Slashdot Mirror
Blaster Writer Caught
Henry V .009 writes "The FBI will be arresting an 18 year-old in connection with MS Blaster, reports The Washington Post." According to the article, the teen was witnessed testing the worm, and then turned in by a bystander. It's also worth noting that this is merely one of the Blaster variations. Hope whoever it was had fun, because a world of pain is waiting in store now.
How on Earth do you witness somebody writing a virus?
He's sitting in front of a computer, hitting keys on the keyboard and looking at the monitor. That describes the person who wrote this story, the person who submitted this story, the person who posted the story, me getting first post, and everybody reading and moderating this and every other post to come.
It also describes RMS writing Emacs, Linus debugging the kernel, and SCO issuing another press release.
Did this witness actually read the code? What kind of idiot virus-writer lets someone he doesn't know pull up a chair and start auditing his code?
Or was the witness tipped off when the screen start flashing "NOW TESTING VIRUS"? Damn, I hate when that happens!
This doesn't sound quite right.
Is this truly the only Earth I can live on?
I mean, maybe he borrowed his mates computer to do something, saw something interesting, then got told to take a long walk off a short plank when he tried to blackmail him.
Well until someone is caught and Proven to have written the virus, as far as im concerned it is a bunch of FUD.
Life is like a box of chocolates, you never know when your gonna get food poisoning.
I'm no sure about the world of pain. Given the age, given the media, I predict the sympathy angle will start to be played for all is worth.
This is a ~10 year old vulnerability in DCOM.
Corporate neglagence is still a crime. and Corporations are Individuals, therefore Microsoft, Inc. Should be incarcerated.
Buttsex.
Well if he's reads slashdot, he'll be long gone by now
Is it standard FBI practise to anounce to the public they will arrest someone before they actually do?
This guy's probably just a kid that grabbed the worm while it were passing, modded it a little and passed it on. I doubt it's the original author...
Although, looking at how lousy that worm was implemented, the authour might be dumb enough to get caught.
The next great MMORPG.
I submitted this story sometime ago, but got rejected. The kid actually did not write the MSBlaster worm, he modified it to make it more potent and released it. story here
.ACMD setaloiv siht gnidaeR
Perhaps, as some kids are at that age do (not all before you flame me), he had been bragging about it in an irc chat room, had an enemy/concerned chatter catch wind of it and reported it to the feds with logs and IP information.
Why not eh? stranger things have happened at sea.
--Mods giveth, Mods taketh away--
It can take weeks of computer forensics to identify what someone was creating on a computer, so I doubt very much that they're 100% certain this kid is guilty without inspecting his equipment. And last I checked they need proof before assigning guilt (unless Ashcroft's already removed that clause from US law).
Yo, RFTP/RTFA. It says in both the article and the post that the witness saw the person "testing" the virus, not writing it. Which is even more scary in a way. How did the witness know what he was doing? What day was it? Which version is he supposed to have written? Oh, and there has been "no arrest made in this matter yet."
The BBC article contains a bit more info: It says he's suspected of altering the original MSBlast worm into one that would cause more damage.
It also says: "Reports suggest he is likely to be arrested by the end of the day." WTF? They're giving him advance warning?!? Run, boy, RUN!!! LOL.
I wonder if this could be the variation they suspect the teen worked on? If so, it could turn into a slippery moral slope for the press to take a stand on either way...
IIRC, the boy tried to DDOS www.windowsupdate.com, which is not the URL people usually use for windowsupdate.
Makes you wonder what a professional terrorist could do. The worm could have been far more destructive.
Infected computers were programmed to automatically launch an attack on a Web site operated by Microsoft, which the software maker easily blunted. The site, windowsupdate.com, is used to deliver repairing software patches to Microsoft customers to prevent against these types of infections.
:\
Talk about an advertisement.
Anyway, doesn't it ever occur to the press that Microsoft could actually be doing a better job researching into securifying their products *pre* release? Right now (as everyone knows), they're submitting corporate-level products to corporations, making gazillions of dollars, and ignoring any bugs until someone points them out.
When is somebody going to finally decide to call them on this and force Microsoft to do a security audit?
www.sitetronics.com/wordpress
Well, the BBC article claimes the FBI already talked to him.
There is probably more to this then the article states (as is almost always the case with the media-reports). It's pretty vague. A witness, testing? Where was he testing, and how. AV-companies also test this stuff.
Context is missing, so I guess a conclusion will have to wait till this afternoon.
So "used" cases that used "unused" could break, though older compilers in essence used "unused" to mean both "used" and
***World crippled by 12 year old***
Who would've gotten blamed then and what would've been the consequences?
-Look lively. LOOK LIVELY!!! --Mr. Shmallow
Few years ago, one of our local companies got hacked and it took like 1 week to catch the "hacker".
How? He started bragging about what he did in a IRC chat room... But oops.... few days later caught!
For gods sake he was like 23 years old!
Mafiaboy.
Given the age (he was only 15!), and given the media, he was still crucified. There was no sympathy angle, there was no "youngster gets hassled by overzealous feds" angle. He was, as could be expected, generally portrayed as an evil h4x0r who DoSed eTrade, eBay, Yahoo, etc.
No, whomever launched MSBlaster.B is not going to become a media darling, and he damned sure isn't going to win the hearts and minds of Joe Sixpack, whose computer kept rebooting itself due to the various incarnations of MSBlaster.
From a personal standpoint, I think it's sort of shitty that this kid is getting busted for what seems to amount to no more than a bit of hex editing. I'd rather see the FBI investing its resources into tracking down the author of the original MSBlaster (as opposed to a barely-modified variant which didn't propagate widely)... And I'd much rather see them go after whatever assclown is responsible for SoBig.F, of which I've now received more than 6,000 copies at 100KB apiece. That's not to say that they aren't investigating these things, and I hope they find the perps eventually; but I think it's a bad deal that they're going to bust a kid who made a knock-off instead of the guy who started it.
I really don't buy the sympathy angle. The guy allegedly launched a worm variant, he probably bragged about it (another similarity to Mafiaboy), according to MSNBC, the FBI subpoenaed IRC server logs to track him down. Launch a worm and gloat about it to your 31337 buddies, and you get what's coming.
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
Advertisers and marketing executives spend billions of dollars each year creating, researching, and disseminating memetic viruses through every conceivable media outlet...
OUTCOME: Profit and stupidity
An 18-year old writes a computer virus that shakes these corporations up a little bit....
OUTCOME: The FBI arrests him
MORAL OF THE STORY: The Matrix has you...
P.S. Wake Up by Rage Against The Machine is a great song
An the article is not kidding about variants of the blast worm. Two weeks ago we saw heavy destination traffic on port 4444 to random boxen on the internet. It turns out one of my client's linux boxen had been cracked into and a dropper that works just like the blaster virus starting hitting hundreds of outside servers. We tested it in a clean lab and it would infect but not install the worm properly. It was nice that he left source code and all. Makes me wonder just how many variants are still out there?
/*/ 2003-July/012000.html .
Here's the some of the source, might look familiar to some of you..... Hope the right person sees this.
**
** 2003/07/27 - DCOM RPC WIN32 remote exploit (Most languages)
**
** FlashSky/Benjurry and, H D Moore's code is very excellent.
** It works well even if change only return address.
** I didn't feel necessity for new make.
**
** Thankful to them.
**
** 2003/07/30 - Update, Added magic return address.
**
** kokanin supplied very excellent information:
** URL: http://lists.netsys.com/pipermail/full-disclosure
**
** * As well as Korean thanks to, a lot of systems can exploit.
**
** --
** Thank you.
**
** P.S: Sorry, for my poor english.
**
** --
** exploit by "you dong-hun"(Xpl017Elz),
** My World: http://x82.i21c.net & http://x82.inetcop.org
*/
#include
#include
#include
#include
#include
#include
u_char bindstr[]={
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,
0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,
I expect the comments in the first place. It's inevitable among any community that has people the likes of the "Frist p0st" and "go to cnn.com [secret link to goatse.cx]" commenters. But the moderation system is in place so that crap like that can get ignored by the people who don't want to hear it.
If you think it's funny, Obviously I can't/won't stop you from moderating it that way. But think about the real issue behind it before you encourage lighthearted humor about rape.
There is also a possability they busted someone who was just discecting blaster not making a new varent.
To a techno neophite there isn't much diffrence. If the guy decompiled the code and his friend looked over his sholder his friend would see someone with the blaster source.
Decompillers aren't so well known now a days so even an experenced programmer who might normally know what he is looking at might not recognise this as decompiler output and not original source code.
He might also not realise you generally can not recompile decompiled code.
Or the busted teen is an idiot who said "Hay watch this. I got blaster. Now I'm chaning it to penis32. Aren't I clever?"
I don't actually exist.
The Houston Chronicle version of the story allows you to vote on who's to blame:
Microsoft, The virus writers, or people who click on attachments.
Come on you anti-MS-types, get clicking!
World's tallest building rises in the desert
eing an animal-rights ass or just fighting some dumbassed class war?
both
We are a place without wilderness.
Access to every square inch is under control.
Freedom is not just freedom of thought.
Without freedom of movement there is no freedom.
We have a saying, "The trouble with country folk is they lost touch with nature."
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Look it up, amigo. If you know about a felony and you don't report it, you are guilty of cover-up and can serve time for your avoidance of doing the right thing.
You have an amazingly rosy view of how the law works in this country. You must be those law-abiding citizens with nothing to fear that I keep hearing about. When we have laws that will revoke habeas corpus for the bizarre and impossible crime of loitering with space aliens (1982, Department of defense appropriations bill) and the hard-hitting "conspiracy of one", you can and will go down for anything if they want you.
Do you think it's an accident that we have the largest prison population, in absolute and relative terms, in the world?
Laws are for people with no friends.
IS it really worth ruining a persons life, if he is found guilty, just becuase you as a sys admin had to deal with an inconvience. Windows update didn't go down, maybe some of your time was spent dealing with it, but that is YOUR JOB. And if your network isn't up to date with updates, IMHO, it's your damn fault.
Sadly he'l be the scaegoat while all the network admins, microsoft etc gets to go free. I just don't think that any punishment they give him will fit the crime... Personally i think he just needs to do some community service, what he did was wrong, but nothing truely bad.
Actually, considering the self-deprecating humour on slashdot, I wouldn't read too much into it. How many of us have joked about "slashdot readers being virgins." Mainly because we have a large geeky population, and many (but not all) of said geeky population lack the social skills to properly interface with members of the same gender, let alone the opposite sex.
The virgin isn't really a reference to sexual activity per-se, so much as it is a reference to the fact that somebody with so much a lack of a "life" probably is very likely sitting in front of a PC 24/7 and not meeting women.
Actually, sounds a lot like me in High School. Except that I didn't write viruses (custom backdoors to deal with people in the lab I didn't like, yes, but the teachers knew and found it amusing), and I now do have a social/sex life in addition to geeky pursuits.
Of course... another trademark of my geekdom is that said social life usually falls on the backburner whenever the newest Final Fantasy or RPG comes out... luckily the g/f is into 'em too (though I haven't gotten her on Warcraft/Starcraft or FPS yet).
Blaster took down transportation systems, among other things, and put many people's lives in danger.
Rape is the least of what he deserves. Try him as a domestic terrorist under the patriot act an make him disappear.
You know, looking at the previous weeks in retrospect we can consider ourselves lucky that virus and worm writers haven't latched onto the "open" paradigm....
I think it would be an extremely bad situation if worms had some sort of SDK and documentation in their payload so that anyone, just like this 18-year old, could build on the worms capabilities. By the same token, it would be even worse if the source code to the worm would not be included because that would be a great help for those developing countermeasures against it.
If there's a way to build on a worm's code, people will come up with novel ideas to use the code the original developer of the virus didn't even think of. They could even provide field service to it, fixing/improving the propagation code for example so it hits even more systems.
Finally there's one thing I hope virus writers never consider.. I hope they wont delay execution of their damage code, not even for a couple of hours. If they did that, their worms could penetrate much deeper into intranets before admins detect it and cause so much more damage.
I hate virus writers. They hurt all the corporations dear to my heart, the bank I love and the government we all rely on. I hate this little 18 year old brat whoever he is going to be (obviously the FBI didn't pick which of the million teens with a computer and a modem to go after yet...). I hope they throw the book at him and make him suffer like Mitnick. Scum like that doesn't have "rights" much less a "right" to "due process". They should kick him into the face for breakfast, torture him with cattle-prods for lunch and bullwhip him for dinner 7 days a week.
Who would understand he was actually writing a virus? Well, perhaps a fellow coder, a hacker, a classmate?
But then that brings the question: such individuals are usually fairly close-knit. If you're around the dude long enough to realize his code is a blaster-variant, and he is somewhat of a friend, or good associate, would you turn him in? How many geeks would?
It's a hard decision, especially with a decent chance that with the current upset over said viruses even a script-kiddy variant-writer is going to get lynched after being caught. It'd make him/her a good example for other would-be virus writers, but would you do it to somebody you know?
Of course, many such geeks are vain. It could have been somebody declaring, "you think blaster was bad... wait until you see the badass variant I'm writing. I'm going to 0WZ0R J00"...
Gee, maybe we should take his message more seriously. Maybe the author of the worm is correct in some aspects. Some say that Microsoft is solely to blame for this. I'd say it is not 100% correct. There is a shared blame for the security problems:
--
No memory available for sig. Please reboot now.
Coderz 4 Life
Apart from the obvious "innocent until proven guilty" matter, how about we don't publicly hang some kid for tweaking a virus until we've found the real author and proved his/her guilt.
On tonight's TV news and in tomorrows newspapers we will see and hear headlines that tell us that the blaster author has been caught and that he faces a lengthy prison sentence. This is what most people will hear and understand. The few who dig deeper will learn that this kid took the worm and created a variant of it.
What the kid allegidly did is wrong, if he did it, he deserves to be arrested, arraigned and go through the process and ultimately be punnished.
I smell a smoke screen here. It seems to me like the FBI is making this arrest and getting the publicity here for their own purposes. By making an arrest and getting publicity, they are doing something for themselves. People will think the FBI actually caught the guy that did it. That isn't true. They caught a stupid individual who took the code, changed it, and re-released it.
Now that the pressure is off, I doubt that the FBI will be able to afford many resources to keep hunting down the original author. They will keep some people on the case but the reality is that they will task most of the agents to other higher priority things now that this is going to the back burner.
To me, the FBI has achieved their goal - to divert publicity away from themselves but, they have not achieved justice which is what I would expect of them.
All these comments posted claiming this kid is innocent obviously haven't run a google search yet for "teekid"... Quite a few of his antics, including defacing the Minnesota Government Finance Officers Association page are still in the google cache.
I think the FBI deserves props for catching this guy, even if he's not the original author, he was still up to no good and one less script kiddie is one less script kiddie.
Decompillers aren't so well known now a days so even an experenced programmer who might normally know what he is looking at might not recognise this as decompiler output and not original source code.
Back in my day we called them disassemblers.
Anyway, the author of this thread says someone witnessed him testing the virus, not modifying it.
Here's that genius's picture - Jeffrey Lee Parson, 18, Minnesota teenager who officials said admitted to making a copycat variant of the devastating Blaster Internet worm.
He looks bald at age 18 !!