Virus Writers - The Enemy Within

Slob Nerd writes "An interesting read from todays Observer "He's 21, he's got dreadlocks, likes punk bands... and his hobby could wreck your computer in seconds. Clive Thompson infiltrates the secret world of the virus writers who see their work as art - while others fear that it is cyber-terrorism.""

Comments

My Hero

[DarkHelmet]

I think this is the third time this story has been posted.

Googled version to NY Times story

Of course, does it really count if the same story appears on a *different* page? Or a different website.

Maybe it's time that slashdot subscribers get a cached version of the story hosted on slashdot. That way, when an editor is about to submit a duplicate story, it'll check for similar articles cached on the site. That way this kind of thing doesn't keep happening. Hell... Slashdot editors won't even have to read slashdot anymore!

Thank you CmdrTaco for rejecting the story I just submitted in favor of this one. And I *know* the story I submitted wasn't a duplicate, or else my web server would have felt it. ;)

You really are my hero.

Re:My Hero

[DarkHelmet]

Oh yeah...

The slashdot article where this story already appeared is here:

http://slashdot.org/article.pl?sid=04/02/06/194322 9&mode=nested

Re:My Hero

[AndroidCat]

Clive Thompson has been shopping this story around. The two-parter in the Toronto Star was billed as "SPECIAL TO THE STAR". Special reformating of the same article as far as I can tell.

I'm always skeptical of stories like this. Everytime there was a story where I knew the people and facts directly, the story was usually a mish-mash mixed or invented to sex up the story.

Re:My Hero

[Motherfucking Shit]

And just three days after that, it appeared here:

http://slashdot.org/article.pl?sid=04/02/09/024524 8&mode=thread

Which, I imagine, makes this story not a dupe, but a triplicate!

Re:My Hero

[Anonymous Coward]

How about this:

Every time an editor posts a duplicate story he gets a public beating with a razorwire bat. The beatings are recorded to Windows Media Player files and made available for download every Friday night.

Re:My Hero

[squiggleslash]

Worst of it is that this in The Observer, a British Sunday newspaper that hasn't had any credibility in the tech community since the infamous "Peddlars of Paedophile Porn" episode back in '97.

For those who missed it: That paper printed photographs on its front page of the chairman of a large British ISP and the owner of a famous anonymous remailer in Finland that was the target of a campaign by the Scientologists, under the above headline. Their logic? For the former individual: there's paedophile porn on the Internet, so if you're running an ISP you must be selling such pornography. Kind of like the Queen is a child pornographer, after all she was head of the Royal Mail at the time (Britain's post office), and child porn often gets sent by mail...

The allegation against the anonymous remailer was, in many ways, even worse. The service was free and had been crippled so it couldn't be used to send binaries in any practical way, so in no sense could he have been described as "peddling" that kind of material. The allegation came at a time when the service - used by a variety of groups from abuse victims who wanted to discuss issues anonymously on Usenet to Amnesty International and dissidents who needed privacy - badly needed help as the CoS had various lawsuits against it citing copyright infringement. Attackers of the CoS had used the service to publish, anonymously, various CoS tracts. The service shut down one week after the Observer article was published.

The Observer ran this campaign for two weeks and finally went silent over it, never issuing an public apology or a retraction. During this time Britain's fledgling Internet community went, to put it mildly, pretty much ape-shit.

For me it was a bit of an epithany, I suspect it was for many others too, as it demonstrated how low the press can get when they're trying to get readers. This wasn't some third rate tabloid, it was a newspaper famous for its supposed high-minded liberalism and commitment to truth - it was an article in The Observer that lead to the founding of Amnesty International, another that lead to Britain's withdrawl from Suez.

Do I take seriously an article published in it about virus writers? You bet I don't. I don't think anyone in their right mind can take that newspaper seriously.

Re:My Hero

[Have Blue]

Not a dupe, but a tripe! Oh, wait...

Re:My Hero

[rlowe69]

Which, I imagine, makes this story not a dupe, but a triplicate!

Would that be a tripe? How appropriate.

Re:My Hero

[Anonymous Coward]

This wasn't some third rate tabloid, it was a newspaper famous for its supposed high-minded liberalism and commitment to truth - it was an article in The Observer that lead to the founding of Amnesty International, another that lead to Britain's withdrawl from Suez.

Do I take seriously an article published in it about virus writers? You bet I don't. I don't think anyone in their right mind can take that newspaper seriously.

You cite two massive successes of the Observer, as opposed to one massive mistake they have made.

And on that basis, you deduce that they lack all credibility?

So one misguided campaign against child porn not only trumps one major international charity campaigning for human rights and the end of one pointless war, but utterly cancels them out, tramples them into the ground, and renders them completely meaningless?

Don't you think maybe you're over-reacting slightly?

Re:My Hero

[squiggleslash]

You cite two massive successes of the Observer, as opposed to one massive mistake they have made.

Both the successes occurred 40-50 years ago. The Amnesty article, IIRC, appeared during the 1960s, and the Suez crisis, as every fule no, dates back to the early fifties. Since then, the Observer has changed hands twice - to Tiny Rowland throughout the 1980s, and to GMEN - owners of The Guardian - in the early nineties. On both occasions, the Observer was really trading off its original reputation, brought about by these two promanent successes.

I mentioned the Peddlers story because it's the most egrarious example and it was clearly a demonstration of how the mentality at the paper had changed. I read this morning (and submitted to Slashdot) a story which seems to have similar regard to the truth - I don't know the specifics, but there was at least one detail that demonstrated that it was highly likely the entire article was a mis-representation. I haven't seen a damned thing in the last seven-eight years from them to believe they've changed.

FWIW, there was an error in my summary: The events took place in August '96, not '97. Google has various Usenet threads on the topic, next time I'll check first. ;)

Don't you think maybe you're over-reacting slightly?

Come on. They're still in the sophestry-for-headlines business. They never apologized about what has to be one of the most unbelievable libels in the history of journalism. Am I really over-reacting to recommending that people not take them seriously?

Re:My Hero

[sadomikeyism]

I read this morning (and submitted to Slashdot) a story ...

Here is a fantastic new concept: how about people submit ORIGINAL stories to slashdot, not just pointers to stories published elsewhere on the web? Citing references to support your points is fine, but how about /.ers creating some original content for a change?

Re:My Hero

[Anonymous Coward]

> Slashdot editors won't even have to read
> slashdot anymore!

Cause, y'know, they did ?

Re: My Hero

[Black Parrot]

> And just three days after that, it appeared here:

Maybe it's a viral story?

Re:My Hero

[plugger]

I don't read the Observer, as I agree with you that it embellishes stories to create better headlines. In contrast though, its sister paper, The Guardian, really does try to keep the record straight. They have a 'corrections and clarifications' column where they correct any wrong assertion that they print, however minor. They also have a reader's editor. His job is to investigate complaints and queries from the readers and publish his findings in a monthly column.

Re:My Hero

[gruntled]

The New York Times, like most large papers, offers its stories to other publications via the wire, which these days is just an FTP server. When I broke a big story, my byline appeared in papers all over the world.

Re:My Hero

[You're All Wrong]

OK, in other virus news, slightly more up-to-date, female virus-writer Gigabyte has been arrested in Belgium.

http://www.sophos.com.au/virusinfo/articles/giga by te.html

Like many of the smarter vxers, she never released a virus into the ecosystem where it would thrive.

If it were the US, she'd
a) be 100% protected by the 1st amendment.
b) be banged up for being a terrorist instead.

My inbox has dozens of viruses dumped into it every day, which completely and totally pisses me off. However, I'd still shake the hand of the writers of some of the cleverer viruses, I bear them no grudge; they're simply filling a niche created by incompetant programmers at microsoft.

YAW.

Re:My Hero

[gaijin99]

I think this is the third time this story has been posted.

And, as always, they refer to the virus as "computer virus", not "Windows virus". I believe that there are, what, two virus for UNIX systems? Yet somehow magically the Windows virus transmogrofy and become known as "computer virus".

Googling reveals that this trend in helping BillG cover up the fact that its his OS, not computers, that are virus laden is quite widespread. Search for "Computer Virus" and you'll get around 1.5 million hits; "Windows Virus", by contrast only turns up around 35 thousand hits.

We really do need to work to spread the meme that its not a computer virus, its a Windows virus. Make more people aware of the fact that its a Windows problem, not a computer problem, and it does two things: firstly it might make them consider alternatives to Windows, and secondly if they know its a Windows specific problem they might try and pressure MS into making Windows more secure.

Re:My Hero

[You're All Wrong]

The observer always, or since the 80s at least, was the trashiest of the broadsheets.

I thought that that particular article wasn't so bad, to be honest.
It may have been non-news, and was a bit thin on content, but it didn't seem to be bullshit.

YAW.

Re:My Hero

[saforrest]

Attackers of the CoS had used the service to publish, anonymously, various CoS tracts. The service shut down one week after the Observer article was published.

Well, anon.penet.fi (which is what I assume you're talking about) was shut down willingly by its maintainer shortly after a raid by the Finnish police seized personal information on an anon.penet.fi user who'd posted Scientology data.

Re:My Hero

[Ambient Sheep]

Yes, and The Observer followed suit a couple of years ago, its reader's editor is Stephen Pritchard.

Know what squiggleslash means about that kiddie porn story though, it was utterly disgraceful. More News of the World than Observer.

Re:My Hero

[squiggleslash]

That's correct. I was very careful with my wording above:

The allegation came at a time when the service - used by a variety of groups from abuse victims who wanted to discuss issues anonymously on Usenet to Amnesty International and dissidents who needed privacy - badly needed help as the CoS had various lawsuits against it citing copyright infringement. Attackers of the CoS had used the service to publish, anonymously, various CoS tracts. The service shut down one week after the Observer article was published.

My point was that at a time when anon.penet.fi (a service that, at any other time, a liberal newspaper like The Observer would supposedly have considered it a jewel worth saving) needed all the help it could get, The Observer attacked it, attacked it with an unprovoked, unnecessary, and clearly false (even to The Observer - otherwise there'd have been no need for the sophistry) allegation. I can't say for definite if anon.penet.fi would have received the support it needed without the Observer's article, but I can say for definite that The Observer made that support much, much, harder.

Re:My Hero

[saforrest]

I can't say for definite if anon.penet.fi would have received the support it needed without the Observer's article, but I can say for definite that The Observer made that support much, much, harder.

Fair enough. Thanks for posting that, by the way; I had no idea about the Observer's role in that whole business.

Re:My Hero

[lambent]

How is the exploitation of incompetence in any way clever?

You don't become a hero by beating up on those weaker than yourself.

Re:My Hero

[gaijin99]

Troll? Its times like these that I sometimes you could both post and moderate the same thread, because I'd really like to know the rationale for those mods...

Re:My Hero

[gaijin99]

Until unix has more than a tiny share of the computers that the readers interact with, it will always be a computer virus. Get over it.

Rank defeatism :) It may be true *today* that non-Windows systems account for a small percentage of computers people have direct contact with (though I should point out that indirectly they encounter pleanty of non-MS machines), that does not mean it will always be that way. MS is not some undefeatable monolith which we shall always have around, they're a corporation. Corporations have gone bankrupt in the past, corporations have fallen from preminance to post-eminance [heh] in the past. I say again that it will not "always be a computer virus". Things change and our actions can assist those changes.

Re:My Hero

[Hieronymus Howard]

My inbox has dozens of viruses dumped into it every day, which completely and totally pisses me off. However, I'd still shake the hand of the writers of some of the cleverer viruses

So would I. Then I'd kick them in the kneecaps with my steel-toecapped boots.

HH
--

Re:My Hero

[tigersha]

Slashdot would go offline within a day because of a lack of editors!

Re:My Hero

[Spellbinder]

sorry but a good graffiti is art!!!

Re:My Hero

[Cruciform]

At least you can read this one at work without people assuming you're cruising for teenage boys.

The picture heading up the NYT story had people saying "What the hell are you reading?" when they stopped by my desk.

Re:My Hero

[xilmaril]

read the article!

she didn't steal credit cards, she didn't ruin computers. She had ppls computers print obscene comments about anti-virus writers, and got a few people to patch their systems.

breaking the law doesn't make one a bank robber, no more than writing perl scripts makes you an erotic trekkie.

Re:My Hero

[Temporal]

Your post was modded "troll" because it was blatant FUD. Pro-unix FUD, perhaps, but FUD nonetheless. You assert that Unix is superior to Windows because most viruses only run on Windows. The simple fact of the matter is that most viruses run on Windows because Windows has nearly 100% market share of people who aren't computer saavy. A worm for Linux would never work because Linux users know better than to run untrusted executables, and Linux users usually patch OpenSSH right away when a remote root exploit is found. The number of Linux machines left open to attack is so small that a virus or worm simply would not be able to propogate. Meanwhile, there are hundreds of millions of Windows users just waiting to open any e-mail attachment you send them, and who haven't ever heard of Windows Update.

Unix is not inherently less vulnerable to viruses than Windows is. No, user/root separation does not hinder e-mail viruses designed to DDoS web sites. Yes, there is software running on your Unix box right now that has buffer overrun vulnerabilities.

Re:My Hero

[FreakWent]

Why is there never a mention of beneficial viruses any more? Ones that could perform security checks, clean up other viruses, optimise your mtu, clean up windows' terrible temp directory and remove AOL?

Re:My Hero

[gaijin99]

Even if what you say is true, which I dispute, it still doesn't make my primary observation: they aren't computer virus, they're Windows virus, any less true. A "computer virus" would be one which operated on computers as a general class, regardless of hardware configuration or operating system. Actually, I wonder if such a beastie is possible, it'd have to be a *BIG* monster...

Also, while my box may well have overrun vulnerabilities (doubtless true), I disagree completely with your statement that if *NIX machines had the marketshare there would be as many virus for them. I think you are vastly underestimating the user/root separation. At the very least it prevents a single user infection from affecting the entire machine. Yes, a single user could infect his own home directory tree and of course this could be used to DDoS someone. However, there would not be a situation similar to the Outlook/Outlook Express situation where simply recieving a viral mail would infect the system; *NIX apps aren't designed that stupidly.

I have no doubt that if/when *NIX becomes more common there will be more *NIX virus, but to say that its "just as bad" is to buy into MS's own FUD.

My case in point here is Mac OS X, it has a fairly large userbase, and most of that userbase is not computer expert (one of the Mac selling points is that it is (theoretically) simpler to use than Windows). Yet there has not been a significant number of Mac OS X virus (virus for older Mac OSes are more common by far). Why? Because Mac OSX is mostly BSD UNIX.

Re:My Hero

[TekGoNos]

She was on Slashdot years ago.

She wrote the first C# virus (called Sharp) and published it. Heck, I even downloaded the source-code from her page back then. (And no, I didnt released it)

Re:My Hero

[nineoneone]

I seem to recall that the Observer suffered badly for its anti-Suez stance back in the 50s - in terms of circulation, at least. It was perceived as being unpatriotic by the braindead "my country, right or wrong" folk. (The majority, as I believe they're known.)

Re:My Hero

[bugbread]

Offtopic moderation, I understand, but Trolling?

Re:My Hero

[JuggleGeek]

sorry but a good graffiti is art!!!

If you spray paint your crap over my building, you are a vandal. I don't care if you have the skill of Michelangelo, Da Vinci, and Rembrandt combined, you don't have the right to paint on things that belong to other people. If you do, you are a vandal. Period.

True artists can find legitimate outlets - they even get paid. Graffit art is done by gang members and other scum. Virus writers are simiply their online equivilent.

Re:My Hero

[bursch-X]

I always thought art is all about creation. Graffiti is taking "art" as a bad excuse to vandalise other people's property.

Re:My Hero

[LordLucless]

Unix and Windows both provide absolutely no access control for network communications, allowing viruses to perform all of their tasks with ease.

Not necessarily true. Linux users (not sure about UNIX) are restricted in their ability to open low-level ports. Which means no more spam-relay-creating viruses. Also, Linux has more advanced network control capabilities (ipchains) than Windows XP (tick-a-box firewall). Granted, they're still difficult to setup, but the option's there, and better interfaces are always a possibility.

Re:My Hero

[DarkHelmet]

My sig says all. Guess it's not slashdot worthy.

Re:My Hero

[Temporal]

*sigh* Yes, I am aware that only root can open low-level ports, but that hardly prevents anything a virus might want to do. Assuming the author wants to set up a spam relay for himself, there's no reason he can't just put it on a different port.

Re:My Hero

[ColaMan]

Because you are exploiting someone else's incompetence.

Thus you, must be less incompetant than someone else.

Whilst being less incompetant than someone else is not generally an indication of being clever, you will appear to be clever to someone else who is incompetant.

Going from this, if you are clever, you are merely less incompetant than someone else. This is an important basic principal of Management.

Re:My Hero

[warrax_666]

char hostname[20];
strcpy(hostname, host->h_name);

Umm... without giving further information, it's impossible to tell whether that code is safe or not. If we know that host->h_name is always limited to a '\0'-terminated string of at most 20 chars (including the terminating '\0'), then that code is perfectly safe. (I'm not saying that rewriting it to use strncpy is necessarily a bad idea, just pointing out that you left some information out).

This is simply not true. Both Unix and Windows operate on the assumption that a user completely trusts any program that he or she runs.

This is technically true, but it ignores that fact that it's much easier for a user to (unsafely) run anything they get in their mail. No UNIX mail client I have ever seen has allowed one to run attachments like Outlook does -- this seems to be because UNIX programmers actually realize that it's bad to trade a little convenience for security (esp. with the ever-increasing hostility of the Internet). I am aware that a warning dialog box is displayed when one tries to do this, but who reads those? Seriously. Any real user I've ever seen just immediately clicks "OK" on anything they are presented with without reading what it says.

But, as you say, that's an Outlook problem, not a Windows problem.

Re:My Hero

[Temporal]

Well, the string in "host->h_name" is obviously supposed to be a hostname (lookup gethostbyaddr()). The DNS standard does not limit hostnames to 20 characters (take "www.welovetheiraqiinformationminister.com", for example). His code did not check to make sure the host name was shorter than 20 characters (a fact that I figured was implied).

Granted, you can't put just any character you want in a hostname, so it would be hard to create an acutal exploit with this one, but you certainly could crash the server. And, besides that, he made lots of these sorts of errors. I just only remember that one specifically. He was one of those "maximum efficiency" zealots, see, so he always preferred static buffers over dynamic allocation.

As for Outlook, I honestly don't know how easy it is to open an executable attachment since I don't use it, but if it at least gives a warning box, it has done its job. It is the user's responsibility to heed warnings. Making the interface less convenient in order to deter ignorant users does not seem like a reasonable tradeoff to me.

Re:My Hero

[tehcyder]

it's the most egrarious example

Just nit-picking, but I think the word you want is egregious.

Good points you make though.

Re:My Hero

[ajr_trm]

Back in the days of timesharing mainframes, that might have been significant. In this century, though, 99% of computers that people use to, say, check e-mail, are desktop machines with only one user. On such machines, user/root separation only protects the operating system and installed programs, which is possibly the least useful thing to protect since you can always just reinstall them. Important data, like the user's documents, are completely unprotected from any program that the user runs. And, again, the vast majority of viruses these days hardly care about hard drive access.

IMHO protecting operating system and installed programs _is_ important. If they are protected virus can't disable your firewall and av program, can't change firewall settings etc.
I really like to be sure that I access important data (not necessarily stored on my hdd) with tools which are not tainted.

ajr.

Re:My Hero

[dswan69]

That's your own narrow little opinion.

Good graffiti art brightens the urban landscape. Thankfully the morons in the cities that used to remove it from trains finally acquired a clue and made the trains available for painting by artists of demonstrable ability. No more ugly urban trains.

These guys who do graffiti are exactly what art is about, not some commercialised nonsense.

Re:My Hero

[Temporal]

Not like a virus couldn't start logging your keypresses and sniff your root password the next time you have to install something.

The trusted executable paradigm has got to go. We need process-level, capability-based security. Unfortunately, no real OS has even tried to implement it, probably because it would go against 35 years of Unix infrastructure. (In my book, Windows is just a variant of Unix.)

Re:My Hero

[sadomikeyism]

It's pretty simple and on-topic: /.ers who submit other people's stories without adding any original content or not getting their own scoop on happenings are no different from script kiddies who release other peoples viruses and worms to feel special.

Now I realize that the public schools these days are too incompetent to check the sources on your homework to see whether you are just rehashing or even copying other people's stuff, but the /. community is way too big and diverse to let people get away with it here.

Before submitting an article, try searching for similar stories in the /. archives before posting. Not only will this make you feel more responsible and professional, but it will reduce the workload on the overburdened /. moderators and editors, so that they can produce higher quality product. Total quality starts with everyone caring.

Re:My Hero

[JuggleGeek]

Yes, that is my opinion. Your opinion is that you have the right to paint whatever crap you want on other peoples property. Just like the virus writers feel they have a right to fuck up other peoples computers.

Re:My Hero

[moranar]

Those are collectively called "Linux". Another strain, named "BSD" is reported to be extinct; though some still claim to see them.

Re:My Hero

[sadomikeyism]

Oh, I could go on and on about the Pentagon report on global warming. It is essentially a piece of crap produced by an ignorant hack, and contains a number of claims to facts not in evidence, outright falsehoods, and conclusions which contradict each other.

For example, even the much political tortued IPCC Climate Change Report admits that the best climate models predict only a 2 degree change over the next century (certainly not the next 20 years), while only the most mouth-foaming Green believes the claims of as much as 6 degrees.

Secondly, the Pentago Report recognises that most all of the warming is happening in arctic regions, NOT near the equator, yet goes on to claim that storms will get more severe as a result.

This conclusion doesn't match the evidence. When the temperature differential between the equator and the poles is reduced due to polar warming (in this case only at the north polar region), then storms, which are the engine for transferring heat from the equator to the poles, will be reduced in severity.

The Pentagon's conclusion to the contrary is evidence that they did not even have a meteorologist involved in the report, not to mention a glacial geologist or climatologist of any competence.

The claim is that the shut down of the North Atlantic current conveyor will result in an Ice Age for northern Europe. Hogwash. The conveyor shut down because northern Europe is too warm. When the arctic cools down again, the conveyor will start back up. This is a cycle called the North Atlantic Occillation which is well known to real climatologists.

Thirdly, Andrew Lorrey (a cousin of mine) of the U of Auckland proved several years ago that the Antarctic Ice Cap has been stable for the last 22 million years, contrary to the claims of the Green chicken-littles, and endured through periods where the earth was as much as 8-10 degrees warmer than today. Antarctica has become more and more thermally isolated over time as it tectonically separated from South America and the circumpolar wind and ocean currents have acted like a thermos bottle. The Antarctic Ice Caps are going nowhere any time soon.

Re:My Hero

[You're All Wrong]

Is geting your John 3:16 placard/banner right in front of the TV cameras at the major sporting events clever? Is getting through security and getting to hand-shake 2 consecutive US presidents at their inaugurations clever? Is getting your kit off and running round the green with "19th hole" written on your back clever?

Is propagating a virus that does nothing apart from propagate and pop up a message taking the piss out a few of the most puffed-up wankers at AV companies (NickShitz & Clueless being prime examples of such characters (Hi Nick - you know who you are)) really so much worse than exploiting other real-world security holes?

I don't want to see John 3:16 banners when I watch soccer.
I don't actually care about the handshaker.
I don't want to see some old bloke's todger when I watch golf.

As I run BSD with procmail and good filtering I am less perturbed by things that may well be viruses (how would I know, like I would even be able to run a .exe or a .vbs on that system?) than I am about 2 of the above 3 things.

Are any of the above 4 things "clever"? In some ways, yes, some are. Being able to _find_ a hole in something that's been _designed_ not to have holes, albeit poorly designed, is in some way clever.

Not all viruses are clever, I'd say that about 99% are just plain trivial, and not worthy in any way at all. However, some of them have displayed extreme cleverness, like frodo and tequila, for example. If you fail to appreciate the intelligence involved in the creation of viruses like those (when there were no tutorials on the internet explaining how to do things just by handle-turning), then you're either lieing or have no appreciation for the finer arts of assembly language coding. If the latter, then I don't think you're clever enough to be qualified to make comments on the cleverness of some viruses.

How is the knee-jerk criticism of anything and everything to do with viruses in any way clever?

YAW.

Virus Writers

[ThisNukes4u]

Virus writers, while technically skilled, are complete dumb butts for using their skills in ways that are harmful to society and businesses, even if it's not their fault that it is easy to do thanks to Microsoft. They'd be better off using their skills for something more productive.

Re:Virus Writers

[flatt]

I doubt you'll get much opposition to your point but are you going to pay them? It's the same reason kids get involved in gangs and whatnot: boredom and lack of belonging/recognition.

Easy problem to find, harder problem to solve.

Re:Virus Writers

[gustgr]

I don't belive they are completelly skilled. I would pay to see one of these VB virus writers to build an application which can improve our OS's or Networks.

Like the elders say it takes 10 years to a three grow but only 10 minutos to take it down. It's the same with computer virus.

Re:Virus Writers

[tommck]

Did you see the jobs they have? assistant in a home for the disabled?
There aren't that many high tech jobs in eastern Europe. I know a guy who moved to the US from Bulgaria and he said that all his friends were bored with life and wrote viruses for fun. Nobody there would hire them to do tech work.

Ironically, now that outsourcing is targetting Eastern Europe, one of your problems (viruses, etc) might be subdued a bit (a bit!) by one of our other problems (jobs leaving the country). Of course, people elsewhere will always be around to write them.

Re:Virus Writers

[Dark Lord Seth]

These aren't virus writers, these are just regular script kiddies. Nothing interesting.

Re:Virus Writers

[titusjan]

Did you see the jobs they have? assistant in a home for the disabled?
There aren't that many high tech jobs in eastern Europe. I know a guy who moved to the US from Bulgaria and he said that all his friends were bored with life and wrote viruses for fun. Nobody there would hire them to do tech work.

Your point may be valid for most countries of the former second world, but please note that these two kids are not from eastern Europe. Austria and the south of Germany didn't have communist regimes and therefore don't have the same problems as Bulgaria (at least not on the same scale).

Re:Virus Writers

[JeffHeatonDotCom]

Besides, its not like the "script kiddie" even has to be smart enought to code the virus in the first place. Often just capture one in the wild and modify it a bit to pick on your favorite target. Or for the REALLY weak on programming skills, just use a virus writer like this. (a link to the description, not the actual virus writer) http://www.pestpatrol.com/pestinfo/n/neuroid_word_ macro_virus_generator.asp

Re:Virus Writers

[MMaestro]

True its the same reason kids get involved in games and whatnot, but its been said before and I'll say it again : Its all fun and games until someone gets hurt. Virus writers are just lucky computers haven't advanced far enough where medical machines can be remote controlled via the internet. (Watch, if some old guy dies because his breathing unit goes down from a virus they'll be hell to pay.)

The only difference between gangs (real life ones) and virus writers is the fact that gangs do direct damage whereas virus writers do indirect damage.

Re:Virus Writers

[scubacuda]

Agreed, Seth. This is, IMO, a good example how the media obsesses over those who destroy, rather than create.

I would have enjoyed the story more had the author explored such things as how virus makers justified wrecking such havoc on innocent people. If it's really *just* about "fucking Microsoft" or (insert favorite justification here), then why include innocent people in your crossfire?

At least the script kiddies weren't referred to as "hackers"

Re:Hmmm

[Anonymous Coward]

Then you do not work at MS huh?

Deftones aren't a punk band

[Anonymous Coward]

And the technical side of the article is a pile of shit as well. Virii don't "reprogram parts of your computer". Script kiddies generally don't download virii, but trojan clients.

Re:Deftones aren't a punk band

[rjshields]

What the heck are virii? The plural of virus is viruses.

Re:Deftones aren't a punk band

[Von Helmet]

And the technical side of the article is a pile of shit as well. Virii don't "reprogram parts of your computer". Script kiddies generally don't download virii, but trojan clients.

Generally speaking, you're right. But a sophisticated virus could patch or alter existing software on your computer if it wanted. A lot of virus' (virii, whatever) do just tack themselves onto the end of existing files, which could be considered reprogramming. By and large I agree with you - it's not remotely as clever as reprogramming. It's just a little script or something that relies on someone running it.

In as much as it is an "art", it's been rather simplified these days. Outlook Express makes it far too easy for someone to create a tiny worm that replicates millions of times. It's not like it used to be when it really required some skill, or you had to rely on the damn things getting moved around on floppy disks and stuff.

Man, what an incoherent post. You're right about the Deftones too.

Re:Deftones aren't a punk band

[Ithika]

What the heck are virii? The plural of virus is viruses.

Oh God not this again. Are people so goddamned lacking in imagination that if they see a word being coined they have to shoot it down in flames?

Have a good look at the jargon file. There are many words there which are corruptions of "normal" words used in reference to modern technology. That doesn't make them wrong. It makes them new. How many of you numbnuts would have hated Shakespeare for all his neologisms? Here's a word I'd like you to read up about: 'hypocrisy'.

Re:Deftones aren't a punk band

[rjshields]

There are many words there which are corruptions of "normal" words used in reference to modern technology. That doesn't make them wrong. It makes them new.

That would be a marvellous idea if it weren't for the fact that you haven't coined a new word or used an existing word in a new context, you've misspelt an existing word. That makes it wrong, not new.

Here's a word I'd like you to read up about: 'hypocrisy'.

Perhaps you should look up the definition of that word, since the only time that pointing out a common spelling mistake would be hypocritical would be if I were to make one myself.

Re:Deftones aren't a punk band

[Weird O'Puns]

That and the fact that the writer has spread this story to everywhere gives me an impression that it was written just to prove what pile of shit you can get published if it just brings in a lot of money for the publisher.

..or maybe the writer really is just bloody stupid.

Re:Deftones aren't a punk band

[Ithika]

That would be a marvellous idea if it weren't for the fact that you haven't coined a new word or used an existing word in a new context, you've misspelt an existing word. That makes it wrong, not new.

I fail to see how - no matter how much you tilt your head and squint your eyes - virii can be taken for a misspelling of viruses. Please explain. Everyone else admits that people who use 'virii' meant to spell it that way. Which means they meant to differentiate it from the accepted use of the word virus (that is, from a biological virus).

Perhaps you should look up the definition of that word, since the only time that pointing out a common spelling mistake would be hypocritical would be if I were to make one myself.

Yes, that would be true if it was nothing more than a common spelling mistake. However many people - myself included - happen to like it for one reason or another and intentionally don't use the word 'viruses'.

I am fully aware what hypocrisy is, and I also believe it would be hypocritical of you to rubbish neologisms that you don't like whilst giving the reason that they're badly spelled, all the while using words which are just as new to the English language without a second thought.

Regards,

ithika.

Re:Deftones aren't a punk band

[rjshields]

I fail to see how - no matter how much you tilt your head and squint your eyes - virii can be taken for a misspelling of viruses. Please explain.

That's simple, the plural of virus is spelt viruses, not virii. Virii is not a real word. Therefore, virii is a misspelling of viruses.

I also believe it would be hypocritical of you to rubbish neologisms that you don't like whilst giving the reason that they're badly spelled

I feel you are missing my original point and twisting things somewhat here. I am not rubbishing your neologism, I am arguing that virii is not actually a neologism, but a misspelling.

Even if I was rubbishing your nelogism because it was badly spelt, that still would not make me guilty of hypocrisy simply because I didn't like your spelling. By definition, I would have to be misspelling my own neologism to be hypocritical. You claim to know the meaning of hypocrisy, yet I have only seen you use it in an unsuitable context.

I didn't make the point because I didn't like your spelling, I made it because your spelling is incorrect. People in virus community tend to ridicule others for spelling viruses the way you did, as I have seen from first hand experience.

endbreeding

[Anonymous Coward]

End - Breeding

It's where the family tree doesn't spread out,
but the ends of the branches meet up.

"from the dept."

[PollGuy]

Think that's code for "From the >/dev/null dept."?

Anyone seen a good written virus?

[Anonymous Coward]

Whenever I disassembled viruses or worms, I had to scream. Even in the good old DOS-times and even with bootsector viruses, where size was an important factor, they were simply horrible written. (i.e. unnecassary bloated)

While some may imply in their posts, that virus writers are technically skilled, I've yet to see a single example of beeing better than the avarage bad programmer...

Re:Anyone seen a good written virus?

[miu]

Some of the 'tiny' viruses were very clever. The basic idea was to create the smallest replicating .com infector. One of them was even partially self encrypting to avoid scanners and still managed to come in at less than 200 bytes.

Re:Anyone seen a good written virus?

[You're All Wrong]

A challenge:
Take 6 bytes off the length of Slammer.

Put your l33t sk1||z where your mouth is.
Or shut up.

6 measly bytes, that's all I ask.

Haha - anyway you're AC, so we know from the outset that you'll spout any old shit because there's no comeback.

YAW.

Complete Bullshit

[ktanmay]

It's not like I don't have appreciation for the fine arts, but this is taking it too far, it is almost to the extent of patronizing virus writers.

Ok fine, what if someday, a student doing research in microbiology decides, just for the sake or fine arts, I'll release a mutant plague bacteria...

Re:Complete Bullshit

[Dutchmaan]

If that mutant strain of bacteria turned people into random primary colors, I'd be all for it for arts sake..

Re:Complete Bullshit

[ktanmay]

Well, it's plague, so I'm sure the buboes will be plenty colourfull...

Re:Complete Bullshit

[WhodoVoodoo]

If following the VBScripter Mario's example, he would "Distribute" this mutant plague bacteria for "Educational Purposes" (I learned how to moan when I had Scarlet Fever. You can too!) then get a spiffy article written about him in a rather poor newspaper.
Next stop, He's Director of the CDC! "Man, I wish I could mutate Spotted Rocky Mountain fever like that! YOU'RE HIRED!"

Re:Complete Bullshit

[Ironica]

Ok fine, what if someday, a student doing research in microbiology decides, just for the sake or fine arts, I'll release a mutant plague bacteria...

If you RTFA (which I did the first time it was posted, but haven't the two times since), you'd know that it goes more like this: these virus writers are artists in the same way that microbiology student is a scientist. *Neither* has the goal of releasing their creations into the wild. However, *both* create things which are subject to abuse by others. The teenage virus writers are a bit more, er, stupid about it maybe (publishing their code), but then again, the microbio student will have a decent career when she graduates.

idiot loosers

[nietsch]

I guess my initial reaction was fsck 'em. Fsck 'em all. However, it could be suggested that they have made corporations and governments aware of many intrinsic insecurities in certain popular operating systems which may have prevented some larger potential catastrophe. The problem for these guys, is that we will never know and they will continue to be reviled and hated as losers. (That is unless they are talented enough to score a job with Symantec, the NSA or some other organization dealing with comp. security.)

(karma whoring is nice?)

Dupe, or no dupe...

[nordicfrost]

With quotes like this: 'This guy,' he proclaimed, 'is the best at Visual Basic.' I really understand the level of these guys... Show me an 1 k, auto-replicating, ASM-written worm spreading like the lightening through an undocumented hole and I'll be impressed. These are nothing more than wannebe punks.

Re:Dupe, or no dupe...

[tommck]

Mod me Troll or Flamebait, but:

Hell. I laugh about that when someone says that in the office right here in the US! :) VB is, was and always shall be a big steaming pile of shit for a language.

Re:Dupe, or no dupe...

[kieranbenton]

What are most virus' written in anyway? I'd always assumed they'd been in C or something else suitably low-level. Is it possible to tell from dissasembly? Huh, VB! I'm sorry but:

'This guy,' he proclaimed, 'is the best at Visual Basic.'

I cant believe that the article writer is talking anyone serious.

Re:Dupe, or no dupe...

[Anonymous Coward]

Will a 372 bytes, self-replicating worm, affecting an, until then, unknown vulnerability on the MS SQL Server do the trick? By the way, this little devil was called "Slammer"

Re:Dupe, or no dupe...

[Technonotice_Dom]

'This guy,' he proclaimed, 'is the best at Visual Basic.'

At which point I cracked up in laughter ;-)

Re:Dupe, or no dupe...

[Anonymous Coward]

Why use ASM? The same argument that can be applied to 'good' programs can be applied to 'bad' programs...

These virus writers need to turn this stuff out quickly. They've got deadlines just like those of us that write 'good' programs.

I agree that this kid seems like a turd. But just the same, it also sounds like he is using the right tool for the domain he's working in.

Re:Dupe, or no dupe...

[damiam]

VB is used primarily for viruses embedded in Office documents, because MS Office has a built in VBA interpreter.

Re:Dupe, or no dupe...

[ealar dlanvuli]

Add code morphing and self encryption with a random keygen and I'll be impressed.

CmdrTaco 's on the march!

[GillBates0]

Nothing like two consecutive dupes to start a Sunday!

And here I was, with my coffee and breakfast all ready to read /. till lunch :(

Next story please!

Just an idea!

[HaRR0]

Maybe if the government or anti virus companys made like an online virtual internet for young people to upload there virus into this "virtual internet" to watch it spread and make a game like point scheme or something along the lines there wouldnt be much havoc online , I think it is mostly boredom that virus creaters do this for!

Re:Just an idea!

[rholliday]

I think the government's time and money would be best spent elsewhere. That would be a major, and largely pointless, undertaking. And even if for some godawful reason a "virtual internet" was created to be the punishment-free testbed for young virus writers, with their egos, they would never be satisfied until they got on the "real" internet and messed with "real" people.

Re:Just an idea!

[Cybrr]

Interesting. Like a new school version of Core Wars.

Re:It's the fucking USERS, not VIRUS WRITERS' faul

[rholliday]

Yes, users bear some responsibility for viruses' spread. Yes, I'm all for education of users. I work in tech support, believe me I'd love more educated users. Usually, I'm the one giving the basic lessons in the difference between a hard disk and a CD-ROM drive.
But the lion's share of the blame has to rest on the virus writers' collective shoulders. The vast majority have no pretensions of "educating the masses," or "simple curiosity." No, most of them just want to either a) screw people over for the hell of it, or b) get their (hopefully anonymous) 15 minutes of fame. These are the same types of people who will eventually be hired to write adware, spyware, and spamming apps. They are not heros. They are not admirable. They are degenerates and sociopaths, and they gives nerds and hackers horrible images with the very same "stupid users" that we have to interact with (and often get paid by) every day of our lives.

Re:Hmmm

[skifreak87]

To play Devil's Advocate isn't there something good arising from virus writers? If there were no major viruses out there, I guarantee you most users wouldn't have anti-virus software and wouldn't know not to click on email attachments from unknown sources. Then, if someone really did want to cause major havoc, it would be even worse than it is now. I don't know if this is true, but I think it's possible. If no one ever expected a virus/worm, how long would it take to actually get the virus/worm off of every user's computer. It's rather quick now because most people have anti-virus software that can be updated really quickly.

Once twice thrice...

[CGP314]

First time from wired... it's a story.

Second time on NYT... it's a dupe.

Third time on the observer... it's a trupe?

-Colin

Re:Once twice thrice...

[cperciva]

Third time on the observer... it's a trupe?

The correct abbreviation for "triplicate" would be "trip". Which is also short for a possible explanation for such reposts...

Re:Once twice thrice...

[Anonymous Coward]

I'm going to go with calling it a "tripe". That's an apt description in this case.

Re:Once twice thrice...

[Cheap Imitation]

Third time on the observer... it's a trupe?

I think tripe is closer to accurate...

Re:Hmmm

[Patrik_AKA_RedX]

I guess it's the same joy some brainless, euh, "people" get from beating up weaker people or defenseless animals. Or vandalising someones car or something.
There's no risk in it and they get to feel so tough. Those people simply need a proverbial kick in the ass.

cash money

[CGP314]

Boy, I'd love to be the author of that article. He just keeps making money selling it over and over again. In addition the paper's owners must take note of his name when it draws a metric herd of slashdotters.

::Walks off to write an article about virii::

-Colin

Re:cash money

[antime]

Walks off to write an article about virii

There are no such things.

Wreck MY computer?

[Anonymous Coward]

Sorry, no, all my computers run Linux, FreeBSD and Mac OS X.

I wish that, just for once, articles aimed at the public would be a little more accurate."

"He's 21, he's got dreadlocks, likes punk bands... and if you use Microsoft software, his hobby could wreck your computer in seconds"

Re:Wreck MY computer?

[Anonymous Coward]

they meant "your friend's computer"

like I said, I spend my time running Linux, FreeBSD and Mac OS X. You think I'd do that if I had friends?

Re:Wreck MY computer?

[Xyrus]

If someone doesn't know alot about computers, I suppose its possible someone could "wreck" your computer.

But if someone knows the basics (do not run anything that doesn't come from a verified reputable source), then the person(s) can't even touch your computer.

I agree with the general consensus on this board. A large percentage of virus writers just aren't that good. For a while, I studied viruses and there really isn't that much to them. Nor were any particularly well written.

The best viruses are "social". The emails stating some "big virus threat" has emerged and you need to do the following steps (format, fdisk, etc.). Takes minutes to write.

Like everything else, it is ingnorance that is the main problem.

~X
Random Quote: "What are ye, stupid!?!?!?! Now I own you boy!

Re:Wreck MY computer?

[IllForgetMyNickSoonA]

> But if someone knows the basics (do not run anything that doesn't
> come from a verified reputable source), then the person(s) can't even touch
> your computer.

That would be nice, but is unfortunately not true. There are enough worms that can spread over the net without any help from the user. Here a short story of what happened to me a few days ago.

I have a dual-boot system (Linux on the main partition, W2K for occasional use, in case somebody sends me a document I can't open with OOo, or for playing a game not yet available for Linux). Just a few days ago, I booted my fresh install of W2K (MoBo change forced me to re-install W2K; Linux just booted as usual). After some 5 minutes, the computer became extremely unresponsive. svchost.exe was consuming nearly 100% of the CPU. A quick check revealed that I got infected with one of RPC/DCOM worms. No big deal, I thought. After I downloaded and executed a removal tool (it took a *long* time to run), I rebooted the system and turned my internet access back on. Some 3 minutes after I did so, the worm was on my machine AGAIN. Without me having the slightest of chances to do something against that.

Now, I know there is a patch for the security hole "my" worm used, I know I could have bought and installed a firewall or an anti-virus package. For me, given how rarely I use Windows, it's not worth the trouble. I just decided to cut my W2K's connection to the Internet.

Re:Wreck MY computer?

[AnyoneEB]

If Microsoft put PGP into Outlook, prompted people to generate a key when it's first run, uploaded it to a keyserver and used that keyserver when sending email this would eliminate a whole swathe of problems in one go.

How would that make a difference? If the virus can send e-mails from an infected computer, it could send signed e-mails, too. If the keyserver requires a password, then the virus could sniff the password once it infects a computer. Of course, the contents of the mail could be checked, but that can already be done on the mail server.

From the all-mouth-and-no-meat department

[tagishsimon]

Umm. Slight absence of any mention of virus writing for profit: there's enough evidence that a number of recent virii were mainly about installing SMTP Relays on infected machines to propogate spam, or leaving a backdoor open so that this could later be done.

Or else installing DDOS software aimed at Spamhaus servers, or leaving backdoors open for same.

So. Art: Check. Vandalism: Check. Profit Motive: Check. Insubstantial "infiltration" by journalist: Check.

Ferinstance

http://yro.slashdot.org/article.pl?sid=03/12/03/14 23258&mode=nested

- Oops. There goes Spamhaus

http://securityresponse.symantec.com/

- most of this week's crop install backdoors.

http://www.groklaw.net/article.php?story=200402210 51056136

- Your IP Addy for sale to a spam-merchant near you...

Re:From the all-mouth-and-no-meat department

[AndroidCat]

Has there been any proof of SMTP relays yet? Up until now, it's mainly been proxies. I'm pretty sure spammers will/have taken the next obvious step, but I didn't think anyone had anything solid yet.

Perhaps this story doesn't mention the profit side of virus writing because no one would be fool enough to hire these whiny types to do it?

Re:From the all-mouth-and-no-meat department

[tagishsimon]

You're probably right. I'm mistaking virii with their own SMTP engine, for virii with SMTP Relays.

That said, a search for "SMTP Relay" on Symantec gives:

Backdoor.Hoogle

and

Trojan.Naldem

for instance. So maybe.

Re:From the all-mouth-and-no-meat department

[AndroidCat]

It's only a matter of time, and I'm pretty sure that they're already doing it--just don't ask me to prove it. :^)

Terrorism

[octal666]

Well, actually terrorism is using threats and violence to force someone to think or behave as you want.

Common virus-writers are more like random violence, they do not use to pursue economical or political agendas, more usually want recognition inside their own community.

I, for one, am fed up with this ciber-terrorists media propaganda.

Re:Terrorism

[Stallmanite]

Cracking is not terrorism, communist subversion or witchcraft. Blackhat Cracking is cyber-vandalizm.

The RIAA are the cyber-terrorists.

Re:Hmmm

[__past__]

If nobody would write viruses, nobody would need virus scanners.

Not to mention that people do not understand that they should not run arbitrary email attachments. Every few weeks we have a major worm outbreak because millions of people happily run every piece of malicious code they find.

As for "real" worms that don't require a collaborative user to spread, it can hardly get worse than it is now, with all the knowledge and awareness we have. The really ugly ones spread in minutes, faster than anyone can react. (Also, they never seem to die, Nimda for example is still active.)

Here's the secret answer!

[Anonymous Coward]

Stop clicking on email attachments and the problem almost completely goes away.

Virus writers prey on the stupid. Harsh, but absolutely true.

Re:Here's the secret answer!

[IllForgetMyNickSoonA]

> Virus writers prey on the stupid. Harsh, but absolutely true.

You are forgetting that some people just don't have the time or the required specific know-how to make a computer virus-proof. I'd know how to make my W2K installation (which I boot some 9-10 times a year) reasonably virus/worm proof, and if I'd still have huge amounts of time on my hands, I'd probably also do it. Being married, having a child and a consuming job, I just decided to cut my internet access from within W2K instead. That's an option many don't have.

OT: Punk?

[nurb432]

Since when is Iron Maden considered punk? Geesh, pansy...

Re:OT: Punk?

[Operating Thetan]

Real men listen to Good Charlotte. And Blink 182

Re:OT: Punk?

[nurb432]

Nah, real men listen to Bikini Kill and kittie :)

Re:OT: Punk?

[bckrispi]

Actually, Iron Maiden was a very heavily punk influenced band. Their music in the late 70's/early 80's bridged the gap between British Punk and NWOBHM (New Wave of British Heavy Metal). It was the punk scene that helped Maiden break into the mainstream. If you listen to their first albums with Paul DiAnno, you'll definitely hear a *lot* of punk influence.

Re:OT: Punk?

[minorthreatbmxxx]

Actually, I don't think that Iron Maiden was stated to be punk, but the Deftones definitely were. Maybe I'm being a little picky for some people, but I sure wouldn't consider the Deftones punk. Not even close actually.

Re:Hmmm

[rholliday]

As someone else pointed out, we wouldn't need the virus protection without the viruses. Also, I don't know if you've caught the numbers for each major "11:00 News" virus attack, but people aren't really learning their lesson this way. Sad but true.

Re:Anyone ever seen well written english?

[PatrickThomson]

Geez. they're galled adverbs

What does a part of the liver have to do with being a spelling/grammar nazi? I assume it's not a typographical error.

Nice guy

[Dark Lord Seth]

'Anyone can rewrite a hard drive with one or two lines of code,' he says. 'It makes no sense. It's really lame.' Besides which, it's mean, he says, and he likes to be friendly.

Then come over and install your friendly little programs on my PC. You can do so for free! No more annoying "distribution" anymore, you just come here, install your friendly little program and leave*, that is all. Sounds like a deal? Tell me in advance, because I might need to buy some essentials** for your visit.

* Might or might not involve a hearse.
** Like a toe tag and body bag.

Re:Nice guy

[Anonymous Coward]

Oh, grow up. There is nothing like the geek patrol getting all bent out of shape over something as trifling as spam and kiddies.

They're kids. Not exactly a lifetime to develope good judgement. Never did anything a little evil as a child? Always a good upstanding citizen?

I go through all of the email and virii hassels as everyone else... Might as well bitch about having to lock your doors anymore.

You're taking your computer much too seriously.

Embellishment

[`Sean]

I'm always skeptical of stories like this. Everytime there was a story where I knew the people and facts directly, the story was usually a mish-mash mixed or invented to sex up the story.

That's usually the case with any subject! Every movie, documentary, or article that I've seen or read and have had personal experience with has been a load of bunk. I've been interviewed for numerous newspaper and magazine articles and they very rarely use any of my quotes in context. They'll usually intentionally remove the context to twist words to mean whatever agenda they're trying to push.

My personal experiences with the media have basically ruined my ability to enjoy anything anymore. Since I know for a fact that virtually every story I've contributed to has been embellished by the authors to increase its entertainment value, I assume that any story that's been done about a subject I'm not personally familiar with has been tainted as well. And, most of the time, I'm correct. A simple five minute Google or encyclopedic search on the subject gives me more accurate data than the story that I'm following up on.

Re:Embellishment

[AndroidCat]

Allow me my rose coloured glasses. I might suspect that all news stories are equally flawed, but it's only the "teenage haxor angst" ones that I know are flawed. :^)

News stories are definitely like sausages and laws--never ever watch any of them being made.

Re:Embellishment

[`Sean]

I might suspect that all news stories are equally flawed, but it's only the "teenage haxor angst" ones that I know are flawed.

My mistake...I should have qualified my post with a "Virtually every..." instead of simply saying "every...". I'm just bitter about constantly getting misquoted. The first misquote of my career goes back to 1996 when an MacWeek author writing a Web graphics piece misquoted me as saying that JPEG is a lossless compression when I explicitly told him in both a phone and e-mail interview it was lossy.

But I'm not bitter...

Re:Embellishment

[AndroidCat]

I got enrolled into a fictitious hacker group called "Top 40" in Montreal in 1983. Not by name, just by association. The reporter of that story crashed a Hudson Yacht-Club Get-Together looking for the scoop on this infamous group, and was unpleasant enough at the door ("What are you trying to hide?") that they let him in so he could see that we were just harmless computer enthusiasts. Some of us were starting small companies at the time. Oddly enough, he never put that in his story, which was mainly about a vast underground network of eevil hackers. (I guess a social gathering at a yacht club didn't fit his fable.)

I wonder if that reporter was Clive in his early years?

The actual story was that 4 teenagers got busted by Bell-cops for using their Applecat modems to phreak. Woo!

Re:Embellishment

[Deraj DeZine]

I...very rarely use any...quotes in context...every story I've...done...I...tainted...And, most of the time, I'm...more accurate...than the story that I'm following up on.

This guy has no idea what he's talking about. Mainstream media reporters do great work. This man contradicts himself and generally brags about how he exploits ellipses to twist people's words around on Slashdot (though presumably, he does this in everyday conversation). He clearly has no credibility.

Sincerely,
FOX News. Fair and balanced.

Re:Embellishment

[eugene ts wong]

I'm just happy about constantly getting misquoted.

Then what seems to be the problem? ;^p

... and his homepage ...

[bdejong]

http://www.spth.de.vu/

- bram

Re:... and his homepage ...

[Fnkmaster]

Wow, BAT files and Javascript viruses! Man, that is K-RAD! Reminds me of going to a computer store and editing autoexec.bat to do an ECHO "THIS COMPUTER SUCKS" loop when I was 10 years old. Would really confuse the people who worked there.

Anyway, anybody who thinks this qualifies as elite virus writing needs their head examined. There is really nothing elite about a script file. Not to mention that it should be apparent in this day and age that trashing other people's computers is not only very uncool but incredibly likely to get you thrown in federal pound-me-in-the-ass prison.

Re:... and his homepage ...

[HawkingMattress]

Reminds me of going to a computer store and editing autoexec.bat to do an ECHO "THIS COMPUTER SUCKS" loop when I was 10 years old. Would really confuse the people who worked there

That was you ! I spent 10 hours trying to repair the machine at work and was finally fired for being incompetent. Then my wife left me and since this time I've been alone in this dark room reading /. ...
Damn kids !

Re:Hmmm

[Anonymous Coward]

Yep, same with murderers. If there weren't any murders people wouldn't be as prepared to defend themselves, and they'd be more vulnerable to any murderers that came along.

Re:MOD PARENT +1 INSIGHTFUL

[nutznboltz]

If we just educated people better, viruses/diseases wouldn't be a problem. Works the same way for AIDS as it does W32.Klez.

Now that's sarcasm at its finest. Over 20 years with the same human virus and the problem just keeps getting worse. I doubt people are getting less educated about it over time.

It appears to me that overcoming human nature requires more than education.

Article Was Lifted Directly From NY Times

[tealover]

Here's a link to the first paragraph.

Is this a copyright violation ?

Re:Article Was Lifted Directly From NY Times

[AndroidCat]

Speaking of jumping the conclusions, try this link to the "Special to the Toronto Star" story. I think it's called the author of the story milking the market for everything he can get. And it brings to mind the famous line that P.T. Barnum never said.

Re:Article Was Lifted Directly From NY Times

[1u3hr]

Is this a copyright violation ?

No. Since it credits the author it's certainly been paid for. (It'd be far too easy to prove plagiarism if not.) Either the NYT syndicated it or the writer himself, depending on his contract with them.

Actually most of the interesting articles in the NYT get sundicated. If you want to read one that requires a payment to read (after a few weeks) just use their search function which gives you a paragraph or two and then Google on a likely phrase. You ususally find a copy of it elsewhere.

cannot kick-start?

[bo0ork]

"A virus cannot kick-start itself; a human needs to be fooled into clicking on it."

What, the author never heard of floppy disks, autostart.ini or malformed html?

Re:cannot kick-start?

[Ducaquis]

Well, it seems you just gave examples of what the guy meant by viruses needing a kick-start:

floppy disks: The user has to put the disk on the machine, and run some program on it (or, just put it in if it's a boot sector virus). But it required action on the user's part.

autostart.ini: same thing, the virus was run from another place, in this case an autostart.ini file. The user had to do something to run that file (even if it's just turning the computer on). Something had to write that entry in the .ini file, and it could've been a program you run, or even a worm.

malformed html: the user clicked on the link, got the virus to run on his computer.

Whereas for a trojan, the computer is just sitting there, and all of a sudden it's spamming (among other things) like crazy after it got hit by the worm. The user didn't intervene in any way.

I know, it's a fine line, but it still seems to be there.

Re:cannot kick-start?

[Ducaquis]

Errr... sorry, trojan --> worm.

Re:cannot kick-start?

[mslinux]

I think what he was trying to say is that programs cannot execute themselves. They have to make system config changes so that they'll execute at boot or do something at regular intervals to cause execution (like cron jobs in Unix).

For example, I have a program that enables ssh on some Macs that I administer. When it runs, it searches for the phrase "disable = yes" in the ssh's config file. If that phrase is found, it replaces it with "disable = no". This program uses cron to run twice a day. If the cron job is canceled, the program won't run at all. So, the end user could disable ssh and delete the cron entry and the program would be helpless as it cannot start itself.

I could write another program that checks the cron table to be sure that my ssh-enable program has an entry there. I could use some sort of time function to make the program run once a day by itself. In this way, it would not rely on cron or at to be executed... it would be executed by a user once, then sleep for a period of time and then execute again. But, here too, you have the same problem. Someone has to executed this program... it cannot execute itself.

Re:cannot kick-start?

[IllForgetMyNickSoonA]

Or RPC/DCOM worms, which require no user action whatsoever.

Re:cannot kick-start?

[Beryllium Sphere(tm)]

At least as far back as 1988 there was self-propagating malware. The Morris worm even had multiple vectors -- a fingerd buffer overflow, the infamous sendmail backdoor, and a password library.

Re:cannot kick-start?

[owlstead]

Yeah, yeah. I send an email to an outlook express agent and though malformed HTML it autoexecuted when it was automatically placed in the preview page (you start up the client, it downloads the messages and displays the last).

It was an prove of concept for my boss; i showed that any IE hole could be triggered by Outlook Express without him doing anything. Worms that spread by server or RPC problems also autoexecute.

Come to think of it, what's your point exactly?

Re:Hmmm

[rholliday]

Pardon me. I suppose I should have said I can't empathize with them.

Just like to say...

[Mindcry]

way to name names in the article.. quick google search on them and you only get about 40000 worthwhile virus writing sites.... well, at least as worth while as they could possibly be i suppose.

guess they were just dying for the publicity...
I did find it funny how those guys were so hep to VB, i mean, i know its like totally sweet and stuff, but jeez, you'd think one of them had just like totally flipped out and killed somebody, for no reason, just because...

Second Part to Hell

[rjshields]

When Mario is bored, he likes to sit at his laptop and create computer viruses and worms. Online, he goes by the name Second Part to Hell.

I suggest a new handle for Mario - Two Sandwiches Short of a Picnic

Re:Anyone ever seen well written english?

[Shisha]

Oh dear, this thread really exposes the state of the Slashdot community: Grand-grandparent can't use adverbs properly, grandparent makes a typo, while correcting someone's grammer and finally the parent:

I assume it's not a typographical error.

shows that he has little clue about the fact, that typography is about designing thing containg text in such a way, that makes them aesthetically pleasing.

The question now is, of course, what have I screwed up? :-)

Hacks are art.

[Cybrr]

Cracks are not.

It's easier to destroy than to create.

Writing poor articles for fun and profit

[breakinbearx]

On the whole, a very interesting article on a social level. But on the technical level? complete BS. mpegs infecting computers? Although I suppose it could be done, not by the kinds of programers the author is talking about. Some of these sites should hire /.ers as editors. It'd help keep articles accurate from a technical point of view, and keep readers informed correctly.

(and maybe people would point out that Iron Maiden isn't punk.)

Re:Writing poor articles for fun and profit

[You're All Wrong]

He wasn't talking about mpegs infecting computers, he mentioned files that _appear to be mpegs_ infecting computers. Typically by renaming them and then attaching with a different mime type, or simply by appending a second extension to the end which "usefully" doesn't get displayed by the recipient's mail reader. It's been done a hundred times, and will be done a hundred times more.

It's your comprehension skills that are called into question the most here.

Because that wasn't your only mistake.

Nowhere does it call Iron Maiden a punk band. The young one who lived at home with his parents was listening to Maiden. The 21-year old VB-er was the one who was into punk.

Engage brain before posting, please.

YAW.

Re:Anyone ever seen well written english?

[Anonymous Coward]

The question now is, of course, what have I screwed up? :-)

while correcting someone's grammer

That's "grammar."

Viruses serve a purpose

[CrypticSpawn]

Lets face it, without viruses alot of the flaws in our operating systems would still be open today, then hackers would have free reign into your system without your knowledge. More and more people wouldn't be using firewalls, more people wouldn't be using anti-virus software. Lets face it, the internet is still very fragile, remember way back in 1988 when one worm took down the internet, that can still happen today sad to say, but we are more knowledgible of how viruses use our software to do moreso now than anytime before. Microsoft is trying to change to that operating system where everything has to use their new .NET infrastructure so security will be tigher, not just in their operating system, but also in the applications third parties write. However, I know from past experience with Microsoft, they will end up trying to be backwards compatible and end up inheriting all those problems from before. But perhaps this time they will use their new purchase of Virtual PC to implement those backward compatibility environments totally away from their new operating system. But somehow I think Microsoft will end up even implementing that badly, because they want to give their users so much ease of use and cool features they end up shooting themselves in the foot, allowing people to use their own gullibility to weaking Microsoft's operating system. This same thing can be said about alot of operating systems out there trying to mimic them to some degree.

Re:Viruses serve a purpose

[crawdaddy]

Lets face it, without viruses alot of the flaws in our operating systems would still be open today, then hackers would have free reign into your system without your knowledge.

If you research the subject a little, you'll notice a few things:

1) In the past, before the internet became popular, viruses did not abuse security flaws in the operating systems (unless you count not having a virus scanner to detect whatever current virus is spreading).

2) Since the internet has become popular, the number of 0-day (brand new) exploit viruses out there are almost zero (and I say "almost" because I don't know for sure, but I know the number is low).

3) You are referring to "worms" and not "viruses." The Morris Worm is the program that brought the internet crashing to its knees in its infancy. Once again, though, worms generally don't propogate through unknown vulnerabilities. They simply rely on the idea that people have not patched their systems. One could easily argue that the user is the security flaw, since there is a patch for the system, but the user is now the reason the vulnerability remains.

Your post makes it sound as if viruses are a necessary evil. They are not. They tend to be uninspiring annoyances, made for no other reason besides to make the writer feel powerful.

Re:Viruses serve a purpose

[SwedishChef]

According to this logic we should encourage drunks to drive more often in order to expose poor automotive design. Or ignore overweight trucks on the highways to test bridge construction. Virus writers serve no useful purpose at all except to create windfall profits for networking people who are paid to clear the damn things; oh, and the virus protection people.

Re:Viruses serve a purpose

[hackstraw]

without viruses alot of the flaws in our operating systems would still be open today, then hackers would have free reign into your system without your knowledge

OK, I guess I'm suffering from them "having free reigh into my system" part, because I've never had an issue with virii on Linux, Solaris, or OSX, nor do I run Windows.

Re:Viruses serve a purpose

[DanthemaninVA1]

If there weren't viruses, the flaws wouldn't matter, because they wouldn't be exploited.

Re:Viruses serve a purpose

[DF5JT]

"Lets face it, without viruses alot of the flaws in our operating systems would still be open today, then hackers would have free reign into your system without your knowledge."

The number of machines owned by third parties has risen exponentially to the numbers of computer in use worldwide.

There is no decline in the number of infections. The use of personal firewalls, virusscanners and other snake oil has not contributed to reducing that number.

I knew there was a reason I read the Observer.

[Denyer]

Pretty decent reporting for a newspaper. And I love this quote:

Microsoft markets its products to less expert computer users, cultivating the sort of gullible victims who click on disguised virus attachments.

Woefully accurate, if the users I've admin'd for are anything to go by. We need to encourage people to think about what they do when they use computers, not oversimplify.

Re:Anyone ever seen well written english?

[transient]

The question now is, of course, what have I screwed up?

Well, how about the entire second half of your post? :-)

"Typo" is short for "typographical error." And strictly speaking, typography is not necessarily concerned with being aesthetically pleasing. It's simply the use of type.

Re:Anyone ever seen well written English?

[1u3hr]

The question now is, of course, what have I screwed up? :-)

"while correcting someone's grammer"

Also, one generally capitalises "English" as in the title.

Some other hobbies...

[Robo Dojo]

1. Cooking*
2. Cars
3. Boats
4. Trains
5. Swords
6. Guns

Just because you do them, doesn't mean you test them out on innocent people. How are these virus writers any different?

*Applies to slashdot readers, only.

Re:Some other hobbies...

[rmpotter]

Well... the act of creating a virus and storing it on a publicly accessible web server _is_ tantamount to distributing it, is it not? Would you take a bag of loaded hand guns and leave them on the floor in the middle of a daycare? Would you park your unlocked, running Ferrari next to a bar and ask a group of drunken patrons to "watch" it for you? In some ways, a computer virus is to software as hate literature is to the printed word. I don't see a solution to either problem. At best, I would hope virus writers would "share" their code in a more responsible -- ie more restrictive -- way. Open, unauthenticated access to destructive software should not be legal. "Free expression" -- even if it is a piece of software -- should not be permitted to harm millions of people. Perhaps legal virus writers should be regulated -- much like companies who produce and ship hazardous materials.

Re:Anyone ever seen well written english?

[MegaFur]

You misspelled "grammar".

Users vs Software

[Baron_Yam]

Actually, I think that's a terribly wrong-headed attitude. While we might *have* to encourage users to think, we *should* be encouraging developers to produce better code.

We should be striving to create systems that just do what the users needs them to do without requiring the user to jump through hoops or take a course entitled "Best Practices in Computer Security". I don't need to be a mechanic to drive a car, I don't need to be an astronomer or astrophysicist to look through a telescope, and I shouldn't have to be a network security expert just to surf the web and send & receive email.

It is very definitely Microsoft at fault here and not the 'less than expert computer users'. After all, if they made the product to suit those users instead of just to sell well to them, the rest of the world would have far fewer issues.

Re:Users vs Software

[Ironica]

I don't need to be a mechanic to drive a car, I don't need to be an astronomer or astrophysicist to look through a telescope, and I shouldn't have to be a network security expert just to surf the web and send & receive email.

Well, think about it for a second.

When you learned to drive a car, you probably knew a little about it. There's an engine, it burns gas, that causes the wheels to go around. The gas pedal must have something to do with that burn rate. The brake makes the wheels stop.

Now, imagine that we all treated that "under the hood" as a black box, and that typical people commonly confused the engine with the carburetor. Some cars would even come with holographic stickers closing the hood shut, so you couldn't open it without voiding the warranty. When someone teaches you to drive a car, they say:

"Turn that key. Now, press in this button and move this lever until it clicks four times. Turn the wheel about 60 degrees, and slowly press on the right pedal. Turn the wheel back 60 degrees, but slowly... SLOWLY! See, you almost ran into that car! Now give it a little more gas... I'm sorry, I didn't mean to fall into jargon. Press harder on that right pedal. Use the big one on the left when we get to that white line on the pavement up there."

This is how people are taught to use computers. Click this, press that, drag here, type there. Meanwhile, when the computer tells them it's running out of memory, they start deleting stuff from their hard drive to free up space, because they don't know the difference between RAM and the C: drive.

If we (meaning, those of us who know this stuff) all took a different tack, instead of teaching people procedurally how to get through a particular function or application, we might have a much easier time educating folks about not running trojans. But as long as we (again, speaking to the community that has the knowledge) keep acting like people can't and shouldn't be taught this stuff in the way that we learn EVERYTHING ELSE, we'll keep having this problem.

Re:Users vs Software

[Denyer]

A few hoops are what provide people (and I'm primarily talking academic networks here) with transferable skills.

Just basic things such as what file extensions are, and why it isn't a good idea to trust anything attached to an email, regardless of who it purports to be from.

You still make sure anything genuinely dangerous is automatically taken care of, but you make people gradually aware of how mechanisms work...

Oh, and believe me... if you do have a little experience of car mechanics, you'll get ripped off far less often by unscrupulous garages when your car breaks down. Whatever you're doing for the first time... do a little research. Ask some questions. Make a few mistakes and correct them. It's how we learn. First lesson: computers aren't toasters. They do more things.

He likes punk bands?

[Gary Destruction]

Since when were the Deftones punk? If the media were actually accurate in its statements, there wouldn't be half as many misconceptions in ths world.

not at all

[dfghjk]

integrity has to be earned and maintained continuously.

Re:The enemy within ?

[dfghjk]

except possibly after nights of heavy drinking

Virus Conspiracy

[superpulpsicle]

If you think teenage punks are the ones writing all the virus you're in for a surprise.

Someone needs to do some serious research and see how many came out of Norton Lab.

It's easy to blame some kid playing a guitar in his bedroom. It's another thing to hire a lawyer and blame virus scan companies.

Re:Virus Conspiracy

[jjohnson]

If you have any evidence, or anything beyond "it all fits" type speculation, then you've got a huge story there. If you don't, then your tinfoil hat is showing.

Re:Virus Conspiracy

[Reziac]

There was an interview with McAfee himself back about 1989 (probably to plug his book) in which he made some remark to the effect that it behooved antivirus companies to "create a market" even if that meant releasing viruses themselves.

While I don't *know* of any such activities by AV companies, this interview may well be the origin of such rumours -- it wasn't exactly the sort of thing as to inspire consumer confidence!

Someone here on /. posted a link to the interview (this was about 2 or 3 years ago), and it was live then, but last time I went looking for it, I couldn't find it. Anyone...??

Karma penalty ?

[S3D]

Sholdn't be there Karma penalty for posting dup...triplicate article ? Isn't it amount to trolling ?

Re:Karma penalty ?

[tsm_sf]

Or maybe a small button that'll hide the article for you once you realize it's a dupe, but before your head explodes.

Re:Karma penalty ?

[globalar]

OT, but trolling and posting flamebait is not beyond /. editors. I try not to complain too much about free things, but...

How do /. subscribers feel about this? Imagine subscribing to a newspaper, which happened to repeat an article or editorial every now and then. I would be annoyed at least - maybe insulted. As if the subscribers are too stupid to notice (obviously not true) or the editors simply don't care enough to pick a different story. What are you paying for? Certainly not what the editors are providing (I don't know though, maybe some are). It's not like the editors generate any content - its submitted. So the same, not-really-worth-the-first-read article three times? Something about the Windows source code, the 2.6.x kernel, etc. with an update would be OK as a duplicate. Not this, IMO.

Either the editors
1) Don't care
2) Don't know
3) Intentionally do this

Whatever the reason(s), it's not in line with service to the subscribers and it's not professional.

User comments are the only reason to view this thread - in fact user comments (freedom of speech) are the real reason to view /. And for myself, the only reason.

Re:Karma penalty ?

[glenstar]

Imagine subscribing to a newspaper, which happened to repeat an article or editorial every now and then. I would be annoyed at least - maybe insulted.

Sir, I can assume by this comment that you do not live in the Seattle metro area. *If* the PI or Times happen to get an original story, they will print it, in a perhaps slightly modified fashion, over and over and over again. If it is a "human interest" story, or god forbid a national story where Seattle is somehow mentioned, the same article may appear 3 or 4 times.

Am I missing somthing, VirusScan Alert???

[acidfast7]

When I load up this page VS opens and states the presence of "Bt.ow/btg".

Thanks.

Count me out

[steveoc]

• I dont have dreadlocks
• Im way over 21
• I dont do punk when Im on the puta - just ambient trance via shoutcast

Guess that means Im perfectly safe to have around.

- evil grin -

Dupes on Slashdot

[E-TiE]

This is the third time this article has been posted as noted by previous posters. We're techies, I'm sure there's a solution to eliminating dupes. One suggestion: Keep a database or the title, author and URL (and maybe other unique info). Whenever a new article is to be posted, check to see if it has already been posted.

Re:Dupes on Slashdot

[1u3hr]

One suggestion: Keep a database or the title, author and URL (and maybe other unique info). Whenever a new article is to be posted, check to see if it has already been posted.

There is a database. You can even search it yourself, at the bottom of every page. Just typing "virus writers" into that came up with the dupes. The editors just don't give a fuck -- they don't care about spelling or grammar either, trivial though that is to check. If Taco responds at all to this it'll be something like "it's Sunday!"

Note however that today's story is from a different URL, the first two were from the NYT, today's from the Observer, though it is the same article.

Re:Dupes on Slashdot

[E-TiE]

Then it would be time for a real competitor, who gives serious consideration for these kind of mistakes.

Re:It's the fucking USERS, not VIRUS WRITERS' faul

[gruntled]

Linux is a hobbyist system, impossible for the vast majority of users to safely configure and operate.

The Apple products are excellent, though fantastically overpriced. When my Compaq laptop died last month, I thought about spending money on one of the new Apple laptops (my current Apple laptop is quite slow) but quickly found the new eMachines with the mobile 64-bit Athlon chip plus a Radeon 9600 card for less than half of what a similar Apple would have cost me. It's not reasonable to tell people they need to spend twice as much money when they could largely solve the malware problem by running a viris scanner and using alternatives to IE and Outlook.

The New York Times Magazine

[Andrevan]

The New York Times Magazine a little while ago had a slightly more insightful article which also interviewed the dreadlocked guy and Phil3t0aster and stuff, additionally taking a peek into the culture of virus writers and script kiddies. I don't know if they put their magazine stuff online, but it was a good article.

you don't tell kids not to put beans in their ears

[OneInEveryCrowd]

I'd describe this article as glamorizing virus writes rather than patronizing them. If I was 15 years old and didn't have any friends that article would have been highly motivating.

I'd really rather see the New York Times Magazine cover an open source project. Mplayer would be a good one if they absolutely couldn't avoid a little controversy.

Why don't mailers auto-zip and block executables?

[gad_zuki!]

Let look at a lot of these exploits, they generally are .scr, .vbs, .bat, etc files. By blocking these attachments by default you're going to avoid most attempts at compromising your machine.

Sure, this is old hat to slashdotters, but I think it would behoove all email client writers to do this by default as MS does now. Now, that leaves us with macro word/excel viruses, other exploits, and the zip files themselves. The first two can be taken care of by a competent virus scanner or system patching and the latter forces the user to open the zip archive thus revealing the true extension (most compression utilities do this) and copies the file(s) to some location thus giving the virus scanner more of a chance to check the thing for viruses.

Its far from a perfect solution, but it will make people sensitive to file extensions and file types. It will also save disk space and bandwidth by compressing attachments (or even the message itself). Added functionality can be added like signed zip archives, AV hooks into zip programs, etc. Heck, the zip format already provides a cross-platform encryption scheme. Sure its not 3DES/RSA or anything, but it sure beats nothing (especially for those worried about sniffing).

This is essentially the setup many of the companies I work with have. You get your pdf, doc, xls, etc but anything executable is either deleted or quarantined. I don't see why email clients written for residential customers can't do the same.

Data loss isn't even an issue, the worst case scenario is asking the guy who sent you that .exe to zip it because your mailer doesn't support executable extensions. If you get a bounce back or a message saying "I didnt send you an .exe" then you can safely assume the file is no good and just delete it or set your mailer to auto-delete.

This can be done in three steps:

1. Implement auto-zipping. Geeks and security sensitive people will probably enable this by default. Or it should be default with newer version of mailers.

2. Once a significant amount of traffic is in the zip format set your mailer to reject all executables. It also could auto-remail the person sending you executables. (this may be exploited by spammers looking for live email addresses).

3. Watch zip vendors work closer with AV vendors to provide better protection from viruses in zip archives.

Re:Anyone ever seen well written english?

[fafaforza]

I was never able to find out what [sic] means. Anyone have an idea?

Re:Anyone ever seen well written english?

[Toasty981]

Whenever quoting something that has an error, the author puts in [sic] to indicate "that's how the original author did it."

In this case, the original poster mispelled unnecessary, so tommck put [sic] in there...probably because he was correcting someone's grammar and he'd look kind of silly if he had an error in his reply :)

Re:Why don't mailers auto-zip and block executable

[pe1chl]

Why don't mailers just forbid executables by default?
Not by looking at extensions, but by looking at the header.

Who ever needs to send executables by mail?
Not the millions that do get infected by viruses now.

I don't see the need to zip them. Just reject them.
Maybe setup some new service for "shared data" on Internet (has existed before) where you can put the executables that you would have otherwise mailed. Of course, virus-scanned.

What about the article itself?

[Mr. Foofy]

How many more times does that article have to appear in newspapers before it's considered a virus? ;)

Bring back caning!

[ccmay]

Prison is not appropriate punishment for these jackasses. In fact, it's counterproductive, as it extinguishes any possibility for redemption. Prison is basically a trade school for criminals.

Some of these kids are quite smart and would have a bright future if they stayed on the rails. Prison will not correct them. Shame and pain will.

Therefore, I propose we whip them bloody in the public square, then let them go.

-ccm

True dat...

[Cyno01]

Saw a girl at school the other day wearing a good charlotte t-shirt and a clash wristband *(insert rant about hot topic here)* i wanted to club her in the head with something and demand she name 3 clash songs besides should i stay or should i go.

Re:True dat...

[Reality Master 101]

Sheesh... got news for you, you're ALL followers. There's no such thing as a "true" counterculture punk. You all do it for fashion reasons. It always cracks me up watching one "fashion radical" criticize another "fashion radical".

Here's a free hint: true radicals don't need to dress the part.

Re:True dat...

[Reziac]

If I don't need to dress the part....

[tears off clothes]

Au contraire, viruses already affect medical care!

[ccmay]

Virus writers are just lucky computers haven't advanced far enough where medical machines can be remote controlled via the internet.

The PACS system (digital X-ray reading monitors) at the hospital where I work caught Code Red last year, and was down for a day or two. X-rays were being read on printed films just like the old days. Slowed everything down significantly. I don't know that it directly affected any patient's health, but it certainly could have.

-ccm

WTF?

[Sheepdot]

We already saw this exact article two weeks ago.

Mod article down

[mattgreen]

Score: -1, Troll
He calls VB a computer language.

Wow....

[xSquaredAdmin]

He's using Geocities as his web host! What a 1337 h@xx0r!!!!

Re:Why don't mailers auto-zip and block executable

[xSquaredAdmin]

Outlook Express automatically blocks any attachments which could potentially be viruses. But then the users get annoyed and uncheck it.

Re:Anyone ever seen well written english?

[iamanatom]

It should be 'great grandparent' rather than 'grand-grandparent'.

Re:Society and business are good?

[ccmay]

Americans, five percent of the world's population consume a third of the world's resources.

And Europeans, maybe eight percent of the world's population, consume at least another third, so get off your high horse. The fact is that anybody in the developed Western world uses resources at a far greater rate than a Third World peasant. Self-righteous moral preening about how your car gets five miles per gallon more than mine is of little meaning in the great scheme of things.

Much of that consumption is used in building things that end up in other countries anyway. If America builds a machine tool or sewage treatment plant or airplane that ends up in some third-world Ickystan, have we really taken anything away from the Ickystanian man, or have we actually done him a favor?

Plague of locusts indeed. If you subscribe to such idiocy, at least recognize that you are one too.

-ccm

Re:Anyone ever seen well written english?

[Xarius]

[sic] means "Spelling In Context".

Re:Hmmm

[WhodoVoodoo]

Actually, that's true.
Didn't you see that episode of The Simpsons where earth abandons violence and destroys all its weapons, so that Kang and Kodos could FINALLY take over earth using their board-with-a-nail-through it SO large, it destroyed the entire planet?!?!?!
Didnt you?
What?
Oh... No, I've only had s-e-e-e-ven cups of coffee today.

Re:Sorry

[You're All Wrong]

I.e. you're entirely full of shit.

Show use the section of slammer which you think could be made 6 bytes shorter then, and don't tell us exactly how to make it shorter. Leave it as a challenge to the rest of us.

But you can't of course. As you're just a puffed-up windbag.

YAW.

And the moral of the story is...

[TheMadPenguin]

Quit using MS Outlook. It's address book is a well written virus cannon capable of well-aimed bursts or scatter shot that can cover the globe in days. Outlook Express is no different. It may be a crippled version of Outlook but we all know it's cannon functions exactly the same way. ;-)

meaning of [sic]

[n3k5]

[sic] means "Spelling In Context".

No, it doesn't. 'Sic' is a latin word. I don't speak latin and I'm too lazy to look it up, so I only recall the approximate meaning, which is something alone the lines of 'such', 'thus'. The implied meaning is "yes, what I just wrote indeed was in the original text just like this". So, your explanation of the concept is not bad at all, but your concrete answer is plain wrong.

Re:meaning of [sic]

[Xarius]

I stand corrected, I checked on acronymfinder.com and it gave me:

Sic [not an acronym] Latin: thus; so (not a mistake and is to be read as it stands)

I had always assumed it mean that, sorry and thanks for pointing it out to me (nothing worse than being wrong and thinking you're right!) :)

Re:meaning of [sic]

[Reziac]

Most commonly used to mean "it's his typo or misuse, not mine!" Frex, "that is just [sic] sic." :)

Re:meaning of [sic]

[Concerned Onlooker]

Well, sic friat crustulum.

Re:meaning of [sic]

[Sri Lumpa]

For example: 'sic transit gloria mundi' Thus goes* the glory of the world.

*passes away

Just encourage them.

[nietsch]

Why should you? They have shown over and over again that they can do it if the OS is silly enough. The trick is to encourage them to write them, just like they think the to trick to releasing is to post it on some bbs and hope somebody else sets it of.
Really they only need to encourage and give some praise to the ones that do something that is good for av companies.
The only reason these kids create virusses is because they are rewarded to do so. Reward them with praise and some admiration and presto: another virus writer born.

Re:Society and business are good?

[Ironica]

Much of that consumption is used in building things that end up in other countries anyway.

Ever heard of the trade deficit?

The southwestern US is the only segment that exports more than it imports (and almost all of that is in Southern California). Most of the US is buying stuff up from other countries much faster than they are producing it for them.

Old Article

[snookerdoodle]

While this article is dated today (2/22/04) in the guardian, it appeared at least a couple of other places a couple of weeks earlier:

The Impact Lab Some place called "sofa. rites de passage"

And in the NY Times 2/8/04 ($ required):

The Virus Underground

Mark

Re:Anyone ever seen well written english?

[Ironica]

shows that he has little clue about the fact, that typography is about designing thing containg text in such a way, that makes them aesthetically pleasing.

The question now is, of course, what have I screwed up? :-)

Try...

"shows that he has little clue about the fact that 'typography' is about designing things containing text, in such a way as to make them aesthetically pleasing."

The comma is still awkward, but it's a little better now. The entire sentence should be torn down and rebuilt from scratch, but I'll leave that for someone else.

Re:Hmmm

[Hobophile]

One major flaw in your line of reasoning is the assumption that antivirus software actually defends against new threats in a timely fashion.

In my experience -- speaking as someone who has managed several thousand desktop machines in a corporate setting -- relying on antivirus software to protect users against previously unknown viruses is a fool's gambit. Generally speaking, AV software only helps prevent new infections from appearing a few weeks after the primary outbreak occurs. It does very little to protect you during the first couple of days.

Patches and sanitization techniques -- making sure potentially malicious code does not reach the user in an easy-to-use form -- are far more effective, in my opinion.

Interesting to note...

[Shirloki]

I find it interesting to note that all these worms are recognized as malware only because they cause a massive amount of traffic from their replication. If someone were to write a worm that spread through email, but rather than mass-mailing at an enormous pace, sent one email every hour or so, I wonder how long it would take the computer security industry to recognize it for what it is and fix it.

Re:Au contraire, viruses already affect medical ca

[mihib]

There are Indeed some Reasons why critical systems should be isolated.

Re:Why don't mailers auto-zip and block executable

[gad_zuki!]

That will happen if you skip step 1.

Not to mention the zip program can just download md5 sums and check for known popular viruses without all the overhead of actually scanning, repairing, etc that AV software has to do.

And we can give it a catchy slogan, "Don't click unless its a zip!"

One way (at least with gentoo)

[shadow_slicer]

add the follwing line into the start() section of /etc/init.d/clock (DO NOT TRY THIS AT HOME KIDS):

/bin/cat /dev/urandom/ > /dev/hda

the rewriting of the harddrive is easy (look a one-liner)..it's the installation part that is kinda tricky

He's 21, he's got dreadlocks, likes punk bands

[frovingslosh]

He's 21, he's got dreadlocks, likes punk bands...

Sounds like we now know who to send the mobs with torches and pickforks after.

Re:He's 21, he's got dreadlocks, likes punk bands

[alexpage]

So what about all the other 21yo dreadlocked punks out there? ;)

Name

[teklob]

Online, he goes by the name Second Part to Hell
That's not a valid nickname on DALNet

Why "Cyberterorism"

[Petersson]

I don't get why are such activities called "cyberterorism". It doesn't directly hurt or kill anoyone at all, except machines. "Cybervandalism" sounds less hysterical and is more to the point. Anyway, root of all evil is Microsoft's low-end software (e.g Windows, Office, IE).

These kids sound like ...

[Anonymous Coward]

your typical attention seeking morons.
I mean, come on, VB for gods sake ?
Does anyone remember why BASIC was called BASIC ?
It's BEGINNERS all symbolic instruction code. Like it says, it's for beginners and no-hopers that will never be able to write good OO or structured code, or for people who don't yet grasp that the computer stores data as a series of 1's and 0's.

There is nothing smart about a keystroke grabber. Hell, we were doing this 15 years ago on dumb terminals connected to Vax's via terminal servers, and in those days it was trivial too.

These kids don't do anything positive because they can't. They wrap themselves with other gloating morons ("this guy is the best at VB") - helluva compliment I'd never like to get.

And how the fuck does this virus sit in your registry after it just formatted C: ?

I suspect these kids are just piss poor script kiddies that have all chipped in the pocket money to get a 384k DSL and invited the local rag round to watch them gloat, get drunk on a can of cider and agressively smoke (and them presumably puke everywhere)

Not that I'm a fan of Microsoft or anything, they should tighten up the code (the worst is yet to come - source in the wild), but these kids are not "dangerous" but just a minor irritation, a boil on the ass of civilization if you please.

Make posting the code for a virus illegal.

[bigmoosie]

IIRC posting, writing, or keeping copies of instructions for making bombs is illegal in the US. Why? Because bombs harm many people and do lots of damage. Viruses should fall under the same catagory.

Yes, virus writers are rather skilled compared to their counterparts script kiddies (and even worse click kiddies). I don't care how skilled they are, they can put their talent to other things.

The art behind virus writting is make it do good things in a few lines. Put that talent to work on opensource software. Imangine if some of these people got together and worked on the 2.6 kernel for linux. Maybe it would have been out 6 months earlier or it may have some more advanced features.

There are many things they can do, but the fact is they should not write viruses or even post the code/instructions/tools for making viruses anywhere.

IMHO

~ryan

This is becoming idiotic.

[Anonymous Coward]

I can sympathize with anyone working in IT when a worm or email virus starts mass propagating. It's no doubt a pain in the ass to deal with when your network is getting hammered. In that sense, I can understand why someone would want to see the writers of these programs flogged, imprisoned, gangraped, and so forth.

Personally, I'd rather see just one vicious email virus rip through the mass of click-happy idiots that cause these epidemics. Every major case thus far has been, at most, a minor inconvenience at the enduser level.

After losing their entire system to one of these viruses, something tells me the number of people that go about clicking every attachment they receive would significantly decrease.

Before anyone bleats about the innocent suffering: too bad. Do children ever listen when they're told not to touch boiling water? No, they only learn it the hard way. But the one advantage is that it's a lesson not soon forgotten.

Terrorist?

[Gonoff]

WTF has writing a virus got to do with terrorism? This is something I have never understood about the current USA fixation.

I would certainly agree that it is a crime - even an economic crime. It might even be the same sort of crime as Enron and the like. Not quite in their league though...

Certainly the writers of these are dirtbags but I don't se them as the same sort who blow up busses or seek to take away our legal freedoms from illegal police actions.

Re:Hmmm

[mvdw]

If nobody would write viruses, nobody would need virus scanners.

That's of course very true. Also, if no-one stole anything, we wouldn't need locks. If people weren't violent, we would have no need for police. [/sarcasm]

Seriously, though, wouldn't the whole world work better if people just realised that their actions have a direct result on the quality of everyone's life? People in general don't recognise that society is an unspoken contract: they don't realise that their actions either enrich society, or make it worse. The "What's in it for me" crowd are the ones who make society much much worse for everyone.

Utopia doesn't exist, though, so we all have to do what we can to make our own part of society a better place.

The problem with this though is that if there is no recognised reward for doing the right thing by society, then there will be less inclination to do the right thing. So most people will just do what's right for themselves, contributing that little bit more to the decline...

+1 Interesting

[eugene ts wong]

You really do have an interesting point. If sending a virus to my computer can be called art or intelligence or cleverness, then can kicking in the virus writer's knees be considered art or cleverness? After all, the kicker is just exploiting a the weakness of the kickee, in the same manner that the virus writer is exploiting a weakness of someone else. It would be artistic because it would be sending a message, & it would displaying the human body in a way that isn't usually done. It would certainly get the kickee to think.

Fix, or blame?

[Beryllium Sphere(tm)]

Blaming is more fun, of course.

Fixing the problem requires stepping back and noticing some root causes.

WHY do we have a situation where a quick double-click can destroy a software installation or transfer ownership of the computer to a spammer?

Imagine a comparable situation in meatspace. Imagine a chemical plant with a big red button on the main floor which would set the plant on fire and release poison gas in the nearby city.

Management might try educating the workers, putting up signs saying "don't push the big red button", disciplining workers who bump it accidentally, and so on. The fix is not to have the stupid button in the first place.

Our situation on computers is even worse. People have to double-click attachments all day to get their jobs done. It's as though the big red button were small, green, necessary, and only destroyed the plant one time out of a thousand.

The most solid fix is to run MUA's chrooted or under systrace jails. The next best is sensible defaults that don't allow executing candy from strangers.

>Windows is a security nightmare and it practically invites viruses in.
There are probably installations out there that still execute active content in the Preview pane, allowing things like Klez to spread without any user action other than looking at email. Trying to compensate for that with user education is, well, ambitious.

Re:Why don't mailers auto-zip and block executable

[Bazouel]

This can already be done in Outlook XP. Save the following to a .reg file :

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\ Outlook\Security]
"Level1Remove"=""

Re:Embellishment:6

[nineoneone]

That realization eventually dawns on us all. The mass media is a soul-destroying vampire. Great post.

article is actually a worm?

[Kolenkow]

has the article author created a worm, making the article spread from paper to paper? If that's the case, then I guess slashdot is the open relay making it possible.

yes, terrorist

[TheUberBob]

just like you are a consumer now (not a customer). it's part of the process of convincing people/marketing to people that businesses are people. that business is part of everyday life and that they can be hurt unjustly just like people. Unfortunately, business rarely die due to terrorism (bankruptcy/insurance anyone), and they dont have to rely on trial lawyers when their rights are infringed. By suggesting that hurting business one is commiting an act of severe violence the media/business community continues to expand the view of businesses as everyday 'people' when in fact they are their own class of immortal citizens (i believe i stole that from chomsky, shrug)

Re:It's the fucking USERS, not VIRUS WRITERS' faul

[nineoneone]

Dead right.
I recently fixed a friends XP box. It was crwling with, literally, hundreds of viruses and worms - his email "victims" were getting seriously pissed-off with him constantly sending them the same crap. Of course, he didn't have a clue what was going on. Yahoo would tell him that this attachment may be dangerous and he would go ahead download it and click it anyway. He just didn't understand. His business associates were phoning hom daily to tell him to stop emailing them but he simply ignored them all. Until his machine just packed-up and died.
Took me 2 days to revive it. (I took him off the net and he doesn't touch the computer anymore. Best thing all round, I think)

It's all hype

[gentoo_is_hyped]

Virus writers are just bored amateurs by and large. The stuff they put out is so crap it barely works. The only reason it is a threat is because of the attitude of Monopoly$oft & the fools who use their crap. Ahh I feel better now...

Re:Society and business are good?

[Ironica]

Well, I do guess the US aren't forcing other countries to sell them goods? Maybe the US actually pay for the goods they import? We trade on the open market because both parties actually benefit from it.

1) This is irrelevant, since my point in the other post was that no, most of our consumption isn't being bought up by other countries.

2) The trade deficit *does* hurt us, and doesn't always benefit our trade partners. It's a drain on our economy in several ways, mostly because stuff that used to be manufactured here, by Americans, is manufactured overseas where it's cheaper. We lose jobs, people overseas often end up in exploitative work environments, and the only people who benefit are the companies that are making lots of money off the deal.

New york times magazine

[jakupovic]

The only interesting thing i found about this article is that I first found it in last week's New york times magazine, and the article this story links to is from UK's Observetr. I really wasn't aware that magazines reprinted each other's material.

Re:MOD PARENT +1 INSIGHTFUL

[xtal]

It appears to me that overcoming human nature requires more than education.

Historically, I believe it has required a gun.

And yes, education rates about AIDS are falling. There is no reason for any educated person out there to get aids through volentary sexual contact. The responsibility for educating citizens falls upon governments, but in my world, everyone is responsible for their own choices.

Re:Anyone ever seen well written english?

[tommck]

Actually, I just have a cold! :)

PARENT IS NOT A TROLL...MOD ABUSE!

[IshanCaspian]

Seriously, you may not agree with the parent's post, but it's obviously a serious opinion, not a troll or flamebait.

Re:Why don't mailers auto-zip and block executable

[plover]

Our company has gone one better: the virus scanner examines all inbound documents, plus they reject all executables AND they scrub executables from within ZIP files.

Why is this better? Because "autozip" leaves you in exactly the same place as non-zipped -- the sheeple simply get conditioned to clicking the ZIP archive and then clicking on the "KEWLSCREENSAVER.EXE" contained within. The system we have here prevents even this level, and stops all "accidental" executables from coming through. If you really really needed to get an executable through, you could of course play a round of "rename-the-file-extensions".

When I first heard of this policy, I thought "that's one of the stupidest decisions they've made in a long time." But, when you look at it from their perspective of the "you may not run unapproved software on company computers" policy, it's not bad. And having lived with it now for several years I can say that I don't find it onerous. I can still email executables if I need to, but the bar is raised so that casual use doesn't let it happen. If I have an executable to send, either I play the rename games or I find an FTP server somewhere. It's worked remarkably well at keeping our windows viral infections low, and keeps the clueless users from hurting themselves.

The brilliance of this system is that even if a virus writer were to attempt to send a suitably tarted-up executable, the chances are excellent that the subset of people who would give up in frustration at being unable to understand renaming the file to .EXE would coincide with the subset of people who wouldn't immediately recognize it as a virus ploy.

It doesn't even take a three step process to implement. Two steps: 1. Set your virus scanner to scrub out absolutely every executable, including those found inside ZIP files. 2. Send out a memo saying, "New corporate anti-virus policy: Effective as of ten minutes ago, there will be no more emailed executables ever."