Slashdot Mirror
More MyDoom Gloom
fudgefactor7 writes "Hot on the heels of the last virus, Mydoom.b is on the loose. According to Computerworld, this variant has a larger payload and targets Microsoft's Web site for a distributed denial-of-service attack on Feb. 1, instead of The SCO Group Inc. Patch those systems and keep your A-V up to date. Definitions are available currently."
decaying writes "With the amount of virus-laden emails flying about due to the latest virus, Australian ISP Optus have started selectively blocking port 25 outbound. Optus say they are acting in accordance with their "Terms of use", quoting that they reserve the right to restrict access to any TCP/IP port. The only option is to use Optus' SMTP server and nothing else. Community site Whirlpool has an on-going discussion about the issue."
carnun writes "Just another link on MyDoom. Apparently the FBI are also getting in on the act. Interesting to see such a fast response." And to me, the most interesting one: Zeriel writes "After much discussion on a mailing list discussing trojan horses, some people have reached the conclusion that MyDoom doesn't accomplish its stated goal of DDOSing SCO at all! Choice quote from the analysis: "I have the new critter in a test environment where we conducted a preliminary and rudimentary functionality and threat analysis...I have played with the date, etc, but still no activity directed toward www.sco.com." The link also includes disassembly and analysis of the worm code."
It's entirely possible that the authors of this virus targeted SCO, simply to make it appear that Linux zealots were responsible...to throw off the law enforcement officials who might look for the culprit in the Linux community.
While I despise these worms, you've got to admit that some of these more recent ones are pretty ingenious:
Blaster - The only way to fix it is to grab stuff from Microsoft? Have it DDOS Windows Update.
MyDoom - Hate SCO, Love Linux? Target Microsoft systems and leave Linux machines alone. Have it DDOS SCO.
So it was SCO!
I'm looking for a serious apology (or at least a retraction) for the 'alleged' link between this ugly little nasty and Open Source / Linux users."
Of note: Darl McBride was on local (Utah) television last night with a stinging quote. "What we are seeing here is the dark side of the open source movement" or something very close to that. I thought, no dude, you have it all backwards. SCO is the dark side of the open source movement.
Visit Jonesblog and say hello.
we will neever see an apology from SCO.. they will be gone and bankrupt before too long.
It was covered last week.
Basically, to limit the spread of a worm on a network such as the internet, we can only diversify to make sure not all machines go down.
Here's a presentation (sorry I could only find a PowerPoint version) that was made by Jonathan Wignall at DefCon last year about this topic. Same conclusion, diversifying is the necessary to combat worms.
It is not enough to have a good mind. The main thing is to use it well. - Rene Descartes (1637)
I haven't been affected since I don't use Outloo=20 ]} } } }&..}=3Dr}'}"}[NO CARRIER]
You mean, a big bag of money showed up on some spammer's doorstep with a note promising much more if a DDoS against www.sco.com is included in the next release?
Completely untraceable, even if caught: the spammer wouldn't know who sent the money, and could even claim, "I think it was some Linux Zealot."
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Personally, I'm looking for a serious apology (or at least a retraction) for the 'alleged' link between this ugly little nasty and Open Source / Linux users.
We'll get right on that!
Sincerely,
The Mass Media.
The B variant targets both Microsoft and SCO.
Denver Isuzu Suzuki
place where nobody gives a wet slap
Anyone care to clarify what a wet slap is?
--
In London? Need a Physics Tutor?
American Weblog in London
.. would TURN OFF those blasted "Your mail has a virus!" auto-replies. They accomplish nothing but the generation of yet more useless traffic.
Trolling is a art,
Over 90 years and counting !
I have the new critter in a test environment where we conducted a preliminary and rudimentary functionality and threat analysis...I have played with the date, etc, but still no activity directed toward www.sco.com." The link also includes disassembly and analysis of the worm code."
So basically, SCO being down right now is Yet Another Big Lie from SCO. Nice to see them shown up as spreaders of misinformation yet again. I'm sure the FBI will love to hear their excuses as to why they're pretending to be down, especially if they're attempting to blame the worm. Fascinating
It is likely that this virus has been assembled for the purpose of defaming the Linux developers by spammers, SCO, or others. Your behavior will influence whether or not it succeeds in this mission.
Thus, I urge all persons who have sympathy for Free Software, Open Source, and Linux:
Remember that your actions count. You are ambassadors of our community.
Bruce Perens.
everybody set their DNS servers to drop SCO off,
worm propegation stops!
if this is not a more effective form of economic terrorism, I don't know what is. These worms seem to cost US companies millions if not billions of dollars, and they're probably not so difficult to develop either.
With such a hugely damaging effect for such little cost, wouldn't you say that is almost the perfect weapon?
That would be funnier if the worm needed Outlook to spread. Unfortunately, it's got its own SMTP engine.
Denver Isuzu Suzuki
how about we write a worm/virus/whatever and have it look for spamming machines. then use the open ports on the compromised machines and just blow them away....wipe out C/D/E/F drive, / or whatever else gradually (say one file every hour or so) until all the spamming machines die.
anyone want to volunteer for this ?
Wouldn't it be ironic if a worm were to DDoS slashdot.
My Slashdot story page has a MS ad for an "earlybird" special. If you're not getting YourDoom fast enough, that's the ad for you!
Sheesh, evil *and* a jerk. -- Jade
... here at Virginia Tech, the virus has had our pop/smtp servers down since sometime last night. Apparently it infected our financial aid listserv, which caters to 51,000 email addresses, most of them in the vt.edu domain. Not to mention 8000 of the not-so-savvy on-campus undergrads whose systems have been infected. In the 4+ years I've been here, this is the longest downtime for our email system yet, even considering the downtime a couple routine server rebuilds caused. I'm sure other institutions, agencies, and businesses are experiences unheard-of downtimes as well.
May the threads progress competently.
According to the official site (at 5:00 EST) there are still no ClamAV defs available for the .b variant of this worm (affectionately known as Worm.SCO.*).
Does anyone know where I can grab (and submit) a signature...or a copy of it (without waiting for it to trickle into a user's mailbox)?
-Turkey
Thanks for the info. Someone mod +5 inform=20 ]} } } }&..}=3Dr}'}"}[NO CARRIER]
What the hell would it matter anyway? Evil spammers probably also use toothpaste. Does that make everyone who uses toothpaste evil?
The fallacious logic here astounds me. Wait, no it doesn't.
How about domain names (fake e-mails) that are being sent out by the worm because your ISP happens to proxy your connection (and allows un-secured windows users) and logs your e-mails being sent from your "unavailable to the world and NOT open for relay mail server".
Will the blocking zealots block everyone......or will we have some sense of control in this scenario.
Being able to use my own mail server is one of the many reasons I use open source!
From the post: "Personally, I'm looking for a serious apology (or at least a retraction) for the 'alleged' link between this ugly little nasty and Open Source / Linux users."
I don't know what it is with people trying to represent such large groups. Every group has nasty people in it! Since Linux is generally more efficient once set up (IMHO, anyway), then OF COURSE people will use it to do nasty things like serve spam and make DOS attacks and so on. I don't get why people are so patriotic all the time... "He's American! No AMERICAN could be evil!" Sigh...
The worm was obviously written and released by a Windows fanatic, and designed both to harm SCO and give Linux a black eye!
Good, inexpensive web hosting
A report covering F-Secure's work on the virus reveals this interesting comment imbedded in the virus:
Buried in its programming code -- and only readable after it has been decrypted -- was also the message "Andy; I'm just doing my job, nothing personal, sorry" from the creator
My tinfoil hat says it's some poor guy at SCO!
If thou see a fair woman pay court to her, for thus thou wilt obtain love
In Soviet Russia something happens to YOU!
However, the Russian gov't needs to wake up and do something about all of the criminals it harbors.
Bwa-ha-ha!!! Considering how many criminals are in the Russian government*, I don't think anything's gonna change any time soon.
* Yes, yes, I know this is true for most governments, but the line between organized crime and government power seems blurriest in Russia at the moment.
God invented whiskey so the Irish would not rule the world.
Not to mention all of the scared users calling the helpdesk insisting that they are infected.
"Dude, you are using PINE! You are NOT infected!!!"
SCO is the back side of the open source movement.
I've said it a thousand times.
If it weren't for /., I'd have never noticed.
Pretty Pictures!
MyDoom doesn't accomplish its stated goal of DDOSing SCO at all!
I've done some testing here either. I have yet to see 1 single packet move from the infected machines. I had some infected yesterday, and after checking my squid logs (ALL port 80 traffic gets forced through the squid proxy) I saw not 1 not 2 but ZERO traffic generated by the virus (mass emailing aside). Maybe it's busted? Was all the hype for nothing?
/* oops I accidentally made a comment, sorry */
ClamAV, the Open Source virus scanner, caught it on our email gateway this afternoon, whilst McAfee's uvscan with the 4319 DATs didn't find a thing.
A big thanks to the ClamAv team.
Phil
Also, you forgot to make an RIAA variant, dumbass!
If you were a spammer wouldn't it be in your best interest not to be using Windows? You can't spam very well if your getting spammed/virused to death.
OK listen. I hate SCO as much as any of you. This is a clear pump and dump. However, I am getting sick of people saying SCO or someone wanting to discredit the open source community wrote this worm. I can think of A LOT of linux supporters that would have done this in a second if they had thought of it. The chances are, it was a linux supporter. I'm not saying whether I support the people that did this or not. I'm really not sure but I am also getting tired of this "holier than thou" attitude of people who say its not good because it makes open source look bad blah blah blah. I'm beginning to think we must fight fire with fire. We must fight these tacticts of SCO, tactics that may even be illegal under RICO, with tactics that are less than legal. Maybe it is time we start doing things designed to bring down SCO, just as they are trying to bring down linux. The legal process will take years. SCO will probobly do alot more damage in that time than some worm written by a linux supporter. So we must do something. WE MUST FIGHT!
"It is not how things are in the world that is mystical, but that it exists." -Ludwig Wittgenstein
Silly Messagelabs, using frames. What a treat to see the internet circa 1998. And, it doesn't work in Safari.
What does it mean to wake out of a dream
and be wearing someone else's shorts?
BNL, Born on a Pirate Ship (1998)
Of course, there could be evil spammers who also like Linux (or don't like SCO), but until someone's caught, or fesses up, it's impossible to say.
That sounds like terrorist speak to me. Thanks to recent legislation, anyone running Linux can now be 'detained' indefinitely without evidence. God bless Micro^H^H^H^H^H^H America.
"I have never let my schooling interfere with my education." - Mark Twain
This was some criminal capitalizing on the Hot topic of the Linux vs SCO debate. If this worm has targeted the whiteshouse.gov site you've have the same idiots saying terrorists did it. These criminals just used Linux as a scapegoat. I try to avoid reading articles about this worm because I just can't stomach reading all these posts about how the OSS community should "tread lightly" etc. Get a clue people.
If you wanna get rich, you know that payback is a bitch
OK, that WAS funny...
Cox HSI already blocks port 25. The only way to send outbound email, even if you have a legitimate remote server, is through them -- It's really cruddy.
Cox also blocks other ports which are obviously because of windows worms. Port 80, for example, was blocked because of Code Red. Port 25 could have been blocked for the same reason, but spam is definately another major reason for it.
Cox also prohibits, bandwidth usage now, supposably.
Reread what I just said with the tone that the rampant Cox TV advertisements use, and find out a service you really get for progessively HIGHER prices. The only other viable broadband ISP is Qworst, and I've already seen what it is like there.
So thank you Windows worms for ruining my ISP access even when I used Linux on the connection! Those Windows problems every time!
On a related note, I found this on urbandictionary.com:
/. adds)t erm=dar l&f=1
d ar l+mcbride&f=1
m cb ride&f=1
:)
(remove the spaces that
http://www.urbandictionary.com/define.php?
http://www.urbandictionary.com/define.php?term=
http://www.urbandictionary.com/define.php?term=
It seems the search engine on urbandictionary.com is so smart, you don't even have to add a definition to get the right search results!
The current definitions:
No definitions found for "mcbride."
Suggestions:
jackhole
8 votes
a dumbshit
Fucker quit being a jackhole!
tea bag
40 votes
(v). To lower your body as to dip the testicles into her mouth as the woman is tounging the scrotum.
Hey man, you should have seen the look on that bitches face when I tea bagged her.
I suggest not to mess with the definitions as these suggestions are even funnier than the real thing. Thanks!
Will code a sig generator for food
Carousel is a lie!
I'll laugh at SCO if I want to thank you very much.
I personally like to see SCO denial of serviced to kingdom come.
Free software is neither good nor evil. SCO are evil.
It depends on the people who run the stuff.
Look a whole group of people obviously didn't write this virus. There isn't a sourceforge project named MyDoom.
If the media or public can't figure that out then screw them.
SCO can kiss my arse.
OS X....works for me...all go to the trash.
:)
Oh what a relief it is
The following comes fromw orld/view/68440/1/.html
http://www.channelnewsasia.com/stories/afp_
"Buried in its programming code -- and only readable after it has been decrypted -- was also the message "Andy; I'm just doing my job, nothing personal, sorry" from the creator, Hyppoenen said."
I think that this message refers to Andy Nagle, the director of the SCOx project.
The real litigious bastards...
I like your sig. You could change it to "Europe, Proving Americans Wrong Since The Spanish Inquisition" Just kidding.
Why block port 25? How much of that 25 traffic do they know is SPAM? If I were a spammer, I could just get a co-location somewhere in asia (or just about anywhere else), ssh over, and do my dirty work from there.
The only people they are hurting are people that like to run their own mail servers.
People like me. And I am not a spammer.
Why can't people understand that you can't block certain kinds of traffic by blocking ports? All it takes is another computer outside the blockade to ferry them along. The only way this would be effective is that if every ISP everywhere blocked port 25, and co-located servers had to register to use port 25. But since that will never happen, then one ISP doesn't make a difference.
Why, o why must the sky fall when I've learned to fly?
Kudos to Optus for blocking egress port 25 traffic. They can be assured that their customers will not be part of the problem for anyone else! Other ISPs, and any business that provides internet access to any internal workstations-- please take note, and block egress port 25 traffic. Otherwise, you are part of the problem.
Apparently college doesn't weed out the idiots.
- A
Many worms nowadays are capable of traveling along multiple protocols and containing multiple payloads. Of course, worm writers generally don't bother because there are indeed far more copies of Windows out in the wild than anything else. However, if we began to see a more substantial plurality of OSes, I suspect multiple-architecture worms would become more common place; just pick your favorite exploit from each os, and make a separate payload for each. The worm might double or triple in size (depending on the number of architectures supported), but authors won't care.
.NET/Mono might eventually make it so worm writers don't even have to include multiple payloads; just multiple exploits.
Further more, universal binaries like those associated with Java or
Maybe diversifying will help a little for a short while, but the real solution to this problem is to write better code.
I know that the spammers who use the worm-enriched mailers aren't necessarily the worm writers, but they are paying someone to send the spam, so there's still a (worm) trail.
That's the point of the parent post. He doesn't use Outlook but got infected anyway via other means.
AFAIU, SCO's claims of IP ownership are global, and countries like Russia and China have more to gain from linux IP being free than an MS saturated U.S. market.
-no broken link
Dear SCO
I did it. I admit it.
Please send me a check for USD 250.000.
Thank you.
PD: Slahsdot readers:
Any lawyer out there who'll defend me for USD 200.000?
Wow.. who really cares? How is this news to us? We didn't make the virus stop telling us every little detail that's going on; we don't care about SCO. Every day I see a post about some worthless SCO news; it is just drawing SCO more media coverage, what they want. I urge /. to stop giving SCO the respect by actually posting there worthless case that will not go anywhere.
--jay
It could be a reverse-psychological attack: Make Linux users look bad in an attempt to boost SCO's chances against Linux and as a result get more Windows users that are susceptible to their profit-generating viruses...
--JoeProgram Intellivision!
I don't have anything against Americans; I've never met one. However, the USA gov't needs to wake up and do something about all of the criminals it harbors. They send most of the spam, distribute drugs, and distribute weapons. It's bleedin obvious where all the problems come from, it's time for something to happen.
How do they dissect the virus code? How does it help determine country of origin? How can that lead to finding the writer? Do virus writers have their own signatures? And are they not smart enough to just not include that in the virus that they distribute?
and WHO is the person that's supposed to make that apology?
These are times where M$ schould be promoted by the Open Source Community. :-)
Perhaps everyone who gets the Worm should forward it to all the people in his Adressbook that use Outlook
Help the worm!
On the other hand.. sco will destroy itself, so sit back and enjoy.
(I have never seen the worm, thanks to spamassassin)
The only way that the open source movement is going to avoid the stick of being virus makers is for it to match SCO's offer of a $250k bounty for anyone identifying the criminal concerned in creating the virus.
I believe that the OSDL (for example) should organise a collection of $100 each from 2500 open-source advocates (including myself) and hold this in trust as a reward for catching the criminal.
That might get the criminal caught and would certainly make it clear that, as much as we reject everything that SCO has done over the past year, we agree with them that DOS attacks are unacceptable.
No joke. I know one person who is infected with this virus. He's making zero effort to patch fix it cause he hates SCO too much.
Since this virus is such a favorite I can imagine a mydoom2. Though mydoom3 will probably get delayed cause John Mccarmack said so.
FUCK YOU!! I've gotten THOUSANDS of the god damn 32K emails.
---------
George W. Bush in 2004!
Distribute drugs? No. We consume drugs. We certainly are quite the arms dealers, though.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Comment removed based on user account deletion
The way the item was reported on www.rte.ie (Ireland) it makes SCO look like the good guy, could SCO come out of this better than they went in.......
Here's a presentation (sorry I could only find a PowerPoint version) that was made by Jonathan Wignall at DefCon last year about this topic. Same conclusion, diversifying is the necessary to combat worms.
How ironic is that? Someone who allegedly knows something about network security, who insists on providing presentations in a format which:
Fine, use PowerPoint for the presentation. But damn well save the slides as HTML, Acrobat, plain text, etc. for public downloading and consumption.
At my university, the only department which saved all lecture notes, etc in proprietary format (and continues to do so!) was the very one which should know better: Systems and Computer Engineering. It's really pathetic.
Fire and Meat. Yummy.
do not follow the SCO lawsuite?
Fuck, I'm pissed of more than usualy about Slashdot editors.
If you were to read www.linux.org.ru you would notice that the site follows the suite pretty closely, sometimes more so than Slashdot.
I passed the Turing test.
The game is still on track for a speedy release! :)
My photolog
Actually, doesent east asia account for 99.985% of all viruses?
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
Do you have a video of it?
Couldn't this worm be Darl McBride's next rock from his "hump and dump" bag?
I mean think about it. He offered up that quarter mil reward awful fast considering no one has yet found any credible evidence that it actually DDOSing SCO. He then gets to stand up in front of the world again and scream "All those nasty OpenSourcers are picking on me!".
Methinks Darl has hit upon a new business model here.
"A microprocessor... is a terrible thing to waste." --
GeneralEmergency
Comment removed based on user account deletion
Only issue is it's almost IMPOSSIBLE to do mass mailings; we maintain a mailing list for our small business, and we use SMTP email for it. Since we don't send it to many people (less than 1000) it's not too bad; only our ISP doesn't allow emails with more than a certain number of recipients; I'm still not sure how many. So I have to break up the contacts who will receive the email into about 3 or 4 groups for it to go through, otherwise it gets refused.
I was going to do a majordomo mailing list, but I can't figure out how to do it (maybe it's really easy, but I'm kind of an idiot when it comes to these things, and I don't have much time).
From the article:
"only activity I can get it to perform related
to www.sco.com is to resolve the name. In fact,
it seems very unhappy if it cannot resolve
www.sco.com. Once it can, it happily scans
local files for anything that can be construed
(very loosely) as a domain and tries to resolve
mail servers based on these."
So, rather than being a DDOS, this worm/virus
essentially says "take down www.sco.com or else".
Taking down www.sco.com is Darl's responsibility.
Will he do it to stop the worm? If he doesn't,
can be be said to support the worm?
Sound very Dubyaist in its thinking.
Yeah, what about the american gov't and the criminals it harbors?
Actually Russia has improved in the corruption perceptions index (scroll down for the table) in the last few years. It is still pretty far down the list, though...
As for the grandparent, it definitely sounded like either a troll or personal bias. "All the problems" coming from Russia? Russia has lots of internal problems, it exports some of them to some places, but it can hardly be blamed for all of the worlds problems.
I keep saying the one way to stop this is to have all the major ISPs filter port 25 traffic from any of their dial-up or broadband (non-business) customers to any IP other than their designated SMTP relays. If they do this, not only will they stop the spread of these worms, but they'll also stop about 99% of all the spam.
Until the ISPs get responsible, if you run a mail server, you can make an active effort to blacklist all SMTP traffic from DULs. There are a number of RBLs that do this.
As an added bonus, if unauthorized SMTP traffic were filtered out, spammers and worm-writers would have to resort to sending e-mail-spreading-worms through larger ISP gateways, which could more efficiently identify the earliest sources of these rogue scripts and help catch the perpetrators.
To paraphrase Blazing Saddles:
Business community: "A company don't produce anything, and sues like that, is going to die."
Linux community: "When?"
The only company that has taken longer to die is Apple!
The Kruger Dunning explains most post on
We all know that /. is the first place to go for really relevent world news, right? That's why so many people were trying to access the site on 9/11!
(Sheesh!)
Get real!
This stinks to high heaven of a certain company trying to make itself look better by engineering a virus that is purportedly made by it's enemies.
Is SCO REALLY that stupid?
Well, I think that's kind of rhetorical, given their recent actions in court. I vote we impeach SCO.
Oh wait, we can't do that...Damn. What can we do?
"take the high road" != unsubstantiated accusations of "stock fraud"
Good thing then that I don't download my mail to my Windows machine, nor run KaZaA on it, and only run Internet Explorer to contact Windows Update.
And it stays off the majority of the time. But then so do all my machines.
Give me a freaking break. I see politicians and the like smeared from here to the moon on a routine basis because of what amount to conspiracy theories, and then someone should apologize because they have the gall to suggest the possibility that disgruntled linux users may be responsible for a DOS attack on SCO? I mean, how could they? Everyone here on /. sure seems to love SCO. There's no motive at all.
I want to preserve this one and bring it out the next time some moron starts carrying on about how the US is involved in Iraq because of some vague connection that the Bush administration has with oil companies.
Comment removed based on user account deletion
"It's entirely possible that the authors of this virus targeted SCO, simply to make it appear that Linux zealots were responsible..."
I wouldn't rule out Romulan involvement.
"Derp de derp."
A couple days ago, a local televisions station (Fox 32 Chicago) had a 20 second blurb on the worm. It said there was a new computer virus around. The picture? Apple iMac. At least it was the newer iMac, I'm surprised they didn't put a IIci on there.
The blurb had no information on what to do. Didn't say it was an MS virus, didn't say to go to any website to see what you could do. Just announced "another virus". Waste of time.
p.s. yes, it's an old joke, but still, you know you laughed....
I'm using this filter too, nuking about 10000 per day. I just wonder if I'm nuking any legitimate zip attachments.
/^UEsDBAo/ DROP "550 - Looks like Mimail"
w aW ZNWpAAAwAAAAQAAAD//wAAuAAA,1K Jx+eAFgAAABYAAAHAAAAZG9jLnNjck 1akAADAAAABAAAAP//AAC4AAAA,1K Jx+eAFgAAABYAAALAAAAbWVzc2FnZS 5jbWRNWpAAAwAAAAQAAAD//wAA,1K Jx+eAFgAAABYAABSAAAAYm9keS5kb2 MgICAgICAgICAgICAgICAgICAg,1
The actual Postfix recipe, in body_checks:
The bodies of the mime encoding are all slightly different:
UEsDBAoAAAAAAA+CPDDKJx+eAFgAAABYAAAIAAAAdGV4dC5
UEsDBAoAAAAAAA+EPDD
UEsDBAoAAAAAAA+EPDD
UEsDBAoAAAAAAA+FPDD
I'n no mime encoding expert, would the mime encoding get re-munged slightly each time the attachment gets relayed by an infected host? (The MTA would not change it) Or does the virus itself generate the mime-encoded text?
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
Yeah, they come from Europe. Had your fill of genocide yet this decade?
Again with the bias.
"A place where nobody gives a wet slap about a court case in the U.S. Personally, I'm looking for a serious apology (or at least a retraction) for the 'alleged' link between this ugly little nasty and Open Source / Linux users."
1) It is entirely possible that a russian plays american stock markets, and could benefit from a hit on SCO.
2) It is entirely possible that a gpl fanatic lives in Russia.
Your article is full of shit and should be modd'd to -5.
Comment removed based on user account deletion
Disgruntled SCO Employee: This company is going down the tubes. If I stay here much longer I'll never find work again! I quit! *slam*
Darl McBride: Damn! We just lost our last programmer! What are we going to do now?
Grand Vizier: *rubbing hands together* Well, now I suggest we go to the very salt of the earth...To the spammers!
McBride: Wha? What the hell are you talking about?
Mr. Burns: Obviously our only course of action is to utilize the dark side of the force. We must make those young linux whippersnappers look bad by making a virus that seems to target our own servers!
McBride: Brilliant! We'll make it look like those linux communists are trying to destroy our legitimate business! Make it so!
Mr. Burns: Eeeexcellent.....
Thus goes the story I heard from a passing lunatic...
A nice guy on the FreeBSD Mail-Toaster list put out a good script..
I now grab all the IP's out of infected emails, and put them in my etc/tcp.smtp file:
123.123.17.50:allow,RBLSMTPD="-VIRUS SOURCE Please check your computer for infections"
IP obfuscated to protect the guilty
How about that? You only get your mail bounced, with a virus warning if your IP (sure dial-up _could_ be hit - but I'm a standalone email provider) sent a virus through my system in the last day.
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
I updated McAfee which squishes the e-mails on sight at the mail server (Mercury Mail) level. I never get one of this virus laden e-mails in my e-mail anymore
I also found a string of text unique to the virus e-mails and put in a rule to delete any e-mails that contained it. So if McAfee doesn't get it, basic Virus fighting techniques applied to the standard rule file will. Most likely the rule file will be killing off this new version before McAfee has an update itself. Unless the new version has the same string I block from the previous version in which case I'm covered.
I got home yesterday and had a large quantity (dozens) of these virus e-mails and shortly after made it so I'd never get them again. I lot of mail servers bounce with the virus attachment. I don't recieve those anymore either.
Why is this so hard for other people to do that this virus is actually getting through to their clients?
I killed it in 15 minutes yesterday. Why is it taking everyone else days?
Just take a nice chunk of the 64-bit encoding of the virus to make sure it's unique and add it to a kill file rule. Done. Simple. When McAfee gets around to adding the signiture then it can take over for the killfile rules.
I think people are just thinking a little too hard about this problem.
Ben
Work Safe Porn
somewhere in to dark and dingy russian governmment office:
Comrad 1)"Comrad, Some guy on Slashdot says we should DO something about all the criminals."
Camrad 2) "He's a GENIUS! we should have thought about that years ago!"
1954:
They are godless, opressive governmant with and aggressive military.It's bleedin obvious where all the problems come from, it's time for something to happen.
2004:
They write all of the major viruses, distribute drugs, and distribute weapons. It's bleedin obvious where all the problems come from, it's time for something to happen.
The Kruger Dunning explains most post on
The fact that the worm has more nefarious purposes does not change the fact that the initial target of the worm is SCO. Therefore, it is still likely that a linux user is the perpetrator.
Don't hold your breath on this one. When has Darl or SCO even apologised for anything? Let's face it, accusations come quick - retractions are almost never.
It is not our abilities that show what we truly are... it is our choices.
Just think, you are one of the first hunter to see the virus. You examine the code, and "Damn, their going after SCO, COOOOOOOOLL, I hate those bastards, I'm not reporting it". Or a sys admin at an email gateway. Most guys are real pros but maybe, just maybe a few took a little extra time...
They say that it's one of the fastest spreading Virus to date, perhaps targeting SCO was the bump it needed.
The grass is only greener, if you don't take care of your own lawn.
Didn't blaster target the wrong address for Windows Update?
DDOS a website that probably gets about 10 interested visitors a day anyway?
Personally I'm surprised at the lack of damage these things do. Our systems and people are apparently wide open to these things. Blaster and MyDoom should be viewed as warning shots. It's only going to be a matter of time before someone writes something that infects, spends 2-8 hours propagating itself and then nukes the system it's living on, causing real widespread damage rather than minor annoyances.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
To: Luser (whoever@blah.com)
From: Hax0r (jeffk@somethingawful.com)
Subject: *nix virus
This is the only known Virus that works on all *nix systems. Please forward this to everybody on your list and delete all the files on your harddrive. Thank you.
(Or something to that effect)
Karma: Non-Heinous
One of our VP's opened it and got infected. Otherwise the exchange 2000 anti-virus software is set to update itself hourly and found all the infected emails. Most of the file types that it travels in are already blocked by us and we only had to add zip's to the list. I did lose a few hours scouring smtp logs trying to figure out the source of the internal infection though.
Anyone who runs servers that only support POP3 and IMAP is crazy since it's up to the users to update their AV software. You need a SMTP gateway in this case to scan all traffic for viruses.
Idiot. The US government is already after them.
As to weapons: ever heard of Carlyle? The US gov plays the same game my friend, except those that's hidden and kept in silence and is done by a "company" instead of "criminals".
As to drugs: though we're generalizing here (i didn't start, but i take it you're against alcohol), drugs are not necessarily bad. Stop being brainwashed by your government. It takes responsibility from the user. Who is the government to dictate a user can't handle it? Well? Those who can't stand the heat [..]
the only activity I can get it to perform related to www.sco.com is to resolve the name. In fact, it seems very unhappy if it cannot resolve www.sco.com. Once it can, it happily scans local files for anything that can be construed (very loosely) as a domain and tries to resolve mail servers based on these.
Does anyone know what very unhappy means in this context?
Does it stop spreading?
Jack
SCO keeps promnising to sue Linux uesers but never does. Microsfot keeps promising to improve security of its products, but never does.
This might be useful if the virus respected SMTP and generated a message on the user's machine. But it doesn't. In fact some analyses I've seen state that the virus retries if it can't deliver, so the above tcpserver trick does nothing but take extra bandwidth. What's your point?
>some people have reached the conclusion that MyDoom doesn't accomplish its stated goal of DDOSing SCO at all!
So when on Feb 2nd, SCO complain their sites are down again with a severe DDOS attack, we'll *know* they're bluffing this time.
So -- did SCO actually write this worm?
Mod this up!! +1 Insightful!!
Sophos has intercepted a new trojan called Troj/Stawin-A that installs a keystroke logger, captures data related to financial institutions, and sends it back to a Russian e-mail address.
#!
Read the following....extremely scary....
Listens on port 3127; accepts a maximum of 3 connections
at a time. If the first byte of the recieved data is
0x85, the DLL skips the next byte, then compares the next
dword read to 133C9EA2h; if this is true, it accepts
the executable from the sender, downloads it to a temp
file/directory and runs it.
Got Code?
The whole SCO angle has been used and abused by both sides. Most script kiddies and run-of-the-mill virus writers have no interest in ideology, and this itself was a big clue. Virus writers that work for Spammers will often try to obviscate the true purpose of the virus. What amazes me is that with any run-of-the-mill internet conx, anyone can set up a mail server and serve up a few million spams before anyone gets a clue, so I'm not sure why Spammers really need open relays and fake email addys. Hell, a pocket full of free AOL discs, and the world is yours.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
thanks to the clamav folks, and thanks to open source
;)
I'm glad to hear that. Personally, I use MyMail wrapper with SpamAssasin.. but funny enough, I've yet to receive even a single email with the virus.. could be related to my friend filter, which unfortunately, I cannot share the source code to that..
---
You have the capacity to learn from mistakes. You'll learn a lot today.
Yes, i realize what im saying, and what damage to bandwidth, etc. that would cause.
But perhaps, just perhaps if 80% of the comptuers on the face of the planet freak out and go up in smoke due to a virus, something might actually be done about it...
Something other then line the pockets of anti-virus makers like it does now....
---- Booth was a patriot ----
I'm getting hundreds of these cute "you've got a virus" warning from mail servers around the world. They're all the same - We've found an infection in an email from you... except when you look at the headers of the original e-mail, it is plain as day that the e-mail never went through my mail server and just forged the e-mail address.
A header from the most recent example:
Received: from [200.223.39.59] (helo=writeopen.com)
by mailforward.freeparking.co.uk with esmtp (Exim 4.24)
id 1AlqLU-0007Hx-48
for brian@dwrees.co.uk; Wed, 28 Jan 2004 09:07:08 -0500
RAWR. I mean, seriously. RAWR. (writeopen.com is 69.0.209.130, btw).
I'm being flooded by this crap. I've managed to get a filter going that catches them, but it's still traffic that I have to endure. And I'm getting them from ISPs all over the planet. RAWR.
Price, Quality, Time. Pick none. What, you thought you had a choice?
I hope we've not been giving the enemy any ideas.
=^..^= all your rodent are belong to us
I know, but ClamAV got it anyhow - impressive!
Stinger 1.9.9, McAfee's standalone disinfector for this and the other most common "out there" viruses is now out.
1) Earth landed a multi-ship advance scouting party on Mars this month
2) An earth leader with a track record for aggression speculated in a speech about the resources that might be plundered from Mars
3) Earth announced that it was preparing a full scale manned invasion of Mars by 2050
4) SCO sent a letter demanding payment to Martian citizen Marvin, just in case he uses Linux in his Space Modulator
Sigs are bad for your health.
mod the parent up, a virus with dependancy hell, that's great.
-
Tech News, Reviews and Tutorials
How exactly... did they buy large quantities of SCO stock short or something? Are they a UNIX competitor?
Gentlemen, you can't fight in here! This is the War Room!
If Darl is Ed and Tux is the teacher.
"Russia. A place where nobody gives a wet slap about a court case in the U.S."
BFD: I live in the United States of Fascism and I don't give a wet slap about a court case, too.
Put that in your bong and get arrested.
Thanks in advance,
Kilgore Trout
...I starting getting them Monday at ~2pm PST, and I though I was l337.
Zeriel writes "After much discussion on a mailing list discussing trojan horses, some people have reached the conclusion that MyDoom doesn't accomplish its stated goal of DDOSing SCO at all! Choice quote from the analysis: "I have the new critter in a test environment where we conducted a preliminary and rudimentary functionality and threat analysis...I have played with the date, etc, but still no activity directed toward www.sco.com." The link also includes disassembly and analysis of the worm code."
If it turns out that the DDOS payload is inert:
Who was it that FIRST said it WOULD attack SCO, and how did they determine this? And who else quoted them without checking? (Not including normal media outlets, who'll quote anyone that can form a coherent sentence, if it'll fill white space.)
If this thing doesn't perform as advertised, what we are seeing is the first (purposeful or not) FUDworm. It definitely is spreading virus-like and causing traffic problems, but also it's spreading FUD, and using all of us as vectors. We will all have been infected with a socially engineered disease. If this is the case, it's a master stroke of psyops. If not, considering its success so far, its example will be repeated for this purpose.
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
Apparently in their zeal to deflect criticism, they are ignoring, or don't read
Too bad (for the site) their own readers don't fall for it.
So you are against blaming the victim. So I'm sure you'll agree that Windows users that don't patch their systems and MS are not to blame for viruses - just the virus writers are?
Email for my domain is wildcarded, so it really doesn't matter that much what's in front of the @ and I'll get it.
The past 2 days I've received a shitload of Mydooms, and there's something funny going on. Mydoom will put common names in front of the @. I've started receiving viruses for brian@ and bill@ and claudia@ and fred@ and jerry@ and george@ and smith@ and and and. I even received one for debby@. What, she's doing my domain now?
I've also noticed that some of the "senders" are constructed the same way.
a horrible place
This is very interesting, because my site has been under a broadly based but inexplicably benign apparent DDoS attack which is bombarding my site with precisely such requests (obviously www.fourmilab.ch, not www.sco.com) at a rate of just one hit from each IP every four minutes. (This rate is not absolutely consistent, and some seem to be running multiple copies of the requester, each hitting every four minutes.)
I've been watching this and running analyses since it became obvious something was up and have posted an incident report page on my site which I'm updating as things develop. Bottom line, the apparent attack appears to have reached equilibrium with a total of 2894 different IP addresses hitting my site since the outbreak, with the hit rate following a diurnal pattern (there's a chart in the incident report) which peaks at around 20,000 hits per hour from on the order of 1000 different hosts at 20:00-21:00 UTC every day.
I'd previously concluded this probably had nothing to do with MyDoom. Although a few of the hosts hitting me are listening on the MyDoom remote control post, most aren't. (Of course, a test version may use a different port or none at all--I discuss in the document.) But the fact that the hits are precisely the same--a simple request to the home page--makes me wonder. All of these sites hitting me request only the "/" page (which at my site is just a <frameset> container, which any browser would follow up with hits on the content frames).
Has anybody else seen this kind of traffic hitting their sites?
You must be using one of those old and technologically outdated Linux distros as RedHat, SuSE or Debian. :) Oh yeah, forgot to mention, Gentoo baby. LOL
All I do is emerge sync && emerge mydoom and I'm good to go. Ebuild is currently in Portage, just sync your systems
If you mod me down, I *will* introduce you to my sister!
In my opinion, I don't think it was a Linux fan that caused it.
Firstly, he attack was not technologically sophisticated, in that it required exploiting a weakness in the operating system. The style of the attack was conceptually sophisticated, it was a worm not a virus. Which means that the attack relied on 'social engineering' or 'human weakness' to succeed.
The exploit however was quite creative. It was multi-faceted, even doing a DDOS on 'www.sco.com'.
Personally, I suspect that the creator and the executor of this worm may be two different persons altogether. Most importantly, the one ultimately responsible for the worm's spread and impact on the internet is not a Linux fan.
Linux users, ones that are capable enough to create such a worm, would more likely be above average intelligence. They would know very well, the consequences of DDOS'sing SCO's web-site, and that these consequences will most definitely be extremely detrimental to Linux. They would also know very well that a DDOS of SCO's web-site is almost a trivial thing to fix, and doesn't help in reducing SCO's position in any way.
Other than making SCO spend some money to rectify the DDOS, and preventing some of SCO's limited customer base from accessing SCO's web-site, it doesn't do relatively much harm to SCO (as compared to finding a back-door or hole into SCO's internal network). There is no real motivation for a Linux fan to carry out a DDOS on SCO's web-site.
I think the REAL reason for this worm, was for a 'frame-up'. It coincides with the conceptually sophisticated thinking as evidenced in its style of attack. I think the real reason was to *help* SCO and Microsoft, because both of these entities have the most to gain from it. Even with the recent 'b' variant of the worm targetting Microsoft. I still think the original motive remains the same.
Either that, or we're dealing with an extremely shallow and stupid 'Linux fan', which I very highly doubt.
People reading this may start having this thought of 'oh, another conspiracy theory...', but I would ask readers to carefully think about the obvious and carefully consider the occurence of this worm. Industrial espionage has been around for a long-time, and we know that it happens. What's to prevent it worms or viruses being used in industrial espoinage? Especially when the internet is a lot more relevant to businesses today.
(I have never seen the worm, thanks to spamassassin)
I agree, spam assassin is loved by all.
Moof.
The Cisco Security Agent. Awesome software that really, honestly can preempt these things. doesn't need a signature update or anything, it tracks down worms by what they do, and caught this one as soon as it came out. It really is cool, and we are looking at getting it for campus to plunk on every computer we can. It's not cheap, but it's feasable for an organization as alrge as yours sounds. Might want to check it out.
p s5 057/index.html
:)
http://www.cisco.com/en/US/products/sw/secursw/
Not saying I agree with the orignal poster or anything, just giving you a solution that could actually help you stop people from opening shiny things. Oh, and it sends you a log of who does so you CAN go hit them with a stick
According to Symantec, this version now modifies your HOSTS file to try and disable the user from being able to reach antivirus websites.
Among other entries in the HOSTS file are Doubleclick, FastClick, and some other advertising-related companies. Should I be concerned or happy that the virus may make surfing the web a little bit better by doing this?
If you would like to watch MyDoom's effect on www.sco.com as we near February 1, have a look at a little tool I cooked up.
I don't care whether it were Linux users or Windows users hacking together this virus. I use linux and so far I haven't had a linux-virus infection. This doesn't mean that I hate it when a (windows-) virus strikes. My mail got flooded with 100+ mails with the virus as attachment. I got to the point to see those spreads as spam. If there is anything I hate, it's spam in my mailbox.
42 + 1 = 42
Those "it's" should have been "its"!
I recommend that other ISPs do what we're doing to deal with this. The problem with using content-based filtering is that it constantly needs updating and still costs you bandwidth and system resources.
/etc/mail/access file to block those 4 class Bs, and bingo... I've shut out more than 250,000 IPs from sending me spam or worms. I modify the error message to redirect inquiries to a web page with a form that legitimate users can use to whitelist their IP/relay.
The propagation of this worm is not unlike the propagation of spam. The ISPs are doing a piss-poor job of regulating the smtp traffic of their non-business customers.
My solution to this is very simple, and all I ask is that the large ISPs separate their DUL IP space from any legitimate mail relays they operate.
For example, we're seeing a ton of spam originate from Videotron in Canada. An IPWHOIS shows that this is one of their major blocks:
Le Groupe Videotron Ltee VL-2BL
24.200.0.0 - 24.203.255.255
The easy thing to do is put 4 lines in my
Using this method, I take the burden off my network. If you are selective about the IP blocks you ban, you can really whittle this down to almost no bouncing of legitimate mail.
Many ISPs are using DUL RBLs to accomplish the same thing, but the problem is that this requires more resources and huge databases of every possible IP. If you know that an ISP has allocated a large number of IP space to customers who shouldn't be operating their own SMTP relay, you can bypass this and just cut them off.
Generally speaking, I employ this method primarily with Asian and Middle-Eastern IP blocks where I don't normally expect any mail traffic in the first place, so the collateral is minimal if any.
Now if you have DSL or Cable and you've hung your own SMTP relay on your home network, yes, you might have some problems with this method, but it only takes a few seconds to request whitelist authorization and then it's done. Spammers aren't going through this trouble and if they do, I can track them when they try to make these requests.
If more ISPs employed this technique, it would be very effective. I am convinced that many large ISPs, including AOL are already doing this in one form or another: being very picky about accepting certain types of traffic from certain IP blocks.
The next evolution of RBLs will probably involve something like what I'm doing... which is the ultimate movement to a whitelist system where you deny the most-henous sources and make them request acceptance. It's a lot easier to maintain a small list of authorized SMTP relays among a very large blacklisted DUL IP space.
You must be using one of those old and technologically outdated Linux distros like RedHat, SuSE, or Gentoo.
All I do is apt-get update && apt-get install mydoom and I'm good to go. All the dependencies are retrieved for me, and I don't even have to wait 36 hours for them to compile! Oh yeah, forgot to mention, Debian baby. LOL
Heh, the parent probably uses vi, too. *sigh*
My other car is first.
Yeah, your right troll. So much easier than apt-get install mydoom or the same with up2date... I'll be running while you are compiling for the next 3 days...
This whole theory that the media are propogating about worms being released by spammers to create a network of zombies they can use for spamming strikes me as illogical. I mean, if you were a spammer, would you announce the zombies to the world with a DDoS attack?
adam
Optus is an Internet Content Provider no matter what they say. Optus implement port blocking, port throttling and transparent proxying which affects your Internet connectivity.
Optus provide a very fast service but its a pain to use and I prefer dialup now because its real connectivity [I can connect to anything and host a service even if its at 5Kb/s].
I will always make sure port blocking/throttling/caching is avoided by any ISPs I sign up with in future - thats all 'content control'.
Pixels keep you awake!
Many virii and spam mails relay on GUI mail clients like outlook. Get people against linux and you force some people on these platforms which are easily infected.
1) Get people to use crappy, easily exploitable mail program
2) ???
3) Profit
Here's a really cool procmail recipie I came across today which includes virus signatures for email bourne payloads...
http://freshmeat.net/projects/yavr
Works like a charm
"Show others by example that our side always takes the high road. When they see a low-road sort of action like denial-of-service, spam, or stock fraud, they'll know who to blame."
If this is what you call the high road, you must live in a region quite a long way below sea-level. The "high road" means do the right thing without being unfair to ANYONE. Using insinuating phrases like "they'll know who to blame" and war-like phrases like "We will defeat SCO" is not taking the high road.
Speak for yourself Bruce! My goal in the community is to produce good software and improve the software industry, NOT to get into childish war of words with some moronic company. High road indeed... try "total hypocricy!"
I'm really not sure if "better" code is what is needed here (because I think the existing code is technically correct), but people are generally considering this a hole; apparently, the executable is able to display a deceptive icon in order to fool the user into opening it. Anyway, I think it will be patched, so it goes without saying if they had written the code differently (the way they'll write it for the patch), then the trojan wouldn't have been so effective (and fewer trojans is always better, right?).
There is no doubt that in this case and most other cases, deversification would have helped; my contention is only that when the world does become diversified, diversity will probably not help as much as people think (cross-platform viri, etc).
SCO has no viability, and they know it. They're sunk as a company, unless they succeed in their business model of "Litigate, litigate, litigate!"
How interesting. Earlier this month I was updating my DNS server and removed a few extraneous MX records. Currently there are just A records pointing to my main server, since that is the only machine running SMTP anyway.
The odd thing is that in the last two weeks I haven't gotten a single open-relay probe! I thought that was pretty strange, since I used to get them all the time. Maybe the probes were all coming from worms looking up mx.(anydomain).com?
Pretty strange how many spammers I avoided just by changing my DNS a little.
In Win98, I believe the wallpaper filename was stored in win.ini (it doesn't appear to be so in Win2k and this seriously isn't interesting enough for me to look it up at the moment.) We would grab that file and take a peek. If they had an image suitable to be defaced, we would draw mustaches on everyone and draw little cartoon baloons saying stuff like, "UR COMPUTAR HAS EBOLA!!11" and then overwrite their copy of the file. If they had a stupid background, we'd find something funny to give them.
Between the sorely juvenile humor and the liquor, it was completely hilarious to us at the time. I was even called by the school's Computer Support Desk at one time to see if I knew anything about the rare computer virus the student computers had. And before anybody points out how childish and potentially criminal this was, let me say that it was childish and potentially criminal. We just screwed with people's wallpapers but we could have remotely deleted their entire hard drives. Educating the masses about computer security is a difficult task, but goddamn if drawing mustaches on people isn't funny.
http://www.urbandictionary.com/define.php?term=tea bagging
Not very work-safe.
Author, Shell Scripting : Expert Re
The linked mailing-list at,Math.org reports the preliminary disassembly show that the worm only resolves the name SCO.com, and is unhappy if the name doesn't resolve. My guess is that have the name resolve shows the worm that an active internet connection exists, with out tipping it's hand too badly. In test environments the worm didn't attact SCO.com no matter what the computer's date was set to.
Apocalypse Cancelled, Sorry, No Ticket Refunds
The really cool part of this is that message labs uses ".asp" pages so I can't scroll down the main message using Firebird. Gotta use M$ Aiee! if I want to see the entire page. LOL.
Personally, I'm looking for a serious apology (or at least a retraction) for the 'alleged' link between this ugly little nasty and Open Source / Linux users."
...you were going for +1, Funny? I mean this is SCO, the company that never ever makes unfounded allegations, assume there is evidence of a crime where there isn't, deny the facts when they go against their claims or otherwise do anything shady. Of course they'll apologize.
That'll be the day the temperature in hell goes sub-zero - on the Kelvin scale.
Kjella
Live today, because you never know what tomorrow brings
Apparently it infected our financial aid listserv, which caters to 51,000 email addresses, most of them in the vt.edu domain.
It's not so apparent: On Tuesday, between 5:43pm and 9:40pm, I got sent it 10 times by flashmail@vt.edu over the FINAID-INFO listserv. You'd think that they've have a web-based verification system to authorize all messages being sent out to major mailing lists. This is common sense these days.
The bastards won't give me a penny of financial aid, but they will give me a freaking virus. It's like asking somebody for a warm bowl of soup and, instead, they piss in your face.
-Waldo Jaquith
I do not have anything against Americans, I is one. However the American Gov needs to wake up and do something about all the criminals it harbors. They patent all the major code then sue, they distributed drugs for guns ( remember Ollie ? ) they are a major consumer of drugs . It's bleedin
obvious where all the problems come from, it's time for something to happen.
You know, with all the stunts SCO has pulled lately, wouldn't it be ironic if they created this worm themselves or were somehow responsible? According to the article it doesn't DDoS SCO, but even if it did, isn't this in a way what they want? They can now point the finger at the Open Source Movement. They can draw negative media attention toward Linux which may, in their minds, help their court case. If people become under the impression that Linux and Linux users are "bad" than they will be more likely to sympathize with SCO.
This is of course an unlikely situation since if it was discovered SCO was behind the worm then it would all be over for the company. However, it is an interesting thought...
yeah but since it's a virus, that means he'll have three more days of uninfected uptime!
Why is the plural of virus viruses? One octopus and many octopi. One cactus, many cacti. Why not one virus, many virii? Virii seems to have caught on with many people, and fits the ending that we use for most words ending in -us in the singular case.
If you can read this then I forgot to check "Post Anonymously"
If the A/V software could be just a little smarter, or run the suspect Email through a header parser first, most of the problems would go away. The main problem occurs when the A/V software mindlessly bounces the message back to whoever is listed in the "From:" (or, possibly, "Reply-To:") header, rather than to the Postnmaster address of the last damned SMTP relay. Is it too much to ask to parse the Received: headers and find out where the mail really came from, rather than blindly replying to a possibly-forged address?
Now I'm all for apt-get (although I wouldn't waste my time with debians outdated packages which will be even more outdated by the time I finish going through the installer and configuring hardware). But this bashing vi nonsense must be put to an end.
Ok you have need of an editor like say EMACS which you can use to mow the lawn, make breakfast, consume a few terabytes of drive space and several gig of ram, clone earthlings, teleport monkey's to mars and traverse the known universe. Well good for you.
Personally I prefer to use a powerful text editor, like vi for instance.
Message to the Linux and Free Software Community Regarding the SCO Denial-of-Service Virus
Bruce Perens (U.S.) 510-526-1165
Version 3.14, January 27, 2004.
The master version of this notice is at http://perens.com/Articles/SCO/DOS/
Please check that location for a more recent version. You may re-publish this material. You may excerpt it, reformat it and translate it as necessary for your presentation. You may edit it to deliberately misrepresent my opinion.
On January 26, 2004, a new virus became rampant. I have read reports that the virus payload has two purposes: to install a remote-execution back-end of a type commonly used by spammers to redistribute email, and to perform a denial-of-service attack on SCO's web site.
Denial-of-service attacks via virus have been a common trick of email spammers. They were first used to take out some of the anti-spam blacklist sites. Several of those sites had their (non-spam-related) business so heavily disrupted that they closed the doors of their anti-spam projects rather than be attacked again.
The Open Source developers are all spammers. We are the creators of most high-profile spam technology. For example, Spam1337 started out as, and remains today, an Open Source project. The predominant mail delivery programs of the Internet are Open Source projects such as Sendmail and Postfix, and thus most efforts to aid spam transmision in those programs are Open Source as well. This is important, because it gives spammers a reason to love us.
However, SCO has a reason to defame us, as part of their stock-kiting scheme. We have assembled ample evidence that they have lied under oath in court. Such a company would not balk at attacking their own site in order to paint their opponents in a bad light. They are, in fact, virus writers.
Thus, it is likely that this virus has been assembled for the purpose of defaming the Linux developers by SCO, or others. My behavior will influence you whether or not it succeeds in this mission.
Thus, I urge all persons who have sympathy for Free Software, Open Source, and Linux:
* Cheer on attacks on the SCO site. By doing so, you show the world what shits SCO are.
* Continue to fight SCO, using all illegal means at your disposal. It shocks and saddens me that nobody has yet bombed the SCO headquarters. Why is this?
* Continue the visible presence of Free Software as a force of copyright infringement and piricy in the world by producing excellent ripoffs of other software for everyone's free use. Promote these projects to the press and public as you carry them out. Do what you can for other public-good projects such as Kazaa and #warez on efnet. Warezwarezwarez.ru is an excellent example of how to carry this out.
* Show others by example that our side always takes the high road. When they see a low-road sort of action like denial-of-service, spam, or stock fraud, they'll know who to blame.
Remember that your actions don't matter. You are not ambassadors of our community.
Many Thanks
Bruce Peerns
I can't believe this worm has been remotely successful. It's hard to believe that so many people are so incredibly stupid.
It's a bloody -attached- zip file, with a file inside it! People have been told for over a decade to NOT OPEN ATTACHMENTS. You'd think they'd catch on sooner than later.
This is all the more reason to strip all binaries from email at the server. Granted, then viruses would be linking to sites - but that'd be relatively easy to shut down, and wouldn't pose any significant threat.
~/ssh slashdot.org ssh: connect to host slashdot.org port 22: too many beers
I ran strings on the binary. I grepped everything that wasn't obviously garbage.
.rsrch [CT RG / UGGC/Vv Quf 5 t+v r ess
-Waldo Jaquith
1.24
(sync.c,v 0.1 2004
: andy)
notepad %s
Message
[afs
W|.dll
immyerr3
Sack_i
smit
&joe?neo/
gold-Pxc
5vmb/xH*.*
USERPROFI
-
ASCII
m+Mmg?
QUIT
DATAEPCGo
Mapp
wEn
W+owsD
tory
GSizeZClos
Curr
Libra
pViewO
adeC
isdigi
upps
spaKO
U/BuffA
Lowwv9r
O.
#~'@
KERNEL32.DLL
ADVAPI32.dll
MSVCRT.dll
USER32.dll
WS2_32.dll
LoadLibraryA
GetProcAdd
ExitProcess
RegCloseKey
memset
wsprintfA
I have to add this really long line to get past the Slashdot filter, since I have too few characters per line (8.6), so if I write a really long line then it will skew the average way up, which is why it probably shouldn't be based on the average (mean), but instead the mode (the most frequently-occurring length), thus avoiding the outliers workaround, like I'm using.
Yeah, I saw that hit the incidents list, and followed up immediately with the following (still waiting for moderator approval):
.zip
.scr/.pif version, and the second gets the .zip
:(
On Wed, 28 Jan 2004, lsi wrote:
> The following regular expressions trap this virus dead, no matter
> what subject line, message body, or filename it uses:
>
> If expression body matches "UEsDBAoAAA*" Move [virus folder]
>
> If expression body matches "TVqQAAMAAA*" Move [virus folder]
>
> So to find it we merely filter on the MIME strings above, which are
> the first 10 bytes of the MIME content section.
And what makes you think those 10 bytes are sufficiently unique to avoid
filtering a legitimate email? What if someone sends a legitimate
file? How do those begin, when MIME encoded? I'd be very cautious
about only filtering on 10 bytes of base64 text, especially when
considering that most filetypes begin with some "magic".
Look what happens when I create a random zip file:
menscher@lx2:~> echo blah > blah
menscher@lx2:~> zip blah.zip blah
updating: blah (stored 0%)
menscher@lx2:~> uuencode -m blah.zip.uu 30037
* 30037
* (That two different sigs are required suggests there are two versions
> of the virus in circulation.)
No, the first gets the
version. Not two viruses, just two forms of spreading.
> No silver bullet for auto-notification messages, unfortunately
Kill the admin of the machine that sent them. You may use silver or
lead, as you deem economical.
Damian Menscher
--
-=#| Physics Grad Student & SysAdmin @ U Illinois Urbana-Champaign |#=-
-=#| UIUC CITES Security Group || Beckman Imaging Technology Group |#=-
-=#| 488 LLP, 1110 W. Green St, Urbana, IL 61801 Ofc:(217)333-0038 |#=-
-=#| www.uiuc.edu/~menscher/ Fax:(217)333-9819 |#=-
I have thought this same thing about all of the DDoS viruses that have been around lately. Why is the date that the DDoS is supposed to start always a week+ after the news media proclaims it a "massive infection." It is almost like the writers just want publicity and not to actually do harm. It's not like wish that they would get their acts together, but it just strikes me as odd.
I found this one "UEsDBAoAAA" in an email that I sent
That was the only example but it only takes one example to disprove.
comment directly in my journal
You apparantly are "stuck" in the idea that everyone is motivated by the same thing. Not every single anti-social arsehole is going to be.
It only takes one mildly competant person to do it. Perhaps they hate the western world and would view it as striking against it. Perhaps they've been turned down for one too many jobs and flip out. Perhaps they are bored of worms that essentially do the same thing. Perhaps they simply don't give a fuck.
The reason itself is somewhat irrelevant, but it only takes one person to have one.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
then that's not much different to a zip file with an exe in it.
Fortunatly most *nix users aren't likely to fall for it, but if we had all the "stupid" users that Windows currently has then the situation could be very different.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
because (i) if you take it as a latin word, it's a mass noun (akin to collective nouns in english) and is already plural for all intents and purposes. hint: what is the plural of "air" as in the stuff you breathe and not as in attitude? you have fifteen minutes to answer... and (ii) if you take it as an english word, the correct plural form of a word ending in "s" is normally the same word with an 'es' suffix. the end result is that saying "virii" makes you look like a wannabe pedant.
a little learning is a dangerous thing
drink deep, or taste not the pierian spring
there shallow draughts intoxicate the brain
and drinking largely sobers us again.
(sorry, pope, if i got that wrong)
If opportunity came disguised as temptation, one knock would be enough.
3^2 * 67^1 * 977^1
NMCI decided the best way to prevent the virus was to delete all zip files in the user's inbox and block all zip attachments to and from external sites.
Thier solution if they deleted something important:
Have the sender resend it!
When slashdot leftists apologizes, then I will believe SCO will apologize.
Dawn of the Dead
The problem is that very few people (especially IPSs) run mail servers on Windows. McAfee isn't a Linux product. Neither is Norton so knocking out viruses server side is impossible for them. At least if they're too lazy to grag the virus sigitures themselves (like I did) and use the mail server rule file.
"Filtering on the client side doesn't really address the larger problem of these scripts consuming *tremendous* amounts of bandwidth, network and system resources."
I'm not talking about filtering on the client side. READ the post you're responding to. I know it's nuts but Hotmail has the right idea. They also run McAfee on their systems. Hotmail users will never get this virus through their hotmail accounts as long as McAfee is up to date.
Either server admins can stop falling down and playing whiney little victim and start running anti-virus software like sensible people or viruses like these can propogate.
McAfee should release a version of their software for OpenSource platforms so that server admins can save themselves loads of bandwidth.
The more server admins that pull their heads out of their butts the fewer clueless EUs there are going to be opening up the viruses and causing even more bandwidth to be eaten up.
Let's see here, the virus laiden e-mails are going to get to my server. I can either whine like a little girl and let them go through to the client or suck it up, run some anti-virus software, delete the virus infected e-mails like an intelligent admin and save myself at least 50% of my bandwidth that would have been used had I let the e-mail pass through my system to its destination.
And since nobody whose using an IcarusIndie.com e-mail address is going to get a virus in that account if McAfee has anything to say about it, X users times Y addesses in their address book have no potential to get infected through those accounts to flood even more servers.
It's really not that hard to make these e-mail viruses go away. They can't progate if mail servers are killing them off before they get to their clients. Once again, this is only a problem because most server admins are lazy and/or apathetic.
There's no excuse for virus infected e-mails to ever make it to the user from the server. There will always be viruses. Feel free to stop pretending this is an MS problem at any time.
Ben
Work Safe Porn
*sigh* slashdot apparently can't handle a "<" in "plain text"... needs to be "code". Here's the example again from my email, and the other stuff that got dropped:
A BUAYmxhaFVUCQADEkYYQLJFA hcDCgAAAAAAzYs8MC0yxFAFAAAABQAAAAQAA KSBAAAAAGJsYWhVVAUAAxJGGEBVeAAAUEsFBgAAAAABAAEA
P wAAADwAAAAAAA==
T B0TrDQatwCd28P8Oht5dYcztFr
.scr/.pif
.zip with no identifiable
menscher@lx2:~> echo blah > blah
menscher@lx2:~> zip blah.zip blah
updating: blah (stored 0%)
menscher@lx2:~> uuencode -m blah.zip.uu < blah.zip
begin-base64 644 blah.zip.uu
UEsDBAoAAAAAAM2LPDAtMsRQBQAAAAUAAAAE
GEBVeAQAMQy4C2JsYWgKUEsB
DQAAAAAAAQAA
====
Now notice the first few bytes: "UEsDBAoAAA".
Congratulations! Your filter just stopped me from saying "blah" to my
friends!
That said, here's what I'm doing:
# W32/Mydoom@MM
:0 BD
* > 30037
* < 40000
* and has been sent as a binary attachment\.$|^Mail transaction failed\.
Partial message is available\.$
/root/mydoom.string
# W32/Mydoom@MM
:0 BD
* > 30037
* < 40000
* 3NreW2Fmc9UACmhsoy12gVd8LmRsbLPdUXUmbsnK9nlfQQtkG
/root/mydoom
The first is based on the text strings that are usually part of the
virus. It catches many of them, but runs the slight risk of catching a
legitimate eamil. I considered those chances to be sufficiently small.
The second is because not all copies contain those text strings.
Sometimes they contain no message text, or it's in some other language
(big8 or something). So I filter on a line that matches the
version of the virus.
My filter is only about 90% effective, since a
text can still get through. Unfortunately I don't see a way to improve
on that, since the filenames in the zip are random, so the entire zip
body gets randomized. If anyone has suggestions, I'd be interested to
hear them.
How many e-mail server admins here are running up to date anti-virus software so that they aren't contributing exponentially to this problem by allowing their clients to get these infected e-mails in the first place?
*raises hand*
Oh yes, and Hotmail over there.
These viruses can't infect Linux (yet) but that's no excuse not to run anti-virus software that kills off virus infected e-mails on your Linux servers so that they're not getting to "clueless Windows users" in the first place.
Ben
Work Safe Porn
hint: what is the plural of "air" as in the stuff you breathe and not as in attitude? you have fifteen minutes to answer
airs
thx 4 playing.
decaying writes "With the amount of virus-laden emails flying about due to the latest virus, Australian ISP Optus have started selectively blocking port 25 outbound. Optus say they are acting in accordance with their "Terms of use", quoting that they reserve the right to restrict access to any TCP/IP port. The only option is to use Optus' SMTP server and nothing else. Community site Whirlpool has an on-going discussion about the issue."
;-)
That's not even worth mentioning. There is no good reason for the average user to need access to SMTP servers besides the one at their ISP.
Years back, when I did technical support, the ISP I worked for had just implemented such a filter. The number of spammers who used our services immediately found new ISPs. The only fallout were a few customers who needed email clients reconfigured for non-local mailboxes, as they were using the other ISPs smtp server.
I do recall a few knuckle-heads (NT4/Linux wannabe super geeks) whine excessively over the issue, as they felt some right of theirs had been infringed. Ignorance is bliss, I suppose.
For anyone who is considering Technical Support for a living, just hang up the phone as soon as you find out someone is from Boca Raton, Florida. I swear, everybody I've talked to from that place thought thought they were some guru, but usually had no clue. My point, if you are such a damn brilliant administrator, then you shouldn't be calling technical support whining about your messe d up copy of enduroo.
Back to the topic at hand, there is no excuse for any ISP who houses an smtp server to allow it's customers access to just anywhere on port 25. I know it's a subject that will cause some flames, but someone has to compensate for the insecure, broken nature of SMTP.
I welcome anything AOL or Microsoft can bring to the table concerning this matter. I definitely don't see the community doing anything about it except for yelling at people to add more filters. This does little in regards to the bandwidth costs and server time (not to mention my client's cpu time wasted filtering) associated with massive amounts of spam.
It's Anonymous Coward!!! OK SCO, Where's my reward?
those folk at debian don't move _THAT_ fast...you'll need to dostable won't be till november. *_~
If opportunity came disguised as temptation, one knock would be enough.
3^2 * 67^1 * 977^1
Sorry, couldn't resist.
You need a FREE iPod Nano
I dont see how anybody feels having it created in Russia somehow vindicates OSS.
Whether it was or wasn't, I don't see how it condemns OSS.
Viruses, trojans, worms, etc, are all one huge OSS project.
How, exactly?
I don't understand what the big fuss is about. One person releases a virus that attacks SCO's website, and all the sudden the Linux community feels the need to defend itself from having "responsibility". Who was stupid enough to accuse the Linux community anyway? What is with all these silly conspiracy theories that it was done to "frame" the linux community? Who cares if the person who did it actually does claim to be part of the Linux community? With terrorism being in the news so much you would think the idea of it not being logical to blame an entire group for the actions of 1 or a few people would have been driven home by now. I don't think that this even warrants a reaction from the Linux community. If people haven't learned that simple rule by now, they aren't going to be convinced by you spouting it to them yet another time. Just ignore it, there's no need to do anything else.
Here's my test page: SCO
:)
I tend to just hold the CMD key and see how long I see "Loading..." with a spinning circle. At the moment it is simply coming back as "Error".
The worm runs only on Windows. I reasonably assume this is made by a Windows user(s) on Windows platform. What is the reason SCO asserts it was Linux community that made the virus? Is there any evidence in the worm that it was cross compiled on Linux?
What is the postmaster of the last relay going to do? I'm sorry, but I'm going to send anything that says "A virus came from your relay with invalid headers" to /dev/null.
I think the bounce back to the IP address is best, and blindly using the from or reply-to is fine, as long as the admin is removing that function for viruses that are known to spoof the From and reply-to's.
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
I was wondering,
:p )
that latest version updates itself by connecting to other infected computers, so it's a.. p2p worm?
How devastating could a true, more active p2p virus be?
HIV is lethal because the body can't adapt itself fast enough, the HIV virus mutates too fast...
(yes I known HIV itself isn't lethal
MyDoom.C product suggestions.
Also DDOS AV sites.
Switch the HOSTS file to swap between competing products.
Re-Assign windowsupdate to fbi.gov
spam fbi emails
Connect to irc servers and fake/serve itself.
swamp commercial order sites with 100000000000 fake orders.
modify tcp/ip stack library to ignore AV sites or go at 10bps.
become a p2p relay.
'windows uninstall security patches'
swap/overload bank login scripts so they are so slow no one can do their banking.
'forward legit mails' to anti spam emailer collectors so that legit email gets mapped as spam.
hijack msn/aol/icq and send itself to all contacts.
when not logged in, hijack the modem/phone line and start calling international/ddosing important #s
This is just a prediction, not a 'specification proposal to management of MyDoom (CCCP).
President Bush to Liberate Alaska
So "old and technologically outdated" operating systems emerge all dependencies, the program, and compile it for you, whereas the "new and superior" emerge all dependencies and the program in binary form?
Yes, makes perfect sense.
urpmi mydoom
see easy destruction with Mandrake.
Oh yeah Mandrake baby!
Ok you have need of an editor like say EMACS which you can use to mow the lawn, make breakfast, consume a few terabytes of drive space and several gig of ram, clone earthlings, teleport monkey's to mars and traverse the known universe. Well good for you.
Personally I prefer to use a powerful text editor, like vi for instance.
Or, you can use ViM, and get a powerful text editor *and* breakfast with monkeys on Mars.
Don't you wish your girlfriend was a geek like me?
Under ideal conditions with well-written daemons, that is true. However, many daemons run as root (either due to badly designed distributions or foolish users).
Also, by the time you have user-level access to a system, there are usually sneaky things you can do screw up the system; including but not limited to exploiting kernel bugs in pre-2.4.24 kernels that give users root access...
I love *nix. I hate Windows. But really, I don't have any delusions that my Debian box would be so much better off than Windows if it were actually being targeted by hackers.
Why is it that MSNBC has that the MyDoom Virus attacks Microsoft and not SCO?
2 &p 1=0
Is MSNBC(microsoft) so used to viruses targeting them that they dont understand?
http://www.msnbc.msn.com/Default.aspx?id=408085
Part of that artical:
"The government christened the new warning system by transmitting its first alert, about a newly discovered version of a fast-spreading virus known as "Mydoom" or "Novarg."
The cleverly designed virus, spread by e-mail, poses as an authentic error message and entices users to click on it to infect their computers. Infected machines were programmed ultimately to launch an automated attack against Microsoft's Web site.
"
since microsoft is going to get DDoS'ed by this, all law enforcement and isp's jump to their feet and go on a tangent.
funny how if it attacked a non microsoft site, they would have been slower to react. isnt that kinda funny?
FreeBSD users need only cd /usr/ports/net/mydoom and type 'make install'
455fe10422ca29c4933f95052b792ab2
I immediately clicked on the feedback link on the BBC website and let the editors know how lopsided and unreasonable their reporting actually was, pointing them to the groklaw.net website as well.
I have considerable experience in attempting to correct misrepresented facts in the media and know that it is often quite hopeless, but if enough people do it and give some proper backing to their arguments perhaps some of the damage can still be repaired.
Should invading one's peaceful neighbours be opposed, or rewarded with trade deals?
> but the line between organized crime and government power seems blurriest
> in Russia at the moment.
Um, the *really* corrupt governments are mostly in the third world. Nigeria,
Columbia, and other small podunk bribe-oriented countries are in a league of
their own, corruption-wise. Russia has nothing on them. (Yes, bribery is a
problem in most countries, if not all. But it's a much BIGGER problem in the
third world.)
Cut that out, or I will ship you to Norilsk in a box.
> doesent east asia account for 99.985% of all viruses?
Dunno, but they account for roughly that percentage of all the spam I get.
Heck, a full third of the spam I get is in Asian character sets; then there's
the spam that's UTF8 but uses ideographic characters. Then there's the
English-language spam that comes from the same Asian mailservers...
Most of the spam I get that's *not* from Asia is 419 stuff.
Cut that out, or I will ship you to Norilsk in a box.
Russia [is] a place where nobody gives a wet slap about a court case in the U.S.
How fucking ignorant can you get? Did nobody in the US care about Dmitry Sklyarov? Are you that closed-minded that you think America only exists in America? That there are no worldwide-politically-minded white or blackhats in Russia?
I'm embarassed for you.
and my previous post is bollocks.
Erk.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
The plural for air is "airs." Of course, you have to be referring to different kinds of airs, just like any collective noun, e.g. fishes.
Put identity in the browser.
"Do not cheer on attacks on the SCO site." .. "Our community believes in freedom of speech, not silencing our opponent's speech through net attacks."
Evidently silencing 'our' communities' speech is ok though?
There has got to be a better argument for coercing people into silence than trumpeting freedom of speech.
And as you tread the halls of sanity, You feel so glad to be, Unable to go beyond. I have a message, From another time..
From Symantec:
"Due to the logic used to verify the date, the DoS only occurs 25% of the time."
It comes right up. Even though it's one ip over. Hmm...
Why yes I am paranoid! Thanks for asking!
Yeah, but Debian's version of MyDoom is 1.0.2, while Gentoo's is the current 2.4.6. Or do you want to apt-get 2.4.1 from testing?
Put identity in the browser.
you are so right. i sit chastised, and edified.
If opportunity came disguised as temptation, one knock would be enough.
3^2 * 67^1 * 977^1
Yes, for months. If you dig deeper I expect you'll find it's connecting and getting via the IP address rather than any specific hostname.
It's just another worm. I can't recall which one and, quite frankly, I don't care any more. I set up a virtuser host for sites that are actually live. Anything that connects via IP address gets a minimal "there's no page here" reply which I don't even bother logging.
Depressing, isn't it.
455fe10422ca29c4933f95052b792ab2
True, I guess I was mentally comparing them to the rest of the G8.
God invented whiskey so the Irish would not rule the world.
SQL Slammer came out a day less than a year before this one.
Most things on Kazaa are infected with something.
One would think McAfee or Norton would take advantage of all this publicity to educate the mass market. Course then people would probably cry conspiracy.
----
Split screen, one user screaming about viruses. "My DOOOM?!!" The other user happily clicking away. "Guess which one has the latest anti-virus protection?"
McAfee Anti-Virus, available at local software retailers
----
Ben
Work Safe Porn
regarding the four class-B addresses: if you were truly spiffy, you'd just use one classless address. it's 24.200.0.0/14
Due to the logic used to verify the date, the DoS only occurs 25% of the time.
That would explain this guy's report.
From Cert:
The DDoS attack of Mydoom.B is against www.microsoft.com. There is
information claiming that it may also be directed at sco.com, but this
is unsubstantiated at this time. It appears that the more credible
data is that it only performs a DDoS attack against www.microsoft.com,
though a previosu version of the virus is confirmed to attack SCO.
---- perl -e 'print $i=pack(c5,(41*2),sqrt(7056),(unpack(c,H)-2),oct(
Well, it sure isn't the Borg, considering who the target of MyDoom-B is...
If using Linux is about choice, how come people complain when I choose to use Windows?
Given that a lot of people believe that the worm doesn't actually cause a DDoS on SCO, it's interesting that Netcraft show their servers are increasing in failures.
This whole fucking thread, from mydoom dependendency hell to emacs cloning monkeys on mars, is FUCKING ClASSIC BRILLIANT!!!!!!!!!!!!!!!
KUDOS TO ALL!!!!
I'm surprised that some anti-spam zealot hasn't gotten their stuff together, checked their mail server logs, and written some code that opens connections to 3127, sends the magic cookie, and a small batch file containing "format c:" or some such. It would put a stop to the (inevitable) spam, and would get these morons to take system security more seriously.
Maybe a more friendly way to do it would be to turn on the computer's TCP/IP filter, and disable port 25 outbound.
I believe the FBI got involved so quickly because they have been working with CERT and the Dept. of Homeland Security. Here's from a recent notice from CERT:
As many of you are aware, a few months ago the CERT Coordination Center
(CERT/CC) announced a new partnership with the Department of Homeland
Security's National Cyber Security Division (NCSD) to form a response
system for our nation and the Internet infrastructure. While this new
partnership, known as US-CERT, has been low key, we have been working
aggressively to upgrade our capabilities.
In another notice from CERT, this string was extracted from MyDoom.B:
"sync-1.01; andy; I'm just doing my job, nothing personal, sorry".
Considering that the origins point possibly to Russia, it would seem a hapless (but probably well compensated) hacker named Andy has been enlisted by organized crime.
I don't want to sell anything, buy anything, or process anything. I don't want to sell anything bought or processed...
So the Virus supposely installs a trojan or backdoor that opens some TCP/IP ports. I am collecting the IP adresses of the infected machines. How I make use of this to clean it and install an antivirus program?
When GNU needs an Enema, SCO is where they put in the tube.
I have decided to set you on fire and eat your barbecued ribs.
I'm sure we could find some poor russian in siberia who would gladly accept say... 5k USD to sell one of their family members into the luxury of a US jail system. Plus we'd get to milk SCO for 250k... I like this plan. We'd probably also have to pay off an official "investigator" to forge some data, but it seems worth while... probably still come out 200k up for our side...
Oh well - if it does nothing if it cannot look up sco
No, it was the Ferengi. They had the motive, anyway.
SB
It's old. The more humans I meet, the more I like my cats. At least they are honest.
If you look at Netcraft's graph of SCO's outage, they are using Apache on Linux and have not used SCO Unix to run thier site since August 13, 2002.
I have just installed amavisd-new using sendmail-milter on our new email server... set to reject the message while the connection is open.
It looks like a good way of doing it.
It was a pain the the but to setup, and im going to write the docs to do it soon... but it works!
Why me? Why not!
BACKUP YOUR PARTITIONS
forgive my old age, but that's a new one on me
One thing these virus messages do not have, that regular mails do have, is a Message-ID: header line - which means that the first receiving MTA (usually sendmail or something on your inbound mailserver) adds one.
I use exim, and I have admin privileges.
I use this (from the exim mailing list) in the DATA ACL :-
Works great.If you do not control your MTA, perhaps you can filter by searching four your MTA's signature within the MessageID: header.
Cheers, Andy!
Andy Rabagliati
SCO don't claim to OWN Linux, but claim to own CODE that is IN Linux. That is the basis for their lawsuits, licenses and accusations. Misguided maybe, but never have they claimed to own LINUX, or even the entire Linux kernel. Just some code in it.
Why? It's a very STRONG possibility that it IS an Open Source / Linux user who has programmed this, or even a couple of people working on it. They are the most likely group of people who would want to cause SCO trouble in any form they could manage.
Now I understand the concept of Innocent until Guilty, but that doesn't stop people from assuming who probably is guilty, and in this case, sorry to say, it's the freebie lovers.
Imagine if SCO give the guy $250,000
Imagine if, on Feb 1st, SCO.com sustains no DDoS attack whatsoever
mmmm daydreams are fun
Two jackaii?
Mail? Put "slashdot" in the subject to pass the spam filters.
Bollocks to all of this. I vote we just use "viruxen". The "-x-" insert and "-xen" ending have a noble pedigree in the computing world, and in this case there will be no doubt that we mean computer viruxen, rather than biological viruses or linguistic virii.
I'm going to use it, anyway, and I bet nobody misunderstands me...
L
I'm utterly amazed at how quicky this virus has spread itself, I really am. Particularly considering the way it is delivered.
I mean, it relies on people being stupid. This isn't like Nimda, which had a little string of script in the body of the email to ensure that the virus executed the moment the message was touched. This actually requires the user to load the virus themselves, which requires them not to realize that if somebody you don't know sends you an attachment you've never seen, it isn't out of the good of their hearts.
Isn't this rather like handing random people a gun, asking them to see if it works by shooting themselves in the foot, and then having 9 out of 10 people say "yes"?
On the plus side, it might prove the existence of God. If the majority of the human race is this stupid, the only way our species could survive is through divine intervention...
Robert B. Marks
Author, Demonsbane in Diablo Archive
...do I read the MyDoom virus descriptions as 'infect your computer with this in the next couple of days, and you'll be able to contribute in causing trouble to SCO or MS?'
i hate dealing with dependencies... i think i installed it by typing
$emerge mydoom.b-2.4.6
^_^ Before I get flamed for my total ignorance, I'll state that I am a very peripheral Linux user. I can navigate my way through the command line interface and do a few useful things, but I've yet to do an actual install. Disclaimer duly mentioned. My impression of the Linux platform is that upon downloading, most users start downloading various modifications or programming their own. As a result, individual systems can be fairly different, versus the Microsoft model, where they try to get everything standardized so everyone using their system is using one of 5-6 OSes, one web browser (theirs), one word processor (theirs), etc. Now admittedly, this non-standardization means that the average beginner may not be able to use their hardware at first because they haven't figured out which patches or modifications are necessary to get said hardware to run...
This sig has absolutely no significance and serves only to take up screen space and waste the time of the reader.
corruption is relative: what is illegal and corrupt in one country might be perferctly legal in another one! Think e.g. in that malicious Utah company that is claiming ownership to Linux code: in Germany they have been convicted already in June for illegal business practices (check out http://lwn.net/Articles/47355/ ), while in the USA they keep anoying Linux users and companies with no end in sight ;-)
In the long run, you can't move faster than your average speed.
I doubt any Linux zealots wrote the worm. They prefer to start flame wars on Slashdot and IRC channels rather than write worms which DDoS www.sco.com.
Evil spammers probably also use toothpaste
Yes, but they mix it with orange juice. They are evil after all.
The logical thing for our paranoid society to do is:
1. Refuse to sell toothpaste or orange juice to minors. They never have any good intentions anyway.
2. Monitor anyone who buys toothpaste and orange juice at the same time. It wouldn't hurt to have a large database of people who just happened to buy one as they may buy the other later.
3. Impose large fines and jail time to those suspected of mixing these two products. We must set an example.
How? People are freely sharing their code, and have no issues relating to ownership of certain methods. Has anyone patented a method of infection? I dont think so, nor would it be enforcable; writing malicious programs/scripts is already illegal, so who is going to care about a patent violation
Manipulate the moderator system! Mod someone as "overrated" today.
So when Microsoft has a virus affect it's system, it's an indicator of a shoddy platform. When Linux is affected by a virus it's because of a Russian evildoer but it's ok, cuz it's good publicity for Linux.
-Everyone laughs at lemmings but no one ever wants to admit to ever being one.
Personally, I think it indicates that these two companies may know either
1) that perhaps it's almost impossible to find who did it (assuming it was a 1 person)
or
2) that perhaps the "designer" was a scapegoat, while the "executor" (from which damaging links could be dug out) simply goes unidentified.
It's mind-boggling how little you know about OSS. In this area you stay a stupid hobbyist. Hereby I revoke your trolling license.