Four Kids Confess to Goner Worm

imrdkl writes: "4 kids in Israel have confessed to writing and distributing the Goner worm, according to Fox." Yet another annoying worm comes and goes, wasting countless IT hours, to say nothing of bandwidth. The kids face up to five years -- of course since they aren't in the U.S., they might actually be punished.

Comments

5 years?

[Your_Mom]

After myself being called to fix a customer's sExchange (Yes, NT, I'm young and I need the money) server that barfed its guts on the floor because of this, you can hand them over to my IT dept, we really wanted to take them out back and flog them repeatedly last week.

Re:5 years?

[Anonymous DWord]

That's what he said. Didn't you read the post?

"...server that barfed its guts on the floor because of this..."

Well blahs all around

[GlassUser]

At work, we got it about 1100 EST. One user got it and ran it, and it cascaded. Our servers groaned for about 30 seconds, by that time, the mail admin had run into the server room and yanked the network cable to them. Honestly, I don't think the fault rests on these kids at all. Sure, I guess they should face punishment if they broke the law, but that's their country's problem. I don't blame them.

If our users had listened to the rules, this wouldn't have been a problem. But within 30 seconds of the attachment entering our network, over 50 users had run it. Why can't someone hold the irresponsible user at fault? The instructions are easy - don't run attachments you weren't expecting. Instead of blaming some kids for playing around with code, why can't we find fault in the people that don't follow their instructions?

Yeah, I'm ranting, but to make something constructive out of my waste of bandwidth, how can we get the users to listen? Anyone have effective tools? Yeah, I'm all for firing the ones that can't observe policy, but that would mean firing my boss too. And she's actually pretty decent, as far as managers go.

Re:Well blahs all around

[Jucius Maximus]

"If our users had listened to the rules, this wouldn't have been a problem. But within 30 seconds of the attachment entering our network, over 50 users had run it. Why can't someone hold the irresponsible user at fault? The instructions are easy - don't run attachments you weren't expecting. Instead of blaming some kids for playing around with code, why can't we find fault in the people that don't follow their instructions?"

Thank you for saying this. It's not the virus makers that bring down networks, it's the people who fall for the same social engineering over and over again and click on the attachment.

I am scaring myself now because I am agreeing with the NRA - I've brought the 'guns don't kill people, people kill people' debate into this as an analogy. I apologise in advance for starting a flame war.

Re:Well blahs all around

[Gogl]

I agree with you, but the world doesn't.

In fact, if users did turn smart, both you and me might find it a lot harder to get jobs.

You see, computer geeks get jobs because we're supposed to be the ones who think about things like this. Hell, we're perverted enough to *enjoy* doing this nitty-gritty computer stuff. Joe Q. User just wants things to work. The user doesn't want to have to deal with anything. After all, the computer isn't their job, the computer is a tool to help them with their job.

So yes, I agree that in an ideal world people wouldn't be stupid and would know not to open unexpected attachments (and always scan everything anyway, and all that stuff). But the reality of it is that will never happened, and it just takes one person screwing up to let the worm wreak some degree of havoc.

Re:Well blahs all around

[TwizzlerMan]

Anyone have effective tools?

Public humiliation always worked well for me!

e.g. "Can you believe that old pervert in sales really believed that the chick in client servce sent only him an 'I Love You' message?"

Re:Well blahs all around

[Ivan Raikov]

While I wholeheartedly agree with your NRA argument, I don't think this analogy is very accurate -- you say that people who run the attachments (i.e. the victims) should be responsible; wouldn't that suggest that you want the gun shot victims to be held responsible, instead of the people who shot them?

At any case, I do believe that virus writers should be held responsible, but I don't think the solution is the so called "cyber crime" laws or anything that focuses on the means rather than the cause.

Re:Well blahs all around

[Sloppy]

how can we get the users to listen?

It's the answer no one wants to hear or do, but one way to get them to listen, would be to hold them responsible for their actions. You sent a dozen copies of virus? You get punished. It doesn't matter if you wrote it or not; you did it.

Re:Well blahs all around

[spinwards]

yes, but guns have other uses than to kill people. The virus was designed to be malicious. It is very much the users fault for running the worm, but the uthors should still be held accountable for releasing it.

Re:Well blahs all around

[mce]

It's not just users who are stupid. I know of an admin who actually used Goner to defend the ongoing introduction of Outlook at the place where he works.

Here's what happened: they were hit at 17:50 local time, at about 18:00, the first of four Outlook
lusers clicked on the attachment, which made the few admins who were still at work aware of the
problem. As they immediately went into action, they were able to get the mail servers under control pretty quickly (relatively speaking, that is). Next day, however, a scan of the network
revealed that about 50 additional PCs had to be cleaned up. These belonged to people who still use Netscape to read their mail and had also activated the worm. It didn't spread from there, but it did disable the virusscanners, so...

Next thing, that admin that I'm refering to claims: "Fortunately, we have Outlook installed on a few PCs already, because that is how we found out just before leaving for home. If everybody still used Netscape, a lot more PCs would have been infected during the evening, night, and morning before the helpdesk would have noticed the problem."

Sadly, this really is a true story...

Re:Well blahs all around

[cymen]

Why not just strip all attachments from incoming email? Or at least *.scr?

Re:Well blahs all around

[jmu1]

Basically, it all comes down to management not taking computer security seriously. I have to deal with this sort of crap day in and day out. The folks up top decide that when something bad happens, it is my job to clean up the mess. When ever I make a suggestion, it promptly gets shot down with excuses like:"the users can't get used to that", or "that would be too much work on our part"... well, perhaps if they had to deal first hand with recovering data from virus ridden machines, they would be pitching a damn fit about it too!

Re:Well blahs all around

[Col. Panic]

I don't think it is too much to expect that users follow a few simple instructions when using a corporate LAN. They are required to keep their passwords private, report chain emails, not try to exceed their network privileges, and NOT OPEN UNEXPECTED ATTACHMENTS FROM PEOPLE OUTSIDE THE COMPANY.

Since we run antivirus at our mail gateways, we catch most of what comes through and users get a scrubbed attachment of 0 bytes with an addendum to their subject line of "Scanmail has detected a virus!" so we are not usually at major risk. But we have had people (in IT even) launch iloveyou.vbs and cause headaches.

Although I do not expect users to know which file extensions denote which type of files are attached, I do expect them to call IT before opening suspect attachments. This, of course, assumes IT has enough people to be responsive to such requests in an organization. When that is not the case, anarchy may reign...

Re:Well blahs all around

[slackergod]

This is more like handing someone a handgrenade,
with an attached note saying "pull this pin,"
and that person then proceeding to pull it,
even though they have been told OVER AND OVER
that if they pull the pin on a hand grenade,
it will hurt them.

The virus is dormant, completely harmless
UNTIL SOMEONE RUNS IT.
The fact that someone wrote and engineered it
to spread in this way, and convince people to run
it, they (the writers) should be held accountable.

But just because they are responsible doesn't
mean every other person down the line
isn't responsible as well.

Makes me think of an episode of Space Ghost Coast To Coast (Snatch, I think..)
which goes something like this:

"The rays... Its... Its feeding on the rays!"
"Then don't shoot it!"
"But.. The rays... It's feeding on them! Ohh."

Re:Well blahs all around

[rlowe69]

If our users had listened to the rules, this wouldn't have been a problem.

Same old argument, right? It's the user's fault.

I really don't like this conclusion. Truth be told, this is a major security flaw in Outlook (and derivatives). The bottom line is if Microsoft is going to market to the technically ignorant, they need to protect these users from themselves for the sake of the businesses these employees work for. This is only good software engineering! Design the software for the target audience - everyone.

Now I know MS probably doesn't think it owes the businesses that buy its software anything - "you get what you pay for". But this flaw - allowing e-mails to execute scripts - is absolutely unnecessary and costly to ANY business connected to the Internet. No amount of policy can protect businesses from this flaw. There will always been a few ignorant weak-link-in-the-chain employees that don't know any better.

So say what you want about the virus writers, they are putting MS under a very important spotlight. How many virii have to exploit various Outlook holes before businesses demand something better, if only to save money in IT costs? It makes you wonder where the breaking point is ...

Re:Well blahs all around

[cymen]

why not just use paper and pencils. OR better yet, smoke signals.

Honestly, slashdot posters are some of the dumbest fartknockers around.

Oh yeah, definately. Sure Mr. Anonymous Coward. Do you have a valid suggestion? I can't think of anything that comes in *.scr that is of any benefit.

Re:Well blahs all around

[odaiwai]

> Why not just strip all attachments from incoming email? Or at least *.scr?

Because it's not a .scr, it's a .scr.pif and Windows helpfully hides the real extension from you by default.

dave

Re:Well blahs all around

[cymen]

Well good point. But what is decent that comes in with *.pif? Again, absolutely nothing...

Re:Well blahs all around

[SilentChris]

Any admin worth his salt wouldn't have allowed the "running" of attachments on the clients in the first place. That's more a client-side issue than anything else.

Also, blocking most attachments, if not all, at the mail server would've stopped the problem complem.

Re:Well blahs all around

[PurpleBob]

and NOT OPEN UNEXPECTED ATTACHMENTS FROM PEOPLE OUTSIDE THE COMPANY.

That's not good enough. After the first one, the rest of the unexpected attachments would be coming from people INSIDE the company.

Re:Well blahs all around

[PurpleBob]

No, it really is a .scr. Screensavers are executable files in Windows.

Re:Well blahs all around

[Glytch]

Tell your managers about how much it costs, instead of just how much effort it takes. Be sure to factor in your own pay, it makes the numbers bigger. Managers don't understand much, but they do understand money.

Re:Well blahs all around

[CokeBear]

The spreading of the first and all subsequent email virii is the fault of the company that wrote such an easily infected email program.

Re:Well blahs all around

[autopr0n]

yes, but guns have other uses than to kill people.

Um, guns may have other usages, like scaring people into thinking you might kill them. And killing large animals. But they were designed for the sole purpose of killing people

Re:Well blahs all around

[Mike1024]

Hey,

Honestly, I don't think the fault rests on these kids at all.

A quick article reference:

Once inside a user's system, it [Goner] deletes anti-virus and firewall programs, then installs scripts to allow hackers to access the computer and use it as a platform for denial-of-service attacks.

This was not a blameless accident. It wasn't a mistake, that wasn't meant to be released. It was a specially written virus designed to build a 5cr1p7 k1d33 DDOS network.

I don't think they planned to sit around with thier massive DDOS network, not doing anything. Furthermore, they certainly knew what trouble the worm could cause - there is ample precedent for this.

We won't deter future virus writers with a slap on the wrist. They need to be given a sentance that others will look at and say 'I wouldn't want that to happen to me'.

They shouldn't be given a 5-year sentancem granted. I would think that a $5,000 fine and confiscation of thier computer equiptment would to fine. But we can't say 'Blame the users; they aren't following procedure', because if it weren't for script kiddie virus writers, there would be no need for virus-stopping procedures at all.

That's my opinion, anyway.

Michael

Re:Well blahs all around

[SCHecklerX]

Right.

So since you can't fix the clueless people, make them use software that doesn't allow it to happen in the first place. Problem solved.

Re:Well blahs all around

[artemis67]

They shouldn't be given a 5-year sentance, granted. I would think that a $5,000 fine and confiscation of thier computer equiptment would do fine.

Nope, wouldn't do a thing. Their parents would pay the fine and they would find another computer to use.

The only deterrent kids would be worried about is incarceration, because mommie and daddy can't fix that for them.

5 years is a lot, but I wouldn't give them less than 1 year. I think 2 years is the optimal number.

-----

Re:Well blahs all around

[davidarcher2000]

At my company, we've implemented a mail filtering system (with procmail) that automatically mangles certain "dangerous" extensions. This way, the user can't just open the attachment directly, but instead must save it someone on their hard drive, rename it, and THEN run it. These extra steps usually make them give pause to the fact that MAYBE they really shouldn't be opening this attachment if they don't know who's sending them it. Also, they get to see the whole name of it when they are opening it since alot of mail clients will cut off the extension and just show "..." at the end if the filename is too long. We've just implemented this about 3 weeks ago and although we were physically sent the Goner worm, no one actually ran it because e-mail alerts had already been issued and because of the filtering at the server level.

Re:Well blahs all around

[GlassUser]

Someone targeting the ten thousand employees at my company's parent. We're the only branch that uses Exchange, everyone else fell into the groupwise thing.

Re:Well blahs all around

[GlassUser]

Um executing an executable is a flaw in your email client? You realize that you don't even have to have email for this worm to infect and damage your system, right?

Re:Well blahs all around

[Col. Panic]

I don't expect anyone non-technical to know that a .XLS.LNK or a .DOC.PIF file actually executes

Oh, neither do I. I have made sure everyone in IT who launched iloveyou knows the difference, but as for the business employees - I won't bother wasting my breath.

GETTING SOME FUCKING BALLS and blocking attachments

Not even remotely practical. With over 70,000 employees all around the world, you just cannot deny attachments - no one could work. The only solution is to scan attachments. I am not a mail admin, so I don't know details, but we occasionally experience lagtime of upto several hours in email from outside the company. This is very painful to live with, but I don't see an alternative. I would rather err on the side of safety than have to clean up the mess on thousands of clients after the fact.

Re:Well blahs all around

[rlowe69]

You realize that you don't even have to have email for this worm to infect and damage your system, right?

Aren't you just splitting hairs? Receiving vbscript/outlook virii in e-mail (through Outlook) is the most common way and it's also, by far, the fastest method of distribution of these virii.

You could go around with a floppy disk and distribute it that way, but ... someone could follow behind you with their own disk installing the patches at the same speed. :P

Regardless, it's the fact that Outlook transforms normally benign e-mail attachments into executable virus scripts that is the problem. Bottom line.

Re:Well blahs all around

[Sethb]

Another helpful tip, and one that saves us TONS of work as IT staff, is to disable active scripting on the Windows computers that your users use. We have a line in our Netware login scripts that does just this. It disables all the visual basic script stuff, thereby reducing most of the worms to harmless text files. I've never once had a user notice, and have a reason to use Visual Basic scripts....

We use that, in conjunction with Norton AntiVirus Corporate Edition, and some diligence on my part in grabbing the newest definitions as soon as a big worm spreads, and we haven't even had to physically visit one of our 350 computers since May due to a virus/worm infestation.

Oh, and Outlook/Outlook Express is fine, if you take the time to set your users up so they cant open executable attachments. Blame the IT support staff in places that have them. I don't know who to blame when it comes to home users, but having a copy of Norton Antivirus 2002, which updates automatically every 4 hours, will go a LONG ways to stopping most of these things within the first 24 hours...

Re:Well blahs all around

[psych031337]

Yeah, I'm ranting, but to make something constructive out of my waste of bandwidth, how can we get the users to listen? Anyone have effective tools?

Get your OK from management to make each and everyone pay 5 or 10 bucks for each occasion he/she fucks up by running a unexpected attachment. Make clear that this is mandatory. Make clear that you talking about the dangers of attachments is taken for real. And maybe conduct "drills" as someone pointed out a few posts back in this thread. (Drill being an selfwritten vbscript that does not have malicious code and is sent to emails at your company. When executed it just fires off an email to you/IT management and notifies the user that he has done some bad that might have cost him a days work if it was a serious, real worm)

Re:Well blahs all around

[CokeBear]

It

Re:Well blahs all around

[CokeBear]

It is different because Microsoft's email client is the *only* one that propegates these virii. Eudora, Pine, kmail, any others you can name... none of them pass along email viruses.

It is different. email is not snail mail. Its a bad analogy.

Comment removed

[account_deleted]

Comment removed based on user account deletion

What's the point?

[macemoneta]

Children do what children do; push buttons to establish limits. That's their job. Punish the managers and complacent sysadmins at the companies impacted, that allowed themselves to get a year behind on maintenance. There will always be children. We don't always have to be cheap/lazy about security. At least not if we're going to bitch and moan about stuff that's completely preventable.

Same old...

[powerlinekid]

Ok heres the basic cycle:

script kiddie/cracker/whatever create worm

worm gets out, spreading by point and click method

IT goes on about how bad this one is

Eventually worm dies and kids are caught

Big deal made over last worm causes more copycat type worms

Cycle restarts

Ok I mean thats pretty general, but goddamn if I'm not sick of all this. How about instead of going after the worm writers (they are not innocent but hear me out), why don't we try to at least educate the public into not opening things they don't know about. I mean what good does blackice and zonealarm do if someone opens a file and turns them off? The technology isn't the problem (except with IIS but thats whole different beast), its the people. Maybe someone (I know I'll be flamed as a bastard for this) should create a worm that actually fucks over the people that open it. Instead of making it so they download some roll-back registry fix, how about you just wipe out the registry? Why not make it so IE and Outlook have popup-adds with every page and email they view. What if the worm steals their emails and sends them to spammers list automatically? I mean obviously people aren't learning, or this crap wouldn't be happening over and over again. Yeah the people are victims blah blah blah... cry me a river. I've never had a worm, and never will. I'm not claming i'm smart or anything, but its common sense that an emailing "I'm asking for your advice" with a document that ends in scr or vbs is something that joe45@aol.com probably didn't mean to send me.

Re:Same old...

[Glytch]

Actually, a better house analogy would be the story of the three little pigs. The first little company made their email client out of straw...

Re:Same old...

[Glytch]

Excellent point! After all, cracking down on drugs with harsh laws has made the drug trade stop.

Re:Same old...

[Croaker]

Why not make it so IE and Outlook have popup-adds with every page and email they view. What if the worm steals their emails and sends them to spammers list automatically? I mean obviously people aren't learning, or this crap wouldn't be happening over and over again. Yeah the people are victims blah blah blah... cry me a river.

Ah yes. It's the user's fault. Damn them for actually using the features in their frigging e-mail clients. How dare they not go through arcane menu commands and figure out how to deactivate features. Let's shoot the slobs now, and totally ignore the fact that lazy-ass developers created all of these problems for the users to begin with.

I've never had a worm, and never will. I'm not claming i'm smart or anything, but its common sense that an emailing "I'm asking for your advice" with a document that ends in scr or vbs is something that joe45@aol.com probably didn't mean to send me.

Oh yeah. very common sense. Unless, perhaps you know joe45@aol.com. Which is the case in most of these "scan the user's address book and send a copy" schemes. That's why it's so successful... e-mails go to people who know, and perhaps trust, the person who launched the virus. Hell, a lot of the viruses are in the form of Word documents, which, believe it or not, are actually passed around via e-mail. See, e-mail is all about communication. People send people things. People open them up. 99.99% of the time, nothing bad happens. That's what e-mail is for. That's why we have attachments. If people aren't supposed to open them, what's the point of having that capability in e-mail clients?

Do you actually expect people to know what the hell a .scr file is? Maybe you've got all of Window's file extensions memorized. Most people I know have more important things to think about.

No, if you want to code up a virus to "fix" this problem, code up one that goes out and downloads and installs an e-mail client that was written by someone with a clue about security. Perhaps install an operating system where something run in userland can't fuck with system files. Hell, write a virus with some AI that can seek out and destroy the source code to lousy e-mail clients, scripting systems that have no concept of security, and operating systems that have no security model to speak of.

In the mean time, screeching at people that doing things that the e-mail clients were designed to do in the first place is grounds for a cyber-anal-raping is about as productive as screeching that they're a witch if they float in water. It may seem obvious to you, but you're not speaking their language.

Re:Same old...

[powerlinekid]

The thing about common sense is that you need to make it common to people. Nobody is born with it. How do you learn the common sense not to stick your hand in fire? By burning yourself at one point or another. With that in mind, by educating the public that is what I mean. Let them know that there really is no reason to open a file ending in .vbs or .src from people. The reason these worms spread so well is that they rely on ignorance of people. Get rid of that ignorance and you've gotten rid of the worms. As for sending word documents... how many word documents have you ever received that ended in .scr or .vbs? Considering that .doc has been the defacto extension for a word document for probably a decade, its just dumb to think that anything that said .doc.src was a word document. By default Outlook doesn't launch worms when it receives them. I've received countless worms in a default outlook setting and not once was one run. So I wouldn't go blaming Microsoft for that. People don't want to use any other email clients, because there really is no point. Netscape's sucks. Mozilla's is based off of netscape's. We're talking people that aren't going to use Evolution or Kmail. Maybe someone should write a worm that actually makes people more aware of worms in general, not just specifically.

Re:Same old...

[pjrc]

... why don't we try to at least educate the public into not opening things they don't know about ...

If you could "change the world" somehow, it'd be a lot simpler to just edit the client software or even add filtering at all the mail servers to delete all executable attachments before the user ever has an opportunity to execute them.

There really isn't any compelling reason for people to distribute software via email attachments. It is rarely done, and it's very unsafe.

punishment for virus writers?

[Krimsen]

Do you guys really think virus writers should be punished? I hate to sound old (I'm only 23), but we've had viruses for years before the internet was as commonplace as it is now and no one cared. You just restored from backup and went on. Am I wrong here? I see jailtime for virus writers as being a little too extreme. Yes i know of the Robert Morris worm back in the day and yes, he ended up getting probation, etc, but for the most part, no one payed viruses the attention they are getting now.

Re:punishment for virus writers?

[brood]

I hate to sound old (I'm only 23), but we've had viruses for years before the internet was as commonplace as it is now and no one cared.

You just made your own point. The internet is now commonplace, and it costs large corporations lots of money in lost productivity when one of these get sent out (if only in our IT department alone, laughing at the stupidity of the users falling for the stupid tricks the virus writers use to get them to open the email). There are a hell of a lot more people to care now.

Re:punishment for virus writers?

[Jucius Maximus]

"Do you guys really think virus writers should be punished? I hate to sound old (I'm only 23), but we've had viruses for years before the internet was as commonplace as it is now and no one cared. You just restored from backup and went on. Am I wrong here? I see jailtime for virus writers as being a little too extreme."

We all pine for the 'old days.' But really ... today all they have to do is relate it to 'terrorism' somehow and then the person goes to jail. And then all virus makers are terrorists. And because the terms are generalised, anyone who is a 'hacker' is a terrorist. But wait, there are many linux hackers who don't go around compromising networks. But they are hackers. Sooner or later a linux hacker or two get identified with working on PGP, but strong encryption, according to the US, is a munition - WE HAVE HACKERS MAKING MUNITIONS HERE!! TERRORISTS !!! Arrest them ALL!!! They're helping Osama Bin Laden! And it could all be falling into a cascading cycle of ignroance.

And this is what THEY want because people with outside-the-box knowledge about computer security can always do things with networks that can't be controlled or monitored by the powers that be.

Ah yes, I pine for the good old days. (Btw, if it means anything, I'm younger than you.)

Re:punishment for virus writers?

[nomadic]

I don't think they should go to jail, I just think someone should smack the stupid out of them.

Re:punishment for virus writers?

[Anonymous Brave Guy]

...for the most part, no one payed viruses the attention they are getting now.

That's because in those days, viruses did relatively little damage to only a few people. There weren't as many around, and it was much harder to spread them.

Nowadays, a s'kiddie with a problem can do millions of dollars' worth of damage because he's in a bad mood, and he can do it in a matter of minutes. No matter how good your security and recovery procedures are, a virus can always hit at the wrong time and do serious damage. Remember, a single day of downtime or an afternoon of lost data across a whole company can be the difference between making a profit or going bust in this business.

So yes, I think you have to punish those who do this, and with something serious enough to act as a genuine deterrent. Slapping them on the wrist and saying "Naughty" just isn't sending the right message.

Re:punishment for virus writers?

[sigwinch]

Nowadays, a s'kiddie with a problem can do millions of dollars' worth of damage because he's in a bad mood, and he can do it in a matter of minutes. No matter how good your security and recovery procedures are, a virus can always hit at the wrong time and do serious damage.

True, but there are billions of people out there and a significant fraction of them cannot be deterred except by killing them. They might be crazy, they might want to bring down the techno-societies, they might not care what happens to them, whatever. Such people are inevitable, so you have to regard them as a force of nature and work around them. Any system that assumes they don't exist, or assumes that they can be deterred, will certainly fail.

Slapping them on the wrist and saying "Naughty" just isn't sending the right message.

OTOH, deterrence and punishment are almost completely futile from a strategic point of view. Deterrence is never perfect, and it only takes one undeterred person to bring down the system. The solutions are better technology and better user training.

Look at it from a warfare angle: Goner is a half-assed stunt by some *Israeli* kids. You can rest assured that if Al Qaeda could find two brain cells to rub together that they would've done something similar, and unlike the kiddies they would've wiped BIOSes and NIC MAC addresses, wiped filesystem metadata and boot sectors, programmed video cards to extremely high refresh rates (destroying old monitors and maybe making them catch on fire), and so forth.

Re:punishment for virus writers?

[stpats]

Are you serious? Viruses/Worms today have the capability of disrupting economies all over the globe. They can cause millions to billions worth of dollars in lost productivity. Who are these crazy people who blame the users and think the authors are practically blameless? The users end up invoking the malicious program, but that's akin to a "clever" a-hole sending a well disguised letter/package bomb to someone with the return address of a friend and then blaming the recipient when they open the letter and it blows them up. Except that the person who's blown up would somehow also be sending letter bombs to every one they kept in contact with.

For everyone that thinks it's all about ignorance, here's to hoping you never get yours and end up somewhere on the globe where it's legal to sodomize random people. You're going to get it in the end.

Re:punishment for virus writers?

[Pig Hogger]

I don't think they should go to jail, I just think someone should smack the stupid out of them.

Don't worry. When they'll get in jail, they'll get their stupid smaked out of them.

Through their anuses.

Re:punishment for virus writers?

[Pig Hogger]

...
You can rest assured that if Al Qaeda could find two brain cells to rub together that they would've done something similar
...

But they DID!. Wrecking billions of dollars ' worth of prime real-estate with only a few box cutters and the like is pure genius. Now, Ossama Bin-Laden truly showed his engineering talent: doing a lot with virtualy nothing.

Re:punishment for virus writers?

[sigwinch]

But they DID!. Wrecking billions of dollars ' worth of prime real-estate with only a few box cutters and the like is pure genius.

I was thinking along the lines of causing grave strategic injury to the U.S. The 9-11 attacks were tactically brilliant, but strategically ineffectual. The U.S. could withstand an attack of that magnitude once a month indefinitely. A successful cyberspace attack every month, however, would destroy the economy within a year, and all it takes is one bright kid.

BTW, Al Qaeda did not accomplish the attacks with "a few boxcutters". They accomplished it with applied psychology. The critical point of the 9-11 strategy was convincing several hundred people to sit on their hands while their planes were turned into missiles. The coming cyberspace attacks will probably use similar social engineering techniques to trick people into working for the attackers to violate security isolation.

They've already suffered enough

[cperciva]

I, for one, think that they've already suffered enough.

After all, judging by the virus code, it is almost certain that they had to use Microsoft software to create it.

Re:US Not Punishment Friendly?

[scaryjohn]

I think taco's making a specific allusion to MafiaBoy, who got off with probation for his DDOS attack last year.

5 years for kids???

[datawar]

I'm a kid (Senior in High School...) and I've seen kids to stupid things (I've done some stupid things myself too). These things should NOT be punishable by 5 years (unless they are violent). Kids are kids, and then they grow. Putting them in jail for years on end isn't going to make them grow up any faster.

In the US, these same kids can just as easily steal a car, get drunk, and run you over while running a red light. Guess what? With a good plea-bargain, they'll get off in 5 years too.

What's more important, 5 years in the slammer for stupidity or 5 years in the slammer for killing someone? Get your priorities straight people...

Re:5 years for kids???

[Tardigrade]

One fewer murder was committed in Florida a few years back because of the punishment if caught. I know this because I was the person who meditated on it, and decided not to go through with it.

Re:5 years for kids???

[hughk]

My own little company is quite tight, but this one definitely hit our ISP very badly and caused all kinds of problems with Email delay. This is a bad thing. This has cost a lot of people a lot of money. Nobody was killed but a lot of people were hurt. This sounds like terrorism to me.

In Israel, they generally shoot terrorists (and one or two innocent people). I don't want the death penalty for these kids but five-years would be about right.

We should harness the talents of 5cRi7K1DDI35

[el'gwato]

Instead of being punished (in the usual way) for this annoying act of internet vandalism the Israeli government should make them pay for their crimes in a way that will harness their talents. Maybe some form of Internet good will, like 2 years doing mindless computer support for a charity organisation.
These kids are to young to go to gaol and the outcome of confining the kids to a cell for up to five years will only make them criminals.
I just think the punishment should fit the crime and actually make a difference to the outcome of such young and talented delinquents lives :)

Re:We should harness the talents of 5cRi7K1DDI35

[ThatComputerGuy]

The SPELLING, oh the SPELLING is a HORROR!

I mean, damn...

Re:What drives a script kiddie?

[CTho9305]

When I was 15 I was like that. I really don't remember why I thought that stuff was cool, it just was. Thankfully I grew out of it.

Hmmm, maybe if there are more crackdowns on script kiddies and more slander against that kind of life these kids won't think it's 'cool' anymore. Just a thought

Same here... but I don't think crackdowns will help. I mean, they probably get enjoyment out of their creation growing (until they fully realized what they did). A better idea than crackdowns might be a controlled environment for kids to screw around in...

Of course, one result would be giving crackes experience / promoting it. But giving out free condoms could be viewed as promoting sex...

whatever. I can't see any especially good solution.

Sigh...

[RelliK]

Well, we all know that most organizations' security is so pathetic that any teenager can write a worm to penetrate it. Once again, we have the living proof of that. Once again, everyone blames "evil hackers" instead of addressing the real problem or even so much as hinting that sysadmins, or beter yet, PHBs should take part of the blame. So, what else is new?

BTW, I've read that in Israel white-collar crimes are punished more harshly than normal crimes. For example, if you commit copyright infringment you stand to spend more time in jail than a rapist. Can somebody confirm/deny this? (But then again, it looks like this is the way things are going in the US too with "hackers" being declared terrorists and all...).

Re:Sigh...

[Angry Black Man]

>>BTW, I've read that in Israel white-collar crimes are punished more harshly than normal crimes. For example, if you commit copyright infringment you stand to spend more time in jail than a rapist. Can somebody confirm/deny this? (But then again, it looks like this is the way things are going in the US too with "hackers" being declared terrorists and all...).

No, no, no. After living in Israel for about a year, I can tell you that copyright infringement (especially cable/sattelite/software piracy) run rampant. I'd say around 80% of all software was pirated, and most people I knew stole either sattelite or cable television. In a country that's at war, piracy isn't the current priority on the ethics hierarchy.

Re:Sigh...

[Bastian]

Once again, everyone blames "evil hackers" instead of addressing the real problem or even so much as hinting that sysadmins, or beter yet, PHBs should take part of the blame. So, what else is new?

Sysadmins and PHBs? Where I work, sysadmins and PHBs are probably the only people working to stop the viruses - and believe me, if we could get away with doing the things we want to do to stop them, we would. We already virus scan everything that comes through email, and we've gone so far as to create worms that search peoples' computers for viruses and sends a message to a server to shut off that computer's port when one is found. We remove MSIE and Outlook from all computers, actively discourage their use, and the helpdesk answers all questions related to the two with, "Get Netscape and then we'll talk."

And despite all this, we got hit hard by Code Red and have been trying for months to get all traces of w32.nimda cleared off the network. Problem is, no matter how much we deprecate as much unsafe software as we can, no matter how much we repeat things like, "don't open unexpected attatchments" at workshops, people still do all the krap we tell them not to do, and have more excuses for why they do it than I care to mention.

If we had our way, we would probably have blocked every kind of attatchment from *.mp3 to *.doc by now.

We can sit and whine about script kiddies and place the blame on them, but that won't ever solve the problem. People will always pull shenanigans because they can. We can blame stupid users, but if there's one thing I've learned from mopping up other peoples' shit, it's that people will always do dumb things.

As far as I'm concerned, there's really only one place we can have much of an affect on this problem, and it is the companies that make software. It's a bit like the problem of auto accidents - you can sit and blame drunks and bad drivers, but the only way you're going to save lives is by imposing safety standards on the automobile industry. Similarly, the only way we're going to fix the problem of viruses is by having some sort of accountability process for companies. I can understand not holding the company accountable when an exploit involves using some obscure bug in the program - we can't reasonably expect bugs to never occur in programs. We can hold companies accountable for idiotic things that nobody should do in commercial software, such as 8-bit XOR encrypting passwords - one of the things that nimda exploited to be able to spread across Microsoft networks so easily.

I can't belive people are still falling for this!

[bnavarro]

It's like that TV Commercial that's been playing in the States here:

*Woman peeks her head into IT Manager's office*
"Oh, and Bob, I opened that e-mail virus -- just like you told me not to!"

Re:What drives a script kiddie?

[OctaneZ]

I disagree, these "crack downs" get media time for the kids who are writing the viruses. If anythign I think all of this media coverage glamourises the entire thing. If kids didn't see this as a way to rebel against everyone in the "mainstream" then this wouldn't be as rampant as it is. I am not saying that we should except it, and I am not saying that it wouldn't exist without the meida talking about it every 30 seconds. But what I am saying is that (Insert Anchor Man Name Here) says that this is the worst thing to ever happen, then some kid sitting there who like many of us (and I freely admit that I used to check all the boards) would look at this when they were younger just to understand it, is going to say to himself I can do better than THAT!
Just my 2 cents.
-OctaneZ

Fixing the staff problem

[Anonymous Brave Guy]

I don't agree entirely with what you write, since I assign the blame for things like this almost entirely to those who write the stuff in the first place. I'm sure you'll get plenty of other replies saying the same.

OTOH, you make a fair point about employee training. The small company where I work, a software development house, has had a few e-mail viruses mailed to it over the past year or two. It's interesting to note that these often get forwarded around the office, but invariably by non-technical staff. The developers and tech support guys and gals generally have the sense not to run blind attachments; the admin and management guys and gals are more trusting, and bite the bullet.

Our IT support guys have long had a record kept of exactly when everyone runs the anti-virus update they mail round every month. Recently, they've instituted a "leader board", which is mailed to everyone, showing who ran it fastest. It's an amusing little game for those of us who are sitting in front of our PCs anyway, but the really telling thing is the people who don't appear on the list at all (which is typically mailed around the afternoon after the update), i.e., those people who still haven't updated their systems several hours later. Guess who they are...

So, we have established that certain types of users are more vulnerable to this than others, and we know who they are. The next question, of course, is what to do about it. You can come up with any number of penalties, but how are you going to turn around and slap them on, say, the MD of your company (a repeated offender in our case)?

Personally, I always liked the "drill" approach. The IT guys occasionally create a Hotmail account or some such, and mail something cool-looking to a few random accounts at the company. If you run the attachment, it pops up a simple message on your screen informing you that if this had been real, you'd just have cost everyone in the company a day's work/sent abusive mail to your most profitable client/whatever. This isn't publicly embarassing, and it makes the point. It's certainly proven very successful in a couple of cases I know of.

You could complement that with a "three strikes" sort of rule. Anyone who falls for it gets a couple more spams shortly thereafter. Anyone who falls for it repeatedly has maximum security settings imposed on their machine thereafter. It will cause them hassle if, for example, they have to send or receive a genuine executable attachment, but such is the price you pay for keeping your systems secure from your own users as well as people outside. Better that than watching offensive mail go to those top five clients...

Re:Fixing the staff problem

[Typingsux]

Well....

At least in my company, the first person to send this out (company name to remain anonymous.) was the CTO

This is not a lie or an exaggeration. Our companies CTO was the first damn fool to send it.

I'll now read the rest of this thread to see other replies.

Re:Fixing the staff problem

[(H)elix1]

Ya, ya... I'm scanning a box now because I had a shared drive that just popped up as being infected.

We use outlook - but mine was patched and I used the web client via mozilla to avoid the vbscript, IIS disabled and using something else for a local JSP/HTTP server. I thought I was being carefull, and I still got nailed by nimda anyhow...

Your drill only works for the first case. From there on out, it sends it to every one in the address book. I get a message from the CTO, rather than 1337hxrs@hotmail.com, that is a known source for me. Your lucky most email virus subjects lines are stupid too - unless the damn preview nails you anyhow. Ah, hell... even when I was practicing safe hex, the only thing left standing was my sunblade.

BTW, the preview problem can be fixed for those of us forced to use outlook... Check out nohtml. http://ntbugtraq.ntadvice.com/default.asp?sid=1&pi d=55&did=38

Re:Fixing the staff problem

[RollingThunder]

As UserFriendly recently put it... that's the "Chief Take-the-blame Officer". Sounds like this one's on the ball!

Re:Fixing the staff problem

[Anonymous Brave Guy]

That's one level of the AV protection in place, yes. Obviously there are others as well.

Re:Fixing the staff problem

[Anonymous Brave Guy]

...the anti-virus update they mail round every month.

Er... would that be an attachment? Hey, I know a script kiddie who'd love to work at your company!

Sorry, forgot the "irony" smiley... :-)

(But actually, no, it's a text link to a batch file on our server in a standard place.)

Re:Fixing the staff problem

[Pig Hogger]

I don't agree entirely with what you write, since I assign the blame for things like this almost entirely to those who write the stuff in the first place. I'm sure you'll get plenty of other replies saying the same.

The best "disclaimer" I ever heard was from a former roommate, when he tried to justify throwing some of my stuff in the garbage (for him, a book that is older than a year is obsolete):

I want't my fault, it was by brain!!!!

Attachment blocking at the server

[bubblegoose]

This virus wasted about 5 minutes of my time. I read an article about what it did, then the next day I deleted about 150 copies of this that got quarantined on our company's Exchange server.

I use a virus scanner on the Exchange server capable of blocking attachments based on extension (Scanmail by TrendMicro works nicely for me). I always block:
ade,adp,asx,bas,bat,chm,cmd,com,cpl,crt,exe,hlp, ht a,inf,ins,isp,js,jse,lnk,mdb,mde,msc,msi,msp,mst,p cd,pif,reg,scr,sct,shs,url,vb,vbe,vbs,wsc,wsf,wsh

Bingo - no e-mail virus problems :)

I figure if my users really need them and the person sending the message is smart enough (and meant to send it) then they can zip it. If the sender wasn't smart enough to zip it, then I can always pull it out of the quarantine folder.

Re:Attachment blocking at the server

[Pig Hogger]

I always block: ade, adp, asx, bas, bat, chm, cmd, com, cpl, crt, exe, hlp, ht a, inf, ins, isp, js, jse, lnk, mdb, mde, msc, msi, msp, mst, p cd, pif, reg, scr, sct, shs, url, vb, vbe, vbs, wsc, wsf, wsh

Might as well list what you don't block, it will be faster... (I wonder if you cut-and-pasted that list straight off your server's config...)

This Is Bullshit

[Lethyos]

The kids face up to five years, of course since they aren't in the US, they might actually be punished.

Computer crimes are MORE than sufficiently punished in the US, thank you very much. I don't know where you get off implying that the US goes easy on computer "crime". I had a little incident during my freshman year of college. The FBI was very determined to get me jail time for a ridiculously minor offense. It was only through sheer wit and creativity of my laywers that we got the offense down to a misdemeanor and a lousy 600$US fine. That was the most hellish time of my entire life and could have ruined my career forever. All over a tiny little deal (no damage was done).

Imagine what these kids would get in the US for writing such a worm. It'd be a helluva lot worse than 5 years in prison. So put your pro-punishment attitudes away and get real. Remember what our government does to computer criminals.

Re:This Is Bullshit

[TobyWong]

He was referring to big P punishment rather than the little p punishment we are used to seeing in the USA.

'p'unishment = locking a person in a room for a while.
'P'unishment = beating the poor sod with bamboo canes or cutting off his hand or something.

Re:This Is Bullshit

[Have Blue]

The big P is, more precisely, a punishment that might actually deter them from doing this again. I have no idea what that might be, but hitting them with a stick or locking them up is not it.

Re:This Is Bullshit

[loraksus]

Did you know that you can get off on murder in 3 years?
The FBI should be actually doing their jobs and hunting down murderers, rapists and people who actually hurt other people instead of hunting down people who write programs to piss people off.
Put shit into comparison for a second.

Re:This Is Bullshit

[finkployd]

That would have been the IT services at the college I was attending (OTC if it gives any particular people a clue).

If it makes you feel any better, OTC is pretty much hated across the board by all the other three letter computer groups (CAC, OAS, etc)

Finkployd

Re:This Is Bullshit

[duffbeer703]

The FBI, being a Federal law-enforcement agency has absolutely no business investigating murder, rape, or most violent crime, since the vast majority of these are state offenses.

Attempts to do what you suggest have resulted in the nothing more than the abuse of hate crime, civil rights and tax laws by federal law enforcement.

Re:This Is Bullshit

[loraksus]

So we have our state trained monkeys investigating the really "important" cases.

I agree that the feds tend to abuse whatever powers that they are given (i.e. Rico bullshit), but it would be nice to have people who have a bit more pull than the local pd investigating crimes.

Re:This Is Bullshit

[duffbeer703]

That's what the State Police are for.

When the local yokels can't handle it, the state guys take over usually. Generally, state police agencies are competent.

These kids are terrorists!

[HanzoSan]

We all know what happens to terrorists, check out bin laden hiding in the cave!

Re:What drives a script kiddie?

[Cheetah86]

When I was 15 I was like that. I really don't remember why I thought that stuff was cool, it just was. Thankfully I grew out of it.

Maybe middle school/high school health classes will start having anti-lameness speeches. I can imagine it now: "Don't do worms..........mkay?" or "Don't give into the peer pressure to code worms... they might make you feel good temporarily but they're bad in the long run" or even "Just because one of your friends tells you that writing worms is cool don't listen". Lets not forget "Friends don't let friends write worms".

Crackdowns cant even stop crime!

[HanzoSan]

WE have kids in the USA who think its cool to be a gangster, who think being an outlaw is cool, and become criminals.

When you tell someon they CANT do something, it makes it COOL for them to do it.

Think about it.

Re:Crackdowns cant even stop crime!

[Afrosheen]

Hey Kids! It's cool to be a skr1pt k1dd13! Just like your uncle Bob says: worms are good, worms are great, write a worm and masturbate!

That should make it uncool enough.

Re:Crackdowns cant even stop crime!

[Pig Hogger]

When you tell someon they CANT do something, it makes it COOL for them to do it.

Indeed! It's my mother's refusal to let me ride the subway alone that turned me into a rapid-transit freak...

Make an example

[macdaddy]

I'd like to see them and every other person caught for virus authoring to be held prosecuted to the farthest possible extreme. The newsgroup Hip Crime flooding is a good example of that. My newsgroups noise is so high that I can hardly find legit postings anymore, the goal of the flooding. I'd love to meet the bastard responsible for that in a dark alley with one of my old Sparc keyboards w/ the metal sub-structure so I can show him how us country geeks deal with problems like him.

outlook address book

[Publicus]

Why does outlook allow a script/program to access the address book without the user's permission? I think we've seen how costly this bug/feature is, why isn't there more pressure on M$ to fix this problem, or provide the option to turn it off?

These kids are essentially going to go to juvi/jail for swimming in a pool, when the sign clearly says, "no swimming."

No fault to the pool owner for not putting a fence around his pool, right? Ah, justice.

Re:outlook address book

[SuiteSisterMary]

Outlook 2000 with the latest service patches, and Outlook XP/2002 does, in fact, pop up a nifty little 'Program X is trying to access your address book.' and a menu of access types, such as none, this one time, allow for one minute, five minutes, ten minutes, and so on.

Re:outlook address book

[Knobby]

What is the problem with a script accessing the address book?

Before flaming me, think about what you're asking.. The address book for Eudora (for example) is a text file! I can write an applescript that accesses the information in the test file without ever talking to Eudora. What will disabling address book support do besides removing a feature that might be very useful (for example, a script that filters your incoming mail according to your address book)..

Re:outlook address book

[CodeMonky]

The outlook address book (and global address list in exchange) are part of the pst or part of exchange and can only be accessed through vb calls. You can still filter based on addresses because those things are built into outlook.

and there is nothing wrong with a script accessing the address book as long as the script has permission to access it which is all this patch does, ask you if its ok.

A Suggestion For Corporations and IT Professionals

[Ieshan]

How about this.

You set up a simple script that by default, turns off accepting email with attachments on it. When a person in the company NEEDS to view an attachment, the script allows one email with an attachment through to his computer after he fills out a form and submits it to the script (the form is never actually read, but hmph).

This way, anyone who needs to see an attachment does and must know about it before hand. At the same time, it blocks attachment-outlook-stupidity viruses by disallowing them to shoot through the system on a normal basis.

Furthermore, any person IN THE COMPANY who sends an attachment to another person in the company that's rejected by the mail server because the recipient hadn't filled in the form has his or her email account locked for 24 hours to stop the virus from spreading.

Done. Finished. My thoughts.

Re:they didn't do anything wrong.

[joel8x]

I guess you think the architects should have been held accountable for the twin towers not withstanding a plane hitting them. I hate M$'s practices as much as the next guy, but you can't hold them responsible when someone else knowingly takes advantage of a problem that they did address in hotfixes and patches! Sure it proved that there are still a lot of ignorant people out there who spread these worms, but the people who write them and send them out into the population are no better than the people stuffing Anthrax into envelopes and exploiting the U.S. postal service. These kids are electronic terrorists and we should take this offense seriously.

Re:What drives a script kiddie?

[mrseigen]

Yeah, I can just imagine that, considering the constant attempts of my school board to notify everyone that they shouldn't use the heavily-monitored, automatically-admin-cc'ed email service for spreading chain letters, porn, etc. because it wastes their precious bandwidth.
Then again, this is from the same school board that says kids can't use the comps for playing games that involve the keyboards, because they wear out quickly that way. They're only allowed to play "mouse games".
Technology has passed these people by. Actually, I don't think we'd ever see something like this because most people I talk to think worms are caused by the Internet or something and act completely stupified when I tell them it's actual people who write them.

Here's the other side of this coin.

[Matey-O]

After reading throug 30 odd messages that a) slammed Exchange/Outlook/Microsoft or b) said 'Hey, NBD, they're just kids!'

Here's a little bit of the flipside:

Our Exchange server weathered it just fine. Why? Because it's running Trend Micro's scanner, and it punts everything but TXT and ZIP files.

The last three virii that ran through the net DIDN'T affect us. We've got 1200 workstations, 60 odd servers, and _6_ admins. (and a 6 member Help Desk)

A Microsoft shop CAN be protected, it CAN avoid this crap, and you CAN run an enterprise on these products with a small staff.

CRIPES!

Further, the poor little kid is just playing around. Bullshit. There are a bunch of businesses having a hard enough time STAYING IN BUSINESS. They SHOULDN'T HAVE to deal with the financial burden of bouncing and disinfecting their infrastructure.

Re:Here's the other side of this coin.

[SuiteSisterMary]

As far as a) goes, MS email server/client architecture out of the box creates these sort of disasters. It is only with 3rd party addons / a non-default configuration that these things get fixed.

Yeah. Lord knows that a good sendmail out-of-the-box install will stop these attachments dead in their tracks.

Abuse Secured Computer Information Interchange

[xixax]

How about implementing a no attachment policy? Seriously, how many attachments are jokes and/or vaguely amusing pictures or multiple copies of Word docs that can be found on a corporate fileserver anyway?

Now that web browsers can handle FTP sites, it's easy to show most people how to upload/download content and it's also easy to set up a low level of security (blind directories etc.) that is comparable to sending stuff over email (if it's confidential, it shouldn't be going out over email anyway).

Xix.

Re:Abuse Secured Computer Information Interchange

[Detritus]

At many companies, Word and Powerpoint attachments are the preferred media for corporate communications. It's a huge waste of bandwidth, but that is what the suits like to use. Putting the documents on a corporate file server doesn't work for those employees who are are off-site and don't have access to the corporate intranet.

Re:What drives a script kiddie?

[Bandito]

If you do any kind of programming, you should have gone through that phase when stuff like that was cool. I remember a time when I thought it would be cool to write viruses or worms. Now, the reason that I thought it would be cool escapes me.

I believe that every programmer, at some point, goes through a phase when they want to try everything under the sun just to say that they can/could/did do it. I never actually wrote a virus myself, but I definitely remember wanting to just for the sake of getting into the guts of a computer and seeing what makes it tick.

Most programmers have also been/are sysadmins. I believe this along with growth/maturity eventually lead to the desire to produce something useful, not destructive, for the rest of the world.

Unfortunately, some never get past it, and some just use pre-fab virus creators. These people for whatever reason didn't move on to the next stage of evolution and probably never will, but at the same time, they keep sysadmins in business and antivirus writers employed.

Re:A Suggestion For Corporations and IT Profession

[mrseigen]

any person IN THE COMPANY who sends an attachment to another person in the company that's rejected by the mail server because the recipient hadn't filled in the form has his or her email account locked for 24 hours to stop the virus from spreading.

Well, I know that if I told Stan from accounting I was going to send him a file, and in his normal scatterbrain manner, completely forgot about it, and subsequently had the attachment bounced and my account locked, Stan from accounting would lose his legs. But otherwise, this plan is good, if a little draconian. Maybe just filters against certain executable file types would be a better idea.

That's right, punish KIDS...

[tcc]

For grown up security mistakes...

Part of the process of being a kid is learning... While I do not approve destruction or paralizing IT infrastructures, this seriously bugs me depending on the seriousness of the punishment.

Meanwhile, LOADS of spammers are still clugging my Hotmail inbox at a rate of at least 20 spam a day, my ISP email account receives at *LEAST* 5 spams a day, multiply that by X amount of users, THERE'S a big bandwidth waste. These people are still running free and going stronger than ever!

Those lame virus lasts for about a week. If after that, anyone else gets caught, they need to *LEARN* the HARD WAY like "doing backup is a good idea because you never know when your system might fail", well the same should go with "Update that antivirus file, because you never know what might hit you". Heck, the antivirus programs offers to do it automatically, there's no excuses.

Re:That's right, punish KIDS...

[tcc]

You probably didn't do anything stupid when you were a kid, right?

The only difference now is that the same kids in a different era of technology are doing stuff with what they have on their hands. While I *DID* say that it shouldn't go unpunished... 5 years in jail at that age, you're SURE to bread criminals, think about it... spending 5 years in jail from 30 to 35 is NOT the same than before 20, while you're whipping their asses, some other kids will do the same shit because of the attention it gets.

Basically you're not fighting the problem, the problem is the SOURCE itself, and it's NOT the kids, it's the LACK OF SECURITY FEATURES in the software.

You're lucky this time it was kids doing a prank, when it's going to be a real hacker that will grab loads of credit card number by exploiting a similar flaw, you'll rethink twice and be glad some kid would have found it first.

Re:Not to state the obvious

[Anonymous Brave Guy]

You'd be way better off filtering any attachments that have a .scr or .vbs extension-- right at the mail server.

At first sight, that sounds like a great solution. In fact, MS themselves tried it (blocking just about anything that might be executable, without any chance to circumvent the block) in the notorious Office security patch a few months ago. Unfortunately, that immediately caused chaos in offices across the globe, as people suddenly discovered that they couldn't send or receive attachments they actually needed to any more, either.

hate crimes

[mizerai]

I believe these kids are guilty of hate crimes against stupid people.

Canada does it best

[Error27]

For the kid who DoSed yahoo and cnn a while back. They put him a government reform school for 8 months.

That is enough punishment for a silly prank.

And I can't simpathize with the people who blame the users for openning the attachments. Teaching users not to open emails that have "Hi" as the subject line is only a short term solution. Trying to get users to remember which types of files are executable is not an option either. (Until a year ago, I assumed that .doc files were not executable.)

A better solution is to not allow executable attachments which end in .doc, .vbs, or .exe onto the network.

An even better solution is for Microsoft to fix their programs or for people to not use Microsoft products.

procmail filter

[CodeMonky]

There is a nice procmail filter (ftp://ftp.rubyriver.com/pub/jhardin/antispam/proc mail-security.html) that renames incoming attachments and makes them non-double clickable as well as pseudo scans office dcuments for dangerous macros.

The extra level of 'abstraction' (the user having to rename the file to run it) has saved us from every major email born virus in the past two years while still allowing people to get there precious attachments if they are expecting them.

Don't worry too much.

[Apuleius]

They're first time offenders who confessed. They're high school students who would otherwise be preparing to be drafted to the Israeli army soon, and the government will not want to disrupt that if it isn't necessary. Finally, they are from a town that is notorious for inducing boredom for its teenagers. They may get a few months, but I wouldn't count on it, and they'll get assigned to the Ma'asiahu prison, where conditions are very good (it's Israel's prison for first time offenders, and it's probably the only place in the world you could call a re-education camp without irony.)

Re:Don't worry too much.

[gnovos]

They're first time offenders who confessed. They're high school students who would otherwise be preparing to be drafted to the Israeli army soon, and the government will not want to disrupt that if it isn't necessary. Finally, they are from a town that is notorious for inducing boredom for its teenagers.

No, no, no! They are T E R R O R I S T S! Come on people, if you let terrorists like these kids off the hook, it's only a matter of time before they start bombing things and mailing anthrax, right? Gotta be tough.

Re:Don't worry too much.

[MostlyHarmless]

Without starting a massive flamewar about the Middle East which would still not make us agree and in the meantime just piss off everyone else on slashdot, I do want to correct a misperception.

I (most unfortunately) get the majority of my news from mainstream sources, and it is rare that they call palestinians "terrorists". Even Hamas or Islamic Jihad members (both of these are terrorist organizations) are listed as "activists" or "militants" by U.S. papers. It works both ways: Palestinians who are protesting peacefully are labelled roughly the same way protesters in Seattle were labeled (not in a positive light), by the same paper that will also show a picture of Israelis apparently firing on rock-throwing children (with gunmen behind the children, not shown in the photo).

In summary: if both Israelis and Palestinians think the papers are biased, the news sources might just be taking the appropriate, centrist line that doesn't choose sides.

Re:US Not Punishment Friendly?

[dadragon]

He was tried and in Montreal, Quebec. He pleaded guilty to 56 of 66 counts of Mischief before the Quebec Youth Court. Judge Gilles Ouellet of the Youth Court heard both the Crown and defence. The other 10 charges were withdrawn.

Re:Punish the kids?

[Anonymous DWord]

How very clever of you. Too bad the 800,000 people passing these worms around don't know as well as you which attachments to open, and which not to.

Re:at least IT is paid by the hour.

[Anonymous Coward]

"Using products that suck is your own fault".

For what it's worth, Microsoft is the biggest fish out there. In a large business with many users that aren't technically proficient, learning to use another program is difficult. So, Outlook is what they use and Outlook is what you'll find.

Blaming the users will not solve anything. It's nice to turn up your nose at their technical inferiority, but I fail to the how that helps anyone.

Expect all you want....

[barzok]

it still won't happen. Two months after NIMDA came out, a PC belonging to one of our remote users popped up and started attempting to push the thing onto any computer it could find.

This after all the usual emails after a virus and instructions on updating DAT files (click here, click there, if it says to reboot, do so, and that was it).

As much as we'd all like it to happen, non-IT people will not turn on their brains and apply logic & critical thinking to computer situations.

Re:Expect all you want....

[barzok]

Honestly, we don't know. All we have is the user ID, and I only know because I heard from someone else that the box was getting hit (virus control is the Security department's area, and I get slapped if I step on their toes. They had already been notified) and I checked the Event Viewer. Since it's a field user, we don't have much control over what software they do or don't have installed on their PC.

For the children!

[anfloga]

"The kids face up to five years -- of course since they aren't in the U.S., they might actually be punished."

What kind of stupid statement is that??? The U.S. shares the honor of being a country which will execute people for crimes committed in childhood with only one other country in the world -- Libya. Great company there.

Your statement implies that our government is soft on the law-breaking young -- HARDLY! Rather, it's attitude towards (non-white, anyway) children is nothing short of bloodthirst.

Re:Here's a bomb, enjoy!!

[PurpleBob]

Wow. That's one heck of an analogy.

"An e-mail virus is like a bomb. Well, not really a bomb, but a bomb that's like an e-mail virus."

Re:What Language?

[Alioth]

According to Symantec.com, it was Visual Basic.

Justice

[Shadowin]

The kids face up to five years -- of course since they aren't in the U.S., they might actually be punished.

Ok, I know I'll probably get marked as troll, but oh well.
The way I see, is these kids are kinda like Big Tobacco. They make something that's harmful, and the people that use it do so of their own free will, despite the countless warnings given out that they should not. It seems funny to me that the same people who think Big Tobacco shouldn't be punished, also think that any mischeivous kids should be severely punished. Well, that is unless it's their own kid.

Defense against information warfare

[xiphosuran]

These virus writers are doing a public service. Serious problems with our communications infrastructure might not be fixed if it weren't for them.

Imagine what could happen if the first exploits of these security flaws came, not piecemeal from a scattering of amateurs, but rather from some adversary who could call on the services of numbers of technically proficient individuals. A hostile government say, or a terrorist movement that drew in disaffected persons in many countries. What if the vast majority of business users had no idea of how vulnerable they were until the system suffered a massive failure?

There is an enormous learning process going. People are finding out the hard way, what they would never otherwise have the time to focus on: computers can fail, for very subtle reasons, and we are more dependent on them every day.

Re:Defense against information warfare

[Pig Hogger]

Imagine what could happen if the first exploits of these security flaws came, not piecemeal from a scattering of amateurs, but rather from some adversary who could call on the services of numbers of technically proficient individuals. A hostile government say, or a terrorist movement that drew in disaffected persons in many countries. What if the vast majority of business users had no idea of how vulnerable they were until the system suffered a massive failure?

And what do you know if it isn't already done? Some serious organizations bent on deeply infltrating western economies to damage would know better than do juvenile pranks like wiping all data on lawyer's computers!!!! They would instead spread thin and wide, and root deep for a while, lay dormant until, when they'll be thoroughly spread-out, wreak havoc like you haven't seen before!

Think of it as the cybernetic version of the World Trade Center.

Burger Flipper

[xixax]

Of the attachments I receive at work (no, I do not flip burgers):

- About a third are irrelevant to work
- About a third could have been done as text
- About a third already exist on fileservers

Then think about the amount of effort in building an insanely large Exchange server to host all this junk and, and compare it to the *very* modest box we used to use for mail. I used to accumilate maybe 20 Mb of mail a *year*, now I accumilate much more than that per month. On average, each of our users have about 200 Mb of "vital" correspondence in PST files clagging their homes (and the PST files starts to spontaneously combust when they top 70Mb or so). After all this, I think we have gone backwards in terms of investment/utility. We are paying a lot of money so people can use Word as their email editor and ignore good file management practises.

Yes, I'd agree that convincing PHBs they don't want floral pattern wallpaper on their email is a lost struggle, but the 1% of attachments people actually need would be far more effectively sent through other means and our mail infrastructure would be a tenth its current size.

Attachments are a PITA.

Xix.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Not in the US?

[autopr0n]

I'm a little confused by this:
of course since they aren't in the U.S., they might actually be punished.

The US has the toughest Anti-hacking laws of almost anywhere, other then china of course, where you can be exicuted for it (actualy, that's pretty much the way things are with any crimes these days, the US punishes harder then any country other then china). And, our laws have only been made tougher by the new anti-terrorism bills. In fact, had these kids been in the US they could have been tried as terrorists. (and I mean they must be terrorists, they're from the middle east!)

Why let it go so far?

[rnicey]

We run Sophos antivirus on the mail gateway. Sure it doesn't stop them all, but most anything that is a single click fatality is screened out. It happily killed all 120+ attempts of the Goner-A worm to arrive on one of my customer service rep's desktops.

I really have little sympathy for IT admins who get killed by this stuff, there are a million tools out there to stop this stuff from doing damage way before idiot humans get their hands on it.

I personally would like to see more ISPs use this stuff, after all they're not obliged to carry any traffic they deem high risk to their users. They already block dodgy ports so windows shares aren't wide open, why not a complimentary virus scan on mail?

Re:Why let it go so far?

[SuiteSisterMary]

I really have little sympathy for IT admins who get killed by this stuff, there are a million tools out there to stop this stuff from doing damage way before idiot humans get their hands on it.

I was of the same attitude, until I honestly heard a PHB say 'we cannot use a virus scanner on our email; it might block something that it shouldn't, and that could cost the company thousands of dollars.'

Re:Why let it go so far?

[SuiteSisterMary]

Yeah, I used scanmail for exchange myself. My point is that the people who write your paycheques can be impervious to such trivialities like 'logic' and 'reason.'

Re:they didn't do anything wrong.

[autopr0n]

I guess you think the architects should have been held accountable for the twin towers not withstanding a plane hitting them

Actually the towers were designed to be able to withstand a collision with a 747 (witch is bigger then the a 767 or 757).

So they shouldn't have fallen, what happened was totally within their design specifications. (looks like the engineers didn't count on all the burning jet fuel)

Re:What drives a script kiddie?

[OctaneZ]

Oh I agree with you, I'm just saying that the media and hype around (I mean Code Red made the 6 o'clock news in the states the day it broke) creates a "competitive" climate for the virus hackers. It's a challenge. I wholey agree that they want to see if they can do it, what will happen, can they beat the last "worst virus ever" (tm), I just think that the coverage that it is given hypes it and creates a mystique.
I'm just waiting for the next rendition of D&D/Magic/Pokemon/Fighting game to be computer viruses...

-OZ

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Sad...

[Lethyos]

I'm sorry, doing something stupid when you're 18 does not justify academic and professional murder nor is it suicide in those respects. You're going way too far overboard in your idea of what consitutes punishment for my offenses.

First of all, I was a paying student. The money I put into the university system there made those machines run. I had vested interest, so that lessens the severity of the intrusion. If you trespass somewhere on a college campus, as a student, they don't convict you of a felony. They realize you're a college student and you're not only stupid, you're probably just goofing around. They slap you on the wrist, send you home. End of story. They do not kick you out then tell the rest of the world what you did so that no other schools accept you.

Your opinion here is so utterly absurd that it baffles me how someone so intelligent would believe that it makes sense to destroy a person's entire life over a minor offense. Punishment is supposed to correct someone's way to conforming their behavior within the laws. Punishment is not supposed to ruin a person. I suppose your parent's never said "it's for your own good" when they administered a spanking?

The FBI was poised to destroy my life in countless conceivable ways. If I cannot acquire an education and hence live a professional career as a computer scientist, there's not much else I could do at this point. The life I have always wanted would be unreachable. So I cost the university a few man hours patching a few systems that had obvious security holes. I'm sure they made some student do the patching (which I informed the admins needed to be done, which is how I got caught - go benevolence) for free.

The justice system is supposed to balance the punishment with the offense because it is supposed to (as I previously mention) help offenders correct their ways. You do not execute someone for stealing a loaf of bread.

Maybe if you had the experiences I had in the whole situation, you would not hold this silly right-wing extremist viewpoint that believes punishment for every crime is death by sodomy. What I ended up getting was still too much to fit the crime, in not only my opinion, but in the opinions of people much more rational than yourself. (One of my laywers included, who managed to get one of the guys the university to admit, over the phone, that they wanted to make an example out of me by going overboard.)

Oh well... there's just too much I can say here and I know this is a lost cause. I should quit before I fall too far behind in the face of ignorance. Since you show me the discourtesy of defending injustice, I can only respond with the hope that one day you find yourself on the wrong end of an FBI prosecution. Maybe then you'll understand.

Re:Sad...

[Lethyos]

Why? Are 18 years NOT adults? They are, they should have all the privelages and all the responsibilities of the rest of the world. You admitted you broke the rules. You should be punished under the law when you break the rules. Can 18 years old not understand that? I am 20, and I can understand that. Why are you so different (well, back then, why were you so different?).

Yes, I certainly agree that a person should be punished if they break the law. I am not an anarchist. If you had actually read my post, you would have realized that I am talking about the punishment not fitting the crime. The punishment for computer crime is far overblown, I suspect because people (read: lawmakers) are still afraid of it. They do not understand it. We see countless other severe offenders like murderers and rapists get off their crimes with on average 1.5-2.5 year sentences. Many computer crimes see offenders get as many as five years or more! Is that justice? I think you oughta rethink your blind faith in supporting our justice system. Murder deserves jail time and a lot of it. Harmlessly poking around in a system does not. And again, maybe one day you'll understand, and perhaps even think for yourself without believing what the Man tells you verbatim. (News Flash! Computer crime is not worse than killing someone!)

You deserve it. You admit that it was wrong. You admit that you shouldn't have done it. Yet you suffered no consequences. Therefore no justice was served.

I never said it was wrong. I performed a valuable service to my university by informing them of a serious problem. I did say I was stupid because at the time, I thought my actions would be recognized as useful. As for suffeirng no consequences, you're full of it. I got fined out the ass and served probation for a year. Not to mention having my computer equipment destroyed (several thousand dollars worth was shipped back to me in boxes w/o any packaging). I was punished, but in great excess. Do you understand what it means to do something to excess?

I said before and I said now: I do not care the end result of the punishment. Whether or not your life is ruined after accepting the consequences is irrelevant to me. That is entirely up to you. Punishments hurt. Thats the name of the game.

Yes, punishment hurts, but punishment is useless if it ruins the potential your life holds. Did your parents, when they spanked you, intend for your future career options to be eliminated? No. They wanted to correct your ways to keep you on a path of success. By going so overboard, the FBI would have ruined my academic and professional careers if we hadn't gotten the offense reduced. What good would that have done? Our country doesn't need more burger flippers or uneducated people. It needs less of both! You still miss the point! YOU DON'T EXECUTE SOMEONE FOR STEALING A LOAF OF BREAD!


Again, what a load of crap. To begin, being a paying student is irrelevant. Can I hack the public utilities since they are public? Could my father kill me because he created me, and paid for me to be raised, and raised me? That is no mitigation. That actually makes it worse: you admit you had a vested interest yet you still acted poorly; it was community property (paid for in part by thousands of other students! what about their interests!) and you mistreated it.

First off, you're still blowing this out of proportion. I compromised a few non-vital systems on a college network of a school I attended, and let the admins know how I did it and how to fix it to boot. This is not on the same grounds as a father murdering his own son. Repeat after me: "computer cracking is not as bad as murder". It is not even close. If a parent murders their own child, that's a criminal act and should be severely punished because it is a severe offense. Duh. If a student cracks a system belonging to his university, he at worst, deserves a small fine and his network access pivaledge revoked. That would have been more than enough punishment. Ending my academic career and spoiling mine, or anyone's professional possiblities over such a small matter is absurd.

Well, this is a waste of time and I am going to end it here. Continuing to read your post, it's clear that you either didn't read what I wrote, or you are unable to comprehend it. I don't care what the law says, I'm talking about the absurdity of it! The law is wrong. It was made by people who are afraid of computer technology and think that "hackers" will bring down our nation if they go unchecked. Sorry, but that is completely wrong. Crimes that hurt people are wrong. Computer crimes that take down networks and cause extensive outages are also wrong. Neither of these are things I did. I didn't write Red Code and prevent thousands of people from gaining network access. I didn't prevent network access for anyone! No harm done. The university would have saved a LOT time and money if they would have just fixed the problem and talked to me about it. Addressing me on the issue in a civilized and appropriate manner would not only have corrected my ways, it would have made me retain respect for the university and the legal system. Plus, I probably would have gotten to interact with some really bright techies. Instead, I got to interact with two FBI agents bent on ending me. But that won't convince you, I'm sure.

You're more interested in seeing lives destroyed than seeing people learn. Punishment is meaningless if it doesn't teach someone something about what they've done. If you're going to punish someone so severely that they cannot continue to function in any positive sense afterwards, you might as well have killed them in the first place.

Re:they didn't do anything wrong.

[crucini]

I guess you think the architects should have been held accountable for the twin towers not withstanding a plane hitting them.

That's a bad analogy. It's more like four kids pressed a button on the outside of the WTC at street level, causing the towers to explode due to an engineering flaw. In other words, there is no way for a mail message to directly cause harm to your computer. It must be interpreted by a program which you trust (a traitor, in other words) which is willing to harm your computer at the command of an outside party.

I hate M$'s practices as much as the next guy, but you can't hold them responsible when someone else knowingly takes advantage of a problem that they did address in hotfixes and patches!

I absolutely can and do hold them responsible. Their decision to facilitate running programs that arrive in the mail without any kind of sandbox or access restrictions was an obviously dangerous one whose implications were immediately visible to people who understand computers. Microsoft spins their product as the omniscient gatekeeper to the internet and handholder to the clueless. They encourage the computer-illiterate to put their trust in Microsoft rather than learning how computers actually work. They created both the software and the culture that propogate malicious code. All of which means that they are greatly to blame for deliberately bringing into existence email viruses.

We must now bomb Irael

[Anonymous Coward]

The new US Patriot Act (HR 3162) makes creating and spreading virus and worms an act of terrorism. As such King George must require extradition of the offending youths and hold a military tribulan. If israel refuses to give up these kids, then we must bomb Israel at a cost of $1 billion dollars per month to US taxpayers as punishment for harboring terrorists. We must make sure to hit any buildings with big red crosses on them and then deny it. We must kill many civilians and deny it and when US soldiers get killed, we muist blame it on friendly fire.

Yes! AND Punishment for CIOs/CTOs

[Greyfox]

Writing and releasing a virus, worm or trojan is just as much an act of vandalism as if you'd gone out and smashed peoples' windows in. And you can smash a lot of windows with the Internet. No pun intended for this particular metaphor.

The question that never gets asked is why all these companies were vulnerable to these attacks. I've worked for several Fortune 500 companies and I've yet to see one with good security. You'd think they'd be going out and hiring a bunch of security professionals after Sept 11 but I'm not seeing a whole lot for infosec or security on the job boards.

Until some CIOs and CTOs start losing their jobs over this crap, the cycle will persist.

Re:Yes! AND Punishment for CIOs/CTOs

[Pig Hogger]

...
I've worked for several Fortune 500 companies and I've yet to see one with good security. You'd think they'd be going out and hiring a bunch of security professionals after Sept 11 but I'm not seeing a whole lot for infosec or security on the job boards.

That's because security is not good for the bottom line. It's too expensive.

Re:So?

[wganz]

After a number of these testosterone impaired virus writers share some time with a 6'6" 300 lb lifer that thinks that they are cute; writing viruses will no longer seem so funny. If you have the bandwidth to know how to write a virus, you have the bandwidth to know it is a virtual letter bomb that hurts people. It hurts people by taking away their productive time and denying them the use of the computer equipment that they bought.

To state the obvious, 'You f*** up, you pay up. You f*** with people, you get f***ed with.' What part of that simple truth you don't understand???

Re:Not to state the obvious

[Anonymous Brave Guy]

"Don't open executables morons", you guys snicker, "(except when you need to, which is all the time ... Yes ma'm, I'll be right over there to fix your computer, lickity-split)"

Well, that's kinda the point. People do need to send attachments, end of story. (OK, OK, that's not strictly true, but the hassle in using the alternatives would be too much for the average user.) All these people who run around saying "Competent sysadmins would disable it completely..." or other such rubbish have either never been a competent sysadmin or have been lucky enough to work in a company whose day-to-day business does not depend on these technologies. Most sysadmins are not that lucky.

OTOH, attachments are potentially dangerous. They are necessary, but caution is required also. The only solution to this is effective user education. As has been noted many times before, you cannot fix a sociological problem with a technological solution. To that end, I personally believe that blanket security restrictions and such are counterproductive; your users will simply learn to stop them, or complain until you are forced to remove them, because they can't do their jobs. Much better to illustrate, vividly but discreetly, the dangers they are ignoring, until they get the point. Restrict blanket bans to those who've demonstrated that no other way will suffice, and you'll keep more friends among your user base.

assail the practice not the concept

[Erris]

The reason given for hiring these guys was not to find out actual damages, but to jack up the cleanup costs into a range where the hit qualified as a felony.

How do you know the motive? Did they say that themselves? If they did a judge should have spanked them. If they did it because they lacked the time or competence to asses the damages themselves, the cost should be passed on. I can't tell from here.

That's why we have courts and civil law. An unbiased third party is supposed to take care of things like this. Abuses of the system do not make the system evil any more than computer abuses make programing evil.

With that in mind, those four should be made to pay. It does not matter that they can not afford it. They can suffer for their the wrong they did. This happens all the time. Losers are often reduced to poverty for thinking like this. "Duh, I don't have nothing to lose, so what?" Wrong, you always have something to lose.

All of that is beside the point, however. I'm just wondering where all the John Ashcoft fans are.

Re:Attachment blocking at the server [PLUG]

[ryanvm]

Okay, that works well for Exchange but what about 80% of the mail servers out there, which are not Exchange servers?

That's why I wrote batemail. It does exactly what you describe only it works on *nix based hosts. Any attachment that has one of the "taboo" extensions is automagically removed from the email and a notice put in its place.

You'd be amazed how many of these attachments we're stripping out on a daily basis where I work.

Re:My users are great

[SuiteSisterMary]

Or use a managed antivirus software whereby the server component grabs the virus defs, and punts them down to the clients.

virus training

[TotallyUseless]

here is what i do... every few months, make a hotmail account or something unrecognized by your staff. Mail them your own 'virus' that simply says 'You shouldn't open unknown attachments. If this was a real virus, your IT staff would be punching you in the face right now"

No problems here

[AaronW]

At the company I work for we've had very little trouble in terms of viruses and worms. Then again, they banned Outlook long ago. Whenever someone does manage to get hit, IT sends out a broadcast email warning everyone and telling everyone that this user was using banned software. A guy a couple cubes away ran Outlook and got hit with one of the worms. IT was there within minutes and immediately uninstalled Outlook, pulled the network connection, and left a nice note for the guy when he returned the next day.

It's too bad other companies don't wake up and just fix the problem to begin with... ban Outlook.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:they didn't do anything wrong.

[autopr0n]

They were designed to withstand one hit from a 707. They were NEVER designed to withstand a hit in each tower

whats the diffrenc between one hit to one hit to each tower? I mean, its still one hit/tower.

Re:Not to state the obvious

[Anonymous Brave Guy]

.vbs and .scr files are fair enough. The problem is, how long do you make the list? Will you also ban .exe? What about .zip, which could contain anything?

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:they didn't do anything wrong.

[Dr. Awktagon]

That's a bad analogy. It's more like four kids pressed a button on the outside of the WTC at street level, causing the towers to explode due to an engineering flaw. In other words, there is no way for a mail message to directly cause harm to your computer. It must be interpreted by a program which you trust (a traitor, in other words) which is willing to harm your computer at the command of an outside party.

Agreed, there should be absolutely NO REASON why a block of text and/or data sent to your machine should do anything you don't want it to. Since it does, and since these viruses get written over and over again, with no end in sight, the blame is with the software writers.

Now I'm not saying these kids should be let off the hook. They did something that was wrong and costly. But if we don't want to have this happen again, punishing the kids accomplishes nothing. Actually it makes the future virus writers want to learn how to be more stealthy.

The solution is sandboxes or code-checking with proofs. Or better yet, just displaying email messages as TEXT-ONLY, like they're supposed to be.

Crime to work on MS Systems?

[ytsejam-ppc]

I'm tired of people making apologies for not working as linux administrators or open source programmers. There are a goodly number of people in this world who make a living writing code for whichever system the managers deem fit, and a goodly number of administrators who administer a network full of whatever operating systems the business deems fit for survival. Why don't you wear your job with pride and be thankful that you are employed. There are others who aren't so lucky.

Only if IT has teeth.

[devphil]

Personally, I always liked the "drill" approach. The IT guys occasionally create a Hotmail account or some such, and mail something cool-looking to a few random accounts at the company. If you run the attachment, it pops up a simple message on your screen informing you that if this had been real,[...]

Unfortunately, that assumes your IT dept actually has the power to do something about stupid lusers.

I work on a U.S. military base, and while some of these viruses are caught by the filters on the Exchange server[*], they pose enough of a risk that once, the base IT folks sent out a "drill" email. This one sent the user to an internal webpage which threw out some technical-sounding gibberish -- NOBODY in the whole damn WORLD is as good as the U.S. military at generating technical-sounding gibberish -- and asked the user for their username/password.

Which they've been told repeatedly not to do. Those who entered it got a huge flashing warning sign, their username was recorded in a "morons" list, and an announcement went out the next week saying that the morons in question would have to submit a 100-word essay on why they should be allowed to continue to have access to the computer network, given that they're (apparently) willing to hand out access to any random webpage.

Cool, huh? 'Cept that some of the N-star generals with more stars than neurons were on that moron list, and of course they have way too much pride to be explaining to anybody why they should be permitted to do whatever they want. So a few days after the first announcement, another announcement went out, "Never mind."

And the morons continue to wreak havoc on the network.

[*] Those filters are fucking stupid, I might add. Frex, the word "funny" in the subject line triggers them. We found out about this one the hard way when a user mailed us with, "The secondary RAID is acting funny."

Re:What drives a script kiddie?

[duffbeer703]

How does that make them different from any perl, java or vb programmer?

Re:they didn't do anything wrong.

[duffbeer703]

"They encourage the computer-illiterate to put their trust in Microsoft rather than learning how computers actually work. They created both the software and the culture that propogate malicious code. All of which means that they are greatly to blame for deliberately bringing into existence email viruses."

Those people whom you despise are the ones who ultimately pay your salary.

There is nothing more obnoxious than a IT person who forgets that the computers are there to drive the business, not vice-versa.

Yes

[autopr0n]

Yes, it does. Everything from .doc to .htm to photoCD files.

Re: Linux wouldn't let a 'user' cripple the system

[ChadN]

What I would like to see is some form of capability added to Linux (et. al) such that "tainted" executables can only run in a "sandbox" environment (ie. like BSD jail() ), and thus, be unable to delete my home (since it would lose write ability to all but a virtual home filesystem when run).

Then, all files that were sent through email could be marked as "tainted" until and unless the user untaints them. Thus, even running such a file after it has been saved from an attachment would be safe.

Obviously, there would have to be some safeguards to prevent trojans that run one way when tainted, and then delete everything when they are not. But if most things worked fine when tainted, it might be an effective strategy... Does the idea have merit?

Re:huh?

[rlowe69]

Outlook doesn't "transform" anything. What, it turns non-executable, attachments into executables?

If I send someone a VBScript file by e-mail, someone using pine will only see the source of the file. Benign.

In Outlook, the file will be executed. This is how Outlook virii spread. Where have you been the last 18 months?

The situation is no different than if you were mailed a package with a piece of candy in it, ate the candy, got sick, and then blamed the USPS.

This analogy is wrong. A proper analogy would be if someone sent you a bomb in mail and when the postman brought it and you signed for it, the postman opens it and detonates it on your front porch. The USPS would be held accountable through their employee. Just like MS should be held accountable through their software.

Having hard drives erased, files deteled and bandwidth used up is not equivalent to 'getting sick', for a business it sometimes means nothing can get done for an entire day or more.

IMO, MS should protect against this and be accountable for what their software does.

Code == speech?

[Ogerman]

I know that's a popular viewpoint around here and one that I hold myself. But in this case, I'm not sure that viewpoint is being represented. Instead, people are discussing the degree to which these kids should be punished for their acts of lameness. A virus is just code. You can write it on a napkin as Haiku. You can print it on a t-shirt. You can represent it as a prime number. And without a vulnerable system, the virus would have no meaning, except as a random code fragment that doesn't work. In some cases, a perfectly legitimate binary (or heck, any data) for one system can be detected as a virus for another. If these kids had not initiated harmful distribution this virus, but rather published the code on a webpage along with documentation of the vulnerability, and yet somebody else turned it loose, should they still be held accountable? Or what about a good virus/worm that can be used by administrators to quickly and controllably patch up a network, but which may be harmful if released "into the wild." (I can name no examples, but it's a theoretical possibility). Kinda different way of looking at it, eh?