Slashdot Mirror
Maker of Kournikova Gets Wrist Slapped Too
shelflife writes: "This story
says 'It is the first time in history that the maker of a computer virus has been tried in the Netherlands -- indeed one of the few times it has been done in the world. Hypponen knows only of one conviction. A man was sentenced to 18 months in jail in the U.K. in the early 1990s. The man served 11 months, said Hypponen.' but that can't be true. What about Robert Morris? Anyway, the requested sentence is amazingly light -- 240 hours of civil service." The really interesting part is that this kid wasn't even a programmer. He just downloaded a kit. Shows how far this Virus Craze has gone in the last few years.
Interesting that he turned himself in - perhaps this does lend credence to the idea that he really didn't know what he was doing. Although, to be fair, if you download a worm creation kit, use it to create a worm, and then post it to Usenet, it seems unlikely that you wouldn't be aware of the potential consequences.
Finally someone in a computer-related trial gets a semi-fair sentencing. I'm suprised he didn't get $4,000,000,000 worth of jail time for all the "damages" he caused. I must admit, I'm a little suprised at the people who are not happy with the outcome of this trial..
---
evelakamatt
Will the makers of Outlook go to court for actively helping the spread of the worm by deliberately insecure handling of attachments?
-- Ed Avis ed@membled.com
The really interesting part is that this kid wasn't even a programmer. He just downloaded a kit.
and
The defendant, Jan de Wit, turned himself in to the police in his hometown Sneek, Netherlands, on Feb. 14.
I would venture a guess to say that those are the reasons why he was given such a light sentance, and the fact that he was 20 years old. A little remorse goes a long way in the courts, and turning yourself in too usually helps to give a lighter sentance.
If God gave us curiosity
Sure kids who program or release viruses should get their wrirsts slapped and do some community service. What gets me is these stupid figures for damages that get banded about. If companies really are losing much as they claim, why don't they just hire someone to install security patches when they become available, it's not exactly rocket science. In my view if you have some critical systems but don't bother to add security patches when they become available, you are equally to blame and should not be allowed to claim damages.
And here I was seeing "Kournikova" and "slapped" and thinking this article was going to be much more interesting (and perhaps have some pics!)
Got Rhinos?
It's a light sentence, as sentences go, but it makes the whole process, from putting it together to serving the sentence, more trouble than it's worth in entertainment.
The reason lame modern viruses get written is that it's really easy; you put in very little time, and then get to hear reports about how it spreads: very little effort, a little entertainment. If he'd known that it would take 250 hours of work, he probably wouldn't have bothered.
The same goes for hacking websites: people do it because it doesn't take any real effort. If it took 250 hours of boring work that you can't automate, people wouldn't bother.
Sir, I find your sig to be more than a small bit offensive.
As an Arab living in the United States, I too have been affected by the tragedy inflicted on your country by these terrorists. I had several friends in the WTC at the time of the attacks, and I feel that the USia needs to extract vengance upon those who committed these acts. However, you must understand that the men who perpetrated this violence represent a distinct minority among Arabs.
Your suggestion that all arabs have their arms amputated strikes me as offensive and highly insensitive. Racially motivated violence will not bring the dead back to life.
Now is the time for level-headedness and tolerance, not ignorance and persecution.
"Technically, a cat locked in a box may be alive or dead." -Kurt Cobain
...to the father of the beutiful tennis player?
"A man was sentenced to 18 months in jail in the U.K. in the early 1990s. The man served 11 months, said Hypponen.' but that can't be true. What about Robert Morris?"
Not to take away from RTM, but what about Kevin Mitnick?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
240 hours of community service is quite a bit, at least in my book.
Say you work a 40-hour week (days)...that pretty much only gives you weekends to devote to service. If you work 8 hours on saturday, it will take 30 weeks to complete the sentence.
Anybody want to give up 30 saturdays? I didn't think so.
The punishment is certainly less than what one might have expected, but I think this is a good trend, not a bad one. I'd much rather see these marginally troublesome white-collar criminals get easier sentences than ANY drunk driver or other violent criminal acts. So the virus is bad. Sure. Was there any loss of life? Was anyone maimed or psychologically traumatized (heh) over the incident? Hell - he didn't even try to steal information or money.
Punishments should fit the crime. What he did was not excusable, but a little perspective check is in order - especially after tuesday's events.
sedawkgrep
Is that a salami in my pants or am I just happy to be me?
We should send a message to all clueless amateurs out there that go around "clicking" in virus making kits and creating Outlook viruses that force law abiding companies to close down their e-mail systems and loose thousands of dolars in revenues (imagine all those suffering employees that cannot send the latest joke to all their collegues).
If we don't act swiftly and decisively now, we risk having these "amateurs" playing around with Code Red Creation Kits.
I say hang the guy in Dam square in Amsterdam - that will show them!!!
"Arms" as defined by dictionary.com.
~LoudMusic
No sig for you. YOU GET NO SIG!
I remember those kits. Especially the one that came with wordstar built in that was set up like Turbo-C. They were pretty shoddy IIRC, it was the quickest way to write a virus that all antivirus packages would immediatly detect (because the kits themselves tended to leave their signature on the virus). I do remember some of the more sophisticated kits claiming to make your virus automatically polymorphic, but I don't know if they actually worked. Most of those kits were riddled with bugs to boot (heck, most _viruses_ have bugs in them, have you ever read through those virus bestiaries?).
Besides, I never heard of any kits that helped you to write boot sector viruses, which were the only ones that ever seemed to spread anywhere, at least before Word Macro viruses and Outlook worms came along.
I read the internet for the articles.
For fuck sake dude, a good sized rock can be used to kill someone. Does that mean rocks of particular sizes ought to be outlawed? Should the writers of compilers be held accountable for people who used their compiler to make a virus? Run of the mill network utilities can easily be used to DOS some poor sap with a slower connection than yours. You post vulnerabilities in order to expose the fact that company X doesn't test their shit properly and ought to learn how before they lose all their customers. I'd rather use a product that has had bugs exploited and fixed than one where I didn't know if it had been exploited or not. If you're the target of an exploit especially a dumbfuck exploit like macro virii then you live and learn.
I'm a loner Dottie, a Rebel.
The conviction in 1990 wasn't for creating a virus. I know, because I was network manager at one of the sites involved and was responsible for logging network activity which formed part of the evidence.
Uh, actually, no, it was for creating a virus, and had nothing to do with mainframes as you suggest.
I had corresponded with the author (he was part of the SAM Coupé programming community). I know who he is. I have tons of his source code. And he was convicted for (on the surface of it) creating the first assembly-language polymorphic virus, and putting it into a virus kit.
The virus was called Smeg.
Here's a link that you might find informative:
News story
Simon
Coming soon - pyrogyra
...c'mon, where's the craftsmanship? Where's the pride in your work? When I wrote viruses, it was all about doing it yourself, accomplishing something. Now you don't even have to be a programmer, you just have to know how to point-and-click. I tell ya, when pride in craftsmanship goes down the toilet, there's nothing left.
"Make it ten--I am only a poor corrupt official."
--Captain Louis Renault (Claude Rains), Casablanca
The purpose was to force Hotmail to fix the vulnerablity. It worked. The reason it worked was because the Joe Blow User found out about the vulnerablity due to the coverage, and took appropriate action. Different people take different actions, but the end result gave Hotmail a clear message: fix it, or you won't have enough business to sustain your operation. Often these security holes are considered too obscure and therefore not a threat. All you have to do it get the message out to a couple blackhats and average users, and walla, it becomes a serious threat even to those who would rather not deal with it.
We had already known hotmail security was breached. Did the poster think that someone might just use it to illegally break into another person's hotmail account?
Yes, the poster knew all too well that the blackhats would find and exploit the vulnerablity if it were made public, and they would run amuck if it were not fixed, as such he/she made it so public that Hotmail is left with no choice but to fix it. The same principle is the reason we invest in the stock market: We give up a little bit of something now, to get more back later. That something is money or security depending on your favorite paradigm.
CmdrTaco appears to be one of those people out there who have a rather confused notion of how severe sentences actually are. This is the second posting about how 18 months in juvie or 240 hours of community service + a criminal record amounts to a slap on the wrist.
This is pretty dumb. Jail is boring, obnoxious, demeaning and occasionally dangerous, particularly for these type of people. A sentence of several months is not a slap on the wrist. Community service sounds about right.