First impressions count when the world is taken by surprise by an exciting new (macro) virus
- Reference: 1584950916
- News link: https://www.theregister.co.uk/2020/03/23/who_me/
- Source link:
Today's tale of oops comes from a reader we'll call "Sam" in order to protect the identity of the woefully foolish. Not that Sam was at fault here. Quite the contrary...
Our story goes back to the 1990s, when Sam was beavering away as an avid Microsoft Word user, writing engineering standards for a contract engineering company.
While insisting that he doesn't, and has never, worked in IT, he told us: "I had a few nifty macros sorted to fix up formatting on the documents to the required corporate standards."
There were also some macros to "do a few other wacky things I needed from time to time."
The words "macro" and "Word" will have sent shudders down many an IT administrator's back. While hugely useful, the handy bits of script were also regularly abused by miscreants, particularly as Visual Basic for Applications put in an appearance and allowed all manner of naughtiness to be achieved.
Users, however, loved their timesaving macros, even as IT departments and antivirus vendors struggled to keep up with the new attack vectors.
"One day," said Sam, "my macros stopped working and the menu system looked... odd."
A normal user might not have spotted it, but Sam spent his days elbow-deep in the guts of Word and swiftly identified the culprit.
The infamous CAP macro had found its way onto his system, copied itself to the default template, disabled the Tools menu "and generally made itself a pain to remove."
While not particularly destructive, this variant had copied itself into every document Sam had opened.
"This was very much virus-like behaviour," he said, "so being a good little minion, I reported it to our IT department.
"They informed me that it was NOT a virus, since their virus detecting software had picked up nothing."
Sam noted the retort, but still pottered around all the PCs in his department to scrape the nastiness off them and made sure his colleagues knew how to do that same.
He's right – a person this helpful certainly does not belong in the IT world.
The IT team eventually caught up and "a day or two later there was an email sent round to all users informing them of the CAP macro virus that," Sam said, without a hint of sarcasm, "the IT department had discovered that morning, with instructions on how to get clean."
By then it was too late. One of Sam's colleagues in another department revealed that he'd had "contact" with the outside world and sent out a file festooned with the virus.
The content of the document? His CV.
"First impressions..."
Ever been the canary in the virus coalmine, only to find your warnings ignored? Or unwittingly unleashed macro horror upon the world? It is time to make your confession to the sympathetic vultures of [2]Who, Me? ®
[1] https://www.theregister.co.uk/Tag/who-me
[2] mailto:whome@theregister.co.uk
Warnings ignored?
This is IT. Our warnings are always ignored. About everything.
Re: Warnings ignored?
I believe in this story it was the IT who ignored the warning.
To summarise (with and without recent events in mind), we all ignore warnings. And we know how to deal with them: [1]Four Stages Strategy
[1] https://youtu.be/nSXIetP5iak
Re: Warnings ignored?
Yes, in the story it was IT who ignored the warning. However, ElReg posed the question to us commentards, many of whom are in IT (or so rumo(u)r has it).
Re: Warnings ignored?
many of whom are in IT
Darn, I always wondered why El Reg has all this IT stuff once I leave Bootnotes...
Re: Warnings ignored?
Why would you leave bootnotes?
Re: Why would you leave bootnotes?
Simple, one note has a big L and the other a big R.
Warnings ignored? Be warned of both possible and probable consequences/results.
To summarise (with and without recent events in mind), we all ignore warnings. And we know how to deal with them: [1]Four Stages Strategy ..... Evil Auditor
Elsewhere though, there are surely myriad alternative arrangements also easily employed whenever the problems/vulnerabilities/opportunities one sees and advises and/or warns everyone about, if such things are not heeded at home for all manner of necessary administrative system executions and engagements, which automatically migrate them from what would be a barren brown field site to any greener foreign land.
There to rest and be considered for future overwhelming advantageous use which could easily be construed by an enemy opponent or bested competitor as flagrant wanton abuse, which it might very well be.
[1] https://youtu.be/nSXIetP5iak
Re: Warnings ignored?
> This is IT. Our warnings are always ignored. About everything.
Is that a warning?
Interesting, but another which is closer to "on call" than "who me?" - perhaps "why me?"
Perhaps I don't get the purpose of "who me?" but I thought it was a place to fess up about something you did wrong (and got away with) rather than things you did right...
Re: Interesting, but another which is closer to "on call" than "who me?" - perhaps "why me?"
Maybe El Reg commentards are just so good, there's just not enough cock-ups to write stories about!
;)
Re: Interesting, but another which is closer to "on call" than "who me?" - perhaps "why me?"
That sounds more like Computerworld, where Its Shark Tank column has had to resort to only 4 postings a week, instead of it previous 5.
It seems almost the entire world ignores warnings
Just look at the coronavirus situation
Re: It seems almost the entire world ignores warnings
The corona virus warnings are ignored because the general public are tired of listening to the WHO crying wolf year after year, coupled with the fact that everybody knows that the government always lies about everything to get re-elected, and the News over-sensationalizes everything to sell bog-roll, tampons and beer. It's as simple as that.
Re: It seems almost the entire world ignores warnings
We dodged a genuine bullet over SARS only with a huge effort. Those countries which were hardest hit by SARS have responded better than those which weren’t like here in the UK. I know someone who worked in the building next to the affected Toronto hospital with connecting corridors. They closed the connections and mandated which doors they could use.
With SARS symptoms correlated with infection which moved fast so monitoring the temperature of travellers worked. Covid-19 takes its time producing symptoms, 5 days seems normal, meantime you are spreading virus. Many have only mild cold like symptoms, some have none at all and become super spreaders.
The death rate from Swine Flu went up but the effect was blunted by vaccine rollout. It was the first flu after I stopped being able to have a flu vax (allergic reaction) and I got it. It literally knocked me flat, I didn’t have the energy to sit in a chair. I HAD to lie down. But it left my asthmatic lungs alone.
Your insouciance and that of others like you is based on ignorance. Those ‘scares’ were genuine emergencies which were blunted by huge medical and scientific efforts. I’m a Biomedical scientist so I understand this. Wise up. The WHO doesn’t scaremonger. Sometimes it is too slow to get going.
Re: It seems almost the entire world ignores warnings
to sell bog-roll, tampons and beer
Yep, it's all down to a perfidious cartel of bum-wad manufacturers. Of course. I can't believe the sheeple don't realise this.
Again, Word 6.0
Word 6.0 was not only the first version of Word that was Windows only (Word 5.5 ran on MS-DOS) but the first that allowed the use of macros.
Yet the thing was just too useful to not use. And while most people didn't need macros, Microsoft made the stupid choice to enable them by default.
Re: Again, Word 6.0
Around the time of word 6.0, I was doing stuff for a significant UK engineering company.
Both the CAD software and the Finite Element Analysis (I think?) software had the capacity to save and load the models as a plain text file, though with differing formats.
In order to convert CAD models from the design software to the analysis software, the official process was to export into plain text, load that into word, run a word macro over it which did the format conversion then save it out again to be loaded into the FEA system... It wouldn't surprise me if they had some sort of airgapped machine still running word 6 in order to still do this...
I Love You
... anybody remember that?
Re: I Love You
Ah yes, the first digital virus that got MASSIVE thanks to e-mail and Microsoft stupid idea of hiding file extensions by default.
Re: I Love You
One of the first times - but far from the last - in which my life was made a lot easier by being in Western Australia rather than the eastern part. By the time we rocked up to work that day, our IT people in the eastern states had already slammed the gates and sent out emails explaining the issue, and giving us clear directions on what emails to delete unopened.
These days I work for a company that has its headquarters (and IT staff) here in the west, so we don't have that exact protection, but then the automated filters are a lot better these days, as well as all the anti-macro protections that have been put into place since those days of course.
The main threat for us now is phishing instead, but I've had far more fake phishing emails from our cybersecurity partner organisation than real ones. It's easy to detect the fake ones: I do a DNS query for the domain name in the link, then do a lookup on that IP and see if it belongs to our cybersecurity partner.
The ones I thought might have been real have so far turned out to be genuine emails from partner organisations. For some reason some organisations think it's acceptable to send you a "Welcome to our portal" link without any warning. That one turned out to be from the firm that was doing our audit - we'd changed auditors since the previous year so I didn't recognise the domain. I never wound up using the portal anyway; I just emailed stuff to the individual auditors.
Re: I Love You
And I feel the need to confess my passing on of that virus once. In my defense, I received an infected email from a lady I was courting at the time so I had no reason to think anything amiss. Still, hindsight etc etc.
Something which cannot be denied nor avoided and effectively ignored for any short length of time? *
Ever been the canary in the virus coalmine, only to find your warnings ignored? Or unwittingly unleashed macro horror upon the world? It is time to make your confession to the sympathetic vultures of Who, Me?
Well .... I would just have to say there is voluminous evidence which more than suggests certainly yes and yes again and often. It is though apparently quite normal in spaces and places entertaining humans and par for the course in novel virulent environments.
* 'Tis the vital incorrigible nature of the beasts unleashed/daemons servered.