Slashdot Mirror
Fizzer Worm Uninstalling Itself
boredMDer writes "According to a recent update on the Dshield.org mailing list, apparently the Fizzer Task Force has gained control of the Geocities webpage from which Fizzer updates itself. From an IRC-Security mailing list: 'We have also postted a Fizzer cleaner to the actual URL that the bot downloads its updates from, as a self extracting and running executable.' The Fizzer-uninstaller posted there creates the file '%WinDir%\uninstall.pky', which then causes Fizzer to remove all of its registry keys. Looks like the Fizzer worm will soon come to an end."
No, the Fizzer runs the code. I think this is a pretty elegant solution to the problem.
OddManIn: A Game of guns and game theory.
They aren't running code in individual computers. They are merely putting code up which may run on your computer if you have this virus and uninstalls it. I know it sounds bad the way you say it and in general it usually is bad but the URL is out there if you want to disassemble it make sure its just uninstalling. Go ahead. I'm sure other people are interested and doing so. If someone finds out that it is more than just the uninstaller, then we can hang someone.
Now the computer security community gets to have a big debate over whether this was ethical or not...
If you had super powers, would you use them for good, or for awesome?
I can only imagine that this is now the bullseye for hundreds of crackers who want to compromise people's computers. I hope the honest security people who have "taken control" of this page are making sure every few seconds that their true uninstaller program is there, and not someone else's kRaK program.
Never hit your grandmother with a shovel, for it leaves a bad impression on her mind...
Being that these people are running code on their machine that they have no clue they're actually running.. hammering the piss out of irc networks all over the world, wasting bandwidth, creating havoc and otherwise presenting their computers to whomever wrote this cluster as a gift?
Yeah.. what adverse effects? Can they be any worse than what's already there? Seems to me if you don't have the worm stop worrying about the effects. If you do have the worm.. get rid of it on your own.
The rest of us (the IRC Community) have to deal with the threats as they come down the pike.
The world according to SComps
i would say not. I think what most virus writers want to do is get a worm that quickly spreads to everyone. Weather it hangs around is of no importence, so having a way it could be disabled after a reasonable ammount of time (a few weeks) would not be bad for them. Just like game companies only have copy protection so they get huge sales for the first week or so, - they know the protection will be broken but not for a short while afterwards.
Slashdot - The one stop shop for procrastination
2 wrongs != right
It is up to the user to fix this stuff, not some IRC dork that wants to prove his/her mad skillz to the world.
But this isn't "mandated" in any way. If you have a computer that automatically downloads and executes a file from a URL, then that's *your* problem, isn't it? Especially since there are ways to avoid such things from happening... (Starting with personal firewall that blocks IE from accessing the network, and use some other browser...)
Like remove windows?
Got Code?
Isn't this just as illegal as releasing the worm itself? What if the fix has some adverse effects that we don't know about?
Nope. This is perfectly legal. They aren't breaking any security on the infected machines, and they aren't contacting them.
All they're doing is putting a file on a webpage. It's not their fault that the infected machines run whatever is on that page.
Generally, have illegaly used someone else's computer, you have to have defeated some sort of access control mechanism. At least that's how it is in NYS.
Since the remote computer is initiating everything, and all they're doing is answering requests, it would be pretty hard to charge them with unauthorized use of your machine.
Think of it this way:
1. The remote computer goes: "What do I do?"
2. The server goes: "Well, since you're asking, I think you should do this."
There's no stolen password, and there's no exploit needed.
Here's another example:
I put a box on the internet, let's call it pk12.foobar.com. This box is a Linux box which accepts any username/password combo as root, and no notices that it is for private use only. Under NYS law (I'm not sure about federal) you can come along and use any services my box provides, including telnet, http, ftp, etc.
IMO, if the fix trashes your data, tough shit. Are owners of DDOS zombies held responsible for the damage their computers are doing?
Morally, this is like parking in front of a hydrant and then bitching because they smashed your windows to run the hose though your car or towed it. It's doesn't matter if you knew you were parked in front of the hydrant. Your car was causing a danger and it had to be dealt with. If you don't want that happening to your car, you should make sure you don't park in front of hydrants. It's your car. You are responsible for it.
Life is too short to proofread.
Of course 2 wrongs can make a right.
Imagine you were in the bizarre situation where you had to shoot a terrorist to stop him from blowing up the entire world, killing everyone.
It is wrong to kill - but in this situation surely it would be right to.
That's not 2 wrongs. It's 1 wrong that avoids another.
2 Wrongs would be if the terrorist blew up the world, so then you kill him.
I guess 1 wrong can make a right!
I just google uninstall.pky at 3:06pm Polish time, and I received 28 results. Lets see how fast this info spreads on Google
Logic, macros, and more
If someone broke into your house, would you mind if a friendly neighbor quietly quietly followed them in and escorted the intruder out? Or perhaps you'd prefer your neighbor to let the intruder rob you, or whatever they intended to do.
They also didn't "hack" geocities like some have suggested...
I dunno, I just don't see anything wrong here.
Sticking feathers up your butt does not make you a chicken - Tyler Durden
Instead of spawning an uninstall-executable perhaps this should spawn a quick harmless executable that will start an Internet Explorer process directing victims to a website warning that they indeed have this trojan and what action they can take to remove it... My $.02...
Wrong answer! Try again!
By your theory, anyone who forgets to lock the door to their house deserves to get robbed.
Sure, it's not ethical on its own to force a download on people... but it is likely MORE ethical than allowing these clueless infected types to continue to infect others.
If someone's unconcious and bleeding from their head, is it ethical to patch up their head wound without their permission? I'd hope so.
--- http://foo.ca
Would you mind if some stranger came along and pulled the weeds out of your garden?
I would. I wanted those weeds there, dandelion makes a good salad.
This seems like what the RIAA wanted permisison to do. They believe its their content so they have access to it no matter where it is.
I mean this in the context of the Geocities web page. Do they have permission to alter the contents of that page??
Solution is elegant, but lets be consistent and understand the implications.
First off, can we get some whitespace? Please?
Good intention does not turn an illegal act into something legal.
Actually there are plenty of laws which consider intent. Here are the NYS computer crime laws for example. Go ahead, Control-F, type "intent".
Life is too short to proofread.
so.. if I were to put a script on my machine in say the /c/winnt/system32/cmd.exe?/c+dir
that would innoculate against code red would this be legal?
Assuming I knew how to do this.....
I still get 30 of these requests a day in my log....
It is wrong to kill
Obviously not. If someone is trying to kill me, I am well within my rights to kill him first. It is only murder that is wrong.
"We returned the General to El Salvador, or maybe Guatemala, it's difficult to tell from 10,000 feet"
After reviewing the arguments, I've concluded this is a good thing. Maybe even a necessary thing. Here's why:
Have you ever tried to explain to an end user what a virus is and how it works? Few have a decent understanding of what viruses are all about. Even folks with a technical background have a hard time keeping up with them, and knowing all the types.
As operating systems and viruses get more complicated, this gap will only get wider. I saw that article/paper arguing that as computers becom almost biological in complexity, they must be able to fix their own minor problems. Same type thing.
I guess that would make them liable to pay damages if their removal code did some damage, and doing something like that is sticking their necks out to be chopped off. Which makes them either unselfish and brave, or stupid.
Too bad there really isn't any "real-world" analogy for this case... I'm having hard time deciding if they did wrong or right. I guess I consider myself to be enough of an anarchist that I must support this kind of positive activism ;)
Especially Freenet.
Yup. Untraceable, but probably useless if you want to use machines behind nat/firewall.
Maybe the worms could even try to keep track of each other, forming their own network, in a very low-key, low bandwidth, gnutella kind of way.
This was the idea behind the Curious Yellow concept. It was featured on Slashdot a while ago.
No sig
I was referring to unrequested code being run on computers on my network. Fizzer_bad and Fizzer_good should not be there. And there is no verification that Fizzer_good is actually that. Sounds like the perfect way to launch spyware with everyone saying "thank you, may I have another."
That page belongs to Geocities, as the worm author had violated the TOS by performing illegal activities with their account. Geocities thus can give out the old account to whoever they want.
Unfortunately, by the same argument...
the telnet daemon runs login, login runs a shell, and the shell executes the code.
Though admittedly "Digital Copyright Millennium Act" is perfectly accurate...
/Brian
(mod self -1, Silly)
Ok .. i don't know much about Fizzer.. but if its keeping itself alive by self updating off of a geocities site, AND WE KNEW THIS. Why the hell didn't geocities just take the site off?
I mean I can't even link a picture from geocities to another site.. but Geocities lets this worm update itself from something on the webpage?
Even past that i saw something mentioned about bandwidth.. if Fizzer is that bad wouldn't its constant updating overload the free bandwidth from the geocities site?
Educate me please.. I'm kinda confused here.
Who makes you Sig?
Looks like it's better to ask forgiveness than seek permission.
My Linux Command of the Day site : LCOD
This is using an existing virus to hijack your computer. That is a dangerous precedent. In this case, it is a good thing. But what happens when, say zonelabs decides that it should let the police crack your computer in their search for child por nography? Or when AOL decides that it is their best interests to install a backdoor in winamp that phones home when suspected pirate music is played? Or when Microsoft determines your Windows OS is in violation of the latest version of your Hotmail licensing agreement? All in the name of goodness and decency, y'know?
Realistically, I'm not opposed the act. Its a good solution to real problem. But it is more important to maintain civil order. If there was a government approval along the lines of a search warrant to do this, than I say okay. Not that I trust the government, or think it is competent in these matters, but this is what the government should do. It's got its hand in a lot of pies where it doesn't belong, but it's real purpose is civil order and public defense.
How is automatically downloading a antivirus any more legal or ethical than automatically downloading a virus without user permission?
Essentially, the same way the fire department has implied permission to save your house and pets should your house catch fire when you are unreachable.
That is, the worm presents a danger to other people's property (servers) and it's a good bet that anyone having it would sincerely like it to be gone. Anyone who WANTS the worm to remain, AND hasn't isolated it from the rest of the net is necessarily deliberatly spreading it, and so is guilty of a felony.
Well, the next time, the author of the worm will probably be more careful in writing the code that executes the update package which is SIGNED by her private key. So, this kind of (elegant) solution won't do the trick...
How do you feel about fire trucks running red lights?
But they don't have implied permission, they have explicit permission from an elected government (at least here). In this case the people doing this are akin to a band of vigilantes, something that civilised socienties all over the world have rejected in the real world.
They are more like a volunteer fire department. In the absense of an appropriate civil authority, sometimes, citizens must get together to do the appropriate thing.
Vigilanteism is an act of ignoring an existant and appropriate civil authority in order to take independant action.
Releasing Fizzer may be a crime in some jurisdictions. The registry
changes made by Fizzer may constitute evidence of this crime. A
potential concern is whether this distribution of uninstall.pky could
lead to destroying relevant evidence. People may want to consult the
legal literature about "third-party spoliation of evidence".
I think you're flat-out wrong. Motive (and results) are very important.
If a burglar drops his gun, and you pick it up and shoot the burglar, that is a good (and usually legal) thing. If you pick up the gun and shoot the bank teller, you're gonna fry. That should be obvious.
Using an exploit to remove the exploit is a pretty good idea. Of course it should be tested beforehand, and shouldn't do anything risky (like deleting infected files). In this case they said all it does is remove the registry keys that Fizzer adds. That isn't a very risky thing to do, and I'm sure they still tested it beforehand.
What they did is perfectly legal and a very good idea for everyone involved. This isn't at all similar to the RIAA using an exploit to delete your files, or Microsoft using their own program to subvert security on your computer.
In your examples a deception, misrepresentation, or a deliberate circumvention of existing security mechanisms is being employed. None of these things are happening here.
In the situation at hand neither of these things is happening. The worm is looking for an
they haven't tested this update on a wide variety of systems, and it may cause a lot of damage and data loss. It's not their place to make that kind of a decision.
Cry me a river. These systems are already hacked. If you want your system to be reliable, you shouldn't have worms on it. It's not like this is the first day Fizzer hit or something.
If you don't want your system to automatically download and execute code at a certain URL, why don't you make sure your system doesn't do so?
I wouldn't be suprised if this method was totally legal.
How about this: Why don't you try and tell me what law you think they're actually breaking?
Normally, I would be against any sort of "hack them back" actions, but I just can't see how this is hacking them. If the infected machines were just checking the webpage for the word "monkey", would adding the work monkey to that page be illegal? I just can't see how it would be.
Life is too short to proofread.
I am a law student, and that post is missing some important facts. The police would have to have a warrant to search your HD, no matter if Zonelabs let them or not. As for the other two scenarios, they can happen right now. It's a matter of contract law and whether or not the EULA allows it and will stand up in court.
Be realistic. They're not hijacking your computer. They're removing a virus.
Don't rely on this advice, though. I am just a student.