Slashdot Mirror
64-Bit Rugrat Virus Emerges
weekendwarrior1980 writes "The first computer virus to target 64-bit Windows systems has been detected by security authorities. Dubbed "W64.Rugrat.3344," the virus is a fairly benign, proof-of-concept infection agent, according to a report issued on the Symantec Web site. This threat does not infect 32-bit systems and will not run on 32-bit Windows platforms. It is a direct-action infector, typically exiting memory after execution, and is written in IA64 (Intel Architecture) assembly code." Update: 05/29 19:26 GMT by T : Yes, this is the same "non-event" virus already mentioned.
It's time for the summer reruns!!!
Hasn't this already been reported on /.?
http://slashdot.org/article.pl?sid=04/05/27/158244
We've seen this before: here
The Technonaut
atleast this one won't make my life working for the IT dept at my school hell.
since it has twice the bits it gets twice the postings... yay!
Runnin' On Empty
PLEASE PLEASE PLEASE do a search on Slashdot for previous articles before posting and/or approving articles!
Going to the Search page, typing "Rugrat", and clicking the "Search" button already brings up a story about the first 64-bit Windows virus from Thursday, May 27th, 2004.
Unbelievable. Took me 2 seconds to do the search and would save a dupe.
Slashdot's habit of duplicating stories is getting pretty rediculous.
I couldve proven that a virus was possible
There, I proved it's posible
I, for one, welcome our new 64-bit beating-a-dead-horse jokes. (in anticipation of the inevitable)
"What do you think?" "I think 'What, do you think?!'"
"First duplicate article on the 64 bit windows virus found!" more at eleven.
Pubcrawler.ca
.
That has got to be comforting to people making 64 bit OS's. There is code waiting!
Now finally a way to make your 64bit computer feel more like your 32bit ones.
Got hosting
Maybe some day the editors will read their own site.
Or maybe their own e-mail. I sent a message to the on-duty editor while the story was still red, and it STILL got posted.
The World is Yours.
Dupe.
Don't the editors them selves read Slashdot...hm, I can see why not. Vicious circle. The more dupes posted, the less they're inclined to read articles, and the more dupes they approve.
"W64.Rugrat.3344", soon to be followed by "W64.Reptar.3344".
We have here a virus for IA64, a system that's out there in a minimal amount of machines, all high-end (presumably well-protected) servers. Now one of the standard explanations for the lack of viruses for Linux is that Linux is not as widespread. It is, however, much more widespread than IA64. Thus the amount of Linuxen out there is certainly not the only reason we're not seeing virues for Linux. Who knows, maybe Linux *is* actually more secure than Windows?
-Lars
We heard you the first time.
First IA64 Windows Virus Released
I think they mean:
The first computer virus to target 64-bit Windows systems has been created by security authorities.
Where would security companies be without inventing threats to sell their own software? It may only be a "proof of concept" - but they've now shown the truly malicious virus writers and script kiddies that there's a new platform to have some fun with.
If they really gave a damn about security, they'd distribute and discuss the proofs among themselves so that they would be ready (& and preferably have already told the software vendors how to fix the problems) for when the real threats hit - and they'd shut the fuck up when it came to the general public.
Something about this seems familiar.... Oh Yeah
As I have said before, a server with a morphable ISA can be really valuable. This new infection only works on i64. Now imagine a writable control store i32 where you can change the decoder/isa cracker. A linux disti with toolchain built from a random #. The random # permutes the ISA and updates the WCS. A new binutils is built and kernel built from that. It will only run on that #'d ISA. Any worm arriving on the wire will die since its i32 decodings have no meaning in this context.
Hedley
Same. The on-duty editor got at least two emails about the dupe. *shakes his head*
Since everyone else seems to want to talk about the fact that this has already been posted....
CRAP, I don't have anything witty or intelligent to say. I guess I'll go read the article.
P
Humans are slow, innaccurate, and brilliant; computers are fast, acurrate, and dumb; together they are unbeatable
The SD.DupeStory.2004 virus has been running rampant. Although, experts claim it is simply an operator error.
Natural Selection: self-destruction of the poor and lazy
Wasn't this chip mentioned recently as having in its hardware a protection mechanism to prevent code from being exec'd in the data segments (i.e. stack!)
:)
Supposedly they were waiting on windows to enable the feature.
No pressure to hurry up that feature enable I guess
Hedley
This looks pretty oldschool... no stupid RPC nonsense or VBScript, it's a virus that infects other programs, and is spread by copying infected executables around. Just like the old days with MS-DOS viruses passed around on BBS's.
Incidentally, you could probably limit your vulnerability if the program was installed by an Administrator but only run by users without write permission, or if you removed write permission from programs that you run in your own folders.
The really cool thing is that it's written in IA64 assembly code. That sounds like quite an impressive feat. From what I hear that is far worse even than the PPC64 assembly code I usually write.
The payload causes infected windows machines to resubmit the same story to slashdot every day, in the hope that a duplicate story will arise.
Richard Stallman was quoted as saying the virus was sourced at Microsoft in an attempt to make linux news sites look silly, then requested that the source for the virus be published openly under a FSF license. SCO then claimed that they had the first 64 bit virus, and were now going to sue the author and every owner of an infected machine. Larry Elison was rumoured to say that the Oracle 64bit virus ran faster and cheaper than an MS 64 bit virus and stood grinning until someone pointed out that Bill Gates can buy him 10 times over.
Gill Bates, the Architect of Windows and the Matrix, was pleased to say, "Our studies have proven that an eMachines costing $500 and running Windows XP has a lower TCO for opening a 2kb email than does a cluster of 1000 IBM z360 mainframes running Linux performing the same task. The cost, using Windows, was about 1 cents per bit, while the cost of the Linux setup was about $88,281,813.25 per byte. Clearly, Windows is much less expensive than Linux.
"Further," said Gill Bates, "employees get more coffee breaks while Windows is reinstalling after a virus breakout. With a Linux environment, the employees of your enterprise might have to work all day long, because the operating system simply isn't considerate enough to offer a coffee break or two every ten minutes."
Everybody knows that 64bit viruses can do N^2 the damage of a petty little 32bit one.
-sincerely,
script kiddie
Even the comments are dupes...
To all those saying that a proof-of-concept virus is still a virus and that this guy is doing a disservice to the world by writing one, I'd like to give an alternate way of viewing it. Writing proof of concepts that aren't spread in the wild (like the other viruses mentioned in the second link) help anti-virus groups in advancing knowledge on current/new techniques that may not have been known about or considered in the past.
hsalsitna
I e-mail Daddypants about the duplicate status of this story and they still ran it. Does anyone ever check that email address?
-m
http://www.invisik.com
I thought people only wrote Windows viruses because it would hit the most people possible. How many people are running Windows64?
hsalsitna
.. we all head over to the previously posted article and post other users' +5, Informative/Interesting/Insightful responses as our own, on here.
No, you fail it.
If you are going to complain about dupes, why not take a look at the current comments before creating another "Yep, it's a dupe"-comment.
Dupes are bad, but dupe comments about dupes...why, that's just silly!!
Read the symantic security advisory, it says IA64, and specifically says NOT AMD64.
Your post is almost as bad as the fact that this article was even put up here today.
- It's not the Macs I hate. It's Digg users. -
Is this a proof of the "Slashdot dupe story" concept?
Beware: In C++, your friends can see your privates!
This is the second IA64 virus. Windows for IA64 was the first.
hsalsitna
I mean, 64 bits, eight bytes, it must be some ultra leet code ! Maybe using some advanced compression technology ?
----------
mobile porn
I know we shouldn't cheer on virus writers, but this is one person who actually deserves credit this time. IA64 assembler, not VB. This actually took some skill and knowledge to create.
...it isn't the first Slashdot repost :oP
I've noticed that everyone who is for abortion has already been born - Ronald Reagan
If a virus doesnt actually do any harm but proove a concept its not really a virus. Sure its violating your system but maybe instead of calling it a virus it would be better to use a name that reflects the reason behind it - is a security flaw in windows. Or commonly known as a microsoft cock-up.
This comment does not represent the views or opinions of the user.
64 bit Windows was the first. *ducks*
DUPE-DUPE-DUPE I WANNA DUPE MY GRANDMA, DUPE DUPE DUPE slashdot sux, get some editors! shoutz to the gnaa, btw :) i like you guys
to try the newest gentoo/64 package
News for the Amnesiac. Stuff that mattered.
Isn't AMD's 64-bit platform called x86-64?
Yes, the editors should try cut down on them, but there's no need to bitch and moan. If you're so worried about the time wasted reading this dupe then why waste even more time posting to it?
It was an honest mistake. Get over it.
They are even duping previous made comments
$ emerge rugrat
:-(
These are the packages that I would merge, in order:
Calculating dependencies
emerge: there are no masked or unmasked ebuilds to satisfy "rugrat".
"All you have to do is be fragile and grateful. So stay the underdog." Chuck Palahniuk, Choke
i am sick and tired of reading these posts "dupe!!!" if it is a dupe why do you ppl post in that topic??? then on top of it you dupe each others posts as i look at the posts made i see about 10 posts about the dupe...pot called...the kettle is black...
Here we go again... So, why is MS IIS so much more exploited than is Apache? Why is MS Exchange more exploited than 'sendmail' (these days)? Why is MS SQL more exploited than Oracle?
Answer: Because they are so much more exploitable; Not because they are more popular.
BTW, welcome to slashdot.
I'm glad I'm using 32bit windows so I can be safe from these pesky 64bit viruses. As the viruses move on to newer windows technology, I will keep my 'ol 32bit windows and eventually be free from virus attacks! I for one welcome our new 64bit virus overlords.
Could you guys at least keep a little current before going though the queue? And geez, most the posts near this one are at least a week old if not double posted on slashdot.
Apparently the only known symptom of this virsus is its ability to generate multiple /. posts.
Let me be the first to give a..
00 00 00 00 00 00 00 65
00 00 00 00 00 00 00 72
00 00 00 00 00 00 00 65
00 00 00 00 00 00 00 72
00 00 00 00 00 00 00 33
Why do people make 'concept viruses?'
Who does this? Is it a matter of hackers trying to warn others of what is possible? Is it about people trying to see for themselves what is possible without causing harm?
___
It's the end of my comment as I know it and I feel fine.
I hate people who say that the reason for the amount of virii for Windows is caused because of it's popularity. 64-bit Linux has been available for a long time now and are there any virii targetting it? I didn't think so.
Every slashdotter knows the real reason for Windows virii (hint: Outlook etc.)
Honestly, I would have modded this as redundant, but felt that the original author should at least get credit for coming up with a witty post (instead of another unoriginal AC bastard).
Ok kiddies, troll away...
"Hell hath no fury like a woman scorned for SEGA. ..."
It is not concievable that a single person can create a virus. Therefore code theft must have happened. It must have violated SCO's self-proclaimed Intelectual Property.
Hint to drinkypoo: if there are six posts already pointing out that it's a dupe, it's redundant. Should the moderators allow dozens of posts saying the exact same thing dominate the thread?
You've already got the karma bonus, why bother playing karma roulette by dupe-spotting?
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
The only thing wrong with Slashdot is that Karma is Kapped. Otherwise it would be the best RPG ever.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
If you're going to post something redundant, you're taking the chance that the mods won't think that you're as clever as you think you are and mod you down. There's no use complaining about it. (And the moderators certainly weren't wrong to do it.) If you really don't care about your karma, then why the whine?
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
I'm just trying to make the world a better place.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
PLEASE PLEASE PLEASE do a search on Slashdot for previous articles before posting and/or approving articles! Going to the Search page, typing "Rugrat", and clicking the "Search" button already brings up a story about the first 64-bit Windows virus from Thursday, May 27th, 2004.
An even quicker method is to click on the symbol that the article is talking about (in this case, the combination lock). This immediately brings up the two stories side by side.
How difficult would it be to modify the slashdot submit story to display the previous stories submitted under a particular symbol?
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
Bunch of fucking morons.
Here's 3 words for you: "Pot", "Kettle", "Black"
Don't ya get the impression that the AV vendors cook these up just to keep themselves needed?
Am I the only cynical one here?
Oh that does it for me. .. err geekier?
:P
.. "Where in the world? ... PC-world!"
Yet another MS-Bashing article, such lack of originality, any excuse to blame Microsoft and now double in a row!!
Oh!!! - and I do recall how SlashPot was so very informative and the nerds so very, so very
Oh that is it, that does it for me then-
I shall wipe my account, Slash My Wrist and just say "ADIOS cruel PC world".
This comment has been sponsored by:
... <enter music>
Sometimes I see a dupe article on /. Sometimes that same article will appear more than a few times. Do I get up-in-arms about it? No, I just let it go. /. has about 10 editors, AFAIK, and who knows how many stories get submitted everyday? I'd say at least in the 1000-range. So you expect every fscking article that is interesting to be reseached?
/. are HUMAN. If they post a dupe, ignore it, go to another article, rethink your view on it. I can hardly believe that you have never made a mistake in your life. You've never typed a wrong character when you were coding? You've never wrongly diagnosed a pc problem? The /. editors are doing us a service of showing articles that they think WE will find interesting. If you have such a hard time with an occasional human failure, go look for another site that's as good. I can assure you you will not find it.
Flame me all you like, but I'd just like to point out that the editors of
Sitting at Score:1... Shame
Put identity in the browser.
Another virus for another version of an M$ OS. Wake me when something new happens.
This isn't news, it's just inevitable.
Professional Politicians are not the solution, they ARE the problem.
Does this virus run on Wintel64 boxes that have one of the NX bit hardware protection? I think that was supposed to prevent buffer overruns...
Sure that was expected.
/me pukes on windows! YUK, What am I doing in the public !!!
remount the user directorys with a noexec flag.
Instant virus stoper in about 5 secs note everyone gets booted out and has to relogin.
This stops all execs in a users directory being directly exec until I have had time to run the virus scan but they can be loged in while I am fixing.
There are other ways of fighting back against this kind of attack. Merge the noexec flag with a script lock down(command/console is gone but X11 is not) the system has gone from being able to run virus to a full system lockdown note they system is still usable in a lock down. I just wish I could find the flags to lockdown openoffice fully with out locking it out completely note you still have abiword and I would have a complete lockdown system. Note there has to be a way.
People Yell and screem because everyone finds particlar things back to system defaults but it is a lot better than having to boot everyone and keep them out until the problem is fully fixed. Note there is away to add a antivirus scan to every ELF ran on a linux box if the box has been setup by someone who knows what they are doing.
How about...
"The previously-thought benign 64-bit Windows virus was just discovered to not be so benign; one of its recently observed symptoms is that it causes duplicate stories to be duplicated! Thus, a single story on the front page of slashdot.org will suffer the standard duplication, then this new un-benign virus duplicates until there are count'em FOUR duplicate stories on slashdot.org's front page. various computer anti-virus laboritories are now speculating that this 64-bit Windows virus could possibly have been making its rounds on the internet ever since the founding of slashdot.org -- oh the humanity!"