authorised the message and there must be a functional "unsubscribe" facility, or you may well be a good candidate for a hefty fine per offence (and each individual email counts as a separate offence). The Australian Communications Authority is the Government body responsible for enforcing the Spam Act 2003.

In America, their CAN-SPAM Act allows anyone to send unsolicited email in moderate numbers, but requires there be a functional unsubscribe option and that the sender information is not misleading in any way. This is known as an "opt-out" system – whereby anyone can send you a spam, and you have to opt out of receiving it for each sender. The Australian system is a lot closer to an "opt-in" system where you must give your permission before you can be sent commercial electronic messages.


Some examples of what isn't considered Spam (in Australia)
  • any email of a non-commercial nature
  • any email that you have agreed to receive
  • any email authorised by
    • a government body, or
    • a political party, or
    • a religious organisation, or
    • a charitable institution, or
    • an educational institution where the body is the supplier, or prospective supplier, of the goods or services concerned
Spam Act 2003 Simplified...
  • Unsolicited commercial electronic messages must not be sent.
  • Commercial electronic messages must include information about the individual or organisation who authorised the sending of the message.
  • Commercial electronic messages must contain a functional unsubscribe facility.
  • Address-harvesting software must not be supplied, acquired or used.
  • An electronic address list produced using address-harvesting software must not be supplied, acquired or used.
  • The main remedies for breaches of this Act are civil penalties and injunctions.
Important things to know about blocklists:

1. Many Internet Service Providers and individual businesses around the world use the services of various "blocklist" providers. A blocklist provider is an organisation that provides a service for reporting spammers, determining which domains and IP addresses have been used to send spam, and allows the administrator of an email server to disallow access to its services from those addresses listed in the blocklist.

2. Spamhaus, one of the major blocklist providers used by over 260 million Internet users worldwide, bases their service on the internationally-accepted definition of Spam: "Unsolicited Bulk Email". Therefore anyone sending UBE on the Internet, whether the content is commercial or not, illegal or not, needs to be fully aware that:
 (1) they may lose their Internet access if they send UBE,
 (2) they will likely be placed on the Spamhaus Block List (SBL) (or       another blocklist) if they send UBE.



Unfortunately, it is not only spammers that get added to these blocklists. If your mail server gets compromised and is used to send out spam, then your IP address could well get added to one of the Internet email blocklists, meaning that your ability to carry on your daily work could be adversely affected.

All responsible Internet Service Providers have policies in place that make it against their Acceptable Usage Policy to send spam, and many of these ISPs will make an effort to disable the accounts of any users found spamming. Most ISPs have an "abuse" email address to which you can send complaints about one of their users sending spam.

As can be seen, at the very least spam is annoying, at worst it can cost you money in lost productivity, increased Internet bills, and increased risk of infiltration by viruses and malicious programs, to name a few things.

Quark IT can work with you to implement a spam filtering solution that suits your needs whether you have a local email server (such as qmail, sendmail or Microsoft Exchange) or are retrieving email from your ISP's email server. We are currently in the development stages of our own filtering device that can be added to your network to take care of spam, viruses and other things to which you don't need to be exposed. Watch this space for details as they come to hand.


For more information:
http://www.quarkit.com.au/content/view/30/45
Did You Know?
MessageLabs currently scans over 70 million emails per day on behalf of its clients.

In September 2004, MessageLabs scanned more than 1.45 billion emails worldwide for spam, of which over 1.05 billion or 72.14% (1 in 1.39), were stopped as spam (404.68 per second).

During the same period, they also scanned over 1.78 billion emails for viruses, Trojans and other malicious content, and more than 86 million or 4.83% (or 1 in 20.69) were intercepted (33.27 per second).

source: http://www.messagelabs.com/emailthreats/intelligence/
reports/monthlies/september04/


Other Sources of Reference
Spam Act 2003:
 http://scaleplus.law.gov.au/html/comact/11/6735/top.htm
The Office Of The Federal Privacy Commissioner:
 http://www.privacy.gov.au/
Australian Communications Authority:
 http://www.aca.gov.au/consumer_info/spam/
Mail Abuse Prevention System (MAPS):
 http://www.mail-abuse.org/standard.html
The Spamhaus Project:
 http://www.spamhaus.org/

Next Month
Microsoft Windows Small Business Server 2003

This is the latest offering from Microsoft that is designed for the Small to Medium Enterprise. Being the fourth release of this Server which, as we all know, means they should by now have had time to learn from their mistakes and produce a nice stable product. Fortunately, they didn't let us down with SBS 2003 - it offers many features that can help your business realise its investment in technology, and help make technology work for you.

Next month will be the first in a series of articles explaining the features in Windows Small Business Server 2003 that you can take advantage of to make your business run smoother, and give you more control over your data.
 'Tis the season to be jolly

That's right - the summer storm season is on the way, so it is time to be jolly sure you have adequate protection from the havoc this time of year can wreak on electrical and electronic equipment.
No-one really enjoys spending their holidays in front of the computer trying to recover data that they knew they should have backed up. Well, no sane person does, and we'd like to think you are a sane person. Saner than us, that's for sure. :)

Next month we will present you with some options that can help give you peace of mind. And its not only peace of mind about your business computers - most of us now have home theater systems that we have spent far too much money on and also a home computer that we'd prefer didn't fry itself.

Signing off
With a redesigned website, this newsletter and also an office relocation now completed, and with the sweet smell of rain still in the air, it is time to sign off for this month and get stuck into other things.

Speaking of an office relocation, please note that our new phone number is 07 3344 3889 - similar to our old one, but not the same. Please amend your records to include this new number.

The team at Quark IT trusts that you continue to enjoy life, and reminds you that we are here to help you get the most out of not only your computers, but also your business. We want to see your business work for you, not just you work for your business.

You are receiving this newsletter because you have an existing relationship with Quark IT. If you no longer wish to receive the Quark IT newsletter, please click here. Please email us if there is anything you'd like to see us cover in future newsletters.