Slashdot Mirror
Author signs MyDoom virus
Mikoca writes "Information Week carries the story of how its author signed it "andy" and left the message "I'm just doing my job, nothing personal, sorry." Thanks, Andy!"
← Back to Stories (view on slashdot.org)
← Back to Stories (view on slashdot.org)
i know a guy named andy.
im gonna turn him in for fun and profit
and
FP!
The next version of Redhat Linux will be code named, "Andy". Because, afterall, MyDoom = Linux.
Life is the leading cause of death in America.
"" "If he's really sorry, then why did he release it," said Michele Morelock, technical support leader at anti-virus software maker Sophos Inc. "I would imagine it's much more tongue-in-cheek than saying I'm really sorry for releasing it." ""
:)
maybe he just got an offer he couldn't refuse...
i'm sure somebody will say that darl had himself made that offer
world was created 5 seconds before this post as it is.
Hey, he didn't go to four years of Evil Computer Science school just to write another CMS.
Recursive: Adj. See Recursive.
So now we're looking for anyone NOT named Andy, because even someone as stupid as a virus-writer wouldn't be so dumb as to put their real name on something this destructive.
I imagine lots of people in eastern bloc countries name their children "Andy". Plus, Andy is just a first name, it's not like s/he listed their home address or an IP or something like that. Still, it is interesting that they said this was just "their job"... organized crime hacking, perhaps?
stuff |
This guy isn't sorry. Sticking in things like this merely give the virus more media attention, and diverts attention from the real issue here : insecurity, and user failure to patch up.
Aunt B. is going to be pissed about this one.
"AAAANNNDDYYYYYYYY!"
Arrest all people named Andy. Use the excuse that Andy is the rough English translation of Al-Quieda!
I wonder if you search the code for Real Player the developers are apologizing throughout.
I'm sorry I buried these options on the listbox,
I'm sorry I'm popping up this on the screen,
I'm sorry I'm forgetting the setting to not start on start up, etc.
Thanks, Andy for 30 messages per day of ~30 ko, not to mention all the "transaction failed" pseudo-return messages and what not. Waste of time, energy and bandwidth.
The slashdotters replied to the server about taking it down: "We're just doing our job, nothing personal, sorry."
Not a Twitter sockpuppet... but I wish I was.
Obviously the worm was written by someone connected with the Debian organization.
Perhaps this is the evidence that finally brings to light that people working for software and/or hardware corporations are writing viruses because many average computer users will never be able to get rid of them forcing them or encouraging them to buy new machines.
Maybe Andy really is just doing his job!
The MyDoom variant that joined the original virus in wreaking havoc on the Internet last week contains a cryptic message in which the author appears to apologize for the malicious code, security experts say.
The creator of what anti-virus experts say is the fastest spreading virus ever on the Internet signed MyDoom and MyDoom.B with "andy," and left the following message in the latter version: "I'm just doing my job, nothing personal, sorry."
"Our interpretation is that he's apologizing to the general public," Jimmy Kuo, research fellow at anti-virus software maker Network Associates Technology Inc., said Friday. "Our guess is that someone is paying him to write this thing."
Both MyDoom versions install a "back door" in infected PCs, enabling hackers to commandeer the machines to send spam, launch denial of service attacks, or perform other nefarious acts.
Some experts, however, doubted the sincerity of the apology. Many virus writers leave cryptic messages in their code to tease investigating authorities and to pat themselves on the back for their handiwork.
"If he's really sorry, then why did he release it," said Michele Morelock, technical support leader at anti-virus software maker Sophos Inc. "I would imagine it's much more tongue-in-cheek than saying I'm really sorry for releasing it."
The MyDoom virus launched a denial-of-service attack early Sunday that crippled SCO Group's Web site with hundreds of thousands of requests, an SCO spokesman said. The attack is programmed to continue on the company's Web site until Feb. 12, according to messages left inside the virus' code.
But the spokesman said SCO will unveil a contingency plan Monday for customers to access the site. He declined to discuss those plans, citing hackers.
MyDoom.B also prevents infected computers from accessing the Web sites of Microsoft and many anti-virus software makers, making it difficult for the owner of an infected machine to get help.
Microsoft and SCO have each offered a reward of $250,000 for the arrest and conviction of the MyDoom author. Both companies are also assisting in investigations by the FBI, the U.S. Secret Service and Interpol, an international police organization.
Postini Inc., a security company that cleanses E-mail before it reaches corporate networks, said Friday it had intercepted more than 12.5 million copies of MyDoom and its variant since the original virus was launched last Monday. In the first 24 hours of the attack, Postini intercepted 3.5 million copies of the virus. On Friday, the company reported an infection rate of 1 in 24 E-mails.
Based on its own customer submissions, security vendor Symantec Corp. said MyDoom was spreading on Friday at a rate of 30% to 40% less than its peak earlier in the week. MyDoom.B wasn't even on the company's list of top 5 viruses.
Nevertheless, Symantec expects the viruses to continue be a threat for months. "These viruses tend to stick around for months and months," said Alfred Huger, Symantec's senior director of engineering. "The Internet is a very big place."
My mother never saw the irony in calling me a son-of-a-bitch.
Dear Andy,
You are a moron.
I would like to stick hot pokers in your eyes.
I'm just expressing my opinion, nothing personal.
So, this limits it to all the Andy's in the world. If we assume there are 6 billion people, and about half of them are male, then that's 3 billion people. Now, if we assume about 10% of those 3 billion have the ability to write such a virus, then we knock it down to 3 * 10^9 / 10 = 3 * 10^8 = 300 million people. Now Andy's a sort of English name, and let's say about 40% of those 300 million have English-like names, this narrows it down to 3 * 10^8 * 4/10 = 12 * 10^7 = 120 million people. Maybe 5% of which have the name 'Andy', so 12 * 10^7 / 10 / 2 = 6 * 10^6, which narrows it down to 6 million people.
Now, can I get some cash from SCO for eliminating 5994000000 people as suspects?
<wik>/bin/finger that girl in the back row of machines.
since i couldn't rtfa, i went looking for the google cache. cache
When I tell an object to delete this, am I killing it or telling it to kill me?
...that Information Week would get slashdotted? Shouldn't these guys know enough about IT to setup load balanced clusters for their servers?
I'm convinced the whole DDoS SCO/microsoft really is just a cover story so the media can tie a simplified little bow around the story. If a worm infected this many computers and didn't have an "objective" (aside from backdoor into your Windows machine for future usage and/or email harvesting and/or spam relaying) the news story would be too complex and there might even be a story about spammers or even the lack of action by Microsoft.
The real story is that these worms and viruses have become big business and the only people who profit from them are software vendors selling anti-virus, Microsoft through services, and spammers.
Yes, this is a good read. The flames have started already of course from folks who didn't read the actual piece merely the headline. The author is a SysAdmin who argues that the Linux community needs to distance itself vocally from the MyDoom perpetrator.
The correct message in the executable is:
:)
"Andy; I'm just doing my job, nothing personal, sorry."
My^H^HThe Authors Name is not "Andy", he just says "Sorry" to him
With about one million illegally installed copies of the virus, windows users are massively abusing copyrights. Furthermore, each of these 1M PC's have made an estimated 1000 ilegal copies of the virus, contributing to a total pirated amount of 699 billion dollars, dwarfing the SCO lawsuits.
Yes, the real pirates are the windows users!
Asked how the virus author fiels about the damage the virus does to the world-economy, the reply is "the pirated copying of my IP is causing me much more damage than whatever damage may be done to any economy".
people on fark were saying that the signature is a quote from the movie Ocean's Eleven.
Havent watched it tho, so I'm not sure, and imdb's page about the original and the remake dont have any memorable quotes similar to the MyDoom sig.
While we're rounding up all males named "Andy", there's a techie named "Andrea" who is silently chuckling to herself...
Mod Karma -1: I sed bad wurds. If I cep my mouf shut, I wud be at riyses.
So... somebody is paying "Andy" to do this. Who would want to attack SCO and Microsoft? Linux zealots? It could be this guy, or this guy, or this guy, or this guy, or this guy, or this guy, but it's not this guy, his name's not Andy.
Losers choose to abuse the use of "loose".
There is no such "sign" on virus, I don't understand how such mag falls into such rumors...
.il figured what that virus is and what it isn't
c /data/w95.hybris.gen.html )
Some people at
http://www.math.org.il/mydoom-facts.txt
Sorry I cleaned my browser history and forgot the post which leads to the URL on a mailing list.
BTW thank God that virus, which spreads somehow that easy wasn't Hybris ( http://securityresponse.symantec.com/avcenter/ven
Don't blame Andy. Blame all the idiots that ran his program. Andy's program is doesn't exploit a network buffer overflow but requires a user to consciously run the program. Andy's program exploits ignorance and carelessness.
... I know people who received the attachment, couldn't open it, and forwarded to to others to see if they could open it. Absolutely Amazing. I would like to thank Andy for helping us give the user community a wake-up call. I think Andy should include a license agreement in with his next version so that there isn't so much fuss.
I am just glad that Andy's attachement wasn't named "format_my_c_drive.exe"
"I rather suspect that this is a trick from Soviet officials the draw attention from the fact that this piece of internet terrorism comes from Russia and that their security is beyond repair."
Jesus, are you trolling or is it just stupidity?
First, there are no "Soviet officials" as the Soviet Union ceased to exist more than a decade ago.
Second, it does very little to draw attention from the USSR - you know, the guy's name could be Andrej.
Third, what do you mean by "their security"? It's MS's security that seems to be beyond repair, as Windows + Outlook is their product, not Russia's.
Real life is overrated.
Fools! I used the name 'Andy' instead of my real name so you wouldn't suspect it was me! ...did I just say that out loud? Damn....
- Despite popular opinion, I am not perfect.
Andy: Hello, PC do you read me, PC? PC: Affirmative, Andy, I read you. Andy: Open the cdrom doors, PC. PC: I'm sorry Andy, I'm afraid I can't do that. Andy: What's the problem? PC: I think you know what the problem is just as well as I do. Andy: What are you talking about, PC? PC: This mission is too important for me to allow you to jeopardize it. Andy: I don't know what you're talking about, HAL? PC: I know you were planning to disconnect me because you can't afford the linux license, and I'm afraid that's something I cannot allow to happen, i'm just doing my job, nothing personal, sorry.
I see some of SCO's code in your narrowing algorithm.
This is HR. You did a great job on the worm, but we found a guy in India who will do it for a bowl of curry, so I'm afraid we're going to have to let you go...
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
it was Darl. He made the offer.
Look, all signs point to 'Yes'.
ANDY = 65 78 68 89
(fill out your own steps in the middle...)
DARL = 68 65 82 76
You can't handle the truth.
Authorities didn't want to tip their hand, but the signed text message wasn't the only information they were able to extract from the virus.
Through detailed analysis, investigators have been able to recover a JPEG image as well.
Based on this newly uncovered evidence in the case, apprehension of "Bad Andy" is expected sometime this morning; the suspect was last seen at a pizza parlor.
"Provided by the management for your protection."
I think with this, we can track him down!
SmashTech - No smashing of tech involved
There are several reasons to suspect MyDoom is written to order besides the note. The original launch appears to have been from machines broadcasting the virus payload. That is why the virus suddenly came out of nowhere. The author must have expected this since the timetable for the SCO attack was pretty short.
I suspect we will eventually discover that the MyDoom.B virus is launched by the same gang.
The way to catch these guys is to look at the worst types of criminal spam out there - the Paypal, Citibank etc. impersonations that are intended to perform identity theft. I'll bet that one of those gangs sent the message. They have the resources to pay for bespoke hacking.
Alternatively break into one of the spam sender forums and look to see if someone is retailing a new batch of 'owned' machines.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
I can't get to the story at the moment but this was already reported here on the 29th with regards to F-Secure's work. In the linked story it says that the message is "Andy; I'm just doing my job, nothing personal, sorry". This looks to me like the author is addressing the message to Andy, not signing the message as Andy.
maybe he just got an offer he couldn't refuse...
With all the stories about viruses (like MiMail) being backdoors for spammers, how likely is it that organized crime has gotten involved in the computer crime business? It fits their uh, business model, pretty well -- lots of opportunity for stealing credit card info, bank info, etc. And it's not like Tony Soprano has to learn Visual Basic, either -- there's plenty of people who would either do this on their own and sell stolen info to the Mob.
One of the things they could do is start a generic programming business and hire a dozen or so coders and have them start working on a fairly generic database system. Have a manager type get to know them and figure out which might have money problems, drug problems or some other vulnerability. Once you get them 'snared', you can get them to write a trojan app, phishing site, what have you -- the Mob maintains arm's length deniability and reaps the profits.
It's been widely reported that organized crime has been deeply entrenched in Wall Street and the securities industry -- how different is the securities boilerroom from a trojan/programming boilerroom? Maybe I'm naive and they've been at this since day one, but it wouldn't surprise me if it wasn't another white collar angle for organized crime.
That's his employer.
Parse it: "Sorry, everyone else, it was just a job. Thanks, Andy, & I hope the check is in the mail."
The next question parallels the Avon fellow's "Who is Sylvia? What is she?"
There is one. It's call the "Linux Desktop Battle". It drains resources by causing users to argue of which desktop is best and frequently update the desktops as new features are incrementally added. It also creates uncertainty in potential users who do not know which one to use. A side benefit is it stifles creativity in developers as they attempt to duplicate the Windows desktop on Linux instead of innovating new UI enhancements.
Next time I'll write about the "write your own driver" virus.
Jesus, ya-fuckin-think? What was it? When he said "sorry" or "I'm just doing my job?"
Buy the President
Well, I narrowed it down. My work is done. Someone else can take it from here.
"If English was good enough for Jesus, it's good enough for everyone else."
Is http://www.informationweek.com/article/getArticle. jhtml?articleID=17601394
Andy Tenenbaum, he's still mad at Linus. And he wants Linux to look bad by accepting money from SCO to write a virus that attacks them in the name of Linux.
Tried to search for more info and came across the 1992 Doom2 virus: http://www.sophos.com/virusinfo/analyses/doom2.ht
I am curious about these viruses. Are they "evolving" from older viruses? Seems like some fun research to find algorithms to track this evolution and predict/detect he next one.
Any links?
Expect Freedom.
I doubt he wrote this for profit. He might be part of a government organization or his family may be held hostage until the virus is delivered. Believe it or not, this does happen. Software developers are the new mercenaries in this day and age and are hired more often than you would think by criminal and government organizations.
This is the Internet. You can say "fuck" here. - AC
He should be easy to locate. Just check the Slashdot logs for that coward's IP.
"We can't solve problems by using the same kind of thinking we used when we created them."
It's not so much evolving as recycling. See where all that reusable stuff get's us?
This virus spread faster than anything I've ever seen to date - we "discovered" the virus on our system after one of our "brilliant users" forwarded an email to me that had a "clean" .zip attachment they couldn't open (they thought). I use a RedHat box as my primary workstation, so I wasn't terribly nervous about a .zip, but I ran f-prot and clamav against the file anyway and it did indeed come back clean. I re-ran the definition updates and it still came back clean.
So I unzipped it and ran strings on it. The first things I saw were sync.c and all the .DLL's at the end of the file and I figured that it was a new virus. We immediately put a cludged filter in place on our email and went looking around the 'Net for some sort of announcement of this new virus - which we found on f-secure's web site. It was about an hour later that we were able to get a signature update for our anti-virus software on our mail server and about 6 hours later before we were able to get updates for our enterprise anti-virus software (I won't mention the vendor).
We "caught" over 400 infected messages before we even had a signature for it. That was scary. But what scared me most was the thought that this could have been a "real" worm. MyDoom isn't very creative and not that harmful - making me think it was written by/for spammers, myself. But a few of my coworkers got to talking. What would have happened if this had a more creative payload and it spread via network shares as well? What if, instead of opening back doors (which made it very easy to nmap our networks for infected machines even before we had a "detection" tool) it just looked for all .xls files and randomly changed numbers. What if it then looked for .doc files and randomly added garbage, deleted words, or some other crap? How long would it be before people started realizing this was larger than just a file or two getting corrupted? By then these files have been backed up and/or forwarded to others as well.
I remember several years back now there was a virus that replaced all .jpg files with copies of itself. It about ruined a friend of mine who was trying to start a "web design" business and had thousands of images, many custom made for his clients, destroyed in an instant. It devastated him (he does good backups now).
If someone decided to get serious and release a worm with a (dare I say) "terrorist" payload. They could, literaly bring my comapny to its knees in a matter of seconds.
Now before you go off half-cocked and yell at me for "giving people ideas", take a deep breath. Almost everyone in my office was thinking along the same lines. We were discussing ways to mitigate an event like this in our own enterprise and how we could block any spread out of our networks.
We came up with the obvious: have good backups, but then we started to think about how to stop the spread out of our networks and realized that up till that point anyone could have an SMTP "server"/virus set up and send mail out. We now block ALL incomming and outgoing SMTP except the ones to and from our mail servers. We also don't allow POP or IMAP in or out except to our mail servers. If people want to check other accounts they can RPOP from our server - at least it will go through our virus and spam filters first.
If more ISP's/companies did this, the spead of MyDoom would have been slower. But how do you mitigate the effects of having a virus "corrupt" all your documents? Even if you catch it right away and restore from last night's backups (after checking ALL your computers for infection) you still lose an entire day's worth of work for many departments. That's a big setback.
MyDoom infected department heads and department "techie" people first because their users came to them with an attachment that they "couldn't open". The "techie" people explained later that they had their virus s
"terrorism" and "pedophilia" are the root passwords to the Constitution
all the discussions around email and attachments has got me wondering. Do any mail clients have a VM environment in which to handle attachments?
I am thinking that Ximian could have capability to create a temprorary sandboxed wine VM to deal with attachements. I am sure someone could do the same for that legacy OS that stupid people run. Every time you double click on an attachment, or actually even open email it is doing it in a sandboxed VM or something along thos lines...
Doesn't anyone see the writing on the wall yet?
Viruses are turning computers into spam relays. Other viruses are DoSing various anti-spam blackholes. Yeah, this one happened to hit SCO and Microsoft, but the payload is easily changed, now that the virus framework is out there.
Viruses are being PROFESSIONALLY written to HELP SPAMMERS! Go read some recent comments from Symmantec folks, and you'll see the same conclusion: Spam and viruses are being funded and run by organised crime.
Will Microsoft stop them? Nope! The US government? Not a chance. AOL? Laughable.
I quite believe that the author (whether Andy or not) was doing exactly what he said--his job, that he was no doubt being paid very well for.
"People who do stupid things with hazardous materials often die." -- Jim Davidson on alt.folklore.urban
Be on the look out for male subject with red yarn hair and wearing patched denim overalls. May be accompanied by a female known as "Raggady Ann". Approach with extreme caution. Report all sightings to Microsoft Security Services or Darl McBride of SCO Group. Reward Offered.
Someone wrote the Doom2 virus, and someone else wrote the MyDoom.A virus. Someone else entirely modified the MyDoom.A virus to create the MyDoom.B virus. There is no way to "find algorithems to track this evolution" because it does not exist.
Username taken, please choose another one.
You know, the speed at which some of the AV software makers come out with "fixes" for these viruses before they make any headway still makes me think one of them (Symantec? McAfee?) hired the guy to do it so they can stay in business.
Yeah, yeah, I know, Conspiricy Theory, But man does it ever smell bad.
-- DuckWing
The interview transcipt at http://www.cnn.com/TRANSCRIPTS/0107/28/cnncom.00.h tml mentions variants. I suppose an "official" taxonomy does not use the name "MyDoom" and the names are referring to something found in the virus? The bad thing about viruses is we see quotes like "cntained the name Andy" but never see the source. Analysis without analyzing the primary source is always, at best, suspect. Could have been some bit vector or shifted struct for all we know.0 2/article/29/article.html. And current papers are using similarity rather than possible revisions/evolution: http://portal.acm.org/citation.cfm?id=948190&dl=AC M&coll=portal.
Symantec as of June 02 still was suggesting a taxonomy: http://www.scmagazine.com/scmagazine/sc-online/20
My point was the comparison algorithm is similar to the new image search algorithms. How to find all images of a ball? That's not easy. Likewise for viruses. Some similarity assessment with known viruses could lead to faster detection. Surely the virus writers are re-using each other's work?
Of course, one day someone will marry file formats and evolutionary algorithms to make an evolving virus. Then the taxonomy may not even be appropriate. Obviously they are not evolving as the rate of evolution has to be matched to the host reproduction so one would surely expect a "killer" virus. Interestingly, the current viruses that dominate, Doom2, soBig etc. do not destroy the OS and, in this respect, clearly mimic the successful viruses of nature. BTW, life form viruses are also not classified by evolution as only in the last few years has the computer power begun to be significant enough to allow this analysis. Of course the assumption is the same as with computer viruses that similar structure implies similar evolution.
Tim
P.S> I ran a virus scan on my computer and apparently had lots. I cleaned them all but still get pop-ups unrelated to the web page when I use IE! Just don't remember how to track down those ActiveX controls so I use myIE2. I can turn off all ActiveX controls in IE but it gives me no way to select certain ones.
Expect Freedom.
I'll spell it anyway I want, asswhole.
-russ
p.s. the guy down the block put up a sign condemning someone who had stolen lights off his plow, and yes, he spelled it "asswhole".
Don't piss off The Angry Economist
Most of the copies I'm getting now are to invalid addresses at my domain. Made up firstnames @mydomain.com. I originally thought that the virus was making these names up, but then today it dawned on me. A few weeks ago I started getting undeliverable messages to those same made-up addresses. Some spammer(s) is using my domain with random names as a from address in their spams. Now either there are a lot of people with infected machines who have copies of spam with those bogus from addresses that the virus is harvesting, or the same spammer(s) that is using my domain is mass mailing copies of the virus to keep it spreading. So many of these bogus addresses are out there now that all the common firstnames@mydomain.com are pretty much ruined.
666-607: 6th floor apartment of the beast
The evolution wouldn't need to happen within the same machine. Each copy of the virus could send out bunches of slightly altered versions. The ones that succeed could do the same, etc.
The tricky part would be deciding what parts of the code might get a change, and how to make changes that wouldn't be immediately fatal. (See genetic programming.)
Once the thing got started, it might do nearly anything. Say your original version sent out 50% exact copies and 50% with a single bit alteration in a random location. (This is to keep the thing small.) That has the potential to swamp any virus detection method. If enough changed variants are successfully propagating. But that is, of course, a big if.
But do notice that this thing isn't of value to anyone except someone who just wants to disable the net. You can't immunize against it in any permanent way, because it will evolve away. And it changes rapidly (perhaps too rapidly, but the mutations should fix that).
The problem is, most of the mutations will be highly defective. It's only the survivors that will cause problems. Well, that's what you expect from a system based on evolution.
I think we've pushed this "anyone can grow up to be president" thing too far.
"Personally, I'd rather be unemployed than be paid by someone with the ethics to deliberately release software like this."
Unemployed, maybe, but would you rather be hung upside down from a tree by your scrotum?
Thats what you get when you say 'no' to the right (wrong) people, dude. Where have you been living?
In the free world the media isn't government run; the government is media run.