Back Orifice is back and it's badder than ever
|
|||
 | |||
|
Advertisement: |
Yes, I did it again. I flew 3,000 miles to Las Vegas' eyeball-searing summer heat to go to the Def Con 7 hacker convention. In attendance: three thousand hackers, National Security Agency minions and corporate security types, all sucking down $1 Heinekens 24 hours a day. The focus of this gala event: the release of Back Orifice 2000.
The guys from the Cult of the Dead Cow (CDC), which brought you the original Back Orifice last year, have updated their creation, which the CDC modestly calls "the most powerful network administration tool available for the Microsoft environment, bar none" (www.bo2k.com/indexwhatis.html).
The CDC's raison d'etre is to exploit the lack of security in NT and Microsoft products in general. The group says the original Back Orifice and Back Orifice 2000 are merely remote administration tools, but many security professionals swear that the creation of Back Orifice 2000 is even more of an attack on organizations.
At Def Con, the CDC put on a rousing show and talked about the great new features that Back Orifice 2000 boasts. It now works on NT rather than just Windows 9x boxes and has a mode that can make an NT machine look like it has gone to the dreaded Blue Screen of Death. In reality, the target machine is processing in the background, under the control of whoever infected it.
The CDC also added additional encryption facilities that are supposed to make the program harder to detect. But the most notable news is that the group plans to make Back Orifice 2000 open source, meaning the source code is free to anyone. Expect dozens, if not hundreds, of copycat versions of Back Orifice 2000 to appear. Hackers will modify the code just enough, they hope, to avoid detection by anti-Back Orifice products. More than 300,000 copies of the original Back Orifice were downloaded. If even a small percentage of those same folks download Back Orifice 2000, make modifications and distribute them, we could see serious problems.
What can you do? You could go to a whole rash of hacker Web sites and download various anti-Back Orifice 2000 products. That would be really stupid. Many of them merely infect you with Back Orifice instead of protecting you. Your best bet is to go to a legitimate vendor, such as an antivirus company, and get the updated signature files, which are capable of detecting and eradicating Back Orifice 2000.
However, if there is a whole slew of polymorphic versions of Back Orifice 2000 floating around out there, your job becomes a lot more difficult.
How often will your antivirus software vendor update its software? How often will you update your anti-Back Orifice 2000 software on your servers and desktops?
Since Back Orifice and Back Orifice 2000 generally infect systems through an e-mail attachment, what changes to your current e-mail policy do you need to make? Will you allow attachments from outside the company to come in, and if so, from whom? Will you go the extreme and forbid attachments? How do you educate your users quickly? Do they open e-mail attachments from people and e-mail addresses they don't know? How about allowing only e-mail attachments from within the company?
I have heard rumblings about a lawsuit against the CDC. One group that does not want to be named is thinking about a civil proceeding under the premise that Back Orifice 2000 is essentially only harmful and, therefore, its creators should pay for damages. The other noise is from law enforcement, which is thinking about charging CDC members under the Racketeer Influenced and Corrupt Organizations Act, and conspiracy to violate almost every computer crime law on the books.
The CDC wants to make a point: Microsoft makes lousy products and it is up to the hackers to make fools of Redmond in public. Microsoft, security vendors and corporations see it differently: They maintain that the CDC is just trying to legitimize hacking under the guise of professional network management.
No matter which story you believe, you are going to have to deal with Back Orifice 2000.
RELATED LINKS
