Slashdot Mirror
Four Kids Confess to Goner Worm
imrdkl writes: "4 kids in Israel have confessed to writing and distributing the Goner worm, according to Fox."
Yet another annoying worm comes and goes, wasting countless IT hours, to say nothing of bandwidth. The kids face up to five years -- of course since they aren't in the U.S., they might actually be punished.
At work, we got it about 1100 EST. One user got it and ran it, and it cascaded. Our servers groaned for about 30 seconds, by that time, the mail admin had run into the server room and yanked the network cable to them. Honestly, I don't think the fault rests on these kids at all. Sure, I guess they should face punishment if they broke the law, but that's their country's problem. I don't blame them.
If our users had listened to the rules, this wouldn't have been a problem. But within 30 seconds of the attachment entering our network, over 50 users had run it. Why can't someone hold the irresponsible user at fault? The instructions are easy - don't run attachments you weren't expecting. Instead of blaming some kids for playing around with code, why can't we find fault in the people that don't follow their instructions?
Yeah, I'm ranting, but to make something constructive out of my waste of bandwidth, how can we get the users to listen? Anyone have effective tools? Yeah, I'm all for firing the ones that can't observe policy, but that would mean firing my boss too. And she's actually pretty decent, as far as managers go.
funny munging
The kids face up to five years, of course since they aren't in the US, they might actually be punished.
Computer crimes are MORE than sufficiently punished in the US, thank you very much. I don't know where you get off implying that the US goes easy on computer "crime". I had a little incident during my freshman year of college. The FBI was very determined to get me jail time for a ridiculously minor offense. It was only through sheer wit and creativity of my laywers that we got the offense down to a misdemeanor and a lousy 600$US fine. That was the most hellish time of my entire life and could have ruined my career forever. All over a tiny little deal (no damage was done).
Imagine what these kids would get in the US for writing such a worm. It'd be a helluva lot worse than 5 years in prison. So put your pro-punishment attitudes away and get real. Remember what our government does to computer criminals.
Why bother.
They're first time offenders who confessed. They're high school students who would otherwise be preparing to be drafted to the Israeli army soon, and the government will not want to disrupt that if it isn't necessary. Finally, they are from a town that is notorious for inducing boredom for its teenagers. They may get a few months, but I wouldn't count on it, and they'll get assigned to the Ma'asiahu prison, where conditions are very good (it's Israel's prison for first time offenders, and it's probably the only place in the world you could call a re-education camp without irony.)
Ah yes. It's the user's fault. Damn them for actually using the features in their frigging e-mail clients. How dare they not go through arcane menu commands and figure out how to deactivate features. Let's shoot the slobs now, and totally ignore the fact that lazy-ass developers created all of these problems for the users to begin with.
Oh yeah. very common sense. Unless, perhaps you know joe45@aol.com. Which is the case in most of these "scan the user's address book and send a copy" schemes. That's why it's so successful... e-mails go to people who know, and perhaps trust, the person who launched the virus. Hell, a lot of the viruses are in the form of Word documents, which, believe it or not, are actually passed around via e-mail. See, e-mail is all about communication. People send people things. People open them up. 99.99% of the time, nothing bad happens. That's what e-mail is for. That's why we have attachments. If people aren't supposed to open them, what's the point of having that capability in e-mail clients?
Do you actually expect people to know what the hell a .scr file is? Maybe you've got all of Window's file extensions memorized. Most people I know have more important things to think about.
No, if you want to code up a virus to "fix" this problem, code up one that goes out and downloads and installs an e-mail client that was written by someone with a clue about security. Perhaps install an operating system where something run in userland can't fuck with system files. Hell, write a virus with some AI that can seek out and destroy the source code to lousy e-mail clients, scripting systems that have no concept of security, and operating systems that have no security model to speak of.
In the mean time, screeching at people that doing things that the e-mail clients were designed to do in the first place is grounds for a cyber-anal-raping is about as productive as screeching that they're a witch if they float in water. It may seem obvious to you, but you're not speaking their language.
That's a bad analogy. It's more like four kids pressed a button on the outside of the WTC at street level, causing the towers to explode due to an engineering flaw. In other words, there is no way for a mail message to directly cause harm to your computer. It must be interpreted by a program which you trust (a traitor, in other words) which is willing to harm your computer at the command of an outside party.
I absolutely can and do hold them responsible. Their decision to facilitate running programs that arrive in the mail without any kind of sandbox or access restrictions was an obviously dangerous one whose implications were immediately visible to people who understand computers. Microsoft spins their product as the omniscient gatekeeper to the internet and handholder to the clueless. They encourage the computer-illiterate to put their trust in Microsoft rather than learning how computers actually work. They created both the software and the culture that propogate malicious code. All of which means that they are greatly to blame for deliberately bringing into existence email viruses.