BBC Links Linux To MyDoom

minus_273 writes "It seems the BBC has a story on their front page titled 'Linux cyber-battle turns nasty', very specifically linking Linux users to the MyDoom virus. Some lines to note: 'If anyone's anger has no measure, it is the wrath of internet zealots who believe that code should be free to all (open source). So, it seems likely that the perpetrators of the MyDoom virus and its variants are internet vandals with a specific grudge.'"

Comments

Can't even get the details right

[rabbit994]

From the article:

It has attacked a company based in Utah called SCO, bringing down its website with a barrage of emails sent from countless computers into which the worm had been insinuated, unbeknownst to the users.

It was HTTP GET requests. Problem is most PHB listen to people like him but they can't even get the freaking details right on small shit like that. Yes they were probably hit bad with MyDoom email viruses but so my 6 user server. HTTP GET DDOS was targeted at them but that has been zero proof of a Linux Zealot targeting them. Let me know when you get evidence not just some speculation.

Re:Can't even get the details right

[mpk]

I don't know if anyone bothered reading anything other than the pull-quotes before getting all huffy, or indeed if the story's been changed since release, but in the next paragraph it goes on to clearly say that there's no proof.

Additionally, it goes on further to say how well Linux has been doing recently in the server market.

Anyone who thinks that there is *no* possibility of *any* link between some Linux zealot with a screw loose and a grudge against SCO and MyDoom is in denial. It's one of many theories, but it's certainly a plausible theory.

Read the article in full

[p_millipede]

Just after the quote given, the article goes on with:

There's no proof, of course, but it must be one of the theories at the top of any investigator's list.

So, the BBC aren't actually saying that Linux users are behind it. They're saying that it is a theory that many people give weight to!

BBC Story Feedback URL

[tinla]

http://news.bbc.co.uk/1/hi/help/3281777.stm

The bbc accepts feedback on stories. It is worth letting them know that there is no evidence to suggest the involvement of members of the linux community, they may be involved or they may be a handy group to frame. If this wasn't 'scary computers viruses' the media would be be more sceptical of the obvious conclusion.

Re:Pretty hilarious...

[mainframemouse]

/. is not a news site. We are not journalists. We are not paid to give an informative unbaised opinion. The BBC however are,we (brits) pay them to give us the facts, the truth.

Re:Complain

[fucksl4shd0t]

I used yours as a model and wrote my own additions, corrections, and so forth around yours because I liked yours very much. :)

Here's mine:

I'm disappointed by the errors included in the article by Stephen Evans on the MyDoom virus. His article is nothing more than tabloid reporting conspiracy theories. If it had been offered as an 'opinion' or 'editorial', then maybe it would have been more appropriate. But his statements regarding the intents of the virus creators are treated through most of the article as statements of fact. This is improper, as Stephen could not possibly know the intent. It is also a false conclusion, due to the fact that there are many websites discussing the MyDoom virus and the reason it is dangerous is because it opens a backdoor on the user's computer through which spam is being relayed.

There are also some blatant factual errors. For example, Stephen writes "[i]t has attacked a company based in Utah called SCO, bringing down its website with a barrage of emails...." This statement is false, and only a very introductory knowledge of internet would protocols is needed to disprove and discredit this statement. The only way a website could be taken down by a barrage of emails is if the email host and the web host are the same machine. This is a known Bad Practice, and people who install networks in that fashion frequently get fired.

Finally, the article closes with the statement "[i]t is about malice not money." This is also widely regarded, among the computer security community, to be untrue. Considering the actions and statements of SCO executives, it seems more likely to me that SCO is behaving in a malicious fashion. Ever since they filed suit against IBM claiming ownership of thousands of people's work, SCO has gone off an a tirade every time someone has attacked them in any form, including the many open letters written to SCO by members and leaders of the community. This childlike behavior should not be rewarded by a "reputable" news source such as the BBC.

The article failed to mention that the virus creates a backdoor on infected machines that can be used to relay spam. The virus appears to have been written by for the purpose of helping spammers. The DDoS (distributed denial of service) attack on SCO appears to have been added later, almost as an afterthought, as a way of distracting the news media from the more insidious threat. It is unfortunate that it seems to have succeeded in that goal.

Please feel free to contact me if you have any questions about my statements. I recommend especially reading the comments of the "incidents" list at www.securityfocus.com to see what experts are saying about the relative importance of the "spam relay" part of the worm to the "attack SCO" part.

It concerns me that an article with such wildly drawn conclusions is to be treated as containing integrity, accuracy, and above all reporting the facts. Mr. Evens could have easily written an article with just as much "fact" as this one stating that SCO developed the MyDoom worm in-house, since they have been trying to try their court case in the press ever since they filed it. With slightly more fact than is included in this article, Mr. Evens could have claimed Microsoft wrote the MyDoom worm in order to support their ally against Linux, SCO. But all of these crazy theories dissolve when you examine the true purpose of the worm, which is to relay spam. This SCO business with the worm is obviously just a smokescreen, and it certainly wouldn't have taken *that many* brain cells to determine this minor detail, and this minor detail completely undermines the entire article.

Thanks!

Re:Why I'm not surprised...

[Albanach]

Complaints to the BBC can be sent to:

newsonline.complaints@bbc.co.uk

This is the feedback I sent.

[Ndr_Amigo]

I would like to make a rather strong complaint regarding Stephen Evans's article "Linux cyber battle turns nasty", as featured as a front-page article on the 5th of Feburary.

This article is presented as a factual piece, not an opinion column, and draws patently incorrect conclusions. Whilst the MyDoom virus does indeed target SCO and (in it's -B varient) Microsoft, the main payload of this virus is a spam gateway.

As someone whos main source of income deeply involves computer security, I find it insulting that Mr. Evans has apparantly made no attempt to research the history of these forms of virii, nor has he apparantly contacted any reputable anti-virus company regarding it. Meanwhile he postulates claims such as "it [revenge] must be one of the theories at the top of any investigator's list", and "in the case of the MyDoom computer worm, the motivation seems clearer". I find it very bad reporting that these claims are made WITHOUT actually asking any of the investigators opinion of the virus. It is a widely expressed opinion (see 'references' at the end of this message) by these security professionals that the Denial of Service attack is the SECONDARY function of the virus, and not at all related to it's true purpose. A simple search on Google, let alone contacting even local London-based security firms such as mi2g, would easily prove how factually incorrect this article is. In fact, to be harsh, it is a downright lie against common knowledge and opinion.

It is current common understanding in the anti-virus community that this virus is indeed designed specifically to facilitate commercial spammers, and that the inbuilt Denial of Service attack against SCO and Microsoft are a secondary effect and not intended as part of the original design.

Current monitoring of activity through infected machines indicate that the spamming functionality appears to be used by a very organised group of individuals, indicating the virus was possibly contract-coded. Current belief holds that the Denial of Service payload was added by said contracted coder.

As such, I do not belief it fair, nor good reporting, to use a proproted factual article to attribute the secondary (and in my opinion far easily avoidable!) of the virus as it's "purpose". The secondary effects may indeed by the result of a Linux user seeking revenge, but is currently understood to be more of a diversion from the viruses demonstratable true intent. There is a long tradition of this type of 'smoke screen' in many viruses intended for commercial benefit, as Mr. Evans would no doubt have discovered if he had researched the article more instead of using it as a pure propeganda platform and drawing unconfirmed conclusions.

I request that the article either be re-labeled as an OPINION piece, removed, or an more factually correct article be posted.

References:
These other news sites, containing articles by researchers willing to do actual research, contain quotes from reputable security and virus research firms confirming the opinion above:

http://thewhir.com/marketwatch/myd012704.cfm
- Contains opinion by London-based firm mi2g

http://www.msnbc.msn.com/id/4113278/
- Contains quotes from researchers at well-known antivirus developer F-Secure and Symantec

http://www.ajc.com/business/content/business/0104/ 28worm.html
- Contains quotes from various other computer security researchers

Evans is a shill

[dipfan]

I'm not surprised to read that this piece was written by Stephen Evans, the BBC's North America correspondent. Evans has been for some time a shill on behalf of big business - anyone in Britain who has had to endure his relentlessly pro-MPAA and RIAA pieces will be aware of this.

Take for example this piece where Mr Evans comments: "Many students seem to think, apparently, that the internet is a law free zone." Oh yeah?

Reply from BBC Business News Editor

[mrwright]

Dear Sir

Thanks for your e-mail.

I have noted the points you made - as well as the vigorous debate on Slashdot.org about this article.

Well, Stephen Evan's weekly "stateside" column is not a news story, but an analytical look at major events and business trends in the United States.

It is, of course, debatable whether MyDoom/Novarg/Shimgapi was written just to bring down the SCO website, or whether the installation of spamming tools on numerous computers was an additional - or even the main - motive.

That was not the point of Stephen's article.

In his piece he wanted to draw the attention of BBC News Online's audience - many of whom are unlikely to know the ins and outs of the Open Source debate - to the rapid spread of Linux as a commercial application, SCO's attempts to cash in on this fact, and the deep anger that SCO has caused within the Linux community through its legal actions.

Stephen is not the first to draw the link between MyDoom and SCO's actions over Linux - plenty of others have done that before, including virus experts.

Regards,

Tim Weber
Business Editor
BBC News Interactive - www.bbc.co.uk/businessnews