Slashdot Mirror
SCO Offers $250K Bounty for MyDoom Author's Arrest
Performer Guy writes "This SCO press release indicates that they are offering a $250,000 reward for information leading to the arrest & conviction of the MyDoom DDoS worm authors. Let's hope they catch them. Not merely because MyDoom is one of the most mindless attacks on our internet infrastructure in memory, but also when they pay up it'll be less cash for SCO's litigation engine."
Thanks to Tin Foil Hat and prostoalex for pointing out links at ComputerWorld and CNET, too. Related to this: stealth.c writes "Bruce Perens has written a letter to the Open Source community, discouraging us from cheering on the MyDOOM virus, as it would falsely implicate the FOSS communities and almost certainly cause the success of the virus writer's mission of discrediting these movements. This letter is also posted on NewsForge and on Groklaw." Unfortunately, with columns like this one blaming the worm on "some ticked-off Linux fan", it needs to be said.
If you're out there, e-mail me. Let me turn you in, and I'll give you .50%!
It's that SCO thinks that MyDoom's source code is owned by them. :)
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
Come on, Darl, you HIRED someone to write it, didn't you? An open source Reichstag fire, right?
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
$250,000!
How did they get that kind of money?
Oh right...
$699 at a time : (
--
In London? Need a Physics Tutor?
American Weblog in London
"Due to low cash flow at SCO, the reward will be paid upon successful judgements in the lawsuits against IBM, Redhat, Novell, et. al."
Someone needs to do the following:
1. Turn the culprit in.
2. Collect SCO's reward.
3. Give the money to the OSDL SCO defense fund.
"They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety."
...350 licenses to Linux.
Message to the Linux and Free Software Community Regarding the SCO Denial-of-Service Virus
Bruce Perens <bruce@perens.com> (U.S.) 510-526-1165
Version 2, January 27, 2004.
The master version of this notice is at http://perens.com/Articles/SCO/DOS/
Please check that location for a more recent version. You may re-publish this material. You may excerpt it, reformat it and translate it as necessary for your presentation. You may not edit it to deliberately misrepresent my opinion.
On January 26, 2004, a new virus became rampant. I have read reports that the virus payload has two purposes: to install a remote-execution back-end of a type commonly used by spammers to redistribute email, and to perform a denial-of-service attack on SCO's web site.
Denial-of-service attacks via virus have been a common trick of email spammers. They were first used to take out some of the anti-spam blacklist sites. Several of those sites had their (non-spam-related) business so heavily disrupted that they closed the doors of their anti-spam projects rather than be attacked again.
The Open Source developers are a target of spammers. We are the creators of most high-profile anti-spam technology. For example, SpamAssassin started out as, and remains today, an Open Source project. The predominant mail delivery programs of the Internet are Open Source projects such as Sendmail and Postfix, and thus most efforts to spam-proof those programs are Open Source as well. This is important, because it gives spammers a reason to defame us.
SCO also has a reason to defame us, as part of their stock-kiting scheme. We have assembled ample evidence that they have lied under oath in court. Such a company would not balk at attacking their own site in order to paint their opponents in a bad light.
Thus, it is likely that this virus has been assembled for the purpose of defaming the Linux developers by spammers, SCO, or others. Your behavior will influence whether or not it succeeds in this mission.
Thus, I urge all persons who have sympathy for Free Software, Open Source, and Linux:
Remember that your actions count. You are ambassadors of our community.
Bruce Perens.
Plus, also the likelyhood that whoever did this will be publicly revered and hated (not liked) by the Open Source community, and blacklisted from getting a programming job anywhere else in the world, most likely for life?
Also, there's the chance of being treated like Mitnick, and charged as a "terrorist." All for the sum of just under $32,000 a year.
No thanks. If I were the worm writer, I'd hope to God that the virus can't be traced back to me. Either that, or I'd move to Iran or North Korea.
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
OT, but I just submitted the story below. Since this is an SCO thread, and -Taco probably isn't going to post 2 SCO stories in a row, here it is:
/. readers! The SCO "litigious bastards" linking campaign has succeeded! SCO is now the first link on a Google search for litigious bastards. (If you try a "I'm Feeling Lucky" search, it'll still go to SCO, but it looks like the SCO site is down.)
:-(, and mirror!
Thank you to all
Congratulations, everybody!
On a side note, simply searching for "bastards" brings up SCO). If Google happens to notice and block it (as in the past), a screenshot is here. Please be kind to my server
SCO Offers Reward for Arrest and Conviction of Mydoom Virus Author
LINDON, Utah, Jan 27, 2004 /PRNewswire-FirstCall via COMTEX/ -- The SCO Group, Inc. (Nasdaq: SCOX), the owner of the UNIX(R) operating system and a leading provider of UNIX-based solutions, today confirmed that it is experiencing a distributed Denial-of-Service (DDOS) attack. SCO announced that it is offering a reward of up to a total of $250,000 for information leading to the arrest and conviction of the individual or individuals responsible for creating the Mydoom virus.
(Logo: http://www.newscom.com/cgi-bin/prnh/19990421/SCOLO GO )
"During the past ten months SCO has been the target of several DDOS attacks," said Darl McBride, president and CEO, The SCO Group, Inc. "This one is different and much more troubling, since it harms not just our company, but also damages the systems and productivity of a large number of other companies and organizations around the world. The perpetrator of this virus is attacking SCO, but hurting many others at the same time. We do not know the origins or reasons for this attack, although we have our suspicions. This is criminal activity and it must be stopped. To this end, SCO is offering a total of $250,000 reward for information leading to the arrest and conviction of those responsible for this crime."
SCO is also working with U.S. law enforcement authorities including the U.S. Secret Service and Federal Bureau of Investigation (FBI) to determine the identity of the individual(s) involved. Anyone with this information may contact their local FBI office.
The Mydoom worm, also known as Novarg, is a mass-mailing worm that arrives as an attachment with the file extension .bat, .cmd, .exe, .pif, .scr, or .zip. When a user opens the attachment their computer becomes infected and uses their computer with the intention of connecting to the www.sco.com Web site on February 1, 2004. Network security firms including Network Associates and Symantec have already issued software updates to combat this particular worm.
About The SCO Group
The SCO Group, Inc. (Nasdaq: SCOX) helps millions of customers in more than 82 countries to grow their businesses with UNIX business solutions. Headquartered in Lindon, Utah, SCO has a worldwide network of more than 11,000 resellers and 4,000 developers. SCO Global Services provides reliable localized support and services to all partners and customers. For more information on SCO products and services visit http://www.sco.com .
SCO and the associated SCO logo are trademarks or registered trademarks of The SCO Group, Inc., in the U.S. and other countries. UNIX is a registered trademark of The Open Group in the United States and other countries. All other brand or product names are or may be trademarks of, and are used to identify products or services of, their respective owners.
SOURCE SCO Group
Blake Stowell of The SCO Group, +1-801-932-5703, bstowell@sco.com; or Payal Patel, or Avi Dines, both of Schwartz Communications, +1-781-684-0770, sco@schwartz-pr.com, for The SCO GroupCopyright (C) 2004 PR Newswire. All rights reserved.
News Provided by COMTEX
Please check that location for a more recent version. You may re-publish this material. You may excerpt it, reformat it and translate it as necessary for your presentation. You may not edit it to deliberately misrepresent my opinion.
Now I wonder why you put that in there?
Robyn Peterson, robyn_peterson@ziffdavis.com, is probably pretty safe to ignore at this point.
From eWeek's (heh) "Online Jubilation About MyDoom's SCO Attack" article:Reactions on Slashdot, arguably the largest discussion board for technophiles, displayed a cathartic wave of pleasure, "Finally a worthwhile virus!" exclaims one poster. While another adds, "So, uh where can I download a copy?" (Robyn here included links to relevant /. comments)
While the person who gets paid to write this for a living (wtf?) ignores that the majority of the +4/5 comments that aren't rated "Funny" are
1) Reminding people that DDoSing is always stupid and silly2) Anticipating this kind of silly article
and 3) yelling at people who post unsupported theories about SCO.
But hold on, Robyn has more to say:
Another Slashdot poster goes as far as saying, "SCO has used past denial of service attacks as 'the dog ate my homework' type of excuses in court." It went on to suggest that "SCO's next court date is in early February, maybe they haven't done all their homework this time," implying that SCO itself released the worm. (Robyn will report next month on the inability of SCO to find evidence because IBM is being a big meanie.)
I know it's an advertising publication, but some people read eWeek and expect some of the things in it to be true. Rather than mention the tangible allegations against SCO with regards to insider trading, lying to stockholders, and inconsistent policies, Robyn reports what he's paid to. And that's fine - a half-truth is not quite libel - but it's kind of disturbing to read.
Bad Robyn Peterson, robyn_peterson@ziffdavis.com. Bad.
We recently had heard in the office over one of the Yellow Machine that's made by Anthology Solutions.
SCO brought it on themselves, they behaved immature and childish and now they're getting an immature and childish retaliation. Someone needs to take both SCO and the virus author out of the playground and give them a good spanking.
---
DRM is like antifreeze, to the MPAA/RIAA it's sweet, to the consumers it's poison.
And then you can go to jail for obstruction of justice. Paying people to not turn in evidance of a crime is a federal offence.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
When this first cropped up a number of people pointed out that the DDoS against SCO is probably just a red herring to hide the worm's real intent - to act as a backdoor into countless windows systems for the virus writer's real purpose. Given the last analysis I read on it, that purpose seems likely to be to leave Zombie Emil Gateways for spammers to use.
.
While it couldn't happen to a "nicer" company, it seems very likely this virus wasn't written by a "Pissed off Linux advocate" or even a "Rabid SCO hater." The DDoS is probably just incidental to the real payload, serving to deflect suspicion from the culprit.
Yet another Bottom Feeding spammer . .
Never attribute to malice what can as easily be the result of incompetence...
Get $250k, use money to buy licenses for my linux copies(tivo,etc). Because that would be the worlds greatest slashdot troll.
Have you ever been to a turkish prison?
The catch-all on my domain email is getting about 2 of these every minute, and has been for the past 20 hours. This is really making me angry, and unfortunately there's nothing I can do to filter most of them. I'm only able to filter the ones that have the special messages (7-bit unicode nonsense and just plain 'test') This virus is hurting everyone; including people who run linux servers who are getting thousands of these emails.
Shut the fuck up It's kind of obvious that this is a doing of a Linux user, so please stop writing your pointless letters, no one cares. Heed my advice, and once and for all Shut the fuck up
Seeing as Bruce is considered to be one of the leaders/spokesmen of the Free/Open Source Software Community, he has a responsibility to speak out on issues such as this. Since so many people, organizations, and companies pay heed to what he says, his silence would be considered tacit approval by some.
Additionally, this single worm has the potential to do more harm to the Free/Open Source Software Community than all of SCO's shenanigans combined. evereyone really needs to speak out against this.
They don't want to get DDoSed on the 1st, so they decide to give out a huge reward.
I bet they didn't think about the number of people (not just from Slashdot, but everywhere) that were going to DDoS them just by reading their press release...
Yet another showing of intelligence from SCO.
Jeremy Baumgartner
Which is what makes this press release so...so...strange. We all know that the FBI goes ballistic over this kind of thing. And unless the worm author was incredibly careful, he's probably got federal agents tramping around his bedroom and emptying out his dresser drawers even as I write this.
So why then, is SCO so eager to hand over $250,000 for an informant? SCO's moaning about how much this worm has cost them, but, really, can we take that seriously? I could see if this worm targeted Dell or IBM, or, you know, some company that actually has customers visit their website. But who is SCO selling anything to anymore? It's just a litigation house. What do they care if their site drops down for a day or two? The FBI is likely to be hot on the worm author's heels, so why is SCO so eager to hand over 250 thousand smackers without any clear reason?
When you see spending decisions like this, it's a pretty good sign that a company is being run by bozos. You get the sense this press release was rushed out the door in an effort to capitalize on media attention. But was there any real reason why SCO needs the attention, or why it's in their best interest to part with so much money given that the culprit will likely be found anyway?
So here's my crystal ball prediction: the worm author will be found. But SCO won't pay up. This is all about publicity, and for some reason I don't foresee Darl rushing to sign a check.
I'm generally "Interesting," "Insightful," and even "Funny" here. What the hell happens to me at parties?
Check out what the virus targets and doesn't target. It ignores .EDU addresses, as well as a host of other *nix places, including .gov and what not. While we may complain about how this virus makes us look at a whole, at least give the writer a nod for being courteous about the sites he/she targeted. Go on, read it
Anyone worth their while knows that Linux fans don't code anything for Windows unless they are paid for it. It's something called 'taint,' which money readily removes. :-P
You need to restart your computer. Hold down the Power button for several seconds or press the Restart button.
Bruce is wrong.
there is no way that one person or even a small group can create a worm that takes down linux or FOSS.
Anyone who thinks so is demented.... And I guess that means you Bruce.
Honestly, who the hell cares about SCO anymore?
SCO themselves have blown the shit out of their own case..... We all know its a pump and dump...
cheering on a boston tea party is only possible because the legal system of the US has allowed this mess to get as far as it has publicly.
Ultimately it has only served to let the general public know there is an alternative to Windows and Mac.....
The idea of blaming the whole of FOSS for the expression the worm writter communicated is totally insane, but so what if some cheer for the statement...
ISN'T it really just a statement of telling SCO to either put up or shut up?
What the legal system has so completely failed to do!!!
When was the last time you read the declairation of Independance Bruce?
Bullshit. It's possible, but unlikely that someone pulled this stunt to defame the community. It's likely that this shit was pulled by some dickhead who thought it would be cool - you know, the kind of dickhead who has been cheering this virus on Slashdot?
This "open letter" is nothing but transparent propaganda - trying to paint the Open Source world as perfect, free of idiots, fighting against all the evil forces in the world. Newsflash - there are idiots everywhere. Deal with it, and keep the bullshit to a minimum.
Hand me those earmuffs, Mr. Lucifer. Chilly, huh? You just never know about the weather around here.
This is my post. There are many others like it. If you don't like what you read here, go try one of the others.
SCO isn't really a "high profile" target. In fact, most people outside of the IT community don't know who or what SCO is. It takes someone with knowledge (obviously) and a state of mind. What is the current state of mind of the OSS/Linux community? Obviously, it is one of resentment and anger? Can you deny that? One only need glance at Slashdot's headlines to prove my point.
A blog like any other.
I know it's an advertising publication, but some people read eWeek and expect some of the things in it to be true
I wonder who exactly are those people who expect some of it to be true. I have some nice bridges in various American cities for sale and we are also handling the pre-sale of some real state in the Moon and in Mars for Nasa. So if you know anyone who believes in articles whose main source of information are Slashdot comments, please ask them to give me a call.
Website about Linux Stealing SCO Code, read the page very carefully, don't be too quick to hit your browsers back button (hint,hint) http://www.linuxstolescocode.com
I think it means very little that the worm launches an attack against SCO. The primary purpose of this worm, like the Mimails that preceded it, is the wide-spread distribution of a zombie network for the purpose of propagating spam. You see, spammers hire programmers to do this coding for them (read up a bit on Mimail and spam) in order to help their spam biz. While the hired programmer was at it, he probably threw in the SCO bit for shits and giggles. Or maybe he's a younger programmer and just kind of immature. Either way, the spammers (the people commissioning the construction of the worm) don't care.
To me this sounds like the most likely scenario -- remember that spam and viruses are linked. The SCO thing is just throwing people off track.
The Reichstag fire is what I thought of immediately
Yes that's the obvious parallel and the right conclusion IMO.
SCO's two pronged approach includes the court of public opinion in addition to the U.S. judicial system. It suits SCO and their Redmond Muppet-masters to disparage the Open Source community, which is why we see pejoratives like "Communist," "Hacker" and "Anti-American" emanating from them at every opportunity. It would suit them perfectly for each of those terms to become synonyms in the common vernacular.
At the very best, SCO is capitalising on this Virus by offering the reward for their propaganda, knowing that it will cause headlines. At the very worst they developed this virus themselves for the same purpose. Either way SCO will come out of this looking like victim.
Conversely, all that an independant Virus writer could hope for is a temporary interruption of SCO's Internet access.
It's obvious who has the most to gain.
Scene - the virus writer's parents' basement
Script Kiddie #1: OK, dude, like, I got the, y'know, latest version of, like, Virus Creator, dude.
Script Kiddie #2: Swheeet! Dude, like, run it!
Script Kiddie #1: Fuxor! Like, I clicked on it, and, like, it didn't go!
SK2: Dude! You have to, like, double click! Lamer!
SK1: STFU! I know that! Fag!
SK1: Uhhh, like, it's doing sumthing. Oh - kewl! It's like, installing stuff.
SK2: Shweet! Man, this rox!
Virus Creator: Virus Creator Wizard - page 1 of 5 - Do you want to install a backdoor? [yes] [no] [help]
SK1: Shweet! Yeah, let's set up my army of zombies! Huh-huh-huh!
Virus Creator: Virus Creator Wizard - page 2 of 5 - Do you want to install a spam relay? [yes] [no] [help]
SK2: Dude! We can, like, make money! Do it, dude!
Virus Creator: Virus Creator Wizard - page 3 of 5 - Do you want to install an HTTP relay ? [yes] [no] [help]
SK1: WTF? (clicks help)
Virus Creator: This lets us serve PR0N through your zombies - click yes and we will let you have the password to see some of it.
SK1 and SK2 (together): DUDE! SHWEEET!
Virus Creator: Virus Creator Wizard - page 4 of 5 - Do you want to DDOS somebody ? [yes] [no] [help]
SK2: Yeah!
Virus Creator: Virus Creator Wizard - DDOS setup - Who do you want to DDOS? [enter URL here]
SK1: Who should we fuxor? School?
SK2: DUDE! If you fuxor school how can we look at pr0n during class? (dope-smacks SK1)
SK1: OW! Fag! OK, uhhh, dude, like, the RAII?
SK2: YEAH! Fuxoring with our MP3s!
Virus Creator: Virus Creator Wizard - URL "www.raii.com" not found - try again [enter URL here]
SK2: Fuxor!
SK1: Dude, like, what's something with less letters, man?
SK2: SCO?
SK1: Yeah! FUXOR JOO, SCO!
Virus Creator: Virus Creator Wizard - page 5 of 5 - Virus ready - click here to email [ok]
SK1 and SK2 (together): SHWEET!
In other words, I think the DDOS against SCO is incidental to the real purpose of this virus - which is to spread spam. Like as not the choice of SCO was just because they are in the news, and to shift the blame to somebody else.
www.eFax.com are spammers
So how is it that SCO is supposedly already feeling the effects of the DDoS from the virus?
"This SCO press release indicates that they are offering a $250,000 reward for information leading to the arrest & conviction of the MyDoom DDoS worm authors. "
Is that 250,000 in cash or SCO stock?
Coder's Stone: The programming language quick ref for iPad
I take offense to the term DDOS (Distributed Denial Of Service). I don't know how you could describe SCO as providing any kind of Service.
It suits SCO and their Redmond Muppet-masters... That's an insult to Jim Henson! Heck, that's even an insult to Frank Oz! Please refer to them as "Nefarious puppet-masters" in the future; it conjures up more of an image of Bill Gates with his hand up Darl's... er... back.
"Freedom means freedom for everybody" -- Dick Cheney
What Linux user would admit to being enough of an expert at Windows to write a virus for it? It's a little outside of most Open Source Contributor's area of expertise, isn't it?
"Freedom means freedom for everybody" -- Dick Cheney
Shun it, ignore it, cheer at it, but don't ever apologise for it unless perhaps if you created it. Submissive, misguided fools.
Are you sure the virus is just meant to hurt SCO? Note that like previous variations of this virus, it installs a back door (specifically the ability to execute supplied code and port forwarding). This same functionality has been used by spammers in the past (and indeed, the DoS portions of previous versions have targeted anti-spam sites).
As the saying goes, "you must be new here." The Linux fanbase is not alone in its share of zealots and childish behavior.
Who said anything about MS? Bruce's comments mentioned SCO. And spammers. That's it.
Google for "gobbles". There are plenty of folks who would love to take a swipe at Open Source (or specific groups under that banner). And why not. They're just as tempting a target as anything else that gains notoriety. After all, what would an individual gain from attacking... say... Microsoft?
You're on the money on that last bit. This will hand SCO more ammo to fling at the OSS community. And SCO will undoubtedly do their best to get it in the press and in front of Congress (which in turn is fodder for the unlikely possibility that this is SCO's own doing - they'll skuttle their own company for a buck, why not their own site?).
So what if this is not the work of a ticked off kid? Who would do this?
Again - this is a variant of previous malware. It is possible that someone got mad and just did the basic changes needed to vent their frustration. Or it could be from the same source as other recent attacks. And that source is undoubtedly some part of the spammer "industry" / community.
So why attack SCO? Bruce touched on one possibility - discredit a community that's been working hard to make spammers' operations difficult to maintain. Others have suggested it is an attempt to distract people from the virus' real intention - providing another fleet of zombie proxy machines. I've toyed with the idea that attacking SCO may appeal to the very ones who are usually cleaning up malware and the virus author hopes that these individuals would just let this one slip by.
In short, there are plenty of possibilities. And while the lone malcontent is still a very valid one, it is by no means the only likely candidate.
I already have two Linux licenses for a whole lot less money. Hit the bookstore. Lots of Linux manuals have a publishers edition of Red Hat and Caldera in them. Since SCO is renamed Caldera, there should be no way they can get you for using it. Be sure to read and follow the EULA.
I have a 2 publishers editions, one of 2.3 kernel and one 2.4 kernel. There should be no way they can demand more money for using it the way they sold it.
There may be a legal challange for having the Red hat copy that came with the book. I guess I'm going to have to hide it until the SCO case is over.
One copy makes a great SAMBA server and the other one is a great desktop web tool.
The truth shall set you free!
Excuse me for supporting Mr. (Score:0,Troll), but doesn't he raise at least one valid point?
It's not like this is the first time Outlook and all it's features additional to mailhandling (which mostly is usefull only to spammers and virii-writers) causes complete havoc on the internet.
You'd think by now, Microsoft should have turned of all scripting and activex-support in their email-client to avoid all of this happening again?
After all, I can view HTML mail in Mozilla, Opera and Pine for god's sake. And still I have to admit no viri/worm/trojan has ever infected my machine.
So call him troll if you like, but he did (even though maybe in a flamefest fashion) ask the question that should be asked:
Why the hell is this email client still the biggest source of viruses on the internet?
Not Buzzword 2.0 compliant. Please speak english.
Mr McBride and the media in general- stop calling MyDoom a worm, I know it sounds more dramatic and "computery" than virus, but VIRUS is what it is
see here and elsewhere on the web