Security

As mentioned before, I will finally get the whole delphij.net out from beastie.frontfree.net because I will be finally graduated from the university and hence I must give maintainership (at least the principal maintainership) to someone who still live in the campaus so they can better solve problems encounted with. Well, I missed the post so much, as I have acted as principal maintainer and security officer there for more than three years: I became the security officer in 2000 when I joined the Association of Computer Machinery at School of Computer Science, Beijing University of Technology because nobody else in my grade can operate a Linux box :-)

http://neworder.box.sk/newsread.php?newsid=10436

Gibe is still the first place, and MyDoom(here, it was called Worm.SCO.A) drastically dropped down.

beastie# bzcat maillog.0.bz2 | grep INFECT | awk ‘{print $8;}’ | sort | uniq -c | sort -rn
181 (Worm.Gibe.F),
86 (Worm.SCO.A),
2 (Worm.Dumaru.Y),
1 (Worm.Sobig.F),

The hardware of beastie.frontfree.net (this machine) seemed to be endsuring some problem. Today, I have completed several improvements to mitigate this situation.

Gibe and its variants are still dominant, and MyDoom is approaching to catch up:

beastie# cat drwebd.log | grep infect | grep MyDoom | wc -l
243
beastie# cat drwebd.log | grep infect | grep Gibe | wc -l
257
beastie# cat drwebd.log | grep infect | grep -v Gibe | grep -v MyDoom | wc -l
0

It’s interesting that there’s no viruses without a name “Gibe” nor “MyDoom”…

Thanks junsu and I have got a copy of MyDoom now.

Its MD5 is: 39A7D2BB 5652C9D1 05C0D64A 640C5A9D [UPX unpacked]

Unfortunatelly he said it’s not valuable to research it because a previous analyze done by his colleague indicates that this is not a “skilled” worm.

I’ll keep this for some time. For security reasons I have denied my own execute privilege of that file.

From my Dr.Web log, it seems mydoom is getting its peak. Today it replaced the Win32.HLLM.Gibe.2, to be the king of virus on my mail server :)

It’s to my interest that the virus seemed to be < 32K. So if you have a sample, please send it to me (REMEMBER: Please encrypt it by adding a password in your ZIP or RAR archive, so I will be able to receive it without having the DrWeb to block it.)

What I concerned has finally happend. nectar committed a patch to cvs without (in my view) maintainers’ permission.

Theo de Raddt has pointed out that the /dev/crypto testing program in FreeBSD, like in NetBSD, was derived from a test program which he never published with a free license. It has now been deleted from the NetBSD tree as well.

Robert Watson wrote:

Please welcome Colin Percival, our newest src committer. Colin has been using and abusing FreeBSD for several years, but in the past couple has produced “FreeBSD update”, and a host of bugfixes and changes from that work. Colin will be picking up his own PRs to merge, and picking up some others. Let this be a lesson to you all: no good deed goes unpunished. I’ll be his mentor.