Worms Prove Passwords Do Matter

Security experts and overworked systems administrators for years have implored users to pick hard-to-guess passwords and to change them often. But many users persist in using their names or children’s birthdays as log-on credentials, and two recent worm outbreaks have shown why that’s such a risky practice. Deloder, the latest worm to hit vulnerable Windows machines, and a version of Lovgate both use a list of common passwords in an attempt to compromise computers. Lovgate began spreading in late February, while Deloder just appeared on the scene last week. Although neither worm has spread as far or as fast as threats such as SQL Slammer or Code Red, both Lovgate and Deloder clearly illustrate the danger inherent in lax security policies. In Deloder’s case, the worm tries to connect to random Windows NT/2000/XP machines on TCP port 445, normally used by Microsoft Corp.’s Active Directory. It then looks for network shares on the remote machine, and if it finds any, it tries to copy itself to the shares by using easily guessed passwords to gain access. The worm also installs a Trojan horse and a utility for executing commands on remote machines. Lovgate behaves in a similar fashion. It spreads from an infected machine using the MAPI Windows functions by answering recent mail with an infected reply. It then tries to copy itself to network shares and their subfolders. If the folders are password-protected, Lovgate tries passwords such as “admin” and “123.” Full Story