Slashdot Mirror
Fight Virus With Virus?
Insanik writes "I am not an expert with internet worms like Code Red. However, I am curious if it would be possible to create a friendly worm/virus/whatever that would fight the original by using the same security holes. For instance, I read that Code Red II opens a back door. Why not have another virus that exploited the back door, closed it, then started sending itself to other servers for a certain period of time? " The submittor raises an interesting question - is this possible? I would guess so, in theory. And while we're working on Code Red, can we send a large man to the home of my latest Sircam senders and politely "ask" them to stop clicking on virii?
FYI, I have a normally reliable Cisco 675 router that Was repeatedly being infected with Code Red, requiring a reboot each time. Here's the easy fix:e d-worm-pub.shtml for more, and check your ISP's web site for the actual patch.
1) From the "cbos#" prompt*, input the command "set web disabled". I think you'll have to follow that up with the "write" command. That shuts off the router admin web-interface. If you really must have that interface, you can change the port instead.
2) Upgrade the CBOS to version 2.4.1. See http://www.cisco.com/warp/public/707/cisco-code-r
Hope that helps...
*Note: to get to the "cbos#" prompt, input the command "enabled" at the "cbos>" prompt.
This is like saying that a certain amount of rape is inevitable, so lay back and enjoy it.
.. more violently .. pick your poison, but eye-for-eye almost always leads to revenge worse than the original crime, even if it is in the name of authority.
.. sure, some of the viruses will help fight malicious ones, but after awhile, it will be difficult to tell just who the white and black hats are. Nevermind that the popularization of viruses for the cause of 'good' will start masquerading about for various personal causes; ie, the 'good' virus that only attacks 'hell-bound' porn sites, or 'good' viruses that only attack sites which endorse gay rights. (Well, of course, these types of attacks and viruses already exist, but legitemizing the distribution of viruses would only allow these authors to claim they are writing 'good' viruses.)
.. for good."), nor figure in the cost of 'good' viruses written improperly, and subsequently causing as much damage as the 'bad' viruses they seek to purge.
/. tradition. I'm just saying, there are other ways to fight viruses .. such as forcing a certain software maker to fix the pieces of swiss cheese they call web servers and mail clients, or condemning friends and family for not practicing caution when being online.
No, it's like saying a certain amount of rape does not justify raping the rapists (otherwise we could just allow rapists-to-be to get their jones off raping rapists (of their gender preference of course)). I realize that sometimes we are stuck between a rock and a hard place when dealing with miscreants, but the power to commit acts deemed illegal at the behest of authority leads to corruption - family and friends of those in charge of supervising the counter-rapes would no doubt get first shot, rape harder than the rapist did, longer
I support community action more than the average individual, but there is a very important distinction here: community action is only warrented when the action is to stem abuse and corruption AND the adversary does not make themselves avaiable to a dialog; and even THEN, only if they refuse to aknowledge that a large enough opposition to their behaviour or ideals should result in change.
I do NOT support community action to fight violence. Why? People are not responsible enough to recognize the difference between revenge and problem resolution. When it comes to the moment when you're smashing the bat over some dissident's head, you're probably not thinking about whether or not said dissident will continue their actions (in this case, continue writing bad viruses), but rather how much the dissident had this coming to them. And since you've lost sight of the goal, no resolution is likely to come from it. Same goes with white hat viruses
All this is notwithstanding the fact that you'd raise awareness of how to write viruses (I'd imagine you could easily publish a book "How to get into an IIS server, and spread
Unfortunately, mentalities like yours seem to prevail. People lack the tolerance and foresight to see that sometimes the eye-for-eye cure, no matter how self-satisfying, can cause the problem to reach levels of magnitude far beyond that which it would have reached had resolutions be seeked IN OTHER WAYS.
Incidentally, there is someone on our street with cracked windows. Despite this, everyone else seems content to continue to take pride in the appearance of their dwelling; the lawns are mowed, and the flower beds are gorgeous. If the motivation for behaviour was whatever the lowest common demonitor was, we'd have never gotten out of the stone age. I should hope that the sole motivator for maintaining some sense of responsibility, dignity, and self-control is not that others HAVE to do it to. I could list hundreds of examples, from j-walking to litter in which the only reason they havn't reached catasphoric levels is because SOME people take it upon themselves not to contribute to the problem, even if there is little chance of being punished or caught. Even if littering and jwalking were legal, I'm positive a significant portion of the population would continue respecting others' environment and traffic flow.
A please notice I never once suggested we 'lay back and enjoy it', although I suppose drawing judgemental conclusions out of posts has long since become a
"Old man yells at systemd"
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
My approach would be educate in a real-world situation. If someone has too much time on his hands and wants to do this, well here's a suggestion:
:)
Lock the screen in black, disable ctrl-alt-delete on any OS, and type this a bit below average reading speed in white:
"Boo... I'm a virus, you know what you did was really dumb?... You're lucky this time, you will lose no data, I won't send anything critical by email without your knowledge, and your operating system will stay intact... in exchange you'll have to bare with this message for a few minutes.
Clicking on attachments in your email when you don't even know where it comes from = Stupid.
Clicking on attachements of which you don't even know the extension = Dumb.
Opening a file that you don't know about in your [download] directory = Asking for trouble
Did you know that running an operating system without updated antivirus file, or without antivirus at all is bad when you're a rookie? (you ARE a rookie since you are reading this, please don't consider yourself bright or IT-man 2001 because if you ARE actually working in IT, you're even dumber than a rock, reason #1? a rock wouldn't catch this virus)
If you typed CTRL-AlT-DELETE anytime while this was displayed, you diserve to be wiped and bitchslapped you selfish log, if you don't care about the damages you can get, think about the damages you can create by spreading your stupidity?
Now find a way to remove me, else I'm gonna repeat this every xx minutes, and in the end, I might actually end up doing something bad.
Regards, retard!"
howzat?
--- Metamoderating abusive downgraders since my 300th post.
you have about 600 anti-virus viruses on your server you don't know about some of which were poorly written leaving the admin to weed out the cpu hogging, mem leaking, anti-virus viruses.
Photos.
If you are in a dark alley somewhere, and there is one other person, and he draws a gun on you, indicates an intent to harm you, you have the right to use your weapon ONLY IF that is your last resort. And I won't even go into the notion of the "danger to life and limb" that is present in that scenario, but suffice it to say that generally speaking, you can do things you can't otherwise get away with if it's for the purpose of saving a life.
When it comes to your web server, nobody's going to die if you get defaced, rooted, bent over, etc. It costs some money to fix, ok, but that does not give you carte blanche to break the law at a similar level. Keep in mind that nearly every law that outlaws hacking is based on "unauthorized access." It doesn't matter WHY you're doing it, just that you know you're not supposed to be there. And if you're basing your code upon a notorious worm...well...good luck trying to say "I didn't know!" :)
Final point, you have other options. Keep up with your patches. Install IDS and watch the logs. Yes, this takes work, but so does writing a counter-worm every time a new worm comes out, and at least this way you can be protected BEFORE it hits, not after. And if all those Code Red-nailed boxen are knocking any of your systems offline, I gotta tell ya, you need to do something about your network, because as severe as the scanning is, I haven't heard from a single client who has actually had downtime from it.
For your security, this post has been encrypted with ROT-13, twice.
What about just disabling the viris as a response to the scan? As Code Red boxes advertise themselves as infected and vulnerable, you don't need to probe the net for infected/vulnerable computers. Besides, releasing _any_ scan-and-infect worm on the net is a bad idea.
Is automatically patching someones box for them (as compared to infecting it) a valid form of self defence? I can't see being sued for it.
If you wanted to go a little further overboard, you could install a defensive-response worm in response to an attack. It would only spread as far as the origional infection and place minimal load on the net.
-- http://thegirlorthecar.com funny dating game for guys
The problem -- as many knowledgeable folks have already reported -- is that admins are reluctant to update production servers, because of the fact that such updates can and do break those systems.
Do you really want to rely on Microsoft's updates to be reliable and correct? Updates are best installed on test servers and then migrated to production systems. The fact is that once an exploit is discovered, it typically takes several months for destructive software to be released that takes advantage of the export. Code Red came out much quicker and that has caused many of the problems we are witnessing.
www.timcoleman.com is a total waste of your time. Never go there.
Is it possible you accidentally left your sense of humour and response to irony in your other pants?
He probably hates me because he's not circumcised. [grin] With my .sig, I get irrational stuff like that every now and then.
Fire and Meat. Yummy.
How about instead just writing a program that sends e-mail to the offending system every time it makes an attempt to infect your system. That way, you're only notifying them of the problem (each and every time it occurs), and they'll be obliged to do something about it before their e-mail logs fill up.
GreyPoopon
--
Why is it I can write insightful comments but can't come up with a clever signature?
In other words, what you do may be ethical, that doesn't make it legal. Using the same methodes as a virus to gain access to someone's computer is not legal. It doesnt matter if you are trying to defend againts a virus, it's still illegal.
:)
Criminal law guarantees you a trial by your peers. It is not illegal if your peers will not convict you. Here is an example: I knew a fellow in San Francisco who got AIDS as a long-time drug user. He nearly withered away and died. He started smoking pot at the advice of his physician even though it was illegal at the time. He was arrested numerous times, but never convicted of smoking pot.
You see, a jury of San Franciscans will NEVER convict someone with AIDS of smoking pot to boost their appetite. My friend gained a lot of weight and probably lived another 2 years as a result of pot smoking.
In the case of CodeRed anti-virii, you would need to have a reasonable argument that your actions were justified as bettering society on the whole. If you don't think such an argument exists, I wouldn't recommend writing it
Your analogies aren't valid, because you're talking about cases where there is the threat of physical harm to an actual person. The Code Red virus is annoying, and it's causing major problems, but it's not going to kill anyone, and it's not going to permanently damage your system.
I disagree. CodeRedII is going to permanently damage your system. It is the equivalent of AIDS for computers - if completely knocks out your defenses, but doesn't cause any harm itself.
People with AIDS do not live very long. Neither will computers with CodeRedII. They are remote-rooted by anyone accessing the httpd port.
Also, you neglect to make an analogy between financial harm and physical harm, perhaps on purpose. Both are justifiable legally.
If you attack someone else's machine, then you're on exactly the same ethical level as the person who wrote the original virus.
THAT is a flawed analogy. Whereas it may not be appropriate to kill someone for committing murder, using an anti-virus to shut off machines with CodeRedII is completely different. The machines are compromised and vulnerable.
Imagine you are a business owner, and someone came along, opened the doors to your store, didn't take anything, and left. Are you trying to claim it would be illegal for me to close the door, and place me on the same level as the first person who opened the doors ?????
If you do believe that, please put down the crack pipe and back away slowly.
I would like to point out that many if not most of the machines that are still being infected by the Code Red worms are operated by users who are not even aware that they are running IIS.
Case in point, my roommate bought a Dell Dimension L700cx with Windows 2000 about 6 months ago. He was surprized when I showed him that his machine is running IIS and serving the default web page on port 80. This person did nothing to install or activate IIS, the machine was shipped with that configuration.
I think this fact is important to keep in mind when trying to understand why so many machines remain vulnerable to the IIS attack.
PS: We run our LAN behind a firewall that denies port 80, so my friend's machine was not infected.
It already happened about 15 years ago or so... it was called "Vacsina" and actually cured 1701/Cascade, 1704/format and Jerusalem, if I recall correctly. It was even auto-updating: different vacsina versions would recognize each other and the most recent would overwrite the older. Sadly, a few "nasty" strains came out too....
Vacuum cleaners suck. Kings rule.
The Cheese Worm seems to constitute exactly what you want. Cheese actually sought out Linux hosts infected by the Lion worm and removes any backdoor root shells from /etc/inetd.conf . Some say the Cheese Worm constitutes the first hack-of-a-hack known.
Another first for Linux and Open Source software!
Yes but you don't get to decide who is a "danger to yourself or others". A judge has to do that.
War is necrophilia.
Ah, but we (as a society) do legally require people to get vaccinated, because doing so benefits society as a whole sufficiently to justify the slight loss of personal freedom
Not so slight in the case of MMR vaccine which has caused much of the increase in autism cases lately.
Getting back to computers, what about where the anti-virus-virus causes inadvertant damage to the system because it has an unusual configuration, different software, etc. So instead of fixing the webserver, it utterly kills it. That could happen very easily if you binary patch even a slightly different version of the executable than you were expecting. Then what?
Just because it CAN be done, doesn't mean it should!
The first such anti-virus virus, Den_Zuko, was discovered in 1988. Check out this article on VNUnet, which has more info on the history of such software and why it's a bad idea.
More recently, the Linux.Cheese.Worm has done similar things for Linux users infected by the Linux.Lion.Worm.
++ Say to Elrond "Hello.".
Elrond says "No.". Elrond gives you some lunch.
It might be possible to make a program that, given a sircam-infected file, would send something to the originator of the message. It could send a message with an attachment that looked for sircam, and, if it found it, removed it and installed the program. That way, it would take a sircam-infected machine and make it respond to future attacks by spreading to the originating machine but do nothing to anyone else.
The message could even say that was what it was doing.
"My advise is to run this script to remove the virus and to pass the information on to other people"
This wouldn't really be a virus at all: the people receive it in response to a request for advice and it is something you actually think they should be running. It doesn't try to infect other machines, except by advising their users to use it; no more illegal than Norton responding to a download request with a program.
Why do schools neglect an ethics curriculum?
Your solutions should not affect the state of the infected machines. Even if you could "fix" their machine. Even telling them that their machine is infected is over the line, if you're using their machine to do it.
If you're being hampered by Code Red hits, make a script to firewall off every infected computer for a day. Allow those firewalls to expire, and if they're still infected, they'll get blocked again.
- "Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety." -- Benjamin Franklin
Yeah, that means you. You're giving up liberty-- not yours, but theirs. If you're messing with someone else's machine, you are part of the problem. No matter your intentions, or how nicely you word the "message" you deliver onto their desktop. Just don't touch it.If you're going to call it a virus, think of the influenza virus. A medicine is widely available on the market. It is up to the infected party to take the medicine, and it would be unethical to sieze the unwitting victim and force the medicine into their bodies.
It's just a small problem, and in a month, people will just roll their eyes about the terrible outbreak. The best thing to do in a storm is to shelter yourself until it passes, not to rage against the howling winds around you.
[
Find infected machines and popup a warning Window on each machine telling them they're infected.
I don't agree with doing it whatsoever, but that would wake up a lot of sysadmins.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
It's understandable in some ways. Say, for example, someone pulled you off the street into their home and shot you. It's your work against theirs that you didn't break in, and you're dead.
I'm the big fish in the big pond bitch.
When all you have is a hammer, everything looks like a skull.
A good idea? Absolutely not.
Part of the problem with worms isn't just the malicious acts that they perpetrate, it's the bandwidth that they use.
A particularly virulent worm can bring servers and routers to their knees just propagating itself. That's before it even gets the chance to do any of its intended damage. (Remember Melissa, or The Great Internet Worm?)
Add to this very real concern the fact that striking back in this way, no matter the good intentions, is almost certainly illegal, and the whole idea is a definite no-no.
(Yes, it does have a certain appeal - but so do many other things that are bad ideas, too)
Cheers,
Tim
It's official. Most of you are morons.
A K5 user has provided the source to a proposed code-red anti-virus, which actively repairs remote systems infected with the code red virus. The legal implications of this are a bis issue, but it's certainly an interesting code example.
--CTH
--Got Lists? | Top 95 Star Wars Line
Which is excellent justification for killing him, burying the body in some remote location, cleaning up the mess, and denying everything. ;)
Meldroc, Waster of Electrons
Hey, who said my Perl skills were anything other than sub-stellar? That's the nice thing about Perl - you don't have to be any damn good to write useful little bits of code. :)
I'm trying to arrange for space on a relatively ./ proof server right now and should be able to post an easily hackable version of the script there soon. I'll post the URL when it's sorted.
I would be a paid subscriber if Taco and Hemos weren't such cunts
Why not take the Symantec Sircam cleanup utility, patch it to make it self-propagating, and then e-mail it out with the message "Hi there! I send you this because you're a stupid fscking idiot. :)"
Got Rhinos?
Personally, I feel a virus is a virus, regardless if your intentions were good. You're not any better than the hundreds of losers out there creating this mess. If you want to warn me of security holes in my system, send me an e-mail that doesn't contain a virus.
there are no stupid questions, but there are a lot of inquisitive idiots
- The morality aspect - you are "taking control" of someone elses hardware/software
- The legal aspect - this still constitutes "cracking" as you have illegally gained access to a computer system that is not yours. Breaking into someones house is not OK just because you only intended to do their dishes.
- The practical aspect - the worst side effect of internet worms is not primarily damage done to the infected systems, but bandwidth consumed and resources depleted as a result of the worm spreading.
I don't know of any real-life implementations of this (I somehow have the feeling I have heard of it, but it escapes me right now), but the concept has been debated at length during prior "worm attacks". There are probably many other reasons why this is not a good idea, but I think these are the most signifficant.^]:wq!^M
I don't see how it could be a problem, I mean, logically only something like a DoS attack or the like can't be "undone". If it's a bug in the individual system then it should be able to be fixed. The problem arises with the media stigma of a virus.
Now this just goes right back to the whole "but I thought a virus was bad" response that your typical user will tell you. For the most part, it could work wonderfully, but the big thing is, the only people who will need it are those who did not patch a system for the bug (since if they patched it, then the retrovirus (if you will) will not be able to use the same vulnerablilty). Those are most often the same people that opened 40 SirCam attachments even though they were warned ("But it came from my best friend!"). To these people, a virus is something to be afraid of, regardless of purpose. A virus is always a bad thing that will "break the computer" and we don't want to "break the computer" because we can't "fix the computer" <Cue ominous music>
But then again, if these people are so oblivious as to how they're infected, then it just may work as long as the media doesn't blow it out of proportion again.
- Relativistic? That's barely Newtonian!
Is this part of the problem?
I have a friend who works for a company that's doing just this. They are funded by the government to write intelligent agents ("agents" in the sense of mobile code) for security purposes. So rather than merely setting up a firewall, the goal of this is to write software that can move from machine to machine, like a virus, and stomp out viruses, trojans, and fight off other attackers.
Call it a white blood cell.
So is developing a counter-virus, an antibody, a white blood cell being part of the problem? I don't think so. Once a computer's been hacked, it's already been hacked. It's already been violated. If you don't want people to write counter-viruses, for heaven's sake, don't let you computer get infected in the first place! Viruses are preventable.
You'll find plenty of cases where a criminal harmed by a victim who was protecting himself has successfully sued for damages.
I'm the big fish in the big pond bitch.
Although this is probably an urban legend, I have been told of someone to whom SirCam emailed Windows XP RC1. So yes it is theoretically possbile ;)
Remember the DirectTV anti-hack on the hackers? Seems like this is the same idea. Anti-virus the virus...
Hey, if it worked for DirectTV, it should work here...
Actually, this may start a "best of the best" competition with virus writers. They'll come back with a virus to counteract the anti-virus, and on and on.... might be interesting...
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
See this link for examle.
check out http://www.cknow.com/vtutor/vtplural.htm for more information...
(rant mode off)
- In Capitalist America, law violates YOU!
So now you have a bunch of viruses, and counter-viruses roaming the net. This is not so bad until you have self-mutating viruses and antigens, several generations down the line. Eventually chaos theory will dictate that the nature of the relationship has become so complex as to be unknowable. This is a pandoras box we don't want to open. It's similar to the human cloning issue, in that there are a lot of good arguments not to do it, but there's one overwhelming argument for making it legal, lincensed and monitored; that is, if it's not legal, those who choose to pursue it will not be hindered in that activity, but will be forced to pursue it without oversight, while in hiding and possible in poorly controlled conditions.
All you can do here is appeal to the logic of those who would pursue such an activity and suggest that they not undertake it, but regardless of how much you argue, convince and suggest, someone will eventually do it and there will be severe concequences - not all negative, but severe, with respect to how we look at technology and how we use it.
It could further be argued that those against such undertakings, need to ajust to changing technology and make the appropriate changes to their world view. This is what the recording industry is having to do, as well as companies in other well established industries. The same will eventually be true of how we look at software design (computer viruses), and biology (human cloning).
--CTH
--Got Lists? | Top 95 Star Wars Line
i live to see the world, be there for my family, and be who i am, but the governement and monopolies sure are good at fudging things up.
Let's also drop the insane analogies comparing this to someone threatening a family member's life. It's just a bunch of computers.
from the bugtraq post:
To: BugTraq
Subject: Infection Notification
Date: Sun Aug 05 2001 10:50:22
Author:
Message-ID:
If you'd like to help us notify users they are infected please send offending IP data to aris-report@securityfocus.com. Please use the following format:
IP ADDRESS DATE/TIME WITH TIMEZONE
Or something similar to this. Please ensure the information is constrained to IP address and date per line as we do our notification automatically and our systems need to be able to understand the data you send us.
--
Elias Levy
SecurityFocus.com
http://www.securityfocus.com/
Si vis pacem, para bellum
---end bugtraq post---
-f
www.blackant.net
I keep seeing people talk about how invading a server in some cases is legal, because "the intent was good". That is an incorrect interpretation of the word intent. Intent only refers to the crime itself, i.e. did the criminal intend to break-and-enter or was it accidental.
This means that unauthorized access in the attempt to do a "good deed" is just as illegal as black-hat unauthorized access.
For this to happen, someone with the antidote virus would have to break the law to spread it and apply it. Of course, Robin Hood was considered a criminal too.
Seriously, folks, everybody who *could* write something like that either (a) recognizes that infecting someone's box is infecting someone's box, closing holes or not or (b) sees no problems in having the rooted boxen out there anyway. I doubt that anybody else actually has the skills to do it.
At work, we had a Lotus Domino server that would crash whenever someone requested an non-existant Web URL from it (don't ask...). As most access to it are done from programs, or from links & bookmarks, this hasn't actually been a problem until recently...
Since the beginning of August it started crashing every hour or so, making it rather difficult to work with. Then, this week it crashed every ten minutes... Initially we assumed that unknowingly a coworker was mistyping an URL, or doing some bizarre tests which crashed it. Then we understood what was really happening: it was CODE RED! Does that qualify as client having downtime due to Code Red?
However, in retrospect, this whole story had a good thing to it: it encouraged the guy in charge of Notes to find out why exactly it was crashing when asked for a non-existing URL... And he did indeed find the faulty config option and fixed it.
Ok, now on the next task: another of our Domino servers crashes whenever somebody enters a bad password into the HTTP password dialog box for protected pages (yeah, yeah, I know...). Now that the weekend is approaching, and the kiddies are putting their final touches onto their new creations, could somebody please include an Authorization: Basic Tm90ZXM6c3V4b3Jz0 into the HTTP headers of the probes of his Code Red III, so that we have an excuse to fix that problem too? ;-)
Say no to software patents.
The problem is that 'self defense' only exists in a situation where your personal safety is at risk - like the above scenario.
It's like asking: If someone is breaking into your house to use your coffee maker, are you allowed to kick down their door and throw away all their coffee?
Basically, you can't violate someone else's rights unless your own safety is in danger.
That seems a bit like overkill. There is an Everything2 node on this subject with some simpler PHP code samples, including (full disclosure) one by me.
Of course, the author can't go around claiming responsability (or posting stories on slashdot), that's not cool.
--
Stay tuned for some shock and awe coming right up after this messages!
Google cache because it looks like the original site has been remove.
I suppose that it would be possible to use the ISAPI filter vulnerability in IIS to get into a system and patch that very same vulnerability. Maybe someone who knows more about this can clarify.
-atrowe: Card-carrying Mensa member. I have no toleranse for stupidity.
Making a worm to fix the worm is just going to create more problems. My main slowdown of service comes from all the ARP requests from the think scanning my neighboorhood.
./ reader) make a CGI script called default.ida that fixes just that machine that tried to attack your server. Make sure it can deal with Code Red 1, otherwise once 2 is dead, 1 will be able to swing back easially to the unpatched servers. Also make sure it sends a bill to the company for "IT Consulting".
Instead, (idea from another
The Fish virus, IIRC, would remove the Stoned/Michaelangelo virus if it was found, and then infect the machine itself.
Further info about the virus is found here from Datafellow's virus database.
> Ethics is religion. Faith is not a Religion. You must understand the difference.
I'm going to have to disagree on this point. Ethics and religion are very different things. They are actually not even directly related to each other. The link between the two is morality, to which both are related. To give an example, it's possible for an agnostic person to act in an ethical manner. Actually, it's possible for any person to act in an ethical manner. It's also possible for someone with a religious ideal to act in an unethical manner without violating his/her religious convictions (the Inquisition is an old example, but it fits, so I'll use it for ease). Religion is a belief system. Morality is a rule set based on the belief system. Ethics is adherence to generally accepted codes of behavior.
And, in response to your second sentence, religion is specifically a belief system. So, while linguistically your statement is correct (one can have faith without a directed religion, such as "faith in the goodness of mankind"), by definition one cannot have a religion without faith.
Virg
I agree. This past monday when i first login, my W2K told me it shut down in 2 minutes because it just installed an anti-code-red. this is itself exactly a virus: executing something without owner's consent...
This past Monday? Wow. I see your administrators take their time, don't they? Or did they wait until they'd been infected to decide that it might be time to take preventative measures?
Fire and Meat. Yummy.
(which you can do manually right now with the worm-installed back door.)
Leave that going long enough, and the infected systems will just keep powering off until the IIS feebs get a clue.
A "white hat worm" of this sort could be made, but its deployment would be just as illegal as the original "black hat worm" it was created to fight. You're still making unauthorized use of someone else's computer. It doesn't matter that you have good intentions. And what if a bug in your code crashes some machines? How do you prove it wasn't intentional, and that your "white hat worm" isn't really a "black hat worm" in disguise?
Apparently, it seems that in the early 1800s, there was a general problem with people smoking too much opium, so people came up with a supposed cure for it -- morphine! Of course in hindsight this wasn't any better than opium, but at least it had a pain relieving effect so there was some medical use for it (and still is). Sure enough, former opium smokers got hooked on morphine, and a new cure was needed. What did we get? Heroin! This was much worse, had no worthy side effects, and has generally been a huge headache ever since. What was the solution? Go cold turkey? Of course not, we came up with yet another new drug -- methadone. This one seems to have the great benefit of not being worse or more addictive than it's predecessor, but that just means that people don't want to stop using heroin in favor of methadone, so while methadone may not be worse, it does little good either.
Like I say, this may not actually be true, but I think it illustrates the point very well. Even if it isn't true, there are still similar examples all over the place -- people that give up cigarettes for nicotine gum, etc.
This sort of suggestion has the same critical flaw: it might look good on paper, but in practice you're just trading one nasty thing for another. Sending out a benevolent trojan sounds like a nice idea, but how do you know that it'll be benevolent anyway? Are you sure it isn't going to be vulnerable to some flaw that will do more harm than good? You've checked all your buffers and are careful in what your program accepts and strict in what it sends out? Moreover, you're confident that, even if it *is* perfectly benign (which, let's be honest, is a tricky assertion at best, and very hard to verify) once it's out in the wild can you guarantee that your code isn't going to get hijacked by someone less saintly or all-knowingly proficient as you surely are?
I doubt it.
These sorts of proposals sound nice but are fraught with danger and likely to come to a bad conclusion, both technically and, let's not forget, legally. This sort of idea comes up every now and then -- K5 is debating it right now, too -- but it's never a good idea and in practice it will never reliably work. It's clever & tempting, but raises more problems than it solves, just like trading morphine for heroin...
DO NOT LEAVE IT IS NOT REAL
I agree that 'stuff' is worth less than a life. However I don't think that's the end of the story.
Some people, to me, are of negative worth. These would be the rapists and murderers. I wouldn't assume someone was of negative worth, but I think the simple fact of finding them in my house without my permission, despite locks, would be fairly strong evidence for that.
Now, I don't necessarily think these people should be killed, but my adversion to killing is sufficiently lowered in those (hypothetical) circumstances, that I would be willing to shoot, if I thought it was warranted.
Now, what is warranted... Tough question. To me, seeing some kid trying to break into your garage isn't. Seeing someone walking *out* of your house with the TV, isn't. Heading the door be kicked down and seeing someone come in, is.
If I could clearly see them and tell they didn't have a weapon handy, I'd give them a warning to leave. If I couldn't, why would I want to risk my life and that of my family, by giving them a warning which they might use only as a chance to duck for cover before going for their weapon?
There's been a rash of home invasions in my area, which often lead to murder. I don't know about you, but my door has never been kicked down, I think I'd assume the worst, and in that case, be willing to defend myself. Any criminal intending only theft should either announce himself "Hey, I'm just here to steal the TV" or risk my assuming that since he broke the door down, he's probably got more sinister motives, given the rash of invasions/murders.
A funny story from where I work. Some guy took the code from the melissa virus and tried to do the same thing. While doing it, he accidentally ran it and set off his screwed up version of it accross our network. Big fun :)
It's like asking: If someone is breaking into your house to use your coffee maker, are you allowed to kick down their door and throw away all their coffee?
That's a great analogy. Mostly because of the image it conjurs.
The enemies of Democracy are
I thought of doing this a few days ago and I started coding. I got as far as a script to automatically reboot attacking machines, to help slow the spread of Code Red.
I had begun work on a worm called Code Blue that would infect Code Red machines and clean them of Code Red. This kind of work is very laborious since it involves writing Intel assembly code that uses the Win32 API and runs in a Windows environment.
Before I could finish, my best friend (who is a security consultant) informed me that somebody has already done this. There is a perl CGI script going around that you can put into your root directory and name "default.ida" so that infected machines will cause it to execute.
The script connects to the IP of the attacking machine, uses the Code Red II backdoor to clean the system of trojanned files. Then it uses the very same buffer overflow exploit used by Code Red to send a binary to the server that patches IIS, removes Code Red-related registry entries and reboots the machine.
I have spent the last week thinking this over, and spent some time coding a test. Working with a known named hole, I ran a vulnerable version of named on a few of my machines.
I obtained some script kiddy code to open up a shell on the alternate machine and started to modify it. Since I have no desire to be assused of starting a virus of any kind, I have no intention of finishing or releasing this, but I want to have the concept proven in case someone with more guts than I decided to release something similar.
No matter how you look at it, I believe that releasing this worm would be illegal, at least in the US where I live. Knowing this, I'm not going to concern myself with legal issues, but with ethical ones. The purpose of this prototype worm is to exploit the named deamon and obtain a shell on the victim computer. Then it will send over a copy of the worm, along with a nonvulnerable version of named.
On the victim's side, it will make a copy of all programs and configuration files it needs to change and replace them with safe versions. It will then send a message to root on that machine explaining exactly what was done and why, how to reverse the changes in case the worm broke something, and what to do in the future to avoid the same or similar problems. The worm will then
find and exploit 256 more systems within the same network level, one in each subnetwork. For instance, if the worm is currently working at the class A level for the 24.0.0.0/8 network, it will try to find one system in the 24.1.0.0/16 network, one in the 24.2.0.0/16 network, etc. Each progression will work one level lower. This will prevent the same machine from being hit more than twice for every pass the virus makes over the internet. After finding 256 systems, the worm will shut itself down and remove itself.
The important factors of this worm is the fact that it will ONLY be beneficial. If it causes more problems than it solves, it will be seen as another nuisence instead of fixing security holes as it is intended. It is important that root on the machine is notified of any changes. This gives the administrator the opportunity to fix other potential problems and if necessary reload the system. There must be a way that an administrator can leave configuration files on the machine so the worm will function in a limited capacity. The machine operator can therefore prevent the worm from making changes although they will still be notified if there's a security risk.
The worm will only search for and detect a single flaw in a single program, and only use that specific program to exploit the system and only replace that single program. Updating an entire package to fix one program may actually introduce other security problems into the system. Programs
deployed on the system should also be either compiled on that system or staticly linked to prevent any library conflicts.
On a side note, the worm might also want to check for a root kit on the machine and notify root if one exists. If the machine has already been comprimised (which is possible if there are vulnerable programs running), then the machine will need to be reloaded and root needs to know about it. Fixing one program won't make any difference.
Am I completely off my rocker here? Comments?
-Restil
Play with my webcams and lights here
Just put up a website on your computer that advertises the ability to automatically clean the CodeRedII virus off of the viewer's system, if present.
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (etc), which then scans the sender's IP and proceeds to start a command session, download the patches, and do whatever else is needed to done to vanquish the worm.
:)
... afterall, they tried to hack your box first. ;)
All the viewer has to do is click a button at the bottom of the screen.
Just so happens that this particular button sends a request to
Afterall, they did click on the link, right?
Seriously though, if someone wants to get all pissy about you going to their box and fixing their screwup, threatening to sue and the like, I'd just countersue
The indexing server is bundled with IIS, and is one of the main reasons for choosing IIS -- searching is bundled right in. Comparing it with "some CGI script" is disingenuous.
It would be fair to compare it with Apache modules that are part of the standard distribution and are usually installed. Care to point out a recent hole in such a module?
Insightful, my foot. The pro-MSFT moderators are busy today.
As a more casual defense, I've written stuff that causes the worm to hang in its receive function: http://robertgraham.com/tools/deredoc. It's kind fun, I've got hundreds of worm threads waiting for me to respond back to them.
You can create benign anti-worms. You can setup a worm to only counterattack when attacked itself. Such a worm would not bother innocents, and would only spread to infected systems, cleaning as it went. In other words, it wouldn't be 'scanning' -- it only responds upstream to infected systems. There are two problems to that approach: the first is that CodeRedII self-DoS itself, so the systems cannot be exploited, either with the .ida attack or the backdoor. The second problem is that a heck of a lot of these systems are behind firewalls, and you cannot directly contact them on port 80 (CodeRedII has been extremely effective about worming its way around firewalls).
You can evade legal constraints. Post the source of your anti-worm to Usenet as an example how an anti-worm is constructed. This is legal free-speech -- as long as you don't encourage others to run it.
CodeRedII is raging inside corporations. It would be extremely ethical to put something on your own machine to help stop it. One example would be a script (CGI, PERL, PHP, ASP) named /default.ida on your system that did something like "/scripts/root.exe?/c+net+stop+w3svc" back at the attacker.
Ehmmm,
For those of you participating in the DOS attack against Securityfocus...
Although, they did not launch a posting to this, in the mailing list they said that they were going to discontinue taking mailings from people.
When I went to get the link for this message I found that they are having a hard time responding to HTTP requests... Perhaps caused by the slashdot community?
Lando
/* TODO: Spawn child process, interest child in technology, have child write a new sig */
this isn't original, a friend found it posted somewhere, but you can call up an internet explorer window with the cert advisory(or the patch for that matter)byt usung the root.exe file. like such: http://the.fckd.up.host/scripts/root.exe?/c+explor er+htt p://www.cert.org/advisories/CA-2001-23.html
this works great for cable/dsl users who might not even know they have a webserver running. kinda tough to ignore explorer windows poping up, even on a MS computer.
I remember seeing a /. blurb about just such a thing. If I remember right, after it invaded the system, it patched a security hole, copied itself onto whatever removable media was in the computer and deleted itself. Unfortunately I couldn't find the article in the archives.
In the meantime, this sort of program is pretty trivial, aside from invading a secured host. I've heard talk in various organizations about writing maintenance viruses to crawl the network's hosts and do whatever updating needed to be done. Such ideas are usually tanked because everyone's a little nervous about independent critters running loose, doing things on their computers. Besides, there are more reliable automated ways to install patches and updates. In the meantime, writing one of these as a good samaritan deed would likely get you prosecuted because, 1) You don't own the computers you're infecting 2)You don't know what the configuration is on the machines and your virus might screw 'em up, 3)What if you missed a bug in your code?
After all, how do you tell a 'good' virus from a bad one? It might be harder than you realize, if you're a virus scanner, for example. There is an article here that deals with some of the other issues that 'good' viruses raise.
Geeky modern art T-shirts
With the internet, this is a greater danger because the number of machines is much larger...
LedgerSMB: Open source Accounting/ERP
While what you say is factually true (spoofing the source is tricky), the principle of not fighting fire with fire is still reasonable. Whenever you automatically respond to an attack with another attack you open up the potential for an explosive situation.
Yes, I agree totally with that principle. I do however prefer to use factual arguments and not bullshit like the commentor that I responded to did.
"Rune Kristian Viken" - http://www.nwo.no - arca
An article on /. came up a while ago about a worm that did just this called "Cheese Worm".
:-)
It fixed a back door created by another worm then goes looking for other systems infected by the l10n worm.
Yes, it's a novel idea. No, it's not the solution. Not everyone runs the same distro/OS and not everyone has them configured the same.
It would take an amazing amount of design and coding work to create one that intelligently fixed configuration problems without creating more nightmares for the admin, and even then, it's likely to cause more problems than it fixes. Then it would no longer be a worm - it'd be a "service pack".
Why bother.
This is NOT an "IIS" hole. That's a fact. This is an Indexing Server hole. That's a fact. Comparing this to 'apache never having an exploit like this' is wrong. That's a fact. Comparing this to some apache module or CGI script being exploited, which has happened, and will continue to happen, is accurate. That's a fact.
Vintage computer games and RPG books available. Email me if you're interested.
> Yes, but criminal trespass (a crime to which an American citzen
> can respond with deadly force) and cracking a webserver are of the same magnitude.
Even if I agreed that criminal trespass and cracking a webserver are the same (they're not, in either a legal or ethical sense), you're way off on the justification for deadly force, at least in the laws of most U.S. jurisdictions. First, cracking a web server is like picking the lock on your front door, which is breaking and entering, not criminal trespass. Second, you're not legally allowed to use deadly force against someone unless they are threatening your life or well-being. Since someone can commit criminal trespass when you're not present, if you drilled someone just because they broke into your house while you were at work, you'd be guilty of second-degree murder. In fact, if you shoot someone who breaks into your house while you're at home, the burden of proof for threat still rests with you (basically, you get "convicted" of justifiable homicide) or you're still going up the river.
Virg
There are two problems with an anti-worm:
1) there is an obvious, less-intrusive solution to the problem. Log the IP addresses, notify their ISP, and (assuming the ISP is on the ball) they "go dark" until they clean up their act. It's not like it's hard to verify the information provided to the ISP.
This will guarantee that 1) that system infects nobody else and 2) the owner is aware of the problem.
2) The second problem is contained in the comments above - quietly patching the system does nothing to undo the damage (it might close a few doors, but *anyone* could have run *anything* on that system while it was open) and does not teach the owner to take responsibility for their system.
However, this requires the ISP to take action. To be honest, some of these systems are starting to remind me of car alarms that run for hours (e.g., because of high winds) and the owner can't be bothered to shut them off. Breaking some glass on that car is illegal... but few cops or DAs would consider anger vented at car alarm which kept neighbors up all night a crime without a compelling mitigating factor.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Anyone who uses a script like that is crazy. Next there will be a Code Red III which spoofs the originating IP and then your perl script becomes an unwitting part of a distributed DOS attack... Then YOU go to jail instead of the Code Red author.
Ohmy, how fscking stupid is it possible to be. Let me give you the hints one by one.
To attack a webserver you need to use http..
http uses tcp
tcp has something called initial sequence numbers
initial sequence numbers have been randomized rather good in more "recent" (think 97->now) operating systems.
spoofing a connection via tcp is almost impossible.
"Rune Kristian Viken" - http://www.nwo.no - arca
Are you unaware that firefighters often do use fire to fight fire?
(They burn away strips of forest to prevent a forest fire from being able to cross the strips and attack, say, neighborhoods.)
I think your comment in the next paragraph is right, though, because it illustrates the weakness of the forest-fire analogy.
In particular, while fighting viruses on the Internet today might be more like fighting a forest fire -- in that the trees are not "smart" at fighting fires, you want to save as many as reasonably possible, yet you're not averse to burning a few more down yourself to avert a larger disaster -- the overall goal should be to convince Internet sysadmins to do for their systems what homeowners and business owners have, over the centuries been encouraged to do: be the first line of defense against fires starting, or offense against fires spreading, etc.
(Think of elements of "progress" here -- new homes likely have smoke alarms, people are strongly encouraged to report fires quickly, flammable materials are less widely used, buildings are designed for quick exit in the event of fire.)
Until the Internet resembles something more like today's upscale suburban neighborhood (in its security against fires) than a dry, dense forest, I suggest that fighting fire with fire does have utility, if thoughtfully (rather than arbitrarily) applied by experts.
Practice random senselessness and act kind of beautiful.
...though it's not quite as effective.
Since the start of this week, I've been running a Perl script as an hourly cron job that parses my firewall logs, gets the originating IP addresses of any Code Red scans, does a reverse lookup, attempts to extract a meaningful domain name and then mails a polite notification to postmaster and webmaster at that domain. The notification contains a link to the MS page with the details of the relevant patches.
Since doing so, I've had a number of responses from people thanking me for pointing out the problem and confirming that their server has now been patched. The response rate is only about 1%, largely due to the fact that around 90% of the problem servers are on dial-ups/cable modems/DSL, but it's better than nothing.
I'm not advocating that everybody, or even a large number of people, do this, as the amount of traffic it would generate would only add to the problem, but it seems like a more legal solution than another, white-hatted, worm.
I would be a paid subscriber if Taco and Hemos weren't such cunts
The Electronic Communications Privacy Act and the Computer Fraud and Abuse Act combine with state "Blue Sky" computer crime and fraud law to make this tactic amazingly dangerous for anybody who does this. G-d forbid the license should (accidentally or otherwise) harm any system in any way in so doing -- the damages and liability could be enormous, and there may well be substantial criminal responsibility as well.
In short, anybody who even begins to perform a passive security audit of a system of another without having obtained written consent TO DO EVERYTHING THAT WAS DONE (exceeding authority can be a crime as well as obtaining authority in some cases) risks the slings and arrows of abusive attorneys.
It would be nice to have a vigilante virus out there -- the guy who wrote it might even become some kind of folk hero. Even so, he might spend years in jail for his good deeds, and g-d save him if he messed up.
Also affected are Cisco 678's.
i rus.html
See http://www.qwest.com/dsl/customerservice/coderedv
The virus nVIR A was propagating the macintosh world.(1990) Someone created a second nVIR B to counter attack the nVIR A, to replace A with itself.
:-(
There were bugs into nVIR B, making the computer part unusable. and the nVIR B could propagate on a computer which wasn't infected by nVIR A.
Not everybody was happy
bye
I'd say a stranger in my house DOES pose a threat to my family. I don't know who this creep is, or what he intends. If my family is at stake you'd better believe I'm going to play safe. I might not shoot the instant I see him, but I'd sure take aim and if he tried to flinch without my permission he's history.
"I object to doing things that computers can do." -- Olin Shivers, lispers.org
Perhaps system administrators have other things to do other than keep applying patch after patch to the rubber dinghy Microsoft built as a web server. As long as we have good backups, why bother until something goes wrong? It's a waste of attention to keep patching things, not to mention the odd service pack disasters that make things worse than before.
Don't go blaming the system administrators who have better things to do, put the blame right where it belongs, in the developers lap. They should test their code, and not count on us as their test lab.
--Mike--
I'm definitely against the idea of another virus/worm, but if the anti-worm resided on a server and only activated in response to a request from an infected server (the reply to the infected server caused the cleanup and patch, plus installed the anti-worm)... it couldn't propogate without provaction, and would slowly eliminate the infected machines. Bandwidth wouldn't go up, since the anti-worm isn't active, only reactive (and only makes one request per attack, which should then prevent further attacks by the attacking box).
"It's tough to be bilingual when you get hit in the head."
There are a lot of good legal resources out there, both internet law libraries, the supreme court web site, and actual "meatspace" libraries. If people would just do a little research before posting, we would have a lot fewer "it seems to me that" posts and a lot more informative "if we apply the ruling in blank V blank" posts. I can dream, can't I?
I'm the stranger...posting to
I've seen this asked many places already. The long and the short of it is that this tactic is ILLEGAL. You'd be subject to the same punishment as the Code Red authors. Yes, your intentions are good, but you're A) accessing a computer system without consent and B) INSTALLING software without consent. This is no different than me walking into your house at 3 AM to install the IIS patch on your server. It doesn't matter that I had good intentions, I'd be at gun point pretty quick. I'd be charged with unauthorized entry regardless... you didn't invite me, I came in, and refused to leave when you told me to because "the patch wasn't finished upgrading".
There is no reasonable defense against an idiot with an agenda
:wq
In a sense, "white hats" are merely Good Samaritans themselves. Perhaps new laws should be passed to cover the actions of Good Samaritans whose intent is to help others online.
--It's Pimptastic!--
Guees that means if my machine gets hacked here I have to give it over to whomever hacked it.
I'm the big fish in the big pond bitch.
I can tell you what'll happen; your wardrobe the next day will be an orange jumpsuit and shower shoes.
Actually, there's nothing like a challenge to a virus writer .. so I'll bet if you started spreading a good one, you'd just start escalating the war. Sometimes I believe viruses havn't caused major catastrophes yet because we dont fight viruses with viruses. Think of guns .. since we fight guns with guns, it really ends up coming down to who has the most/biggest guns. Do we really want to find out who has the most time and haxoring genius, the black hats or the white hats?
"Old man yells at systemd"
IANAL but....
There is really no single law that covers this so a lawyer would be useless in this case. You could get ten different opinions from five different lawyers and any or all of them could be right. Or wrong. That's what Judges do.
Now, with the PHP or CGI programs that do something to a computer, it would be a very grey area. After all, the 'attacking' computer is actualy requesting information from your machine. You are simply returning information. Then you can get into the motive of the requestor and the motive of the author and it gets even worse.
Basically, all a lawyer is going to tell you is his theory of how a set of laws will be interpretted. Only Judges can actualy do the interpretting.
Viv
Gmail invites for ip
> Colorado (for positive) and many other states have a "make my day" law.
This doesn't contradict my original statement. Note that my example describes a breakin when the homeowner isn't home (the MMD law doesn't apply) and that when he/she is, that the burden of proof for threat rests with the homeowner (MMD laws relax that burden considerably, but they do not remove it).
Virg
If these worms are illegal because they gain unauthorised entry then of course making a 'friendly' virus is illegal because it is doing the same thing.
Having good intentions is nice but consider this (fictional) scenario: A local cat keeps trying to have 'relations' with my cat and I dont know who the owner is, plus the owner is unaware of their cat's activity. I catch the cat and get it 'fixed' without the owner knowing. When the owner finds out I doubt they or the police would be too pleased about it. Swap 'cat' for 'web server' and you have this code red situation.
Yes the internet is unpoliced but I dont think the 'Do-Gooder' virus is a very good answer. Internet policing is an interesting new subject but traditional security ideas still apply - the owner of the house is the one responsible for making sure the door is locked. People need to be taught this applies to the internet too.
(And no jokes about unauthorised entries thank you very much)
As promised.
They're a bit rough and ready, and will require some customisation and possibly a minor bit of hacking. I've put a few comments in to make that easier, though. Good luck!
I would be a paid subscriber if Taco and Hemos weren't such cunts
Supply programs that do this for all the latest viruses to the IT departments of companies with bad/lazy/not enough sysadmins. Charge them a yearly fee, and just email them a new worm that will go through their network and close all the holes behind itself once a week. Have a client that they can put on their firewall to keep it from escaping to external networks (Or just program it to stay on on local networks.).
There are companies out there that might actually pay for this.
Create a scriptalias on your web server, so that fetches of "default.ida" go to a CGI which responds, very slowly -- just under code red's timeout -- with whatever code red is looking for a the response of a successful penetration.
I know it creates a lot of threads, but assuming it will tolerate a decent timeout, enough of these would slow it down quite a bit, until it dies from people installing fixes.
Anybody taken apart the virus to know what timeout to use and what response it's looking for?
Has it been over a year since you last donated to the Electronic Frontier Foundation
The worm goes after 'default.ida' as I can see. They're trying to execute a program on my system. (default.ida). If my default.ida was actually a script that sent a payload back, and that payload just HAPPENED to be commands to disable their system, what's the harm there? I'm not ACTIVELY exploiting their system. I'm only sending a payload back in response to a request that THEIR system requested. Seems pretty clear cut to me.
Code red backdoor checker
creation science book
If I install Win2K or NT on a box connected to the net right now, there is a high probability I will be infected before I can even apply the patch. That's a fact.
If I install Linux/BSD/etc with Apache on a box connected to the net, I will end up with an access.log full of default.ida?XXXXXXXXXXXXX requests and nothing more. That's a fact.
It's disingenuous to say that the indexing hole is comparable to "some CGI script," because that CGI script is not a default component of the Apache installation. The relative security records of Apache and IIS are not the result of "open" vs "proprietary" development models, they are the result of the attitudes of the respective developers towards the need for new features and accountability to end users. IIS doesn't end up with more holes because it's "closed-source," but because it's designed to add as many features as possible and install those by default. This isn't an ideological difference, it's good development practices difference.
If it ain't broke, you need more software.
The solution is twofold.
A: Microsoft needs to release more secure OS/Web servers.
B: People need to patch their system themselves or take it off the net.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
Nope, you didn't /. any of those, but you did save me some time in tracking down a CRII-infected server to play with. Seems you can manipulate the files in the \inetpub directory, but very few anywhere else. Making a dir on the desktop didn't work, but their index.asp has been renamed. Hopefully and admin with 1% of a clue is supporting this server.
Lots of people here are saying "this is legal because you have good intentions" ... which is, of course, absolutely not true.
/.) IANAL, but I imagine the courts would be quite willing to see a counter-worm situation similarly. It is not legal, and it could land you in some serious trouble even if your intentions were pure.
Imagine you got home after work one day, and found your front door standing wide open. You frantically search the house, and find a complete stranger sitting down at your computer. He cheerfully tells you that your computer was infected with a virus, and that he's going around the neighborhood breaking into people's houses fixing their computers.
No damage was done, because he merely picked the lock to the front door. You check out your computer and as far as you can tell everything looks fine, so it seems like he was telling the truth.
Do you:
A) say "Oh, that's okay! Thanks for fixing it!"
B) tell him to get the hell out of your house, and then call the police?
I'm betting the vast majority of you would pick (B). Now (just like all the other idiots on
ZFS: because love is never having to say fsck
... that the Slashdot editors don't read Slashdot.
... -1, redundant.
This has been discussed on the other three Slashdot stories about Code Red.
Each time, none of the comments have risen above +1. Some have even been modded down to...
Nevertheless, this is a good idea. You have to remember that not all NT administrators are anything more than employees of a small company trying to see what this "Internet and web server" thing is all about. They'd patch, but they just don't know how. (And yes, I know. If they don't know how to administer it, they shouldn't be trying to.)
I believe that the United States FBI still counts this as an unauthorized intrusion, so watch out if you do try to inject something like this into the Internet...
Do you like German cars?
How about instead of actually patching the machine or doing something else to affect the state of the machine (like turning off the web server), you simply pop-up a message on the screen that says "This machine infected with Code Red, please download update from Microsoft.com/security" or something along those lines. I'm not sure myself how you'd go about raising a message or dialog box but there are probably a number of ways you could do this.
That way you don't enter the grey area of messing with another users machine, and since most of these boxes are probably home machines they'll get the message pretty quick that someone can do anything they want with the machine and they should patch it pronto!
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I didn't ask my lawyer about this, because I know exactly what he would say. "catfood," he'd say, "what happens if you don't send the white-hat virus to those hosts that are probing you?" And I'd say that basically nothing bad will happen to me; I'd just get a couple hundred hosts a day knocking on my door and not getting in. And then my lawyer would say, "and what might happen if you do send the white-hat virus out?" At which point I'd say well, I guess it's remotely possible that I might break something, and the other host's manager might notice it...
And then my lawyer would say, "Don't be an idiot. You'd be exposing yourself for no benefit to yourself, right?"
Then I'd say okay, you're right, and my lawyer would send me a bill for $300.00.
I save a lot of money by asking myself, "what would Tim the Lawyer say?"
There's a small difference here.
The fact that a hole exists isn't the problem. The fact that a hole is being exploited actively, and being used to propage software to hundreds of thousands boxes (causing all sorts of bandwidth problem) is a SERIOUS problem. Compounded by the fact that 90% of the people who are currently infected by it WILL NEVER FIX THE PROBLEM THEMSELVES. This has been going on for almost a week now, and it's only getting worse! My server at home is getting hit by this damn thing multiple times per minute! Hell, the after this thing was in the wild for the first 16 hours, I had 355 registered attempts to hit my box with it.
The app you speak of did four things:
* it patched holes
* it left open a new backdoor
* it tried to spread itself
* it told no-one what it did
I'd have no problems with something that patched compromised holes, didn't leave open any backdoors, didn't attempt to spread itself, and told the owner of the box in some fashion what it did. Some would argue that "well, they'll have to wipe the box because who knows what was done by the fix" -- guess what, they should have done that in the first place, because god only knows who else did nasty things before the hole was patched...
Somewhat more hazy is setting your web server up to shut down a web server that just scanned your for code red II. That would be completely passive and would have a hell of a lot more benefits than drawbacks. If you're evil you could also bill the owner of the server for administrative services (With about 2000 scans since saturday, I could have made a hefty chunk of change on paper had I been doing this heh.)
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Perhaps she'd have been a bit annoyed, but if he saw her leave, and she went far enough that he lost sight of her, it would also be enough time for a burglar to get in.
She might have to call to get someone with a spare key to come over, or at most, a locksmith whose price I'm sure Startled would have paid half of, but it's a small price to pay compared to having your stuff gone, or someone waiting inside when you come home...
And if she did want it that way, she need only tell him once and he'll never help her that way again.
It's never happened to me, but if I was in a parking lot and saw an unlocked car without an obvious alarm, I'd open the door, lock it, and close it. To avoid risk of a theft charge, I'd get a random passer-by to witness it, so that it was obvious I was only locking the door if the owner came back right then. But I would lock the door. I don't want anyone to have to pay out a large deductible and lose their CDs, etc. That sucks.
You'd think so, but there are plenty of cases in turn where the family sues for damages, or even worse murder charges are pressed. Revel in the beauty of the U.S. justice system.
I'm the big fish in the big pond bitch.
Cheese, a linux worm did this.
Read This
Slashdot desperately needs is a full-time lawyer. It's a great site for Internet geek stuff but nobody on the site has the first fucking clue about liability law. That in itself would not necessarily be awful if it were not the case that all discussions here invariably end up with a bunch of laymen talking legal theory. Lawyers, help!
There have been many suggested responses, in approximate order of grayness;
- Do nothing.
- Send email to any system that probes yours.
- Provide a patch, and make it as easy to download and install.
- Have a bot send email to any system that probes yours.
- Provide a web page that activates a bot that exploits and patches a system.
- Have a bot exploit and patch any system that probes yours.
- Have a bot exploit any system that probes yours, and patch it with the bot.
- Actively search out infected systems and patch them.
- Actively search out infected systems and patch them with something that
actively searches for systems.
- Write an even more virulent worm that patches systems.
I feel that arguing the current legality of the above options is meaningless. The question is, which of the above is the right thing to do. Once it's decided what the right thing is, then we can change the law to make that legal.Personally, I would be opposed to anything past 6, as they all involve unlimited expansion, and thus are potentially more harmful than the worm they are stopping. Below 5, I think is ok, although 4 does have some potential for harm. As long as the bot is properly limited to, say, one email per infected system per week, then I think the response is justified.
5 is curious - it does involve cracking the infected system, but theoretically only at the behest of those who are infected. There is, however, a potential for abuse - you could spoof a request, and trick it into patching a different server. However, someone would have to actively choose to spoof it, so it effectively is no different than the spoofers running the exploit themselves. I.e. you've made it a tiny bit easier for them to do it, but didn't actually initiate the action.
6 is onerous. It does involve cracking a system - but it's a system that is "attacking" you, and potentially others as well. I would rate it about the same as cold cocking someone who's been drugged, and is now running around swinging at everyone they see. I'm nervous about the idea of vigilante cracking, though - too much potential for abuse. Perhaps a compromise between this and 4 above - have someone "trusted" set up a cracker/patcher that only patches servers that are reported to it, and which it also agrees are infected and dangerous. Sort of like calling the net-cops on the server.
Haven't we already discussed this?
Alex Bischoff
HTML/CSS coder for hire
VbScript that uninstalls MS Outlook?
JiM
---
Better Living Through Reckless Experimentation
I can no longer run services on port 80. As of tommorow port 25 is filtered.
Verizon is my DSL provider, telocity is the only other choice and they use Verizons network so the filters will remain even if i switch.
I pay for Pro service and now some Virii/Worm has expired my abilities to run a hobby server at home
Cable modems (@Home) aren't available in my area yet and they have a terms of service prohibiting running servers.
Is the internet dying now that monopolies have 100% control? I mean verizon is blocking services, other isp's control the content and now even if i switch providers i'm still paying for a monopoly after all?
Just look at how many of these worms have had little bugs in them, like not attacking when the were supposed to, or emailing the wrong drop and stuff. All we need is some cowboy thinking he is going to clean up the internet and messing up even more stuff.
Ever see that movie Office Space? One wrong decimal point could mean big trouble. It is bad enough these people have to run Microsoft's buggy code. But at least they chose to do that. They shouldn't be forced to run your buggy code too, even if you are trying to help.
I'm sure folks will scream its illegal and it probably is - but can't a case be made for 'self defense' I mean if someone brandishes a gun at me am I not within my rights to shoot them or at least take their gun away?
Why not apply the same logic to this, they are probing me to infect my server so why can't I probe back and disarm them?
Top Most Bizarre/Disturbing Error Messages
And after closing the hole, the counter-virus should stay resident and launch a counter-attack against anyone who tries to exploit the hole with anything other than the counter-virus.
After hearing what everybody has to say, I've decided that this sort of script is probably not a good idea. To those of you who replied to me via email, I'll send you a link to a webpage where I'll be putting up the script, once I get hold of it. You'll be able to reach it after clicking through a disclaimer.
I would still advise against anyone using this in "production" (i.e. to combat live code red attacks on the open Internet.) Think about it:
If, for some reason, your copy of the script mis-performs and corrupts IIS DLLs or executables on the attacking host, you will be liable.
If the federales are monitoring traffic and see your box actively exploiting the Code Red hole, you're in trouble.
If your ISP notices your box "propagating" Code Red, then you are likely to be denied service (in the most literal manner) and your account might be terminated.
So, in the final analysis, it's probably better just to put up a default.ida that does a "net stop w3svc" (as someone else here recommended) or does a reboot.
While the Code Red virus has been spreding rapidly, in part due to all those Windows 2000 users on cable modems, I think this idea of "fixing" everyone's computer is a really really bad one.
By connecting to someone elses computer, and running code on it without their permision you are in fact committing an illegal activity. I think a much better idea would be to politely inform the machines' owners that their server is infected. Also providing a link to the patch.
Any unauthorized access is scary. Remember that worm a while back that went around and "fixed" unix systems by patching holes? Remember the outcry about how no one would want that because it was "Their" server and whatnot. Same thing applies here.
S.t.e.v.e.
thad
I love Mondays. On a Monday, anything is possible.
This is a very Bad Idea. First of all, unauthorized access to a computer is, by definition unauthorized. Any worm which spreads changes is illegal and as such a Bad Idea.
No matter how good your intentions are (RTM just wanted to play around, right?) you cannot take the "law" into your own hands.
Ethical issues aside, it would be very dangerous to being publicizing that there was a beneficial worm available; immediately, we would get copycat worms everywhere, appearing the same (yes, this could probably be circumvented by MD5 checksums or something, but jeez, if the webmaster was going to go through THAT much trouble, they'd install the damn patch themselves!) but doing far worse things.
I'm not usually one to spout Libertarian philosophy - but in this case, if somebody wants to leave their box open - through ignorance, laziness, or some other ineffable reason - that is their choice and not the choice of some 15-year old hacker who thinks he'll redeem his l33t friends' images in the media's eyes.
The defenses always have to be kept up - or else you have to start making judgment calls about which outside sources to give access to, which is a path no one wants to go down.
I don't see at all why it's a bad idea. Please explain.
creation science book
In this case, why don't the cable/xDSL providers start suspending the accounts of people with infected computers? That tends to get people's notice a lot more effectively than vigilante counter-viruses . . .
Any sufficiently advanced technology is indistinguishable from a rigged demo
--Andy Finkel (J. Klass?)
If only this sort of thing weren't illegal where I live...
Liberty in your lifetime
Depending on what declension it is (I haven't dealt with Latin in a long time), wouldn't the plural either be virî (one I) or virûs in Latin? I seem to remember that there are a few strange (fifth declension?) -us words that are pluralized with -ûs.
Liberty in your lifetime