Slashdot Mirror
Fizzer Worm Uninstalling Itself
boredMDer writes "According to a recent update on the Dshield.org mailing list, apparently the Fizzer Task Force has gained control of the Geocities webpage from which Fizzer updates itself. From an IRC-Security mailing list: 'We have also postted a Fizzer cleaner to the actual URL that the bot downloads its updates from, as a self extracting and running executable.' The Fizzer-uninstaller posted there creates the file '%WinDir%\uninstall.pky', which then causes Fizzer to remove all of its registry keys. Looks like the Fizzer worm will soon come to an end."
...now control the update page...
At what point does the vigalante hacking become acceptable when fighting against Something Bad?
If this worm updated itself from a random group of computers that it had infected (say for exmple, yours), would you mind if they took control of your computer if it meant stopping the worm?
Why isn't the geocities site saying it's 'bandwith exceeded' or something?
Guess thats another thing worm writers will pick up...dont have autoupdate from a website, without that little "feature" the worm would probably hang around for alot longer.
"What do you mean you have no ice? Do you expect me to drink this coffee hot?" - Random Customer, Clerks
Hmmm... hijacking a web page to interfere with the virus' self-update. Is this an illegal "circumvention" of a "protection feature" in this copyrighted program (regardless of how it's installed)?
Don't get me wrong; I applaud the efforts of the virus busters; I just figured it was yet another example of unintended DMCA side-effects.
Its nice to see some people just looking to do some good.
There is nothing inherently safe about liberty. That's why so many people died protecting it.
1) Run the risk of potentially damaging peoples' computers by running code on them that hasn't been thorougly tested on all platforms.
2) Leave a massive network of compromised systems in place which could be used to launch a massive DDOS against banks, internet connected water and electrical grids or law enforcement networks.
IIRC (IANAL) the law gives you a good amount of latitude in defending others. This includes the little-used ability to make a citizen's arrest and also allows you to kill to protect others in some circumstances.
I'd put my money on the correct choice being to remove the weapon from the hands of the criminals.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
It would have been smarter for the worm to verify a signature on the code it downloads
Even better, it should not go to a hardcoded URL. This makes it too easy for the enemy to take over a vulnerable web page and attack the worm operation.
The worm should download its code via. P2P, maybe IRC, or maybe even Freenet. Especially Freenet. This way, the more the worm updates are requested, the more they replicate.
Maybe the worms could even try to keep track of each other, forming their own network, in a very low-key, low bandwidth, gnutella kind of way.
Finally, you had better not be shown to have the private key when the bad guys come knocking.
The price of freedom is eternal litigation.
RIAA's counterpoint:
All we're doing is putting a virus-infected MP3 file on our own machines and running KaZaA. It's not our fault that people download it and run it on exploitable software.
Is there a difference here?
Truthfully, maybe not. If somebody had hacked the geocities page in question and caused fizzer to completely toast the OS it's running on, that would certainly be illegal (even if the person was not the original creator of fizzer). The fact that you are doing something good does not necessarily factor into the law.
However, the key point here is this: nobody is about to go out and sue the Fizzer Task Force for doing this. We are all pretty happy about it, and most of us think it's a pretty clever solution to a real problem.
They most likely contacted Geocities and asked for access to the account so they could stop the worm.
An look at ethical issues involved in "hacking-back" was written by a cow-orker of mine. It looks at different ethical systems and how they might be applied here.
It's called "Crossing the Line: Ethics for the Security Professional"
Aren't they violating the DMCA in doing this? After all, they reverse engineered the virus' code and are interfering with its copy mechanism... do I need to say "copy protection"? :)
"It takes considerable knowledge just to realize the extent of your own ignorance." - Thomas Sowell
And it could be argued that people who let viruses like this onto their machines have no training, are incompetant, and need to have experts solve their problems for them.
Let's try another analogy then:
Let's say that you are just an average person going in to get a flu-shot at the doctor.
The flu vaccine wasn't manufactured correctly and has a small amount of contamination that causes people to become slightly feverish. It's not fatal, but it's uncomfortable.
The health authorities, rather than trying to re-vaccinate everyone effected, put the cure (100% safe and effective) into the public water system to help everyone as quickly as possible, prevent the spread of the problem, etc.
How do you feel?
"Nothing strengthens authority so much as silence." - Charles de Gaulle
What actually happens is that there's a series of update sites hardcoded into the worm. Reddog (A Magicstar op) found one of them that "Sparky" hadn't registered yet, registered it, and put up the update file with the uninstaller.
:)
Pure genius, really.
Mad props, Reddog.
-- Antiarc