Sasser Author Under Arrest, Say German Police

Apogee writes "A number of german news websites, like n-tv, or the german yahoo news site (courtesy of the german press agency, lending this some credibility) (web sites in german) report that the programmer of the Sasser worm has been arrested by German police. The Sasser author is an 18-year-old man who was arrested on Friday in Rotenburg, Germany. With the Sasser worm being the latest among worms that spread like wildfire among unpatched windows boxes, and apparently also caused serious computer outages and cost to the economy, how will this be transformed into an indictment?" Update: 05/08 18:41 GMT by T : SexySas writes "As the German news site heise reports, the 18-year-old author of Sasser is responsible for Netsky, too. The German police is talking about 'a milestone in war against cybercrime'."

Comments

they caught him too soon

[ReallyQuietGuy]

they shoulda waited until MS announced a reward for it first!

Re:they caught him too soon

[d'fim]

"No due process, no suspect's rights, no Miranda warning, no 5th amendment, no court-appointed attorney, no judge, no jury, no appeals, no comfy jail cell, etc, etc, etc...."

No apology if they got the wrong guy.....

Re:they caught him too soon

[gnu-generation-one]

So when will the LSASS author be under arrest?

Re:they caught him too soon

[lpangelrob2]

I don't think you can make that comparison at all.

Computers can be formatted, and the whole deal mostly forgotten. Human lives don't exactly work the same way.

Re:they caught him too soon

[roror]

The difference between the rapist and the virii writer is (if you look from the eyes of the so called criminals) - one enjoys overpowering the "weaker sex" sexual gratification and the other enjoys excercising engineering talent to blow the covers off a sub par OS, which has gotten way too much more credits than what it deserves. Are they the same crime ?

Re:they caught him too soon

[Anonymous Coward]

You think he's unhappy, you should see what they did to the cat (picture at right of Yahoo article).

Re:they caught him too soon

[10101001 10101001]

I'd love to see the same penalties applied to breaking into computer systems as as applied to rape, because then I think the people doing these things would have to consider what they're doing and their imipact on their victims. Right now, I think most people like this guy think it's a game, instead of focusing on the incredible amounts of agony that is caused.

I pray you're being a troll. If not, step back for a minute from your weird obsession personification of a computer, and realize that a computer is a product just like a toaster. It isn't an irreplaceable, unique person composed of trillions of cells where a violent physical act is unlikely to be entirely erased from either physical or mental realms. Computers aren't alive and setting the same punishment for abusing either horribly degrades the perceived worth of a human.

Only at the point at which computers are in a position where they can do the same sort of physical harm to a person should there begin to be punishment in the same realm. But that's just harming a person by proxy which is already covered by law (killing a person by a gun is the same as killing a person by strangling them, legally (and the same issue of a question of neglect by using a proxy comes up)). Then comes the question of is the computer maker responsible, and I'd say that they might be if the physical harm was the result of a defect.

Re:they caught him too soon

[FreeSoftwareZealot]

Weak of mind, aren't we? To quote:

"I'm not going to go quite this far, because the physical experience gives rape an entirely different dimention,"

But then you *do* go quite that far.

I rest my case.

Re:they caught him too soon

[klui]

I would slightly disagree with your analogy. Being a victim of these worm attacks is more like having your car keyed. Having your system cracked personally by an individual is more like rape. Especially if the system has a lot of your personal files on it and you know the cracker has gone through/downloaded them. Nonetheless, it's not the same as physically-raped victims.

Re:they caught him too soon

[daviddennis]

It was an exaggeration to make a point: That people whose computers get broken into or hit by virus and worm attacks feel real suffering and pain from the experience, as I did.

A computer system is not a unique person, but nowadays it's very much an extension of one. It has things I've written, things I've done, and important stuff I need to remember. If it's lost, a whole chunk of my life goes away.

I think the preoccupation society as a whole has with people breaking into computers is sick, especially considering that many people are on the side of the person doing the attacks. And that disgusts me since I've seen what a horrible pain it is to recover from an attack.

It frustrates me that people deliberately and maliciously seek out to cause uncountable numbers of innocent people pain. I think people who are sick enough to act that way deserve to be weeded out and removed from society.

For all the outrage I've gotten from my analogy, nobody's put a serious dent in my point: That people who do these things get away with it all the time, and that they somehow need to be stopped.

If you want to counteract my feelings and my analogy, let's hear some positive recommendations on how to deal with these people. What would you do to put the point in their heads that this kind of conduct hurts real people and has enormous costs?

D

Re:they caught him too soon

[yiantsbro]

We (Americans) can do this---just classify him a terrorist and thus we have:

"No due process, no suspect's rights, no Miranda warning, no 5th amendment, no court-appointed attorney, no judge, no jury, no appeals, no comfy jail cell, etc, etc, etc..."

Re:they caught him too soon

[timmyf2371]

Right, so what about the Law student who writes all his work to pass as a graduate, but then loses it all because of a Virus which some kid has written?

Yes, I use backups - but a Law student won't necessarily be as tech savvy as me and many of us here. More to the point, why should everyone need to make backups in case of this? It's like saying all women should carry guns in case of rape.

Wouldn't that sort of scenario majorly screw up that person's life?

Re:they caught him too soon

[Ironica]

A computer system is not a unique person, but nowadays it's very much an extension of one. It has things I've written, things I've done, and important stuff I need to remember. If it's lost, a whole chunk of my life goes away.

Same with my house. When I leave my house, I lock the door. When I'm *home* I usually have the door locked too (this is more my husband's idea, though). Fortunately, Schlage generally has a good track record on not having easily-broken locks.

I think the preoccupation society as a whole has with people breaking into computers is sick, especially considering that many people are on the side of the person doing the attacks. And that disgusts me since I've seen what a horrible pain it is to recover from an attack.

Same with having your house burglarized. And yet, if you used a luggage lock to secure your front door, and your front door was right on the street, and there was no street lighting, neighborhood watch, etc., people would have a hard time sympathizing with you when you got ripped off. Especially if it was widely known that people keep getting broken into when they only use luggage locks to secure their personal belongings, and they're easily defeated (since they all pretty much have the same key).

For all the outrage I've gotten from my analogy, nobody's put a serious dent in my point: That people who do these things get away with it all the time, and that they somehow need to be stopped.

It's the risk-vs.-reward ratio. If you want to make it less attractive, the first thing to do is make it *harder*. When stealing someone's belongings doesn't require any breaking, just entering, it is more likely to happen. If you're homeless, your stuff gets stolen all the frickin' time. See how much the police care about tracking down the guy who stole it in *that* case. But a mansion in Beverly Hills with 24-hour armed response, noise- and motion-sensitive lighting and alarms, and guard dogs... sure they want to find out who did it, because that guy is *really* dangerous.

If you want to counteract my feelings and my analogy, let's hear some positive recommendations on how to deal with these people. What would you do to put the point in their heads that this kind of conduct hurts real people and has enormous costs?

First of all, you need to meet them halfway. People who keep their windows installs updated didn't get hit by Sasser. I'm one of them, and I don't even have automatic updates enabled... I just go there every so often and get what's critical (after actually deciding if I agree that it's critical... Outlook Express is NOT). That's basic. Using a firewall will also protect you from Sasser, as will using a non-Windows operating system.

People don't have much sympathy here for victims of these worms because they generally painted a big target on themselves and said "come and get me." That's the difference between how much we care about catching the perps in this case and in others... in a sense, these guys are doing us all a favor, because they're reminding people to lock their doors with something more than an ounce of cheap metal.

Re:they caught him too soon

[Cromac]

It's deeply depressing to me that people exist who are as cruel and malicious as the crackers and virus writers of today.

That's awefully naive of you, they aren't any more curel and malicious than people have been for thousands of years. Just take a brief look at history, or even the evening news, the so called "cruel and malicious" acts of virus writers pales in comparison to what some people do to each other every day.

Having your computer be compromised by a worm is a violation but it's a far cry from rape. Try talking to a rape victem and see if they think they're even remotely in the same league.

Re:they caught him too soon

[badasscat]

"No due process, no suspect's rights, no Miranda warning, no 5th amendment, no court-appointed attorney, no judge, no jury, no appeals, no comfy jail cell, etc, etc, etc...."

No apology if they got the wrong guy.....

Saturday on Slashdot seems to bring out an even higher proportion of anti-government conspiracy theorists than usual (I'm using your post as an example, but there are dozens of others in the thread below this). Sometimes I wonder how many of the posters here actually are script kiddies themselves.

The fact is this guy confessed. And not only did he confess, he apparently provided great detail on various worms that he's created. They also found the source code on his PC. That seems like pretty compelling evidence to back up his confession.

I was surprised to read he's only eligible for 5 years in prison. My wife joked "well, he'll get a free dorm room for college". I'm sorry, but this is not a deterrent, which is the point of having criminal penalties in the first place. From the news article, it sounds like he's clearly not very scared. They need to extradite him somewhere where he can really be forced to pay the price for the damage he's caused.

Everybody here should support throwing the book at guys like this. This is the internet we're talking about here, and worms like sasser at best make it harder to use, at worst can take down corporate networks (which sasser did) and even 911 systems, defense networks, hospital networks, etc.

Re:they caught him too soon

[red floyd]

If you're homeless, your stuff gets stolen all the frickin' time. See how much the police care about tracking down the guy who stole it in *that* case. But a mansion in Beverly Hills with 24-hour armed response, noise- and motion-sensitive lighting and alarms, and guard dogs... sure they want to find out who did it, because that guy is *really* dangerous.

<TINFOIL-HAT>
No, the police want to find out who did it, because the BH guy happens to play golf with the Mayor, who pressures the Chief of Police to "catch the bastards who did this". Has nothing to do with the percieved danger of the burglar.
</TINFOIL-HAT>

Re:they caught him too soon

[fugas]

Looks like the informants who lead to his arrest will still get a reward...

Re:they caught him too soon

[Kickstart70]

The point there is that backups should be an intrinsic part of any computer experience, for -all- people using them. I think that this might be the direction M$ will go, making sure that if they can't block all the bad things that can happen to their product, at least they can easily recover from them.

If I had money at all (I don't) I'd be investigating in networkable backup storage device manufacturers.

Re:they caught him too soon

[sirsnork]

Having your data destroyed by a virus is no different than having it destroyed by a faulty HDD. HDD's have moving parts and therefore _SHOULD_ be expected to fail. Anyone who doesn't backup something as important as that doesn't deserve their data

Re:they caught him too soon

[ClosedSource]

".. enjoys excercising engineering talent to blow the covers off a sub par OS, which has gotten way too much more credits than what it deserves"

I'm sure the people who have been infected with viruses are grateful to the virus writers for informing them of their opinion on the OS they have chosen in such a positive way.

It's comments like yours the add credibility to the theory that open source advocates are pro-virii when it suits their political agenda.

Re:they caught him too soon

[subVorkian]

Being a victim of these worm attacks is more like having your car keyed. Having your system cracked personally by an individual is more like rape.

Being raped and having your system cracked are the same thing? Rape leave scars and mental anguish that remain for your *entire* life.

The effect of having your system cracked will last until you re-install your OS.

You are a fuck-tard.

Re:they caught him too soon

[JamieF]

>It's the risk-vs.-reward ratio. If you want to make it less attractive, the first thing to do is make it *harder*. When stealing someone's belongings doesn't require any breaking, just entering, it is more likely to happen.

And when it gets really easy to do, people do it so frequently and with so little consequence that they start to argue that it isn't really illegal anyway, or they blame the victim, or try and find some other way of rationalizing the crime.

Re:they caught him too soon

[tiger99]

Well said, and I think the mandatory sentence should always be life imprisonment, because the damage far eexceeds any other crime, being on a worldwide scale, and as you say, puts people's life at risk, eg, the UK Coastguard.

But, it should also be a criminal offence to connect critical systems to any public network in such a way that they can he hacked, or to use M$ software, with all its unnecessary security risks, on such systems.

I was horrified to learn the other day that banks are using Win XP in ATM machines, it is totally inappropriate. Such a thing needs only a small embedded microcontroller with no real OS as such, in fact the more removed from mainstream PCs that the thing is, the less likely it is to be hacked, especially if it has no capability to be reprogrammed without access to the hardware from the inside of the bank.

Same with other systems, they might need to get data online but should have no facility to download program code of any sort

Of course almost all of these incidents would be avoided if people dumped IE and Lookout, and used decent browser and email software, and in the case of really critical systems, a secure OS like OpenBSD, instead of Monopoly trash.

Re:they caught him too soon

[TheUnFounded]

Looks like MS is gonna shell out $250K for this one, actually...

Re:they caught him too soon

[(C)0N0(R)]

Some ATMs are using OS/2. Real bank ATMs. Not the 200 pound quickie-mart models. My uncle works for one of the larger ATM service companies (formerly Shields). I was trained on the Diebold and one of the other (NCR maybe) about 12 years ago. These were simple imbedded-chip systems with EPROMS. My current bank has a brand-fuckin-spankin-new ATM with all sorts of bells and whistles, touchscreen, etc. You have to choose 'English' on the touchscreen, then enter PIN on keypad, then back to touchscreen to 'enter'.

Re:they caught him too soon

[flibuste]

but they all use torture....

Re:they caught him too soon

[flibuste]

Responsible, but is this guy really guilty of anything ?
I am not sure but they are many people who benefit from weakness of others (like president Bush) and don't get jailed or fined.

Re:they caught him too soon

[klui]

Before you fly off the deep end (oh well, too late), you should read my last sentence of prior post. As I said, the affect of having your system cracked will be different if your system was just an install w/out any of your personal data files compared to another where you knew the perpetrator had downloaded all your personal documents (financial, personal, love letters, etc.). Unless you have no life (no personal, financial documents) then it probably won't make any difference.

Re:they caught him too soon

[Froug]

There's no Miranda warning or 5th amendment in Germany. Besides, he confessed and the evidence found would have brought a conviction even had he plead not guilty.

Not framed?

[Luguber123]

How can one make sure he was not framed?

Also what international terrorist law is he going to be tortured for?

Re:Not framed?

[rduke15]

Also what international terrorist law is he going to be tortured for?

I hope that they don't do this sort of thing in Germany. But I wouldn't bet on it. Military and police have a tendency to be the same sort of people in all countries.

Re:Not framed?

[JaxWeb]

He admitted it:

"An 18-year-old German high school student has admitted creating the Sasser internet worm, police say." (From the BBC)

It's true that people often do admit to crimes they didn't commit, however I doubt somebody would pretend to write a virus to be 'cool'. Especially not an 18 year old (Maybe a 13 year old would, however).

Re:Not framed?

[tgrasl]

According to the yahoo article, he has admitted that he wrote the worm.

Since the German police (I hope) is not into forcing such admissions, it would seem fair to assume that he is indeed the author

By the way, the article claims he is also responsible for the Netsky.ca worm which was released into the wild recently.

Re:Not framed?

[frost22]

given the dubious record of the poilce to even understand such confessions I tend to hold judgement for now.

Maybe he only wrote a variant - according to the articles he also admitted doing a netsky variant.

As for punishment, if the charges proves to be reasonable, expect him to be tried in juvenile court.

Re:Not framed?

[rduke15]

Forgot to add: it's the politicians role to keep the military and the police under control, and make sure they behave. Unfortunately, politicians mostly also tend to be the same sort of people in all countries...

Re:Not framed?

[Luguber123]

politicians mostly also tend to be the same sort of people in all countries...

Pretty much what begged the question :)

Re:Not framed?

[zazzel]

Obviously, you don't know much about the german judicial system, nor about our police.

The boy is already back at home (no risk of escape) until he'll be tried. He'll probably get probation, at most. He'll MOST probably be tries under juvenile laws, which have the overruling goal of "educating" young people.

However, he'll be held responsible for the financial damages he's done.

Re:Not framed?

[Luguber123]

Considering his age I think he should go free and get a medal for highlighting a potentially more dangerous security hole, just like RTM.

Re:Not framed?

[TykeClone]

However, he'll be held responsible for the financial damages he's done.

Will he be extradited to other countries to stand trial for damages done elsewhere?

Re:Not framed?

[rduke15]

I know. And I believe that's more or less how it should be. I was making a disillusioned reply to the sarcastic remark "Also what international terrorist law is he going to be tortured for?".

But if he is 18, I guess he wouldn't be tried under juvenile laws. Whether he will get probation or not will be up to judge(s). And it may be a bit early for us to decide what he would deserve :-)

Re:Not framed?

[zazzel]

To answer two posts in one:

- he cannot be extradited. The German constitution forbids that.
- juvenile laws *can* be applied for ages 18-21 (and very often are), and they have to be applied below.

My guess: juvenile law, probation and probably several 100 hours of social service. And financial damages, of course.

Anyways, shouldn't Microsoft be in his place?

Re:Not framed?

[Guppy06]

No one who speaks German can be an evil man!

Re:Not framed?

[Sique]

A german court can't award financial damage during a criminal process. If you want to claim financial damage, then you have to enter the trial as a "Nebenklaeger" (secondary plaintiff) and prove that you were financially damaged by the actions of the defendant.

I guess most people will be afraid to fully disclose in court how their IT management works and how their other business processes run to prove the amount of money they have lost due to Sasser.

Re:Not framed?

[SmackCrackandPot]

According to a quick translation of the website, he could face up to five years imprisonment. But it looks like he write anti-virus software first.

18-More year-old stood programming of the internet-worm Sasser

Hanover red castle (dpa) - a 18 year of old students out of lower Saxony brought the internet-worm raging worldwide Sasser in circulation. The young man out of the little village Waffensen in the circle red castle/Wümme in Bremen had stood the programming of the worm, said the speaker of the Landeskriminalamtes (LKA) lower Saxony, Detlef Ehrike, in Hanover on Saturday. On the day before officials had searches the parental home of the 18-year-old and evidence, under that a PC and an amount of CDS, certainly placed. After its interrogation, the occupation fold student came again on free foot.

Sasser had spread itself for the 30 April in rapid speed and infects worldwide million computer of private persons and business. It used a space in Microsoft it operating systems Windows Xp and 2000.

We determine because of computer-sabotage, said Ehrike. On that punishments would stand up to five years custody. In this dimension, let the investigative procedure in Germany be previously unique. The youth had stood, had written Sasser even and to have brought in circulation. The investigators found also the so named source code of the virus, the text written in a programming language of the program on the PC of the 18-year-old. After the present situation is to be reckoned with an accusation, said the leader of the district attorney's office Verden, Helmut Trentmann.

The decisive reference to the author of the worm had come of Microsoft. The firm would have type received on their part one, said speaker Sascha Hanke. A call reached us of persons, who purported to know the identity of the culprit, said he. The tipsters could reckon now with a reward. To the fight of viruses-attacks, Microsoft put on a 5-Millionen-Dollar program.

A real damage in the actual sense did not emerge to be sure. For example no files were destroyed, declared the speaker of the federal bureau to be security in the information technology (BSI), Michael Dickopf. After information of the LKA, about the US-airline Delta airline had to paint however previous weekend all flights. At the European commission, 1200 PC-systems fell out.

The occupation fold student indicated, he had written before Sasser also already Anti-viruses-programs. End the Anti-virus Netsky it had developed then Sasser. The accused said had underestimated, it the actual measurement the damage, said senior state prosecutor Trentmann. The youth designated itself as passionate hobby-programmer.

At the search for the Sasser-Schöpfer, also the US authorities security authorities were involved FBI and CIA. One had assumed the "Sasser" author not until the USA, later in Russia then, said BSI-speaker Dickopf.

The German authorities another second viruses programmer went at the weekend into the network: in Baden-Württemberg was arrested has a 21- more year-old, was programmed has that after characteristic statements together with other hackers in lower Saxony, Hamburg and Bavaria the Trojaner Agobot, renamed became that later in Phatbot. Presently there are however no criteria for a direct connection between the bathing-Württemberger and the Sasser-Programmierer, announced the district attorney's office Waldshut-Tiengen on Saturday.

Worldwide circulate according to the Karlsruhe viruses experts Christoph fisherman round 75 000 computer-viruses. Sasser an already well known technology had transferred differently and had exploited a well known weakness, said fisherman.

Re:Not framed?

[hhnerkopfabbeisser]

- juvenile laws *can* be applied for ages 18-21

18-21 is the transition period for juvenile laws.

Furthermore, since many of the charges against him date back some time to when he was still 17, juvenile law will definately be applied for those.

Re:Not framed?

[Cromac]

The boy is already back at home (no risk of escape) until he'll be tried.

Why is there no risk of escape? Does the German government control the locks on everyones doors, or have the posted guards around the guys house?

And don't say it's because your society is so well ordered that no one would try to escape, he's already shown that he's a criminal with no regard for laws or other people.

Re:Not framed?

[sverrehu]

Sounds almost like Robert Morris jr. from back in those days when the US was still a reasonable country. I'm sure Mr. Morris took out a far bigger fraction of the Internet than Mr. German did. No death penalty for that stuff back in good ol' 88.

Re:Not framed?

[garwain]

Where do I send my bill for the time I've spent looking at my log files, and reporting infected computers to their ISPs?

He was just helping his mother

[Anonymous Coward]

http://www.channelnewsasia.com/stories/afp_world/v iew/83848/1/.html

The motives of the alleged Sasser author were still unclear, but Der Spiegel suggested the teen may have wanted to drum up business for his mother, who owns a company offering assistance to computer owners.

Re:He was just helping his mother

[Zocalo]

Well, if he gets sent to jail at least she should know how to bake him a CD with a file on it.

Re:He was just helping his mother

[Halfbaked Plan]

CDs are Roasted, not baked.

Re:He was just helping his mother

[Sweetshark]

You are right, but the link is wrong:
CDs are Roasted, not baked.

Re:He was just helping his mother

[MrHanky]

Thanks. Now I have Tuborg in my nostrils.

Re:He was just helping his mother

[anticypher]

Ok, you owe me a new keyboard. At least the screen wiped clean.

the AC

This one caught me completely by surprise, since there is rarely any really sophisticated humour on /.

Re:He was just helping his mother

[Megor1]

Actually he was helping everyone that the worm infected.

Every single person who was infected with this worm will now be
A) Off the internet due to crashing
or
B) Have patched their system and removed the worm.

Instead of having millions of computers with an easy to exploit bug for kiddies to take over and use in bot nets, or for spammers to use they are now "fixed" one way or another.

Re:He was just helping his mother

[cheesy9999]

Sounds like the fire fighter woman who started those forrest fires a few years ago so she could go fight them...

Re:He was just helping his mother

[CowboyNick]

Um no, typical broken window fallacy...

phatbot authors busted too

[taran9000]

they were also arrested on Friday.

Re:phatbot authors busted too

[Anonymous Coward]

This will demonstrate the power of Open Source. The Phatbot source code is public, so it will be modified and used long after its original author has been thrown into jail.

Re:phatbot authors busted too

[Anonymous Coward]

it's only in german:

http://www.heise.de/newsticker/meldung/47209

While the sasser author comes from the northern part of Germany at least one of the phatbot writers is from the southern part of Germany. They don't seem to have any direct connection.

cb

Re:phatbot authors busted too

[Vlad_the_Inhaler]

Loerrach (where that article says the Agobot/Phatbot author comes from) is on the German/Swiss border and around 10 miles from the French border. The programmer was also apparently part of a group - others helped him write it.

Loerrach is about as far as you can get from the village the Sasser author came from and still be in Germany.

US authorities helped the German police in both cases.

Re:phatbot authors busted too

[nyseal]

Except the internet....

Re:phatbot authors busted too

[0x0d0a]

US authorities helped the German police in both cases.

In other news, crackers continue to use unencrypted communication between each other on untrusted IRC servers. Guess what? The Fed isn't stupid.

It's like watching people use cell phones for years to transfer incriminating messages to each other.

Re:MS

[RGautier]

This is such a troll. There were worms that took down the Internet long before Bill Gates even knew wtf TCP/IP was. The sendmail worm didn't need Windows to effectively shut down most communications on the ARPANET, and Morris didn't use VBSCRIPT to write the worm.
Bottom line is that irresponsible writing of worms and viruses is a crime of indiscrimination and chaos, and deserves to be punished as such.

Articles in English

[metlin]

Here is Reuter's take on this and the news release at Biz Ink.

Re:Articles in English

[Zocalo]

And a few more at The BBC, Sky News, CNN... None of them have a great deal of detail yet though, nor is there any mention of the connection between Sasser and Skynet alledged in the code of one of the varients.

Re:Articles in English

[Pike65]

None of them have a great deal of detail yet though, nor is there any mention of the connection between Sasser and Skynet alledged in the code of one of the varients.

Skynet was involved?!

Shit - it's only a matter of time before Terminators begin walking the earth. Makes sense that they would leverage a technology as fundamentally evil as malware though.

. . . I can't believe I just said 'leverage'. Someone kill me. Seriously.

Re:Articles in English

[Pike65]

Good god, man.

No need to go that far . . .

Re:Articles in English

[Drooling Iguana]

Of course. After all, Skynet was originall activated to combat a computer virus. Haven't you seen Terminator 3?

I'm kinda curious

[defile39]

How did they find this guy? Was it that he was bragging like in the former MS worm cases, or was there a "higher technological power" involved?

Re:I'm kinda curious

[mfh]

> How did they find this guy? Was it that he was bragging like in the former MS worm cases, or was there a "higher technological power" involved?

From Reuter: "Spokesman Frank Federau for Lower Saxony police said the man was arrested on Friday. He did not have the name of the suspect but said he was a schoolboy who lived with his parents near the central German town of Rotenburg.

"He is the programmer of the first version of the worm," said Federau. He said he did not have any details of how the suspect was found.

Police did not know if the suspect had also created other versions of the worm. They took all the teenager's computers from his parents' house, Federau said.

"He is still free. He is not in custody. There will now be a court case," he added."

Re:I'm kinda curious

[Dark Paladin]

If you read the book "The Hacker Crackdown" (free at peanutpress.com), you'll find the FBI know that once they catch most crackers, they can't get them to shut the hell up afterwards.

I think most of it is "bragging rights". Which is why you notice the most successful psychopaths in history are the quiet ones....

Re:MS

[mumblestheclown]

Score: Pandering Karma Whore -5

does anyone...

[Lxy]

find it ironic that an ad for Microsoft security services accompanies this story?

Re:does anyone...

[rokzy]

no, I find it surprising that there are people on /. who still see ads and expect other people to see ads too.

Re:does anyone...

[Halfbaked Plan]

A lot of us block all display of graphics from images.slashdot.org and do without all the pithy little bitmaps. It works pretty good.

I'm not sure I could endure a world without Mozilla any longer.

Re:does anyone...

[mt v2.7]

>>Linux: Telling Microsoft where to go since 1991

lol.. you can get an MS burn and a Linux promo from ANY article can't you.

Re:does anyone...

[roman_mir]

What are these 'ads' are you talking about?

As a side-note: I also heard of such things as 'pop ups' and 'pop unders', are these some sort of rare pecularities that make the net life so much more interesting? I believe one has to have use a superior MS technology to run accross those things.

Re:does anyone...

[nastro]

You're right. Ads on the internet are truly the fnords of the immanentized eschaton. Now I must fashion a new tin foil hat, for the last one was needed to bake a potato on the grill. Adieu!

Re:does anyone...

[0x0d0a]

Suggested software to avoid being an advertisement-reading whore:

* Firefox. FOSS. Good at blocking popups. Can accept cookies only from the website issuing a page (good for thwarting DoubleClick and friends). Can allow only session cookies.

* Privoxy. FOSS. A superset of much of Firefox's functionality. Allows powerful control over ad-blocking, including blocking based on image size, regexes, allowing only session cookies, can have exclusion regexes, can be disabled per-site or temporarily, tells you why and when it blocks something. Can chain to another proxy. A continuation of Junkbuster. If you use a web browser, you should also use Privoxy -- it's the first worthwhile end-user proxy I know of.

* SpamAssassin. The best there is when it comes to FOSS spam blocking. Supports just about every mechanism under the sun. Unfortunately, a pain in the ass to set up for Windows use -- phenomenal on *IX, though.

* ClamAV. Not really for blocking ads, but the other half of the FOSS SpamAssassin/ClamAV formula for eliminating junk from your inbox.

* GPG. FOSS and a nice piece of software. If you get signed emails from your buddies (and there's no reason for at least *you* not to use GPG if you're using a mail client with good PGP support like Thunderbird or mutt, since it lets you sign your emails and let your buddies ensure that they aren't getting forged emails, besides advertising the fact that they can send encrypted email to you), you can mark something as definitely not spam.

Re:does anyone...

[dave1212]

Who is this 'us' you speak of?

Re:does anyone...

[juhaz]

* Firefox. FOSS. Good at blocking popups. Can accept cookies only from the website issuing a page (good for thwarting DoubleClick and friends). Can allow only session cookies.

• Adblock. FOSS. Another superset of Mozilla functionality (optional regexes, can block flash and other embed/object tagged nuisances), without being overkill Privoxy is in most cases. Also much better integrated into the browser.

Re:does anyone...

[Halfbaked Plan]

I remember the kids in school who got a star after their name.

Shouldn't you be ordering something from that big ThinkGeek banner right now?

Re:MS

[FAT_VIRGIN]

Testing? What's that? If it compiles, it is good, if it boots up, it is perfect. -- Linus Torvalds

Can we arrest Linus, too?

Easy enough

[Dark Lord Seth]

IF that person is found to be guilty ( Remember kids, innocent until proven guilty! ) than that person wil be solely held responsible for all damages Sasser has caused, is causing and will cause in the future.

Re:Easy enough

[Tango42]

Are you an expert on German law?

Re:Easy enough

[Tango42]

Strange how you posted your first message logged in and the second as AC... If I didn't know better I might think you weren't actually the same person...

Re:Easy enough

[kunudo]

It's MS' fault for writing exploitable code. Sure, noone's perfect, but they should strive to be, and pay the price when they fail at it, instead of some random german kid who knew how to do stuff with their bugs. He should go jail, but not be financially responsible.

Re:Easy enough

[Tango42]

Confirming something you said in a previous post is something you have to put your name to for it to mean anything, and it wasn't at all offtopic at the time. Someone has been arrested in germany, how can german law not be relevent?

Re:Easy enough

[canadianjoe]

Not exactly. If I leave my front door unlocked, and someone comes in and takes all my stuff, it's still break and enter/theft.

Re:Easy enough

[kunudo]

Yes, but this is you making a decision to leave your door open, for yourself, you're not providing houses with open doors to people for money, are you? Microsoft is making that decision for 80-90% of the worlds computer users. They should be accountable for their product, just like every other business/industry is.

Re:Easy enough

[mattyrobinson69]

in the UK, if somebody walks through an unlocked door or even climb through an open bathroom window they can only get done for tresspassing - not breaking and entering.

Re:Easy enough

[Zathras26]

Remember kids, innocent until proven guilty!

Which brings up an interesting point. Presumption of innocence, lest we forget, is an American concept -- is it also supported in Germany? (That's not a rhetorical question or a troll, I really don't know and am curious.)

Liability

[madaxe42]

How, exactly, is he any more liable than the millions who run insecure, unpatched machines? It is the end user's responsibility to keep their machines secure. If you leave the doors to your house open, and a large neon sign over the threshold saying 'WELCOME', you'll be *damned* lucky if your insurer would pay up. If he hadn't exploited it, someone else would have, and the result would have been the same.
The reponsibility lies with microsoft, for creating shite software, with inherent vulnerabilities, and with the users, for not bothering to have any kind of protection.

Re:Liability

[panamahank]

"How, exactly, is he any more liable than the millions who run insecure, unpatched machines? "

Indeed, and how exactly is Microsoft, who sell shit sandwiches at ham/cheese/dijon prices any less liable, than the virus writer?

Re:Liability

[cms108]

if i go out onto a motorway... and throw a bag of nails on to the road, into the path of cars traveling at 80mph, how am i any more liable for the resulting carnage than the millions who run insecure rubber tyres?
the responsibility lies with vehicle manufacturers for not fitting tyres with kevlar inserts in the side walls as standard; and with motorists for not fitting them themselves.

Re:Liability

[foidulus]

Yeah, but even if you leave your house unlocked it is still a crime. If it weren't, any criminal could grab your wallet saying that since it wasn't pad-locked down to your chest, it's his. Or could kill someone and claim it was his fault for not carrying a loaded weapon and constantly surveying all around.
People lock their doors because they realize there is a threat, if they don't realize there is a threat, they lose stuff, but it is still criminal. Hopefully after the 5th time someone gets their house broken into they will realize that they need a lock, same goes with computers.
I'm no microsoft fanboy(I don't even use windows), but blaming them is like blaming a car manufacturer because your car got totaled when some jackass rear-ended you. You should have done your homework before you bought the car, and that still does not absolve the jackass.

Re:Liability

[v01d]

If you leave the doors to your house open, and a large neon sign over the threshold saying 'WELCOME', you'll be *damned* lucky if your insurer would pay up.

This is more like just leaving your doors unlocked. There is no protocol for a system to advertise it's vulnerabilities.

Without regard to whether your doors were locked it is illegal to steal things from your house.

Re:Liability

[madaxe42]

Unless, of course, you just type something along the lines of 'doscan -A 50 -b 512 -c 100 -i -p 5554 -P tcp -r "200 OK$" -v 217.43.0.0/16'

Re:Liability

[rokzy]

tires are not designed to run over multiple nails at high speed, Windows *is* designed to access the internet, handle email etc.

Re:Liability

[Tango42]

Microsoft and the end users are in the wrong due to not doing something, the virus writers are in the wrong due to doing something - that is the difference.

Your insurer might not pay up but the police will still arrest the guy for theft, criminal damage, or whatever it is he did while inside. The only difference is that he won't be done for breaking and entering.

NB: IANAL

Re:Liability

[tanguyr]

How, exactly, is he any more liable than the millions who run insecure, unpatched machines?
That's ridiculous - people who don't wear bullet proof vests aren't "as liable" as the people who shoot them.

If you leave the doors to your house open, and a large neon sign over the threshold saying 'WELCOME', you'll be *damned* lucky if your insurer would pay up.
No, but you could press charges for burglary if somebody came into your house and stole something. Insurance is a matter of commercial contracts - we're talking about the law here.

If he hadn't exploited it, someone else would have, and the result would have been the same.
No, if someone else had exploited it, then the gentleman under discussion here most probably wouldn't be in police custody facing criminal charges right now.

The reponsibility lies with microsoft, for creating shite software, with inherent vulnerabilities, and with the users, for not bothering to have any kind of protection.
What kind of a world do you live in where the people who write and send out a virus are not liable for the damage it causes?

Re:Liability

[Ghorin]

Even if windows is very bad about security and even if many people don't apply security patch, still nobody has any right to go into other's computers. Thus the man hwo created sasser is responsible for all damage.

Re:Liability

[mumblestheclown]

If you leave the doors to your house open and a large neon sign over the threshold saying 'welcome'.

Actually, those are two completely separate issues.

Let's say you left your house and left your door unlocked. If a thief happened by, saw that it was unlocked, and came in and stole all of your belongings, the law in every jurisdiction that I know of is unequivocal: the thief is solely to blame.

On the other hand, if you put up a sign that said "welcome", then that could be construed as an explicit invitation to enter and the corresponding legal judgement would be less clear. You may recall cases way back when when some FTP sites said "Welcome To Private FTP site! Username: Password: ".. well.. some were broken into using brute force un pw attacks. The attackers were subsequently found and based their (largely successful) defense on the fact that it said "welcome!"

Now, about the rest of your point: about people being liable and microsoft being liable; basically, it's wishful thinking from you, who knows nothing. I dare you to build me a house that can not be broken into. It is NOT possible. the windows OS has arguably hundreds of thousands of parts and interfaces and it is not reasonable to expect that every aspect has been checked for every possible potential flaw. I remind you that but a few weeks ago, a new flaw was found in TCPIP, arguably one of the most "eyeballed" standards in the history of computing.

every window in your house can be broken, and a thief can enter by breaking it. the lock on your front door can be opened with a jimmy tool, your electric garage door opener signal can be captured and copied. your hidden key under the bushes can be found. your chimney may be a more or less perpetually open entrance, and yet nobody blames house builders or even home owners of gross negligence in such cases.

the fact is that in a society we recognize the inherent limits of any sort of physical protection. as many on slashdot here have observerd in other contexts (DRM), "if it can be broken, it will be" and "there are no unbreakable protection schemes."

Therefore, we must resort to law and the threat of punishment. It's not perfect, but it's what we have to do.

Re:Liability

[madaxe42]

If you leave your computer unpatched, with access available externally, with nothing informing any potential user of your computer not to use it, the person entering your computer has every right to do so. That, unfortunately, is the way it is. Also, if microsoft wish to take credit for the security of their software, and take credit for their software, they should also be inherently responsible for its flaws. N.B. IAAL

Re:Liability

[Rolo Tomasi]

This comparison is misleading. You can't physically hurt people through computers. In fact, the damage caused is rather hard to assess ... most is just a few hours of peoples' time. Now, you could sum up all the work hours and arrive at a huge amount, but then what about the other things that steal workers' time, like rebooting the OS, messing around with driver problems or application bugs that cause work to be lost? The software vendors aren't held responsible for these.

Re:Liability

[Rolo Tomasi]

There's still a difference: if the door is unlocked, it's trespassing, if it is locked it's burglary. Quite a difference in the amount of punishment I would imagine.

Re:Liability

[TykeClone]

I would say that in many cases the damage is easy to assess. I've cleaned off about 4 machines this week at an avarage cost of $50.

More importantly, didn't some big companies get their networks essentially shut down by this thing? If so, I'm sure that they have a pretty good idea about what it cost them.

Re:Liability

[Sancho]

Actually, in many states, it's still considered burglary if you are there for the purpose of theft/murder/whatever. I believe in Texas, you can be charged and convicted with breaking and entering for such an act, even if the door is unlocked.

Re:Liability

[varmit poontang]

If someone sets fire to a house. Are they not responsible for it burning down, whether or not it has sprinkler system or not. This tried to set a fire to all the computers in the world that didn't have their patches yet or sprinklers on. Its a simple thought. He set the fire, it destroyed the city, he is liable for what he has done. I'm just getting pissed that the virus writers are turning out to be teenagers. I mean, come on, go out on dates, go to the movies, play sports or something, why the hell are they staying home and doing this crap. And Microsoft, just start having your patches work, I'm sick of the patch for the patch for the patch because you couldn't get it right the first time.

Re:Liability

[cms108]

ummm... you've kind of missed the point.
the technology exists to make cars that can run over nails. just as the technology exists to make an operating system that is resistant to attacks. technology exists that will stop you from getting shot or stabbed in the chest. technology exists that will stop an icbm from hitting the country you live in.
whether "windows *is* designed to access the internet..." is true or not doesn't matter... they've clearly failed in this attempt at design, but the outcome is the same as if they hadn't bothered. microsoft makes no warranty for windows being free of remote exploits. just as tyre manufacturers make no warranty for their tyres being able to run over nails.
just because there is a (potentially simple) way of preventing someone doing something nasty to you, your failure to implement this method does not make you liable for their actions when they do it.
in an ideal world, it wouldn't matter that windows is full of holes... because nobody would be going round trying to cause other people hassle just for the fun of it. but hey.
ooh look... windows has just downloaded another critial update. great.

Re:Liability

[cyxs]

well its kindof funny. If a lock maker made a lock that was easy to bypass and sold them, if the criminals started to look for that lock and use the bypass method to break into the house, i think that we would have a class action lawsuit on our hands against the lock maker, sure you should have had more then one lock but its still partly the lock markers fault.

Re:Liability

[gvc]

Suppose the "few hours time" is lost to the Coast Guard in the middle of a search-and-rescue mission?

Re:Liability

[Vlad_the_Inhaler]

Two unrelated points here:

• A couple of friends of mine are thinking of 'upgrading' from Win95 to WinXP. Both have good reasons for the upgrade - USB support, other SW support, whatever - and both have V.90 modems.
  Yup, neither uses the net much and sees any reason to upgrade to DSL which is the only alternative here.
  Now tell me how they are supposed to download the M$ patches necessary.
  Professional sysadmins have fast net access and have to find the time to routinely download patches. These ladies are not fools but they have a real problem here.
• The other point is that the kid has already admitted the offence, and sufficient proof was found on his PC to convict him anyway.
  At a guess, he is looking at a suspended sentence + compensation claims which will bankrupt both him and his family (even though he is 18, his parents are still liable).

Re:Liability

[Sancho]

You are a lawyer? Interesting. How'd you miss the
Computer Fraud and Abuse act, then?

I believe that this is the law that most virus writers are prosecuted under. I don't see anything explicitly saying that you have to notify anyone that they can't use the computer--in fact, that it says "accessed a computer without authorization" indicates that authorization is required, and that lack of authorization is not implied consent.
Now obviously you could say that accessing any webpage is usually without authorization. I do believe there to be implied authorization when someone intentionally opens up port 80, for example. However once you begin requiring a login and password, attempting to circumvent that also violates this law due to "exceeding authorized access".
Most people didn't open up the port that this worm uses. Most of them didn't know it was open. Most of them probably couldn't have closed it to save their lives. And precedent goes a long way towards establishing that virus writers who abuse such holes are, indeed, liable.

It's quite likely that there are other laws covering similar material.

Re:Liability

[cms108]

of course you can pysically hurt people through computers. this very worm took out the computers that controlled a hospitals CT/MRI scanners...
i'd be really unhappy if i'd just been rushed to hospital with a brain aneurysm only to be told... "sorry, we can't scan your brain right now... we're just waiting for windows to finish installing, but the little green progress bar says there's only an estimated 45 mins remaining; so it shouldn't be too long now"
in this case, however, there probably is something to be said about the stupidity of people who use unpatched, networked, windows machines in potentially safety critical environments. got to be verging on criminal negligence.... if not criminal stupidity.

Re:Liability

[DrEldarion]

You really blew your analogy with the "welcome" sign bit, unless the computers in question actively send out "Hey, I'm not patched!" packets.

Either way, though, you're still wrong. What you're saying is basically the equivalent of a rapist saying, "She was wearing provocative clothing! She was just asking for it! It's her fault!"

Re:Liability

[Ghorin]

No, if a PRIVATE computer has no lock on it, you still have no right to enter in it unless his proprietary accepts. Don't forget the notion of PRIVATE PROPERTY, this is one of the most important of our lives. My home is mine and the law deny anybody unauthorized to enter inside. It's the same with a private computer.

Re:Liability

[noda132]

This is more like just leaving your doors unlocked. There is no protocol for a system to advertise it's vulnerabilities.

Yes there is -- TCP/IP. Leaving certain ports open is just begging for trouble. For example, Netbios (port 137-139) or CIFS (port 445).

Basically, grep -i microsoft /etc/services; if any of those ports are open on your network, you are advertising not only your vulnerabilities, but your complete lack of care about them.

Re:Liability

[Jeff DeMaagd]

Vandalism is still a crime, regardless of whether it is a locked residence, unlocked residence or a retailer open for business.

Absolving a virus writer of crime is like blaming a rape victim for wearing skimpy clothes and looking pretty (or whory). Just because some people think the target is "asking for it" doesn't absolve the criminal.

Re:Liability

[Holi]

No It is burgalry only if you actually take something. Otherwise it is either trespassing or breaking and entering but this is getting way off topic.

But what the hell karma be damned.

Re:Liability

[Ghorin]

That's right but in Germany (where the virus maker was found) and in France (where I live) and still in most countries, private property is propected by mny laws.

Re:Liability

[amembleton]

Microsoft don't provide any guarantees or suggestions that their software is secure. A lock is solely for security.

Perhaps it would be better to ask if a house-maker didn't add locks to the houses they sold, should that house-maker be liable? And, should the owners of houses built by this house-maker add locks to them?

Re:Liability

[amembleton]

"purlywrong" WTF is that s'posed to mean?

Using my brain I have worked out that he was meaning 'surely wrong'.

Re:Liability

[LiquidCoooled]

If your friends are having trouble, then you could be nice and burn all the patches for them so that they catch up.

After that, trickling downloads makes it possible to stay upto date.

I agree the initial problem makes it difficult to consider upgrading, but it shouldnt prevent them.

Of course, the other issues may be the computer hardware they currently own.

An alternative method for updating was to include them on magazine cover disks - indeed this is how I used to update, and choosing the correct magazine could also teach them new skills.

I believe however that Microsoft stopped allowing magazines from including every patch/service pack, but my information on this is sketchy, since by the time I read about it, I had cable and had stopped purchasing magazines.

Re:Liability

[Kent Recal]

Windows *is* designed to access the internet, handle email etc.

Oh? I'm more under the impression that windows was designed to be accessed by the internet...

Re:Liability

[Sunda666]

Dude, one gets tired of hearing this BS about "Billions of Dollars Worth of Damages". This is utter crap.
I say fuck these companies, fuck the users who got their boxes busted. Viruses, worms and the like are
all part of the "Microsoft Experience", if not part of the whole "Computer Experience". If you are serious
about using computers as a vital part of your business and don't want to get screwed by a random 18 year
old german guy, you must:

1) have a decent hardware/software/network infrastructure (and NO, NO DECENT FUCKING INFRASTRUCUTRE
have MicroSoft software in it, nor has peee-cees that the user can fiddle with, like Bill Gates
wants us to have) Think old maiframe nets. Those were insanely secure, but expensive. But with todays
tech it is possible to build a similar infrastructure for dirt cheap;

2) have COMPETENT people (not MSCE-like our LSB-Cert-Like drones) to admininister said infrastructure.

Every time someone brings this point up I say : A good computing infrastructure is one whose users have
NO privileged access to their stations (actually, they have no "personal stations", everything is in
central servers, the stations are more like dumb terminals), the allowed software is the bare mininum
people need to do their work (eg, no video/audio codecs for the secretary, just word processor and
maybe a spreadsheet), disk quotas, tight control on the users profiles, etc. This nazi setup is what we
used to have in the early Mainframe and UNIX days, and it worked. I bet serious guys still use these.

Well, what I think is probably wrong, because every friggin company I worked implemented exactly the
opposite... Following advice from MS reps, everything became a bunch of pee-cees with windows, whose
users had administrative privileges to install whatever they wanted on them, and later became a mix
of half-assed-secure (NT, 2k, XP) and insecure (95, 98) boxes... a total mess... I must be really
dumb for not understanding the "One Microsoft Way".

Well if anyone is interested, there are ways to setup a mainframe-like environment using nothing
but free software (linux on the terminals, linux or BSD on the central servers, OpenOffice, PostgreSQL,
maybe Mozilla) some custom software that can be written in Wx...
In the end you will need a staff of 2-3 people to manage a network of hundreds of computers/users ]
(not counting hardware probs,those scale badly with the number of boxes).

Darn I say too much. sorry.

cheers.

Re:Liability

[NotoriousQ]

However, the closer analogy would be that a house upon being robbed will create 50 more robbers which will go rob your neighbors. Who is responsible now?

The car manufacturer analogy still works, as they knowingly sold you the car without appropriate safety features. Do your homework -- yes -- but you can not expect people to know everything about a car or a computer.

Re:Liability

[riscthis]

I believe the Windows Update client (the one that sits in the System Tray, not the web site) just uses the latent bandwidth of the connection to download patches, so the user should not notice it until the patch is ready to be installed.

Aside from that, enable the firewall (or install a third-party firewall of your choice), install one of the free Antivirus packages, disable any unnecessary services and make sure "File & Printer Sharing" and "Client for Microsoft networks" are not enabled for the dial-up connection and things should be fairly secure -- or at least no less so than the current Win95 setup.

Oh, and install SP2 when it's available too.

Re:Liability

[gnu-generation-one]

"Hopefully after the 5th time someone gets their house broken into they will realize that they need a lock, same goes with computers."

Heh right...

Thank goodness PC owners aren't responsible for keeping their houses locked. Oh, wait..

Re:Liability

[mt v2.7]

mo, thats like saying: I'm not responsible for entering your house and stealing stuff because the builder gave you a rusty lock and you never got it fixed.

Re:Liability

[JimDabell]

people who don't wear bullet proof vests aren't "as liable" as the people who shoot them.

That's a terrible analogy. When you get infected by a worm, it's not just your own welfare put at risk, as your computer then goes on to infect potentially thousands of other machines. A person is responsible for their own computer, and if they don't install updates that their vendor lists as critical, and other people get infected by that computer as a result, then it's not like somebody getting gunned down. They are part of the problem, not just an innocent victim. It's like getting shot, and then taking your revenge out by shooting a load of other people in the area yourself.

Re:Liability

[schmedely]

That's the most asinine response I've ever heard. So it's my fault that some idiot wrote a worm that infected my machine(s)? The virii writer is not at fault, it's me and my unpatched computers? Give me a break, you are obviously as big an idiot as the writer. Go back to your day job of playing the ukelele and selling chiclets at the border crossing.

Re:Liability

[Have Blue]

If a terrorist sprays you with anthrax and you infect a bunch of other people while running around in panic, are you a terrorist too?

Re:Liability

[Deadstick]

That's ridiculous - people who don't wear bullet proof vests aren't "as liable" as the people who shoot them.

No, but people who leave guns lying around unsecured can be liable if someone takes them and commits a crime.

rj

Re:Liability

[mumblestheclown]

A lock has one function and about 10 or less pieces. A computer operating system has about severn billion functions and about a million pieces. big difference.

Furthermore, any masterlock can be cracked through the means easily available on the internet (do some google searches). Yet masterlock is not deemed irresponsible. the last two paragraphs of my previous post (parent) to get my point yet again.

Re:Liability

[hymy]

It is easy - though wrong - to use "liability" as a synonym for "blame"...

The only liable person in this case would be the irresponsible, school-going "man", IMHO (but I'm not a lawyer). Objectively speaking, there would be no damages to be held liable for should he not have written and released the worm, as he supposedly did (I still adhere to the presumption of innocence)...
But the worm got released and he seems to be the perpetrator of the crime. So, he would be the only starting point for the "tree of causality". Hence, all liability lies with him.

Blame, however, is a whole other issue.
For each individual incident caused by this particular worm (or any other virus, worm, ... for that matter), there are two people or entities to blame:

• the author of the malicious program/script (for "trespassing and... well... let's call it plain vandalism and reckless endangerment or even manslaughter")
• the party suffering the damages (for "not closing the doors properly")

Common sense - in this society - dictates the use of a set of rigorous safety precautions to protect ourselves, our loved ones and our property. A few things that spring to mind are driver's licenses, medical licenses, gun control, ...
So there is a need to educate people in the use and (others) in the development, maintenance. This encompasses the background knowledge as well as the implied responsability that comes along with it. Clearly this concept has been violated in both directions (cfr. the two directly involved parties).
However, in current context there is another thing to keep in mind: the extended implications of a product. As Henry Ford realized, he had to improve the overall performance, knowledgeability and safety of his cars. More and more people were starting to use his automobiles... Legislation had to follow because the implications of the use of cars grew beyond their initial "size".
There are such things as copyright and patenting for both software and automobiles, but there is no set of laws/guidelines for how software should be made secure, although there are strict regulations regarding car safety.
There seem to be two differences between these contexts (but they may well be related):

1. everyone (now) recognizes the dangers inherent to driving motorized vehicles, as opposed to the ignorance of the majority of the computer users
2. Henry had much less leeway than Bill does, because of the difference in market share, cash flow, ... I presume

So, to remedy this disease we need to stop reacting from a viewpoint of "symptom treatment", i.e. hopping from one virus/worm disaster to the next, pointing the finger, happily jailing only the exploiters, while frantically wasting our time trying to glue the broken Window$ (and programs and OS alike)...
We keep naively giving our money to immense companies, too profit-driven and inert to handle the problems at hand. We do try though to confront the source of the problem, but it easily buys its way out of trouble (the mighty Dollar and Euro, you know)...

My conclusion: these events will keep occuring over and over again, until there is an overall change in mentality.

Knowledge to the people!
Oppose the (irresponsible) giants with all your might!

Re:Liability

[10101001 10101001]

>>If you leave the doors to your house open, and a large neon sign over the threshold saying 'WELCOME', you'll be *damned* lucky if your insurer would pay up.

>This is more like just leaving your doors unlocked. There is no protocol for a system to advertise it's vulnerabilities.

No, it's more like your door's lock having a structural defect. And in some cases, (not sure of this one) a web service will happily tell you what version its running which is a nice advertising that the defective lock is present.

>Without regard to whether your doors were locked it is illegal to steal things from your house.

It's not stealing, though. If you walk into a house and drink some water from the faucet or breathe air, you can get in trouble for trespassing and theft of service. And if you pee on the floor, it's vandalism. And if the worm was actually copying things, there'd be copyright infringement (it's actually a good question of if the sasser worm author can sue everyone *else* for copyright infringement). But there's no stealing involved unless the worm actually picked up the computer and carried it out of the place for him to take.

Re:Liability

[bobbabemagnet]

So now, when I install windows, I have to run windows update a few times because sasser keeps forcing my computer to shut down. At one point, I was getting an infection in less than ten seconds. I had to disconnect from the network while it booted, then connect and get the update in less than ten seconds. And thanks, microsoft, for making the fix bigger than a floppy. Welchia infected most of our new installs, too.

You can't be liable if you're robbed when the door isn't even hung yet.

Don't think that the only unpatched machines are unpatched out of ignorance. Getting a worm or virus before you even get a chance to patch the machine is a pain in the a$$.

Re:Liability

[kd5ujz]

This work took out the entire network at UT M.D. Anderson cancer center in Houston. The systems were running windows 2000, and Novel. I know this because I waited for half a day last saturday so that my fiancés insurance could be verified. They cleaned it up on saturday, not sure how long the network was down.

Re:Liability

[Feanturi]

How, exactly, is he any more liable than the millions who run insecure, unpatched machines? It is the end user's responsibility to keep their machines secure. If you leave the doors to your house open, and a large neon sign over the threshold saying 'WELCOME', you'll be *damned* lucky if your insurer would pay up.

But it's not actually like that. In order to 'see' that big neon WELCOME sign the 'passerby' needs to be doing something special, something intentional. Only certain people have the knowledge to make such tools, not just anyone walking down the street has this ability. Sure once the exploit is in the wild it's a different game, but initially there is some serious culpability on the enabler that designed the B&E tool.

Re:Liability

[Nikker]

All that your doing by leaving your doors unlocked is making it _easier_ for someone to commit a crime, it does not make it *less* of a crime, it would also make it difficult for law inforcement to catch the person as less evidence (ie method of break and entering, etc) and it usually involves a person of determination to challenge a locking device rather than turning the knob on your front door.

Re:Liability

[hawkeyeMI]

More like running a crack house, you mean? (no flamebait intended)

Re:Liability

[arkane1234]

Or at the very least pick up a relatively cheap router/firewall they sell at the local CompUSA/Best Buy/Fry's Electronics, and turn firewalling on.

Re:Liability

[Jim Starx]

Well, microsoft does attempt to lock the doors. That attempt was circumvented. That fact that Microsoft designed a bad lock does not change the fact that there was an active attempt to circumvent that lock. He can't really claim that he just stumbled in.

Re:Liability

[Jim Starx]

Theft of system resources??

Re:Liability

[Jim Starx]

I think a better analogy then taking your revenge by shooting people would be the HIV analogy. Once you've got it you could give it to other people. So if someone purposefully gives you HIV, and then your ignorance causes you to spread it to others, who it liable? I think that given the fact that purpose of giving you HIV was so that you would spread it, causes the original culprit to be most liable.

Re:Liability

[krappie]

You're completely right of course..

but you also have to realize, once there are millions of exploitable computers online and it is publicly known that they are exploitable, there is only one thing that'll happen. Worms will come out until one comes out that patches it. There is absolutely no other way it can happen..

Re:Liability

[Jim Starx]

True, but a gun is an obvious danger. Are security patches that obvious? You and I would probably both answer yes, but would your average computer illiterate also answer yes?

Re:Liability

[jwsd]

If you forgot to lock your front door and your house was robbed, who is more liable: you or the robber?
Nobody advertises on the Internet with "Welcome to hack my machine."

Re:Liability

[Jim Starx]

So if my back pocket isn't buttoned a pickpocket has the right to steal my wallet? And all those companies who make jeans without buttons on the back pocket are responcible for my loss? You don't have to inform people not to use your computer, your computer is not a server, it's a client.

Re:Liability

[thebigmacd]

In my city London, Ontario, Canada, if you leave your vehicle running or the keys are the ignition and doors unlocked prior to being stolen, you will be fined more than $100 CDN for wasting taxpayers' time and money on Police investigation by inviting a crime.

Re:Liability

[red floyd]

So could he be nailed on a DMCA violation?

I guess not, since it requires an effective access control mechanism :-)

Re:Liability

[Drooling Iguana]

Actually, it's more like blaming the car company because your gas tank exploded when some jackass rear-ended you. The jackass was still a jackass, but that doesn't mean that the car company didn't build a shoddy product, and it doesn't mean that there shouldn't be consequences for that company.

Re:Liability

[Pantheraleo2k3]

Go to $LOCAL_COMPUTER_STORE and buy yourself an El Cheapo NAT router, preferably sans wireless. Plug it in between your Internet connection and virgin computer. It's not perfect, but it should hold the fort until the updates go through

Come to think of it, these days, being behind your own NAT router is a Good Thing.

Re:Liability

[nutshell42]

I think he should be punished but I also think that there are some victims (e.g. the UK Coast Guard) which really should know better.

Tomorrow the government lays off all prison guards. Of course it's still a crime to escape from prison but the fscking imbeciles in the government are responsible too.

I don't know the whole story but AFAIK the coast guard lost critical systems because they didn't follow basic security policies (use Windows Update to get critical fixes).

It's like blaming that guy who shot the Archduke for WWI. Did he commit murder? Of course he did. 10mio?

Re:Liability

[f0rt0r]

Here's a thought. What if the virus writer writes the virus for educationaly reasons, but doesn't give it to anyone. And later someone finds it and lets it loose, cause damage to a bazillion computers. Who is responsible then?

More links

[rduke15]

Was just about to submit this story. I see my lins are different, so you may find them useful too (they are in English):

An 18 year old has been arrested in Germany, suspect of being the creator of the Sasser worm, as reported by Yahoo news and many others. Sophos believes he may also be the author of Netsky.

Re:More links

[croddy]

I think just about all of us with a desktop RSS reader submitted it.

another story at CNN.com

About time

[Falconpro10k]

granted, im no microsoft lover, but im also kind of against punks like this guy... he has probably cost me almost $500 since this worm started in my PERSONAL services to my friends and family in order to get this all cleared up..

as for ms, they should be considered just as guilty, with such a large corporate juggernaught they have, they should be able to look for these vulnerabalities early, and maybe go through some more extensive testing.. or at the VERY LEAST spend a million or so and tell they public they messed up, and how to fix it... (run windows update) at least this way, you have a educated public... ignornance is NOT strength.

Re:About time

[croddy]

on the bright side, he released it just a little too early... seeing as this is just the time for Windows users to do their yearly Spring Reinstall anyway.

Re:About time

[misterHY]

True, but...

there is no way microsoft is ever going to find all their bugs. Neither will Linux, BSD, or any other OS. This is why we need DIVERSITY. If a bug in one specific OS is having such a big impact, that means there are not enough other OSes installed.

Same principle for sendmail,bind,...: a bug in either one will take lots of Linux boxes AND BSD-boxes AND other unix-based boxes down. We need different versions of these programs, too. They exist today. Only, they are not as popular as sendmail & bind.

One disease can't take out the entire humanity because we are all different. The same should hold for computers.

Re:About time

[Falconpro10k]

im going to agree with you on that point... diveristy could be the next big fix...

Re:About time

[tomstdenis]

What services? My parents run XP and haven't had a virus yet [aside from the occasional spyware thingy they install].

I think if you wanted todo your friends a favour you'd tell them about new-fangled NAT boxes that cost all of 100$ and let them network their home.

Tom

Re:About time

[character sequence]

at the VERY LEAST spend a million or so and tell they public they messed up, and how to fix it... (run windows update)

Yes! Just like a product recall where you return something to have a fault rectified. Your PC misbehaving is not in the same league as kids choking on detachable bits of a toy, but maybe governments should force software providers to better advertise their blunders.

Now for some really dangerous products, check out http://www.recalledproduct.com/

Re:About time

[Falconpro10k]

lets see, i live in a rural area and have to drive everywhere, some of my friends live over 40 miles away, gas is $2.00 a gallon, not to mention vehicular expenses.., so dont consider me a poseur, when you dont know my life.

Re:About time

[KanSer]

You idiot. How hard is it to get your idiot friends to click three buttons and do a fucking auto-update? I'm all for punishing the guy, but a monetary fine is fucking bullshit. This isn't an unlocked door, that analogy blows. It's like running your car without motor oil.

Retarded. Preventable. Oil changes are fucking simple, patching your system is even easier.

How ridiculous is it that they have caused you $500 of work when ten seconds of clicking would set the thing installing.

Also, I think the onus in this case should be on the end-user. Don't talk about burglary. Or motor oil. This is new territory, nothing substantial about cybercrime has been setup, it's such a fledgeling criminal offense.

The internet is a malicious place, you wouldn't walk through Harlem at midnight a scrawny nerd in a nice leather jacket. The Police will still pursue the offender but they're going to think you're RETARDED for walking through such a place.

Set the man free!!!

[bezza]

He got me an afternoon off work!

Re:Set the man free!!!

[siavash_of_stockholm]

At least you have a job, perhaps all thanks to guy like him(?) and you probebly got paid (extra) for working on the weekend.

Was it a big joke / mistake?

[djsmiley]

Anyone else get the feeling that this worm, was either a test, or a big mistake, someone wrote it (most prob this guy) and not beliving that it would work (like T33kid with blaster) set it free, or set it free in a closed network, not relising the effect that it would have? Still, just shows the problems with the world today.

Re:Was it a big joke / mistake?

[Tango42]

It has the feel of a proof on concept to me. It distributes fine, but doesn't actually do anything (the crashing appears to be a bug, and the CPU usage is an unavoidable consequence of the distribution process). I wouldn't be suprised if a version with a payload is released soon.

Re:MS

[keif]

Grow up.

Will he go on trial

[foidulus]

In other countries? He did damage in more than one country, but with the tangled web of extradition treaties etc, how will other countries deal with his arrest? Will they demand justice?
I guess the fact that he was in Germany, a country with a modern justice system and extradition treaties, will help. They have had a hell of a time in the past getting police in places like Russia and the Phillipines to co-operate.
Just another interesting adventure in the globalized, internet-driven world I guess.

Re:Will he go on trial

[Star_Gazer]

Since both Sasser and Phatbot developers are native germans, they will never be extradited. German constitution luckily forbids it. Only foreigns can be extradited to other countries and only if they don't have to fear death penalty and will get a fair trial.

Re:Will he go on trial

[rduke15]

Why would he have to be extradited? If he is guilty, he can be judged in Germany. And one cannot be judged more than once for the same crime.

Re:Will he go on trial

[frost22]

will never be extradited. Constitution luckily forbids it. FWIW, that article got a few exemptions recently for purposes of EU harmonisation. I don't know if they apply here, though,

Re:Will he go on trial

[sweet cunny muffin]

"And one cannot be judged more than once for the same crime."

That's not universal.

Re:Will he go on trial

[rduke15]

That's not universal.

Well, it should be...

Re:Will he go on trial

[Star_Gazer]

Hmmh, you are right. Funny, I was reading this Art. 16 only a few weeks ago from an older (online) copy.

One should regularily download law codes and run diffs on them, I guess :)

Re:Will he go on trial

[gmhowell]

In the US, you most certainly can be tried more than once for the same crime. You get your local trial, a federal civil rights violation trial, then a civil suit or three (even if restitution was part of the criminal trials). Yet another case where the common sense of the US Constitution has been bastardized by lawyers. (Another example being playing games with states of war or lack thereof in attempts to legitimize torture and/or abuse, depending on the situation.)

Phatbot comes from Germany, too

[smk]

See here in german and the google translation. Official say, there is no connection. Well ...

Re:Phatbot comes from Germany, too

[fastgood]

See here in German and the Google translation.

According to the Monty Python fraudulent phrase book you get:
"May I squeeze your buttocks, bouncy, bouncy?"

So, how did he find the exploit?

[Coryoth]

Excellent, hopefully they can ask hima simple question and we can put another argument to rest - Was he aware of the exploit from his own hacking, or being told about it by someone, or did he just read the exploit advisory from Microsoft when they released the patch?

Realistically odds have to favour just reading the advisory, but there have been plenty of claims to the contrary.

The next question is, will any media actually bother to find out and publish the answer to that question. I'm guessing "absolutely no chance in hell".

Jedidiah.

Re:So, how did he find the exploit?

[zeroclip]

AFAIK there was exploit code (aka poc code) out before the sasser worm was created.
He just made the spreading/scanning functions.
And after some more analyzis even the FTP server code was taken form somewhere else.

Two possibilities

[scum-e-bag]

Two possibilities as I see them. First the kid was stupid enough to write and release the worm from his own machine leaving behind traces or was not careful enough hiding his tracks. Second, the kids' machine was hacked and used to hide the real creator of the worm while releasing the worm. I haven't RTA but I think these two conclusions are logical.

Re:Two possibilities

[Richard_at_work]

The first possibility stands, as he has admitted writing and releasing the worm - BBC News article

Re:Two possibilities

[Anonymous Coward]

If that were the case, I don't see why he'd have confessed...

Maybe he was threatened with extradition to America. Everyone's heard about the way they treat prisoners over there.

Re:Two possibilities

[DeepRedux]

Recent report of Torture in German Prisons. It was reported that masked prison guards, in groups of three or four, struck prisoners with their fists and with nightsticks. Some of the victims suffered serious injuries and broken bones.

Re:Two possibilities

[Alomex]

First the kid ..

He's old enough to drive, work, vote, own a gun, go to war and die on the service of his country, and be elected to office.

That makes him a young man, not a kid.

Re:Two possibilities

[Vellmont]

Sorry buddy, but someone who's 18 while not technically a child is still a kid in many peoples eyes.

Referenced Story in Der Spiegel

[RidiculousPie]

The article also referred to Der Spiegel
As reported in Der Spiegel

Ultimate punishment

[m00nun1t]

Make him explain to my mother what a worm is, what he made it, and how to enable a firewall. That'd be punishment enough.

Re:Ultimate punishment

[Tin Foil Hat]

That would be OK so long as he makes sure she really gets it. A simple explanation is not enough, your mom needs to really understand and be able to secure her own network in the future.

If he can do that, I'd consider his debt paid. Then I'd consider hiring him as a consultant.

Re:Ultimate punishment

[dist_morph]

... and why do you hate your mother so much?

Re:Ultimate punishment

[gmhowell]

I guess Germany has no laws against cruel and inhumane punishment?

Cyber-terrorism

[amichalo]

...how will this be transformed into an indictment?

It looks like the Cyber-terrorism laws are used (in the US) primary for this type of "cyber joyrider"

It is all a lie!

[Anonymous Coward]

The Sasser author is an 18 year old man who was arrested on Friday in Rotenburg, Germany.

There is no such thing as an 18 year old man. Only somewhat a slashdot would think such a thing. This is clearly an atempt to get someone to trip up and admit to it. It is a trap people, dont believe it!

Re:It is all a lie!

[Simonetta]

There is no such thing as an 18 year old man.
I must respectfully disagree. The American tendency to prolong the age of childhood until the twenties is deplorable.
Historically people became adults and responsible for their actions at much younger ages then today. In traditional Jewish culture, a boy becomes a man at his bar mitzvah ceremony at about age fourteen. Even until the 1990s, Americans reached the 'age of majority' at eighteen with all the privileges (like drinking a beer) and responsibly of an adult.
Layafette was 19 when became commander of the French forces assisting the American Revolution in the 1780s. I believe that Lewis and Clark were 19 when they started their voyage of discovery in 1803.
Until recently, the entire purpose of children's education was to prepare them for the responsibility of becoming an adult in their mid-teens. Now it's just day-care for teenagers who aren't allowed to become adults until their mid-twenties.
I suspect that your comment was just humorous, but it was still a good excuse to pontificate a bit.

BBC Reporting This

[JaxWeb]

I hear this on BBC Radio news. A quick search of the BBC website gave me this link.

I also noticed this story from a while back, entitled "Hunt is on for Sasser worm writer".

(You've gotta love the BBCs use of Stock Graphics! :D)

So basically, what's happened here was...

[Anonymous Coward]

A program exploits the extremely poor security track record of Microsoft products to spread itself. In my eyes, the provider of the broken software (=Microsoft) is just as much guilty as the person who made the self-disseminating program.

But history has shown that Microsoft cannot be sued while expecting to win. It's too big. In other words, Microsoft is above the law.

Re:So basically, what's happened here was...

[Ghorin]

I don't agree with you. Microsoft is not responsable for what viruses written by others. Take another example : If you forget to lock your door when leaving home and if a thieve get in and stole many thing, who are responsible ? You or the thieve ? The thieve. You made the job easier for the thieve but he is still the robber, not you. If there was no robber, no virus, we would not need any lock on our door and no anti-virus and firewall on our computers.

Re:So basically, what's happened here was...

[Anonymous Coward]

No, what happened here is that you got sold a lock that doesn't work and the theif broke into your house and a hundred million others based on the fact that the lock company has a monopoly over lock distribution. The lock company should be jointly liable.

Re:So basically, what's happened here was...

[sjgm]

Let's take this analogy a little further...

You buy a lock. When you have it fitted, you are asked if you would like to receive recall information if any problems are discovered. If a recall is issued, a locksmith will visit and upgrade/fix your lock for you.

A few weeks ago, such a recall went out. Some people either didn't want to know about the recalls, and others ignored them - so their locks never got fixed. Those who did get their locks fixed weren't vulnerable to the particular tools that this neighborhood thief used.

If Microsoft hadn't issued a patch via Windows Update, I might be more on your side on this one, but they did release a patch. Even on a dialup, it doesn't take more than 10-15 minutes to download almost every patch that comes along. Service packs of course are the exception, but these can be obtained for a nominal charge on CD if necessary.

Melissa Virus

[CptChipJew]

Didn't the creator of the Melissa virus get his sentence removed in exchange for helping the government with security stuff?

If so, the same thing could happen to this guy with the German government.

Re:Melissa Virus

[Schmiddtchen]

Dont expect the German government to advance Germany technologically or even think of conducting neccesary reforms. All they do is talk jabber and think loudly about China joining the EU... :P

Re:Melissa Virus

[Star_Gazer]

Since this guy is most probably only a script kiddy, that would have about the same effect as asking GWB to help ruling the US.

Re:Melissa Virus

[Halfbaked Plan]

Under the current German administration, it's suprising they aren't simply proposing that the EU join China.

Rothenburg an der Wümme.

[Qbertino]

We've got a few (3?) Rothenburg's in Germany. The one americans probably know the best is Rothenburg op der Tauber.
Rothenburg a. d. Wümme is not the medival postcard town, it's just a small boring northern german town. :-)
BTW: Wümme and Tauber are both rivers. German cities with same names ofter difference themselves by the rivers they lie at.

Re:Rothenburg an der Wümme.

[datan]

americans - Americans

run on sentence: Rothenburg a. d. Wümme is not the medival postcard town; it's just a small boring northern german town.

German cities with the same names often differentiate themselves by the rivers they lie at.

Re:Rothenburg an der Wümme.

[Gramie2]

How about correcting your German? Isn't it supposed to be Rothenburg ob der Tauber?

Re:Rothenburg an der Wümme.

[Qbertino]

Yeah, could be. :-)

Re:Rothenburg an der Wümme.

[DataCannibal]

"boring" is a bit redundant. By definition all small northern German towns are boring.

Re:"Federal pound me in the ass prison" for him

[Schmiddtchen]

Oh, by the way: after admitting the crime, he has been set free for now. Quote: "Keine Verdunkelungsgefahr" (Unlikely to disappear from the hands of police). See the Heise.de newsitem (german, use babelfish and the like to translate).

I wonder if we can settle a small question

[Sun]

not really an important one, but still.

Sasser broke a new record in the time it took to find the worm, from the time the hole on which the worm was based was issued a public patch. Now that we, allegedly, have the worm's author, we can ask him whether it was rev-enged from the patch, or whether he had prior knowledge of the hole.

Shachar

P.S.
I would wager the former, but still interesting to get an authorative answer.

Re:I wonder if we can settle a small question

[moyix]

LURHQ's analysis says that the code to exploit the LSASS vulnerability came from houseofdabus. who posted it to BugTraq. Given that exploit code, it would be pretty trivial to make Sasser...

Re:MS

[keif]

> And writing intentionally crappy operating systems isn't? Ask yourself: what would happen if they wrote something that was *perfect*?

Someone would complain the default colour scheme was crap.

Probably Bragging

[msgmonkey]

However I am basing this on that fact he is 18 and on the assumption that he fits a profile of some kid who does n't have many friends and needs attention. I'm not saying I'm right, just my take as you'd be amazed on how many criminals get caught simply on the inability to keep their mouths shut.

Re:Probably Bragging

[Anonymous Coward]

"However I am basing this on that fact he is 18 and on the assumption that he fits a profile of some kid who does n't have many friends and needs attention."

Well, that's all the proof we need isn't it.

Re:Probably Bragging

[LooseChanj]

Well, that's all the proof we need isn't it.

In these enlightened War on Terror times, it most certainly is.

Sentencing...

[Ianoo]

Much as I'm pissed off with Microsoft for putting out software with so many holes, I think virus writers still have a lot to answer for.

I reckon he should get 10 minutes of prison time for every machine his trojan infected, since this is the time it probably takes someone on average to clean up the mess.

1,000,000 * 10 minutes = 166,667 hours = 6944 days = 19 years.

Seems fair to me, anyways...

Re:Sentencing...

[nyseal]

I like that idea. Where can I obtain this worm so I can install it on my machine and my 10 minutes worth of justice? (I know, I know....I would be doing it to myself, but still....I WANT MY 10 MINUTES OF JUSTICE! That's at least enough time to meet and become intimately involved with a man named Bubba).

Re:Sentencing...

[Jo_2521]

19 years...

Sure, murderers get 25 years, so why should someone who caused no physical harm to humans but inconvinience and loss of money be fined for much less?

Funny that this is the same slashdot that also rejects the idea of 5 years in jail for copyright infringment (at least when it's about music).

Get some principles, people.

A benefit of Sasser/Blaster

[mst76]

Sure, these worms did cause a lot of inconvenience and downtime and such. But a (probably unintended) benefit of their outbreaks was that many vulnerable machines are now actually patched. Without these worms, if you hit a random 2K/XP machine on the net, there is a very good chance that you can take over the machine through either DCOM or LSASS (port 135 and 445 IIRC). Essentially, everyone can gain access to millions of machines, and the owners would probably be totally unaware. I'm not trying to defend the worm writer, but we all know that millions of people simply wouldn't patch until the machines keeps rebooting every few minutes.

Re:A benefit of Sasser/Blaster

[Oligonicella]

Yes, and when a guy is mugged by someone, he very well may seek a course in self-defense. Therefore, the mugger actually did him a favor, right?

Yeesh.

Re:A benefit of Sasser/Blaster

[orkysoft]

"I was walking the professor, and then this womam came and said I had stolen her purse, and she chased me, and then I was forced to hit her with this purse I found."

Re:A benefit of Sasser/Blaster

[0x0d0a]

It isn't *quite* that bad. I believe that the original Sasser didn't do that much damage. In any event, it was easy to detect, whereas individual compromises could have gone on for a long time. Finally, the way people patched was by running windows Update, which generally yanked down a whole ton of fixes, rather than just one.

The worst-case scenerio would have been either an extremely damaging worm going out or no worm going out and regular manual compromises of such machines.

That doesn't mean that the guy should get credit for doing humanitarian work -- it just means that he may have inadvertently helped people out.

Re:A benefit of Sasser/Blaster

[UpnAtom]

Better still, the mugger clobbers his skull, and when he recovers, his skull heals up stronger than it was...
"Oh thank you Mr Mugger"

Re:A benefit of Sasser/Blaster

[deinol]

I don't think you realize how often someone 'fixes' this problem by formatting and reinstalling windows. Then they don't realize they need to update again, and may still have a pre-SP1 XP install, or some such.

In my experience as a consultant, a user who was hit by a virus does not often learn how to protect themselves in the future. Sometimes they hire me on a monthly service contract, and as a side effect I keep them safe, but they rarely have the time or desire to learn about this stuff.

Most users, especially on the business end, have their own business they spend their time worrying about. They would rather hire me to take care of them every once in a while, and make sure 'it just works'.

Re:MS

[panamahank]

My wife is forced to use XP at work. Her computer is set to auto-update, is firewalled, and has two up to date virus scanners. Despite taking all recommended precautions, her computer got sassered. Does anyone care to explain how she is in any way responsible?

Re:MS

[mfh]

> That you expect perfection only goes to show that you are an American.

I -- Am -- Canadian!

> There is no such thing as a perfect system, in any engineering discipline.

By perfect, I meant: without bugs. I wasn't talking about features. Sorry for the confusion.

Idiot

[Pedrito]

I'm sorry, but any virus or worm writer that gets busted is just plain stupid. It's so simply to NOT get caught:

Step 1: Write virus/worm without your name, intials, alias, or any other identifying info.

Step 2: Release your virus/worm from an internet cafe, preferably one far from home, even a different city or country.

Step 3: Keep your mouth shut!!!

I mean, how hard can it be to avoid getting caught? I think most of these morons have the most trouble with steps 1 & 3, even if they're smart enough to manage step 2.

Re:Idiot

[Richard_at_work]

If virus and worm writers followed these guidelines, then I doubt there would be as many problems as there is now:

1. Authors like to stamp the worms with their own signiture, as then they can boast about it with proof.
2. I agree you with this, releasing it from a traceable system is stupid.
3. If the authors did this, then a major benifit of them releasing the worm/virus is gone. Most of these things are done for bragging rights, and are not malicious. How many worms etc actually cause permanent damage to data or computer systems? Very few, most use exploits to spread themeselves further, and a couple shut down the PC. Few actaully install malicious programs and fewere still wipe data.

There are other people who follow exactly the same procedure as you laid out, for example the "Deepthroat" whistle blower in the Nixon Watergate scandle is still unknown precisely because he followed the above, and demanded secrecy from those he could trust enough to tell.

Re:Idiot

[6Yankee]

So, which virus or worm did you write? :-)

Re:Idiot

[Hanno]

Most of these things are done for bragging rights, and are not malicious.

You forget that there are now connections between virus/worm authors and organized crime (*). Some new viruses/worms appear to be contract work with the specific intent of using it for criminal intent. It is claimed that several new viruses/worms now scan the victims harddisk for credit card data, online bank account logins and similar interesting data they can sell or use for their own amusement. Some viruses/worms are also written for the purpose of selling the victims computers as spam relays and web server proxies to professional spammers.

(*) Big word, but I don't mean international drug gangs. Still, it is organized crime.

Re:Idiot

[Elwood P Dowd]

Step 1.5: Compile your virus/worm with something that doesn't uniquely identify your computer, like Visual Studio.

Re:Idiot

[Anonymous Coward]

Specifically, it is rumored that the Phatbot source code was released because those who ordered the worm did not pay and the author tried to render the already delivered worm unusable by giving anti-virus companies a chance to create signatures before or quickly after it was used.

Re:Idiot

[Hanno]

Whoa, never heard of that. Is there any half-credible source for that rumour?

Re:Idiot

[0x0d0a]

This is not trivial unless you avoid MS software. Really, who would have thought that MS Office secretly embeds unique identifiers in documents until after the Melissa guy was caught?

That could have caused plenty of fun if some whistleblower uncovered, say, nasty financial dealings involving the Feds and Iraq.

Re: Idiot

[Black Parrot]

> Step 1: Write virus/worm without your name, intials, alias, or any other identifying info.

I always use your initials!

Re:Idiot

[Elwood P Dowd]

It was a minor geek news item when they first started uniquely identifying Office installations in every document they create.

I knew about it before the Melissa guy got caught, and my first thought was "who didn't know about that?"

Re:MS

[Tango42]

They would be what is commonly called "God". Nothing is perfect.

If he is guilty...

[darth_silliarse]

...I think he should be locked in a padded cell with a 486-SX and a copy of Windows v3.1 for company, I'd sooner have my left nut crushed in a vice rather than face that

Re:If he is guilty...

[RogerWilco]

I would prefer the padded cell with the computer to one without, I don't see your particular problem with the 486sx or win3.1?
I'd rather not be in the padded cell though.

Times will change...

[John Seminal]

If it becomes that easy, and people don't get caught, then governments will have to react. Government might force an identification system where there will be no anonymity. They might have closed networks, where countries that don't agree with us are shut out. 1984 is going to happen because of these people. And givernment will use it as a legitimate reason to take away freedom from the rest of us. The .0001% of people who are anti-social criminals are going to cause the other 99% of us to lose freedom. That is why they should be punished harshly when they get caught.

is any system really safe ??

[rudga]

hmmm...dump M$...go the GNU way but is any system really safe ?? Check out this news link :: http://story.news.yahoo.com/news?tmpl=story&ncid=1 817&e=9&u=/zd/20040506/tc_zd/126378&sid=961207 51

You know, I really don't understand

[Freston Youseff]

how some of these so-called "genius" worm authors always manage to get busted. If any of them had a brain in their head and assuming they're not bed-ridden, they would stop being so headstrong and arrogant, and release the worm from an internet café. They could even wear a disguise, dye/cut their hair, or walk funny just in case the place had surveillance cameras about. It just seems to me that it would be so simple not to get caught at all.

Re:You know, I really don't understand

[badzilla]

Naturally you don't understand, this is for the very same reason that you probably have never written and released a virus.

Most people in what passes for "normal" society can not see any point whatsoever in creating a virus. It is not that they are too civic-minded or too "responsible" it is merely that there is no motivation to do it.

To me the desire to create a virus proves in itself that the creator has a different viewpoint on life than do most people. I don't presume to understand what that viewpoint might be, however simple logic indicates the likelihood that in their case the sole and only point of creating a virus is to able to brag about it. "Hey see all that stuff on the TV news, that's me that is, I did that!" Otherwise why bother (OK unless spammers are paying you to write smtp trojans or whatever.)

So yes they are certainly smart enough to release their virus silently from a cafe or someone else's hacked cable account. But they don't, because that would defeat the whole object.

Re:You know, I really don't understand

[curator_thew]

It's not that simple: forensics: examine the earliest locations of the virus, exam the nature of its source code - cross check against other source code. Granted, a dedicated genius can evade this, but not all virus writers are dedicated genius. I think there's a good analogy to standard forensics (I watch CSI, which granted is a popular misconception of what forensics is really like, but it shows some sense of the direction).

Re:You know, I really don't understand

[0x0d0a]

If one brags about one's accomplishment (getting into the newspapers all over the world is probably a bit of a pride-inducer for a high school student) on public IRC servers, it's a pretty good bet that law enforcement of various countries knows about you.

WRONG...

[John Seminal]

I could leave the front door to my house open, and if someone enters and steals something or causes damage, they are still guilty. If I wanted to, I could leave my door unlocked, tell the neighborhood I am going on vacation, and if someone breaks in they are still guilty.

The oppertunity to do the crime does not lessen the caupability of the criminal.

Re:MS

[keif]

> My wife is forced to use XP at work. Her computer is set to auto-update, is firewalled, and has two up to date virus scanners. Despite taking all recommended precautions, her computer got sassered. Does anyone care to explain how she is in any way responsible?

She isn't, but my comment was about the trolling post at the top. Her network admins are ;) How could it get through the firewall ?

come down hard

[KrisCowboy]

He should be punished to the maximum extent permitted by law - I don't care under which law. People who can't respect computers should not be allowed to (ab)use them. If he screws up his computer, it's his problem. But the moment he screws up boxes over internet, he's got to be punished hard. The punished should be harsh so that no other individual will ever attempt to write a virus. Microsoft users are already suffering with poor quality, tech-support and other stuff, guess they don't need viruses.

Re:come down hard

[Tin Foil Hat]

Bullshit. Harsh penalties do *nothing* to deter crime.

Texas is the death penalty capital of the world. By your logic that would also make it the safest place in the world, yet people are murdered here every day. A person can be imprisoned for years (years!) if caught with trace amounts of cocaine, yet the crack epidemic is as strong as ever. Community services do more for crime prevention than the prison system can ever do. Prisons are necessary of course, if only to separate the truly incalcitrant, but the current reliance on them as a deterance is simply pig-headed.

The point is, discipline is necessary, but not without compassion. Strict adherance to discipline for the sake of revenge mearly engenders hatred in those being disciplined. Unless you kill that person, he will always be a problem. Compassion can divert that hatred so that lessons can truly be learned. Community based organizations can provide that, the prison system cannot.

They should just give the boy (if proven guilty) an appropriate penalty followed by a period of community service. Get the boy involved in his community and he will not be such a problem. That is the only answer to such things.

(Hey mods, mod the parent underrated. His opinion may be wrong, but it is valid non-the-less. It doesn't deserve a troll mod.)

Re:come down hard

[KrisCowboy]

Well, thanks for the insightful info. Guess I just got carried away. You cannot compare a guy's drug problem to his computer problem. Addiction to drugs only shows that he's weak-willed. Writing viruses shows that he's not disciplined, or, he's watching matrix too many times :). You are right, a period of community service is going to help him. But not a short period of one month or year. I'd say, the period should be of (no of effected computers)*(2) days. That should keep him out of mischief for nearly 5-8 years. Because, when a drug-addict says clean for a month, there's always chance of his getting back to business on the 31st day. If he stays clean for 5 years, it's difficult to get back. Or, when a security vulnerability is detected, those rich bastards at M$ should pay a reward to the guys who fix it, and fix it effectively in a short time.

Re:come down hard

[nyseal]

Oh please. Long gone are the days where prisons are considered 'rehabilitation institutions' for possible release of criminals back into 'productive' society. Prisons exist for the sole purpose of keeping criminals off the street and (hopefully) not getting a chance to perpetuate their crimes. As far as I'm concerned, the longer the better. You're right that harsh penalties don't deter crime, however I for one sleep much better at night knowing that they're not out in the public on some socially accepted experiment that believes these people can be 'rehabilitated'. Now THAT'S bullshit.

Re:come down hard

[Alomex]

Harsh penalties do *nothing* to deter crime.


Actually, you are wrong on that one. Your rebuttal argument is flawed:

Texas is the death penalty capital of the world. By your logic that would also make it the safest place in the world, yet people are murdered here every day.

You are using a flawed control group: other random places in the world. For the control group to be valid you have to find a place with similar socio-economic characteristics *and* similar prison conditions but laxer sentencing practices.

Moreover, save for hardened criminals which tend not to act rationally, studies *have* shown that the common folk tend to adjust their rates of criminal behaviour in proportion to (a) likelihood of being caught (b) harshness of the penalty if caught and (c) potential reward as compared to living a straight life.

For example in a jurisdiction when a specific crime is suddenly punished in a much harsher way, criminals gravitate to less harshly punished activities.

Same studies have shown that a certain percentage of the drop in crime rates of that type are due to the simple reason that criminals are out of comission longer, due to the longer jail sentences (duh!). So even among the hardened criminals we see a reduction in crime rates, simply because they are in prison and off the streets.

Re:come down hard

[NewToNix]

"Bullshit. Harsh penalties do *nothing* to deter crime."

It absolutely deters one person from ever committing a crime again. In that sense the death penalty is 100% effective as a crime deterrent.

Appropriate Sig: Stopping crime the old fashion way, one criminal at a time.

Re:come down hard

[waveman]

> Moreover, save for hardened criminals which tend not to act rationally, studies *have* shown that the common folk tend to adjust their rates of criminal behaviour in proportion to (a) likelihood of being caught (b) harshness of the penalty if caught and (c) potential reward as compared to living a straight life.

Studies do show the perceived likelihood of being caught is the major factor. As has been pointed out however, most murders are crimes of passion where the consequences are not considered. Most of the rest are cold blooded killings where there is actually a low chance of being caught.

The harshness of the penalty mostly has a threshold effect i.e. little effect below a certain penalty, and a fixed effect beyond that threshold. So further increases beyond a certain level of penalty have little effect.

For example, in my case a penalty of 1 year's jail would discourage me from murdering someone. Increasing the penalty further would have no further effect on me. The number of people who would be discouraged by say 30 years prison, but not discouraged by 20 years prison is miniscule.

As for reward/risk tradeoffs, you are assuming criminals make rational tradeoffs, which is rarely the case. For a start, the most powerful variable for predicting criminality is low IQ. You are dealing with stupid people for a start. If you don't believe me, have a look at the people on death row. A large percentage cannot even read. A sigificant percentage of the rest are highly impulsive - 30% of prison inmates have ADHD for example.

While it is true that murderers who are convicted and executed do not murder again, there are other factors:

1. Juries may be less likely to convict if they know the penalty is draconian - therefore severe penalties may *increase* the number of criminals on the streets.

2. Draconian penalties are expensive - keeping all those people in prison for long periods, or paying for all those death penalty appeals, etc. This cost means higher taxes. Also people in prison do not pay tax, again increasing the burden on others. Higher taxes make everyone poorer and less well off.

Most people who go to prison once never return. So by having heavy penalties, you are depriving society of many people who can and would contribute in many ways.

When you are dealing with people it is just not that simple.

Re:come down hard

[waveman]

> For example, in my case a penalty of 1 year's jail would discourage me from murdering someone. Increasing the penalty further would have no further effect on me. The number of people who would be discouraged by say 30 years prison, but not discouraged by 20 years prison is miniscule.

There is also the 'nothing to lose' factor. This was one factor in removing the death penalty for rape. Rapists realized that they may as well kill the victim as the penalty was not worse and the risk of getting caught was less due to lack of a witness.

Re:come down hard

[cranos]

Nope sorry the death penalty is a complete failure. It only occures after the crime has happened, therefore it follows that as a deterent it is a complete failure.

Re:come down hard

[NewToNix]

Site one criminal that was put to death, and then committed another crime.

So while nothing prevents the first crime, the death penalty is 100% effective in preventing that individual from committing a second, third, fourth, etc., crime.

In fact there is no threat of punishment that will deter the first crime - no one commits a crime with the expectation of being caught, therefor fear of punishment does not enter into the equation.

The one exception being when the punishment is vastly less then the gain from the crime. In that event the criminal may commit the crime and not care about being caught, or the possible punishment.

As I said: there is no deterrent except death, and that only prevents all future crime from that one individual.

Appropriate Sig: Death sentence for speeding and that person will never speed again.

Re:come down hard

[Alomex]

Most of the rest are cold blooded killings where there is actually a low chance of being caught.

Only because the streets are underpoliced. If you look at statistics overseas, you can find jurisdictions where the number of unsolved deaths is minimal (for one, since they have lower murder rates they can devote a dozen detectives for an entire a year to each murder case... which further increases the chances of the murderer being caught and thus reduces the number of murders, freeing even more detectives to investigating the next case and so on. In other words a virtuous circle).

The number of people who would be discouraged by say 30 years prison, but not discouraged by 20 years prison is miniscule.

True, but as I said even in this case a measurable drop in crime has been detected due to having the hardened criminals off commission for longer.

Re:come down hard

[cranos]

But by not preventing the first crime the death penalty is a failure.

Let's not even get into the large number of innocent people who have been sentenced to death on false evidence and as a result of an incompetent system.

Re:come down hard

[NewToNix]

But by not preventing the first crime the death penalty is a failure.

But by not preventing the first crime all deterrents are failures.

I agree many Innocent people have went to death via the death penalty.

Many guilty people have gone free via one reason or another.

Life is not fair and "justice" is not only blind but also deaf, and usually favors the rich.

All I said was a very accurate statement: The death penalty prevents one person from ever committing another crime - because he's dead.

It's an accurate statement, but stop reading something into it that is not there - like "the death penalty is fair", or "prevents all crime", or any thing other then exactly what I said.

One last time: "It absolutely deters one person from ever committing a crime again. In that sense the death penalty is 100% effective as a crime deterrent."

Operative phrase: "in that sense". Meaning limited to the context of the sentence in which it was used.

Appropriate Sig: Successful use of "sentence" as a pun in a sentence about the death penalty.

Re:come down hard

[cranos]

I will concede the point that logically the death penalty prevents future crimes.

Re:come down hard

[NewToNix]

And I will agree that killing an innocent person did nothing much to lower the crime rate - given that if they were innocent they probably would not have committed a crime even if allowed to go free, i.e., they were not a criminal to start with. In that sense the death penalty is a waste of time, resources, and a real bummer for those involved.

But then, so was convicting an innocent person to start with...

Perhaps the problem lies not so much in the sentence as in the process of determining guilt.

Appropriate Sig: State authorized killing of an innocent person is only a deterrent to innocence.

Re:come down hard

[cranos]

But until we can determine without a shadow of a doubt that no innocent person will be sent to the chair/gas chamber/weasel pit it is not appropriate to keep using the death penalty, the risk is to great and its deterence factor over the greater community is debatable at best.

Re:come down hard

[NewToNix]

I agree the death penalty has zero deterrent value to the community, but then I think all punishment has zero deterrent value to the community at large.

Crime is motivated by a belief by the criminal that there will be positive gain for the criminal.

The belief in positive gain has already ruled out the possibility of being caught, therefore no possible punishment will be a deterrent.

Of course the "belief in positive gain" would not apply to instant crimes of passion, and/or acts of clearly psychotic individuals. But in those cases gain or loss is not an issue, so fear of punishment would not be a deterrent in those cases either.

But there are, I believe, some crimes that the death penalty is appropriate for. But I also agree that there should be zero possibility of innocence (notice I do not look at it as a question of doubt of guilt) before anyone is put to death.

I hope you can see there is a major difference in "beyond a shadow of doubt" (there might not be a shadow, just a sliver) and zero possibility of innocence. Zero possibility of any possible way one could construe innocence, no matter how remote.

So, for me the death penalty is OK, for some crimes. I just believe that a different standard for how to chose death, instead of life in prison, needs to be established first. But in those cases, life in prison needs to mean absolute life in prison (unless innocence is later shown, of course).

Appropriate Sig: Give me Zero possibility of innocence, or give me life in prison. (With apologies to Nathan Hale).

hmmm

[Knights who say 'INT]

Slashdotters blaming someone other than Billy G or Stevie B for bad things.

In other news, Osama Bin Laden renounces Islam and donates his fortune to the James Randi organisation.

Muprjys law and net.spelling

[frost22]

According to one of thousands of corollaries to Murphy's Law, a spelling correction on the net is guaranteed to contain at least one spelling mistake as well.

Of course, it's not "medival" but "medieval".. :-)

Re: Muprjys law and net.spelling

[Anonymous Coward]

> According to one of thousands of corollaries to Murphy's Law, a spelling correction on the net is guaranteed to contain at least one spelling mistake as well.

I propose that this corollary be named "Muprjys law".

Microsoft involvement [Re:they caught him...]

[j.leidner]

they shoulda waited until MS announced a reward for it first!

Hardly likely to have happened, since according to the Yahoo! Germany newswire, Microsoft gave the vital hint to the German police that led to the arrest. Which makes you wonder whether they scanned their Apache..erm..IIS server logfiles to see who was reading about certain security alerts.

Re: Microsoft involvement [Re:they caught him...]

[Black Parrot]

> what are they putting into the software that can track these sort of people?

Bugs?

Re:Microsoft involvement [Re:they caught him...]

[Lars T.]

Actually, MS got a tip from an informer and gave "no comment" on whether he'll get money for it.

Not to nitpick....

[nobodyman]

...but this man is the suspected author of the worm. The authorities haven't released his identity, nor how they arrived at the determination that he is the author.

Btw, Here'a an english version of the story.

Re:Not to nitpick....

[Oligonicella]

"...nor how they arrived at the determination that he is the author."

You mean, other than his confession?

Re:MS

[Anonymous Coward]

Whoa!

I agree that worm writers are scum. They shouldn't be excused because someone else left a vulnerabilty for them to exploit.

But, especially at this point, I DO think that Microsoft deserves some blame too. SASSER follows in the wake of SQL Slammer and MSBlaster, arguably 2 of the most damaging buffer overflow exploits in many years. IIS has been repeatedly compromised by buffer overrun problems since its initial release.

It isn't hard to code an automated test for buffer overrun vulnerabilities. I have done it myself for embedded designs that I have done with TCP/IP capabilties. Admittedly, it was a much simpler task for my circumstances since my products support a very limited subset of TCP/IP, but then I don't have a legion of progranmmers at my disposal either.

Here' my point: given that you had a product that had suffered buffer overrun problems for yeras, wouldn't you test specifically for buffer overrun problems before release? Maybe I would give NT and win 2000 problems a pass but win2k3 and XP were both released after a long history of buffer overrun problems. Why didn't Microsoft test specifically for buffer overrun problems before releasing them?

Re:Lock him up!

[JRIsidore]

And I hope we will not get the society that you want.

Re:MS

[tomstdenis]

That's your definition of Perfect.

My definition of perfect means I can plug in my new USB scanner and have it work immediately. I can goto a website and see those new SVG images, I can ....

All this "functionality" that is second thought to whiny little bitches like you *IS* what gives operating systems their complexity.

Not to mention keeping compability with so many years of prior operating systems. I'm sure if WinXP wouldn't run Win95/98/ME [heck even Win3.11] applications there would be a huge outcry of how evil MSFT is for limiting compability.

So basically people want a bloated featureful operating system and then expect it to be perfect.

Admitedly a lot of the bloat is self-induced by Microsoft subscribing to any new system [.NET, C#, ASP, etc...] just to sell more product. Why people go beyond the win32api in plain C is a mystery to me. GUI coding really ought to account for a minimum of the time not maximum...

Tom

18 year old kid

[stock]

If a 18 year old kid can write a small piece of code which can lament and trembel a large part of our society, who should we blame?

Robert

Re:18 year old kid

[NineNine]

If a 18 year old kid can write a small piece of code which can lament and trembel a large part of our society, who should we blame?

The kid.

Re:18 year old kid

[Dr. Evil]

Yep... and it's not like people relying upon those systems hadn't seen so many worms and viruses that they didn't expect a new one to appear... and it's not like the patch wasn't released.

The kid did something very stupid... but somebody was going to do it, and no amount of deterrants in the world would have stopped them.

Re:18 year old kid

[pommiekiwifruit]

Well, Alexander the great conquered Athens etc. when he was 18, personally leading the attack against the Thebans. He had already been in battle before of course. He waited until he was 20 before conquering Persia etc. though.

The annoyance of a virus checker running for a few seconds hardly compares with the change in sovereignty of your country.

I guess people just have lower expectations for 18 year olds these days.

Re:18 year old kid

[aardvarkjoe]

...small piece of code which can lament and trembel a large part of our society...

The same people who don't teach students the difference between transitive and intransitive verbs?

So what?

[SphericalCrusher]

No details on how they caught him? Sounds fishy... Catching a virus writter has been proven as one of the most difficult things to do. I bet they just found some kid talking shit in a BBS, traced his IP, and nabbed his ass.

But you never know...

Re:So what?

[Anonymous Coward]

He probably wrote it using Microsoft Word and didn't use the remove hidden data tool which left his name, initials, activation code, revision history etc. in the virus.

Re:MS

[mfh]

> All this "functionality" that is second thought to whiny little bitches like you *IS* what gives operating systems their complexity.

That's not what I meant. I mean that if you have bug-free systems, you can easily add features that are bug-free as well. Microsoft's problem is that they don't care. Why should they? They have never been financially forced to care.

He Caused Damage & Broke Law, Victims Didn't

[reallocate]

He's liable because he committed the criminal act that harmed others. Absent that, no damage and no crime. It may be unwise to run an insecure PC, but it isn't illegal.

Using your logic, we might as well arrest victims of drive-by-shootings for providing targets.

The Microsoft Secret Police caught this kid

[stock]

Remember Minister Otto Schilly signing a security deal with Microsoft ?

"Microsoft signs security pact with Germany" http://news.com.com/2100-7343-5204643.html

That was on may 4th... Today THEY GOT HIM. Thats quite a remarkable effort from the Private Secret Police of Microsoft.

Robert

Easy

[YrWrstNtmr]

Now tell me how they are supposed to download the M$ patches necessary.

Simply go here, give them your name and address, and the nice people at Microsoft will send you a CD with all of the current OS patches. Free of charge.

You do remember what snailmail is, right?

Re:Easy

[Vlad_the_Inhaler]

This particular weakness was exploited 3 weeks after it was publicised. Do M$ send out CDs on a weekly basis? That is what would be needed here.

Re:Easy

[YrWrstNtmr]

No, I don't think they do. But it is enough to get a new 2000 or XP system up and semi-secure. Subsequent updates would be not nearly as large. Easily doable on dialup.

Re:Easy

[Vlad_the_Inhaler]

As a professional who spends a lot of time online (arf arf!), I am prepared to check for and download updates on a regular basis. SuSE's website is fine for that. These two women I am thinking of will be online for maybe 15 minutes a week. They should not have to be permenantly looking around their shoulders to check for updates.

Of course, only being online for 15 minutes a week over a modem is also a form of security.

Another case is my sister, she has XP and DSL. I don't know her security policy - apart from ZoneAlarm - but she is 1000 miles from me so I can't really help her anyway. Her best solution would be a DSL router with integrated firewall. Does no-one do modems with configurable firewalls? Should I patent that idea? ;-)

Re:Easy

[YrWrstNtmr]

They should not have to be permenantly looking around their shoulders to check for updates.

That's what Autoupdate is for. Autoinstall, autodownload and install later, or go get it yourself.
Or are you arguing that they shouldn't have to download any security updates? Then they shouldn't be online, because that happens with all OS's.

Re:18 Year Old 'Man'?

[character sequence]

Cripes, he's 18 - he's barely out of school, and probably set to head off for a college

He's still in school. The German school system runs a little later than most others. The headline on www.tagesschau.de reads Schueler soll "Sasser" entwickelt haben, which translates as "School student suspected of developing Sasser".

German police admit corporate control of courts.

[reynhout]

Someday, after the revolution, this will be remembered as something we should have taken more seriously...

> Spokesman Frank Federau for Lower Saxony
> police said the man was arrested on Friday.
> ...
> "He made a confession and the experts at
> Microsoft have now confirmed that he was the
> cause of this worm," said Federau.

The orignal

Re:MS

[NineNine]

And have you ever seen a single, functional piece of software without bugs?

Assuming he is the right one...

[drgonzo59]

He should have to pay for the time that was spent cleaning up his worm from all the machines. Alternatively perhaps he can do an hour in pound-me-in-the-ass federal prison for every hour spent getting rid of his creation. Even better, since Micro$oft with their lax security policies contributed to the spread of the worm, they should pay a $1000 for every hour spent cleaning the worm or send the windows developers in the same pound-me-in-the-ass federal prison.

Re:MS

[tomstdenis]

Independently many functions are bug free. It's their *interaction* that can cause bugs.

Beside if you think MSFT is so bad look up "kernel vulnerabilities" in google. MSFT is not the only company/group that produces code with bugs in it.

Tom

Re:German police admit corporate control of courts

[rimmon]

So what, that doesn't mean that he is guilty in the official meaning of the word. He was arrested yesterday, with the help of all kinds of specialists, some of them work for Microsoft.
It's standard procedure for the police to work with external specialists.
The idiot who wrote that worm was released later that day and his trial will be in a couple of months where all kind of evidence is used to see if he is guilty or not.
Yes, most likely the statements of said specialists will be heard by the judge but what you are trying to imply is just pure bullshit.
You know, it was a worm written for for a Microsoft OS. I can hardly imagine a better source for information for the police.
Hendrik

Re:18 Year Old 'Man'?

[Oligonicella]

Yeah, like write a truely terrible virus which will disable a hundred times as many systems.

Since when is identifying a criminal an attack?

Sven hit Windows at questionable sweetspot

[stock]

its rather striking that winME win95 win98 win98se are not harmed by sasser, they only help spreading. Only damage is done to win2k and higher. From which i conclude, that these windows versions are just security breaches, and only have such hookups for spyware and other "activities". Thats to be read here :

http://news.bbc.co.uk/1/hi/technology/3687583.stm
"According to anti-virus firms machines running Windows 95, 98 and Millennium Edition can help spread Sasser even though they cannot be infected by it."

The 18 year old kid, (his name is Sven?) really hit Microsoft windows at its weakest sweetspot: Federal ordered builtin hookups for "remote security management" and other "activities" as e.g. Spyware.

Robert

Re:Sven hit Windows at questionable sweetspot

[sjgm]

According to Symantec, the worm code can run on Windows 95/98/ME machines, but not be infected. As far as I'm aware LSASS isn't included with these versions of Windows, but the code used to spread the worm would still work.

It's logical for virus/worm writers to target the most popular vulnerable systems, and Windows 2000 and XP are now in use more than earlier versions.

Re:Sven hit Windows at questionable sweetspot

[upside]

FYI your "Federal ordered" hookups are vital administrative tools for use in corporate environments so administrators don't have time to install and configure each of hundreds or thousands of machines by hand. Read up on Windows server, Active Directory and group policies.

Home users don't realise that a large number of features in NT and derivatives Win2K and XP are not intended for home users, but for corporate environments. This means they have services which unfortunately in turn have vulnerabilities.

Re:Lock him up!

[Oligonicella]

"These comments make you no better a person than the worm writer."

Apparently you have very poor comprehension and discrimination abilities. Making comments, regardless of how vile, does not in any way equal actually *DOING* something to harm others.

"...only when we recognize the futility of violence..."

Yep. Criminals first. *Then* you can carp on the rest.

Re:18yr old *man*?

[Dionysus]

If he is old enough to vote, drink, and serve in the military, I fail to see why you can't call him a man. Just because the US like to keep part of their population immature, I fail to see why it would be true for the rest of the world.

NOT under arrest

[mi]

They have arrested him, but, evidently, later released. Says in this article:

All the teenager's computers were confiscated by police but the suspect himself was not in custody, [Spokesman for Lower Saxony police Frank] Federau said.

So, even the Slashdot editors don't RTFA anymore?

Why don't we just

[gwayne]

tell M$ to put their money where their mouth is and hold them liable for all the damages.

Any auto maker is liable for problems necessitating recalls, so why shouldn't M$ be too? You'd think the biggest company in the world could at least back their products.

Lobby to your congress-person to hold M$ responsible.

Germany eh?

[Bazman]

Interesting. We had a machine fall over last week during the height of the Sasser panic. Norton AV had caught an installation of a Windows rootkit, and when we got to it (holiday weekend, so took three days), it had an FTP server installed with 19Gb of German-subtitled Moviez. Kill Bill 2 et al.

We found various infection scripts lying around, because Norton's quarantine seemed to have stopped the infection script in its tracks. One thing it did was to take the machine's details and upload them to an FTP server. A server in .de of all places.

We don't know if this invasion used the same exploit as Sasser, or if a small number of Sassered boxes get FTP status or what. But the German moviez + German FTP dropbox seems suspicious.

Luckily we had the IP-address, username, and password in the script, and were suprised to find we could login there and delete the info. Hopefully the hacker hadn't copied it, but the box has been re-installed from scratch.

And the user is now seriously contemplating Linux, after losing two days...

Baz

Re:Germany eh?

[sjgm]

All Sasser-infected boxes (at least the original variant) have a FTP server running on port 5554 (see Symantec's information on Sasser for the full details). This might explain it...

Re:Germany eh?

[Bazman]

This box (and a few others on our subnet, but not my department) had FTP open on port 4321 (have a scan for that on your subnet).

Also, if the infection script had completed, it would have opened a shell port on some port in the 8000s, can't remember the exact number.

Its script was c:\windows\system32\nt.bat and it tried to install the HackDefender rootkit that hides processes, services, and files.

Baz

Re:nah

[Jaysyn]

This might be offtopic but it's not really flamebait. A history teacher at my highschool had a Nazi flag on a table in his room, it was appropriate for the current lesson & had been being used for years. Well, a german exchange student, I believe his name was Tomas, we had visiting our school was walking by the classroom & happened to catch a glimpse of the flag (folded on a table) & he went apeshit. He busted into the classroom (between classes thankfully) and started raising hell, yelling what were surely german swear words and such at the teacher & the flag. It took about an hour to calm him down, the flag was put away for the remainder of the year.

Jaysyn

Prison is not the solution

[Councilor Hart]

Give him an alternative sentence, like cleaning up computers as the next virus/worm hits. Or deny him computeracces for some time.
nothing worse for a nerd then no computer.

Sending him to prison only makes him meet the really bad guys.
Jail is not the solution to everything. It denies you normal live, far beyond the duration of incarceration.

Keepen kuhl, yes?

[haraldm]

No, never will a German citizen be extradited. This is forbidden by German law. (Would the U.S. extradit U.S. spammers or virus authors to other countries? Worth considering I guess.) He will be charged for computer sabotage and maybe some more things. IANAL but IMHO he's unlikely not to spend some time from home - BUT - him being 18, he may be handled according to the criminal law for minors, depending on the outcome of a psychological test that is usually conducted _before_ the trial itself starts. Which means a long time in jail is not very likely.

So - forget about the idea of meeting him in Guantanamo. We are a constitutional state which even acts after the old principle "in dubio pro reo" (I still wonder what Binalshibh could possibly know that other countries' officials should not know. Very strange if you ask me ).

T-shirts turn into guns

[takev]

To complete your bullet proof vest analogy.

It is more like people are wearing T-shirts in a crowded shopping mall. now most of these T-shirts are made by microsoft and have some holes in them.

If you shoot a special bullet in that hole the T-shirt begins to magically fire the same kind of bullets all around, and you get a cascade effect where all the T-shirts begin to fire bullets.

Now microsoft offer pieces of cloth to patch up this particular hole in the T-shirt, and you could also have warn a jacket or even a bullet proved vest over this T-shirt which would have solved this particular problem.

There are even people with already firing T-shirts and they walk to an other crowded place and infect the T-shirts there. Granted if you are wearing a blindfold you may not have known your t-shirt is actauly firing bullets.

Now lots of people actually die from these bullets.
Now can you say that the people that wear these T-shirts with holes in them are completely free from blame?

Take

Re:T-shirts turn into guns

[Jim Starx]

Completely free from blame? No, certainly not. But I don't think that they are liable.

Re:T-shirts turn into guns

[Deraj DeZine]

I think vampires would make for a much clearer analogy.

Shirts that shoot bullets?

Re:18 Year Old 'Man'?

[pommiekiwifruit]

The German school system runs a little later than most others.

Not the US system though! I've seen those TV programs set in US high schools - the students are mostly in their 20s!

Re:MS

[onewing]

Im not saying shes responsible but, I would assume that someone on her network has a laptop.
Chances are someone took it home, got infected, then came to work with it.
Voila.

"Will he be extradited to other countries"

[da5idnetlimit.com]

As in "Sent to the U.S.A." ?

Human Right forbids,I really hope for him he's not...I mean, that would really be cruel...

I think to remember a Russian programmer being sent to prison when he came for a security speech, so all he have to do is postpone all travels in the US for the next years...

Re:"Will he be extradited to other countries"

[TykeClone]

Didn't some big insurance companies in Norway and Sweden get hit too - I imagine that there are serveral juridstictions that are interested in him...

Make an example out of him?

[fervent_raptus]

I wonder if international governments and Microsoft will try to make an example out of him?

Maybe give him the death penalty?

Slightly off topic

[presarioD]

I agree with you that there is an international legal void that gets slowly filled when it comes to IT related crimes and severe penalties should apply to cases like Sasser for example.
But I think implementing this will not deter or reduce significantly the number of people that practice cracking/hacking/or-how-ever-you-call-it.
Same reason that the death penelty has not reduced homicides in US.

When was the last time that anybody precalculated the jail time he/she will get as a deterrent to a certain illegal activity?

In fact in this case I think it will act as a boost, since elite/defiant behavior to the law can be considered very c()()()()l!
Cheers!

Re:Slightly off topic

[j-pimp]

When was the last time that anybody precalculated the jail time he/she will get as a deterrent to a certain illegal activity?
The last time someone decided against commiting a crime.

Re:Slightly off topic

[JamieF]

I'm sure that all the innocent people who have been executed over the years were very thankful that the system was so garsh darn lenient.

Kinda makes you wonder, doesn't it...

[Pollux]

that person wil be solely held responsible for all damages Sasser has caused, is causing and will cause in the future.

That kinda got me thinking...

Let's use good ol' Diebold for an example. Let's say, hypothetically speaking, that Diebold makes a voting machine which just happens to have a flaw in the way it tallies the votes. Say someone actually goes to the voting booth and exploits that bug, someone wins by a landslide, and the exploit was found.

Sure, the guy would be found guilty of vote tampering and probably would be given jail time, but Diebold would hang as well for not producing a reliable voting machine which, in effect, ended up costing the state hundreds of thousands of dollars and plenty of man-hours finding out how to fix the bug or find another way to replace the Diebold machines.

But in this case, is Microsoft going to be held reliable for even a split-second? No. This kid's gonna fry, and everybody'll blame him. Why doesn't anyone every blame the product which allowed the virus to spread?

Doesn't anybody ever find it interesting that Windows has basically forced the world to accept its view of security, defined as "wait now, act later"?

Re:Kinda makes you wonder, doesn't it...

[Ironica]

Sure, the guy would be found guilty of vote tampering and probably would be given jail time, but Diebold would hang as well for not producing a reliable voting machine which, in effect, ended up costing the state hundreds of thousands of dollars and plenty of man-hours finding out how to fix the bug or find another way to replace the Diebold machines.

You're *so* optimistic....

The machines have to be certified by the appropriate officials before they're used. Diebold, in this case, would claim that since they followed all the necessary procedures and were properly certified, they can't be held responsible. And they'd probably walk away from the whole thing (mostly) unscathed.

This is the problem with proprietary software running public elections... no one can *actually* inspect the system. But they have to pretend to anyway, which lets the company off the hook.

Re:18yr old *man*?

[IANAAC]

If he is old enough to vote, drink, and serve in the military, I fail to see why you can't call him a man.

Because maybe he doesn't act like a man?

Out of the three things you mention men do, he probably only does one of them.

What is wrong with you people.

[azuretek]

You people are saying things like "kill him", "torture him", "do everything horrible I can imagine to him". I can't believe that! Personally I did nothing to "secure" my system other than run an up to date Anti virus, patch my system, and stay behind my firewall.

I wasn't affected in the least, maybe at work I had some extra calls but that was only after the news started scaring people and surely not when people became infected.

In all actuality he probably made us all a few extra dollars. I'm not sure why you all hate virus writers so much, personally I've never once had a virus and I once went 2 years without an anti-virus. If you all are so great, how were you so easily infected? I've done the bare minimum to be secure, and security wasn't even in my mind when I setup my systems. I think you all are just projecting your anger on someone else because you weren't bright enough to secure yourselves.

I'm probably going to be modded as flamebait but it's the truth, I don't see how you people were affected so much other than probably some extra free time at work.

Vandalism and Theft Of Services

[Bob_Robertson]

Why invent new crimes when it's just the same old crime on a new medium?

This punk trespassed, stole services, and vandalized the effected machines. Prosecute him for that.

60 days in jail and $20 fine, for each instance, served consecutively. That should be sufficient.

Bob-

Re:Kill the sonofabitch

[presarioD]

We'd only haveto do it once to get the message across.

And while we are at it we should reexamine the whole legal system and introduce capital punishments to everything!
YEAH!!! You stepped on my foot... you should die by leathal injection!
Uga Buga (jumping up an down in my hairy hunched-down body and banging a large piece of wood on the ground sometime in 45,000 BC)
How about killing him and his family and his pets as well? How about you do that on public TV?

There's an old saying...

[Bob_Robertson]

"Locks keep out honest people."

Microsoft is certainly not to "blame" for the fact that someone chose to exploit holes in their software. What Microsoft is to blame for is their arrogance in both claiming they are secure *and* absolving themselves of all responsibility for not *being* secure.

No computer system that offers services can ever be totally secure. You know that, I know that, but the Microsoft marketing department will pretend it's not true.

Let this punk get prosecuted for simple trespass and theft of service. Simply paying back all the victims for their time and effort wasted dealing with the worm should keep him in forced labor for the rest of his life.

Bob-

Re:There's an old saying...

[d_jedi]

When did Microsoft ever say their software is totally secure? I don't remember hearing that.. Hmm.. there was a company that claimed their software was "unbreakable".. oh, wait! But that was Oracle.. and wasn't there an exploit found shortly after that ill-advised slogan?

An 18 year old?

[Anonymous Coward]

An 18 year old with enough skill to find a buffer overflow exploit in WIndows RPC, and then to write shell code (it's pure x86 asm) so that it can spread like wild fire...

this kid is either an experienced systems programmer,
a skript kiddie (just unleashed it through out the world),
or a scapegoat.

C'mon, I thought slashdotters were KNOWLEDGEABLE about this kinda shit. You people taking this at face value?

ugh.

Re:An 18 year old?

[prshaw]

He did NOT find the buffer overflow in RPC.

At most he managed to take a fix to the buffer overflow and figure out where it was and how to exploit it.

Or he took the proof-of-concept that was released and used it for a guide.

Why do you think he couldn't do this before the patch was released? All he did was show people don't patch their computer fast enough, he didn't show any skill or new knowledge of holes.

How'd They Do That?

[wintermute1974]

One sentence in an article on Germany's Welt am Sonntag website states:

Der Hinweis, der zur Ergreifung von Sven J. führte, kam aber schließlich von Microsoft selbst.

Roughly translated, this says "The tip, which lead to the arrest of Sven J. [the Sasser's creator], came from Microsoft itself.

My question is: How did Microsoft do that? How could Microsoft find a guy, merely by studying the executable that he had created?! This really has me stumped.

Does anyone care to speculate?

Re:How'd They Do That?

[prshaw]

Why do you assume that all Microsoft did was study the executable? They could easily of had all sorts of other logs and reports from around the world.

Man?

[MicroBerto]

A bit offtopic, but being a 22 year old phogey myself, I think it's ridiculous when an 18 year old is called a "man". I dont even consider myself a man -- i just feel young in this world still. Looking at the morons known as freshman here, I think the word "kid" works better.

Yes, 18 is a legal adult in the US... kinda... but I think of nothing but "punk kid" instead.

Regardless, punish him like a man - hah!

man...heh

[alexs001]

"The Sasser author is an 18 year old man" Virus programmers should be referred to as boys. I think a certain maturity comes with the term man which is obviously not warranted here.

So what are they going to do now?

[manavendra]

Make the kid write a fix for Sasser and let that loose on Internet?

What a joke

[WilyCoder]

What a joke Windows is, all the man-hours devoted to its development, all the programmers who write/maintain the code for it. And it only takes the mind of an 18 year old BOY to bring their system to its knees. Wasn't the last MAJOR worm problem attributed to an overweight 18 year old? M$ should hire more fat 18 yearolds.....

Re:What a joke

[WilyCoder]

My, you are harsh. Did mommy and daddy not hug you, when you were a child?

Re:18yr old *man*?

[0x0d0a]

In the US, an 18-year-old is a man and not a minor from a legal standpoint. In the US, he would be tried as an adult, with corresponding potential penalties. I'm not sure what other term one could use.

Newsclip

[cmdrfletcher2002]

Here you can find a (german) TV-Newsclip.

Destructive Load

[Gary Destruction]

It's really suprising that no one's put a destructive load on these worms. With the amount of pc's that have been infected, the damage would be catastrophic.

As far as security goes, NT 4.0 is the main culprit. Microsoft should have done some serious code checking on NT 4.0 before basing future OS's on it. As you've noticed, an exploit on NT 4.0 is also present across the spectrum of NT-based OS's. So Microsoft's priority should be to examine the NT 4.0 code that went into 2000, XP and 2003 and find potential problems before they're exploited.

Illuminatus Trilogy

[0x0d0a]

For those who have no idea what is being talked about (for *years* I heard the term "fnord" being referenced and had no idea where people were getting it from), read the Illuminatus Trilogy.

Or don't. I found it to be confusing and bizarre. The authors like to switch between viewpoints of characters without warning (and a few times, in the middle of paragraphs). Some characters have viewpoints that are distorted by being wrong or doped up, one character is a dolphin (and has correspondingly un-human thoughts), the whole mess is added to by the fact that much of the book takes place in flashbacks and that it's very difficult to tell who is insane and who isn't, the fact that much of the content is complex uber-paranoid consipracy theory and religious or philosophical -- oh, and the fact that there are backreferences to all kinds of minor details throughout the books.

Mac Address

[BlackHawk-666]

They probably caught the stupid bugger by checking his MAC Address, which is embedded into the GUIDs which you create using that machine. If he used any COM stuff in his code then he would likely need GUIDs. The GUID creation routines use the MAC Address to prevent collisions from different machines. The rule has always been, they will create a GUID, but will only guarantee it's uniqueness if you have a network card installed.

Once they know the MAC address they can find him by asking all the ISPs to co-operate. The MAC address is used in ARP routing for networking and is how each card is uniqely identified. His ISP would know his MAC address, then all they have to do is turn up and arrest him. Of course, he could have just shot his big mouth off on IRC too e.g. "m3 l337 H4x0r br1ng d0wN teh ev1l M$ c0rp0rat1on...pr41s3 b3 to m3!"

Re:The auther prolly used WinXP

[JPriest]

This a groundless troll, if MS had backdoors in XP that sent info back to MS, don't you think SOMEONE would have noticed this a packet capture by now? Sometimes I would rather try to reason with an AOL user than a Linux user.

Re:The auther prolly used WinXP

[cubic6]

Take your paranoid fantasies somewhere where people don't know enough to refute them.

First, when you compile an EXE file with MS tools, it follows a format called the Portable Executable format[1]. You can verify this by opening up the EXE in a hex editor. There are a few headers, a few sections for code and data, and maybe a debug section. There isn't a section called ".backdoor" or ".spyonuser". By examining it very carefully, it might be possible to determine which version of Windows produced it and what compiler, but you aren't going to find your MAC address, name, street address, and favorite color anywhere.

Second, if you're talking about a network backdoor, that's extremely unlikely also. You can see someone using a backdoor on a Backdoors aresimple packet dump. Set up a packet sniffer between your computer and your internet connection and watch for strange packets. Write a virus or something, and see if someone from MS makes a connection to your computer. If you're so paranoid as to think that MS has trojaned all the routers, switches and hubs in the world so as to make it completely impossible to trace, go see a psychiatrist.

[1] - Reference for the PE format: here

Microsoft was involved in getting him arrested

[falonaj]

According to the German Heise.de article, the Sasser author was arrested after someone who knew him contacted Microsoft, showing authentic part of the source code.

Microsoft then called the German police.

they shoulda waited until MS announced a reward for it first!

I am sure the person who called Microsoft was doing this because s/he wanted the reward. Otherwise s/he would have gone directly to the police.

Translated quote from the article:

The first pointer to the writer came from the direct environment of the arrrested. In a phone call to Microsoft a person claimed to know the identity of the Sasser-author. After requests s/he also delivered parts of the source code, which Microsoft categorised as authentic in forensic analysis.

Another good programmer bites the dust...

[imidazole2]

A good example of the man trying to keep us down.

non-malicious virus?

[phazei]

Why doesn't someone write a virus that 'spreads like wildfire' and infects all unpatched pc's and then auto runs windows update or just patches the systems? It might still be illegal, but it's not like anyone could sue for damages... just violation of privacy and unauathorized system changes. But who would really go after them?

If Microsoft Says It, It Must Be True

[Tritoph]

Reuters link

"We are absolutely certain that this really is the creator of the Internet worm because Microsoft experts were involved in the inquiry and confirmed our suspicions and because the suspect admitted to it," said Frank Federau from Lower Saxony police.

OF COURSE! If Microsoft says someone's guilty, of course they are. The fact that they admitted it doesn't mean shit.

"Police described the suspect as a highly intelligent "computer freak" living with his parents."

But OF COURSE he's a 'computer freak' living with his parents. What else COULD HE BE?

Re:If Microsoft Says It, It Must Be True

[Tritoph]

"When police went to the man's house they found a home-built computer which contained the source code used to run Sasser."

HOLY SHIT GUYS! He built his own FUCKING COMPUTER! This kid GOT to be a genius.

Probably ran his mouth

[Sycraft-fu]

Most criminals, espically the non-organized ones, suffer from a problem of running-of-the-mouth. Almost all of us do, actually. We like to brag about the things we've achieved to friends. However, when you are braging about legal exploits like winning the pot at the last card game, it's fine. Thing it most crooks also brag about their illegal exploits too. This is fine, until one of their friends (or friends of friends) turns them in.

Also most script kiddies/crackers run their mouth when they get caught. We had one on campus, he was using some program (I forget the name) that tried to spoof itself as the default gateway so all traffic would go through him and he could sniff passwords. He couldn't get it working right and it kept bringing down a part of the network. Well when we caught him he instantly confessed everything to us, then to the police.

The thing is that he (and those like him) are so convinced of their invenurability because of their anaonymity, that they are just totally unprepared to get caught. So when it does happen, they usually just break down and confess everything.

Frontline

[Paulrothrock]

Frontline had a story recently about "cyber war" and how terrorists are attacking the US. All I could think through the whole thing is "It's not terrorists, it's script kiddies." It appears I was right.

My favorite part was when the 1337 dude they interviewed (complete with silouette and altered voice) said that it only takes 2 minutes to hack a Windows SCADA.

Let's hope this was "you know who"

[Ticklemonster]

Hmmm, you know, I haven't seen Helios release any more updates to his Helios Hook aimbot for Unreal Tournament and Tactical Ops since Thursday. And he was about due for another one already. And we all know he was making trojans already... Wouldn't it be nice if that were he?

I know the perfect punishment...

[ztwilight]

Make him work for Microsoft... Oh, WAIT a minute... :)

this guy is a genious! :)

[thatrez]

I wanna shake his hand, and hire him for my network security company.

What do you mean?

[Sycraft-fu]

Most locks ARE easy to bybass, amazingly so. The simple tumbler locks that 99.99% of houses have are nothing for a trained locksmith. My friend who has such training and tools (it's his profession) and can pick most standard locks in under 10 minutes, usually faster.

This is not an uncurable fault, however. On my front door there is a Medeco Maxum lock. This lock has a different kind of pin (they call it biaxial) and it is something that is very difficult to pick. My friend can't always do it successfully. It also has greater security with it's keys. A normal lock, you just grab someone's key and get a copy made at any Albertsons, then return the key, they are none to the wiser. Not so with Medeco locks, normal grinders can't dealw ith their keys, and Medeco dealers refuse to make copies without picture ID verifying that the person owns the lock.

Well then, should we be suing all these lock companies for selling these poor quality, easy to defeat locks? I mean they KNOW there is better technology right? Well yes, but there is a tradeoff: Cost. If you go to a hardware store, you'll find that locks are about $20-$30, no big deal. I paid about $200 for that Medeco lock. So if you want that kind of security, you need to be willing to drop about 10x the cash.

It doesn't end there either. Medeco locks are better than average locks, but they aren't invincible. They are still pickable, with effort, and they aren't invinvcible. For that matter, someone could just bash in your door, given enough time and force.

Just because better technology CAN be gotten doesn't mean there aren't tradeoffs in doing so.

Groundless troll???

[rjkimble]

Let's see, the guy's user ID is Adoph_Hitler and you're surprised he's a troll??? And you make disparaging implications about AOL and Linux users because of this guy? Just how reasonable is your flamebait?

Re:Groundless troll???

[JPriest]

Actually reading his previous posts he is not a troll. Most of the people I have met that use Linux in real life make simmilar groundless claims. He is simply a Slashdot groupthink subscriber. Better yet someone modded his post "Interesting". I know I personally am enlightened by it.

And he is also the suspected Author of Netsky

[smk]

Sasser was only a new type of worm for him - the police found evidence (Google Translation here) that he is also responsible for the netsky virus.

Scary phrases

[0x0d0a]

Okay, I realize that cooperation with Microsoft may be useful, but this is a little nervousness-inducing:

Spokesman Frank Federau for the Lower Saxony police said the man was arrested Friday. Federau said the suspect admitted to programming the worm, but authorities did not know if he had created all the versions of it.

"He made a confession, and the experts at Microsoft have now confirmed that he was the cause of this worm," Federau said. He said he did not have any details of how the suspect was found.

So...while I realize that this is a black eye for Microsoft, and that it's to their benefit to assist in tracking the guy down, and I realize that police budgets may not allow for competent cybercrime investigators, it always makes me nervous to see police saying "investigators from <large global corporation> have confirmed that this guy is the culprit". Yes, he'll have his day in court, but still...damn.

virii only really a roach!

[bieefy]

even tho the sasser and blaster virii have been infecting loads and loads of machines, it still only seems like a pest. most virii just infect somebodys email or just annoy somebody to the point of formatting their box, and then getting some av protection. there hasnt really been a virus that will actually destroy a piece of hardware so that the machine is completly unusable (wiping the firmware of a harddrive, or overclock the processr for example), and if the people responsable for the viruses at the minute realise that this can be done the there is no telling what can happen in the near future. just think, a highly replicating virus (blaster or sasser) with the ability to destroy a hard drive, or any piece of hardware, as soon as the user restarts! just a thought, but things may turn nasty in the next few years for microsoft! (lets face it, who really likes windows??? :) )

Only a script kiddy?

[UpnAtom]

Or a script kiddy who has been forced to put a sting on his contacts??

Harsh penalties do *nothing* to deter crime.

[UpnAtom]

Texas is the death penalty capital of the world. By your logic that would also make it the safest place in the world, yet people are murdered here every day. A person can be imprisoned for years (years!) if caught with trace amounts of cocaine, yet the crack epidemic is as strong as ever.

I wouldn't complain about his logic when you've used 2 crimes to generalise across the whole of crime.

Believe it or not, crack is addictive. I worked with a crack addict who sold his mum's car. He really didn't care about anything apart from the next fix.

Most murders are spur-of-the-moment crimes of passion. The murderers do not think about the consequences in the 5 seconds it takes to kill someone in your gun-obsessed country.

OTOH, this 18-year old allegedly rationally planned, designed, coded & released Sasser & Netsky, which caused god knows how much in damages, caused as yet uncalculated amounts of stress, and the actual number of people directly killed has yet to be investigated (I bet it's >1). Not only should he receive the full punishment under the law, but it should be a cruel and unusual punishment, just to make sure his peers remember.

Re:Harsh penalties do *nothing* to deter crime.

[Tin Foil Hat]

Boy, you better hope you have no skeletons in your closet, or that none of your family or friends do. What would you say if it were your brother or your son or daughter that had been caught? Would you call for pulling out his toenails as a deterrent? What other cruel or unusual punishment would you want for your kids when they show an unfortunate lasp of judgement?

Just because somebody you don't know committed a crime you feel passionately about does not mean that person does not have rights or that they should somehow be set aside in the interest of wanton revenge. This my friend, is called being civilized.

terrorist

[luwain]

I think the authors of computer viruses should be treated as terrorists. They cause lots of damage to innocent people. George W. should include computer virus authors as "enemy combatants" in the "war on terror". Lock them up. Throw away the key.

That's just too bad...

[thrill12]

...I mean, getting caught - no problem: this person did a thing that only a serious de-'script kiddy'-programming (preferably by some hackers) can fix now.
What I do find very bad however, was that the person who caught him should have gone to Microsoft first instead of the proper authorities. Where will this go ?

Re:The auther prolly used WinXP

[Snaller]

First, when you compile an EXE file with MS tools, it follows a format called the Portable Executable format[1]. You can verify this by opening up the EXE in a hex editor. There are a few headers, a few sections for code and data, and maybe a debug section. There isn't a section called ".backdoor" or ".spyonuser". By examining it very carefully, it might be possible to determine which version of Windows produced it and what compiler, but you aren't going to find your MAC address, name, street address, and favorite color anywhere.

Except that is just your opinion, you haven't provided proof. Remember they used to embed unique ID's in word documents until the word got out.

(OT) Schlage

[bkocik]

Fortunately, Schlage generally has a good track record on not having easily-broken locks.

I spent several years of my life as a locksmith. The unfortunate truth is, Schlage is just average. Not as bad as Kwikset (avoid like the plague), or Weiser (avoid like it's a Kwikset), and not as good as Master (formerly Dexter). Unfortunately a few years ago Schlage realized their locks weren't as good as Master, so they bought out Master's door hardware division (essentially the old Dexter that Master bought) and shut it down.

Schlage aren't bad locks, but they're not really as good as most people think they are. They're just kind of "okay". Not that you asked, but now you know. =)

Re:The auther prolly used WinXP

[cubic6]

A file format standard isn't "my opinion". The PE specification is published in many places, and followed by many compilers, including GCC. You can open an EXE file and compare it to the standard. There are no hidden sections or secret codes in an EXE file. Would you say that someone could secretly embed personally unique information in an XML document?[1]

If you want proof, get the exact same version of Windows and MSVC++ and compile the exact same source with the exact same compile time options on two different computers. Binary diff the result. If there are differences, determine whether they actually represent information about the machines in question, or are simply quirks of compilation.

I'm not going to post an in-depth dissection of the PE format with analysis of each section on Slashdot, because I don't have the time to justify my statements to someone who can't understand the difference between facts and opinions.

[1] - Yes, it's theoretically possible to use a form of steganography to embed data in the number of spaces between the end of a line and the linebreak, but let's stick to practical concepts...

Re:The auther prolly used WinXP

[tiger99]

But the chances are that the author did in fact use Windoze XP as the OS on his development machine. If not, it would have been Win 2000 or 9X......

Nothing to do with how he was caught of course. He most likely was sufficiently stupid to upload the virus from his own machine, has he used an Internet Cafe or an insecure wireless network he would have been untraceable.

It would be a good idea if people had to show ID to use an Internet Cafe, and wireless networks were banned entirely. I rate security higher than the imagined need, dreamed up by marketing men, to be able to use a PC anywhere, with no wires. Now I am going well off topic, but security matters, and a generic right to upload what you want, where you want, with no positive check on your ID, is a serious threat to other people's security and should not be allowed.

I don't know how severely German law can punish this scumbag, but life imprisonment with no hope of parole sounds about right to me. There must be an effective deterrent.

Sasser is my friend.

[Medievalist]

Sasser showed me which windows machines did not have their auto-patch routines working.

Since the PC support group had recently reported that all machines were now in the auto-patch system, we were quite suprised to see almost 1% (which is a lot of machines, around here) get sasser.

Incidentally, a crude way to scan your network for sasser (let's just say you've got a linux box handy with samba,nmap,bash, grep and gawk and that your network is composed of three class C segments numbered 10.0.1.0, 10.0.2.0, 10.0.3.0 for the sake of example) is:

nmap -p 5554 -oG '-' 10.0.1-3.1-254 |gawk '/^Host.+5554\/open\/tcp/{print "nmblookup -A " $2}'|bash |grep "<00>"|grep -v GROUP

If your machines have useful netbios names (such as their location, for instance) and/or you know the names of your users, that should give you all the info you need.

Thank you Mr. Sasser author! You the man! Your non-destructive code was a public service from where I'm sitting (yes I know others feel differently - the real universe is subjective, neh?).

Go get a dictionary

[sparkz]

and look up "Irony." I'm guessing you're American.

Modding?

[upside]

What does a system for secure legal transactions using XML have to do with a teenager who was ratted on by his mates? Either this was a joke or this guy is way past help. I suspect the first option.

I can't believe this has been modded up. Well, Funny may have been appropriate.

Jeez.

Like prohibition stopped booze in Amercia ?

[Gopal.V]

It didn't stop alcohol , but started off the highly profitable boot-legging which gave birth to protectionist mafias ... and in short america's criminal class ..

Considering that example , maybe education should be prohibited :)

Looks like the old saying's true ..... if guns were outlawed ... only outlaws would have guns ...

Names & Reward

[damian]

Maybe we find out about the real names and versions of all the Sasser and Netsky variants now. The ones we know now are just made up by the anti virus guys after all.

heise.de today mentions that Microsoft will pay $250000 to the (less than five) informants.

Re:The auther prolly used WinXP

[Snaller]

Yes its your opinion, and you admit it at the end. We can study the GIF specification as well, and people have been hiding information in them for years.
I'm not saying they are, just that there aren't any proof they aren't.

Re:The auther prolly used WinXP

[cubic6]

The nice part about bringing steganography into the argument is that it has deniability: It's pretty much impossible to prove that something does *not* contain steganography. I can't argue that it's impossible for EXE files to contain steganographic information, but I will argue that it's extremely unlikely given the specific circumstances in original parent.

Re:The auther prolly used WinXP

[cubic6]

As a sibling poster mentioned somewhat rudely, yes, it's entirely possible to embed information in an EXE file using steganographic techniques. I retract any part of my statements which attempts to deny that.

I would like to say that my post was in reply to a post claiming that the virus author was captured because of a Microsoft backdoor in their own compiler products. He did not specify that the virus author had a trojaned copy, or that his compiler was altered in any way from one I might install. He implied that there was a backdoor in the standard installation of MS tools and Windows which inserted enough personal information for tracking. I'd simply like to state that under the conditions stated by original poster, that technique is not practical, and extremely unlikely.

Re:The auther prolly used WinXP

[ultranova]

But the chances are that the author did in fact use Windoze XP as the OS on his development machine. If not, it would have been Win 2000 or 9X......

Which reminds me of something I've always wanted to know: What stops the virus writer from being hit with his own virus ?

Nothing to do with how he was caught of course. He most likely was sufficiently stupid to upload the virus from his own machine, has he used an Internet Cafe or an insecure wireless network he would have been untraceable.

I would imagine that putting it into a P2P network as "hot-young-ones-screensaver.exe" would had been the best way, especially if he had actually bothered to make a real screensaver with the virus as a trojan payload. Especially if the virus in question was a "real" (infecting program files) virus, and the vector program was originally made by someone else...

It would be a good idea if people had to show ID to use an Internet Cafe, and wireless networks were banned entirely. I rate security higher than the imagined need, dreamed up by marketing men, to be able to use a PC anywhere, with no wires. Now I am going well off topic, but security matters, and a generic right to upload what you want, where you want, with no positive check on your ID, is a serious threat to other people's security and should not be allowed.

It would be a good idea if people had to show ID to walk on the street, and had to carry small spy microphones ("bugs") with them at all times. I rate security higher than the imagined need, dreamed up by freedom fighters, to be able to walk anywhere and talk with anyone, with no one listening in. Now I'm going well off topic, but security matters, and a generic right to go where you want, with no positive check on your ID, is a serious threat to other people's security and should not be allowed.

Why is it that the word "security" makes people's brains stop working ?

I don't know how severely German law can punish this scumbag, but life imprisonment with no hope of parole sounds about right to me. There must be an effective deterrent.

I see someone got hit hard by the virus... Instead of likening a virus writer to a murderer, how about keeping your computer updated from now on ? You'll do both yourself and the Internet in general a favor, and don't make yourself look like an idiot.

Reward Information...will be paid on conviction

[Damhna]

http://www.microsoft.com/presspass/exec/bradsmith/ 05-08sasserarrest.asp

Re:The auther prolly used WinXP

[tiger99]

Actually I did not get hit, and have not been hit for a very long time now, but my work was disrupted because the corporate network got hit.

I will not say that my systems at home are totally immune, but I have OpenBSD, FreeBSD and two Linux boxes, and the only Windoze machine, which is the laptop, runs a fully up to date Win2000 (won't touch XP with Raw Sockets!), and is never connected directly.

Even before then, when I did access the net from Windoze, I was only hit twice, which showed me that certain anti-virus software, even when kept up to date, is worthless, both were fairly old virii. One was a Word macro, I do not run Word and so theoretically was immune, except that Norton had not bothered to analyse the thing correctly, and in my case I had the free Word Viewer program, which of course opened the file. Now supposedly there was no menas by which macro code could be executed, but this virus obviously had another mechanism, which Norton had not bothered to analyse, which trashe dmy machine instantly.

The second one was a stupid one that simply closed the browser, if Javascript was turned on. I proved that Netscape was seeing and reacting to the virus before Norton saw it, so there was clearly something wrong, but Norton support staff lied and said that I was protected, yet I could reproduce the effect again and again, simply by turning Javascript on and going to the relevant web page. Funnily enough, a scan of the downloaded file by Norton was positive every time.

I have had a pC trashed by Panda, so has everyone else I know who has tried it, and practically everyone who used McAfraud seems to have been hit, sooner rather than later. I have a very low opinion of the anti-virus industry as you might gather, and an even lower opinion of the scumbag Monopolists who deliberately add features which destroy any hope of security. No doubt I will get hit again (not for about 5 years now) despite my OpenBSD packet-filtering firewall, and only using the Mozilla browser, keeping everything up to date, running F-Prot antivirus, no trace of Outlook or IE to be seen anywhere, even on the laptop, but it will not happen nearly as often as if I continued to use a trash OS, browser and mail client.

So sorry to disappoint you, I did not get hit, and don't expect to get hit very often, but I still think they should throw the book at scumbags like this. And I agree, those who do not keep their computers up to date do endanger other people, I am sick of the number of infected emails I get from PCs which have been infected. They can't do anything, it is just annoying having to delete them, and tehy are about 50% of my mail. But if anyone looks like an idiot, it is the one who jumped to the conclusion that I had been hit, when I gave no such indication. If I had been hit by that one, it would be my own fault, fairly and squarely, the same for anyone who is stupid enough to use Lookout, or its perverted, cut-down relative as their email client, or to use IE as their browser. They deserve what they get.

Keeping a PC up to date, both with the buggy patches from the Monopolist and the antivirus software gives absolutely zero protection against new threats. The underlying OS and the mail client and browser also need to make decent attempts at security, or everything else is in vain.