Slashdot Mirror
Fizzer Worm Uninstalling Itself
boredMDer writes "According to a recent update on the Dshield.org mailing list, apparently the Fizzer Task Force has gained control of the Geocities webpage from which Fizzer updates itself. From an IRC-Security mailing list: 'We have also postted a Fizzer cleaner to the actual URL that the bot downloads its updates from, as a self extracting and running executable.' The Fizzer-uninstaller posted there creates the file '%WinDir%\uninstall.pky', which then causes Fizzer to remove all of its registry keys. Looks like the Fizzer worm will soon come to an end."
They're intentionally running code on peoples' machines without their permission?
Isn't this just as illegal as releasing the worm itself? What if the fix has some adverse effects that we don't know about?
The theory of relativity doesn't work right in Arkansas.
...now control the update page...
At what point does the vigalante hacking become acceptable when fighting against Something Bad?
If this worm updated itself from a random group of computers that it had infected (say for exmple, yours), would you mind if they took control of your computer if it meant stopping the worm?
Why isn't the geocities site saying it's 'bandwith exceeded' or something?
Guess thats another thing worm writers will pick up...dont have autoupdate from a website, without that little "feature" the worm would probably hang around for alot longer.
"What do you mean you have no ice? Do you expect me to drink this coffee hot?" - Random Customer, Clerks
If it's done by an 'official' security agency with govt. approval then it's ethical, if it's done by a netizen vigilante group then it's not ethical - just like if a fireman pulls a victim from a burning building s/he's a hero, but if John Q. Passerby tries to help he's arrested for tresspassing.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
But this isn't "mandated" in any way. If you have a computer that automatically downloads and executes a file from a URL, then that's *your* problem, isn't it?
Yes, but the people who put the file there cannot really claim that they didn't know that the file would be downloaded without the knowlage of computer users onto their machine. They could have just deleted the file.
Especially since there are ways to avoid such things from happening... (Starting with personal firewall that blocks IE from accessing the network, and use some other browser...)
Indeed, I have little pitty for anyone who chooses to use IE.
Beep beep.
Hmmm... hijacking a web page to interfere with the virus' self-update. Is this an illegal "circumvention" of a "protection feature" in this copyrighted program (regardless of how it's installed)?
Don't get me wrong; I applaud the efforts of the virus busters; I just figured it was yet another example of unintended DMCA side-effects.
Its nice to see some people just looking to do some good.
There is nothing inherently safe about liberty. That's why so many people died protecting it.
1) Run the risk of potentially damaging peoples' computers by running code on them that hasn't been thorougly tested on all platforms.
2) Leave a massive network of compromised systems in place which could be used to launch a massive DDOS against banks, internet connected water and electrical grids or law enforcement networks.
IIRC (IANAL) the law gives you a good amount of latitude in defending others. This includes the little-used ability to make a citizen's arrest and also allows you to kill to protect others in some circumstances.
I'd put my money on the correct choice being to remove the weapon from the hands of the criminals.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Want to show a case proving this? Even vaguely?
There was an instance about two months ago of a man whose apartment was on fire running into the burning building to save his dog. The fire department had the police arrest him.
The FD did not want to enter the building because it was too hot/dangerous, and wanted to let the hoses cool things down a bit at first (a perfectly sane decision, IMHO, since there was no human life at stake.) The pet owner didn't like that idea, so took matters into his own hands.
The reason for his arrest is he "put the lives of firefighters and others at risk" by his "reckless" actions.
Not EXACTLY what the original poster was talking about, but fairly close.
What part of "shall not be infringed" is so hard to understand?
They most likely contacted Geocities and asked for access to the account so they could stop the worm.
No, don't move them and call for help. They are very unlikely to bleed to death from a head injury and you will do more damage than good. I hope you understand now, but I doubt it.
An look at ethical issues involved in "hacking-back" was written by a cow-orker of mine. It looks at different ethical systems and how they might be applied here.
It's called "Crossing the Line: Ethics for the Security Professional"
Wow. Way to fucking miss the point.
No "vigilantes" have not been rejected, not even close. I can hire a private security guard, and I can also band together with my neighbors for mutual self defense. If I see an obvious stranger breaking into my neighbors house, I can go over and stop him, OR call the cops, OR both. and ESPECIALLY if 'government" has proven itself over and over again to be ineffectual, like they once again have shown here. and what's the alternative, do you REALLY want a huge new bureaucracy of government cyber cops, beyond what we have now? I sure don't, I'd rather leave the net alone, let the victims be able to FIGHT BACK.
It's just the word got hijacked by the pansy PC police. People are too scared for self defense any more, a lot of them anyway, they want nanny government to always be there for them. Government has it's place, but it's not the entire total solution to crime.
In this instance and other instances, government is 20 years behind when it comes to dealing with spam, viruses, etc. Ya, they passed a few laws, whoopedy zing, they haven't stopped any crime,they haven't stopped or even cleaned up one virus or worm that I am aware of, except off their own computers, at best, government usually just reacts to crime after the fact, and most of the time they don't even get that right.
Frankly, I'd like to see open relays that are hijacked treated this way, maybe a screen pops up HEY, QUIT SENDING ME SPAM, MORON!
then maybe people would start to take more proactive measures with their computers, or demand the OS and app vendors to do a better job.
Maybe, don't know, but if someone hacks me,or infects my box, I claim the right to fight back, to use whatever self defense is at my disposal, same as when I am out and about on the street. these poor IRC people are doing all they can do, or should a worm writer have the right to just destroy their networks?
I don't see any problem with this thing, none, good for them to do something actually effective. Same as spamming spammers, tough luck for those nimrods.
I LIKE good old fashioned in your face instant karma justice, I LIKE to be "vigilant". If we had more of it, there would be less crime. People talk about the old "wild wild west", but if you research it, with only a few exceptions it had much less crime than what we have now, the only difference is, the crime fighting was mostly done by the victims. It's not perfect, but nothing else is either, is it?
They're just putting a file out on a web page. It's people's choice (since they chose to become infected) to download and execute it. More power to the team. A nice way of eradicating a nuisance.
"The guide is definitive, reality is frequently inaccurate."
What actually happens is that there's a series of update sites hardcoded into the worm. Reddog (A Magicstar op) found one of them that "Sparky" hadn't registered yet, registered it, and put up the update file with the uninstaller.
:)
Pure genius, really.
Mad props, Reddog.
-- Antiarc
Yes, there is a binary out there. It's also encrypted (PE compressed, actually) - I doubt you have the resources to decrypt it and alter the binary. The people hacking on it were able to find the strings it contained by infecting their own machines and using WinHex to stroll through RAM. If we'd been able to decrypt it, things would have been a lot easier.