Slashdot Mirror
Bagle/Beagle Variant Includes Source Code
NASAdude writes "Sunday brought a lot of fireworks... and the release of two new Bagle/Beagle variants. One of the variants includes a copy of its source code as an attachment as it spreads via email. It is expected the inclusion of the source will result in numerous variants.
It's been dubbed Beagle.Y and Beagle.Z by Symantec and Bagle.ad and Bagle.ae by McAfee.
ZDNet ran a story that covers these new variants."
beagle.sourceforge.net doesn't have it :(
The Slashdot Paradox: "100% Overrated"
Reading title fast, I thought that NASA had released some source code... *sigh*
I live in Soviet Canuckistan you insensitive clod!
Can someone please make a variant that makes users regret not patching their systems? Like, overwrite the BIOS, turn ones into twos in all spreadsheet documents, delete all JPGs, MP3s and AVIs, send a resignation to boss@yourdomain.com and a log of your online banking transactions to the FCC, donate 10 bucks each to the KKK and THEN put up a screen which lists all that.
How long until SCO sues Bagle's author for copyright infringement....
Rich
Funny.
If you try to google Bagle assembler "source code"
you'll get
Microsoft shares source code with students - ZDNet UK News
It's okay, the source code is in assembler, so all the script kiddies will just look at it in confusion like it's some strange alien language.
VBscript or WSH which is inherently Open Source on Windows?
<nitpick>Open-source is a type of licensing; VBScript is a language, and WSH a technology, not licensing regimes. Typically the source-code for a VBScript app is distributed with the application, but not necessarily - it might be obfuscated - but might well be subject to proprietary licensing restrictions.
Just because you can see the source code doesn't make it open source. Open source implies certain freedoms that are additional to being able to see the code: the right to modify and redistribute the code, for example.
</nitpick>
This is where the serious fun begins.
So far you could spot a viurs author by the "evidence" that he had the source code of the virus on his PC. Now everybody has the source. I guess we need bigger jails soon.
(example given in MIPS since it is the only assembler I know)
well think about this the kiddy scripter does not need to know that li is load imedate but all he needs to know is 24 is the register, do not touch, and 1025 is the port, change to a new port to try.
Bots in particular have sky rocketed. In the last few months alone we have seen names jump from two letter varients (bot.ay) up to 4! (bot. wrzq) Do the math, its an insane number.
One of the major contributing factors are virus generators! Yes there are programs out there that will write the bot for you!
On the other hand, because they are all variants of the same family, they are fairly easy to keep the AV software up to date to catch even the latest variants early.
Seem Familiar?
In all seriousness, having the source code can't be a bad thing, since this way, it'll be easier to stop if we understand how it works.
And at least if we all get a virus, there is a good programmer behind it, and it's less likely to crash on all of us.
Normally I'd consider virus writers the scum of the earth, but this one is talented enough to be a professional hacker, from my limited experience with assembly language (512 byte boot sector on a FD). Not that I endorse email worms, but this guy has talent.
What license is it released under?
/^([Ss]ame [Bb]at (time, |channel.)){2}$/
This just brings to mind an idea I've had for a long time now. And it's in no way an unique idea, I know that for a fact.
So here's the idea: Write a variant of one of these viruses. And he's what it does. When it infects a machine, it sends out copies of itself to every person in the address book. After that, it forces the machine to download some sort of Anti-Virus software. PC-Cillin or NOD32 are favorites of mine. It installs them, then forces a Windows Update.
Sounds good, right? But read on. My second idea is better.
Here it is:
Viral Anti-Virus Software.
Most virus recognition is based on Pattern Recognition, from what I have garnered from my research. Create a virus that spreads like wildfire -- kind of like Melissa and Code Red spread all crazy-fast -- except this little bit of code contains Virus Recognition software in it. It invades unprotected boxen and then starts a continuous scan for Viruses.
You know how most people click 'Yes!' to anything that pops up, a la Gator?
Have this little golden nugget of Illegal Do-Gooding pop up a small dialog saying, "File.Extention is infected with a virus (XX% Probability). Do you wish to delete? Y/N?"
And just to hold with custom:
Step One: Create Virus.
Step Two: JAIL!
Step Three: PROFIT!
Edward@Tomato - /home/Edward/ man woman
man: no entry for woman in the manual.
"Qua!?"
Tried to run it once, and it crashed.
All it means is that there are still clueless people using computers. I already know that. Sometimes I think it's a damn shame viruses can't do the kind of real, permanent damage that shocks a clue into people -- if there is such a thing. For once I'm actually wishing for a SCO story.
Please, please, please, I know I'm preaching to the choir here, but please, for crying out loud, please if anyone ever asks you about buying a new computer, just point them towards the nearest Apple authorised reseller. If they complain about the price, point out that the inherent usability and security designed into Mac OS X from the ground up will more than pay for itself in terms of not cursing and screaming at the damn thing every time you boot it up. If that doesn't work, mention that Macs are prettier. If that still doesn't work, give them six months tops before you're saying "I told you so".
Windows may be popular but that doesn't make it any good.
Je fume. Tu fumes. Nous fûmes!
I'm so glad my entire network is running Linux. :) I swear there is some major virus every goddamn week. Linux has it's own problems, but I am glad I can do something about them. I wonder how long it will take for businesses to realize that running around chasing exploits and viruses isn't a good way to make use of your technical support staff time.
-Mind
Check the EULA that comes with the virus, it's Shared Source, not Open Source!
"Only wimps use tape backup. Real men just include their important stuff in a Windows worm and let the rest of the world mirror it."
And in the other news today, new variant of the Beagle virus, Beagle.goatse, opens a easily abusable back door in your system. However, so far it seems that hackers have been unwilling to use this hole to breach into our computer.
Oh wait, there are a dozen in my inbox already. God you guys are quick, thanks ;)
Actually.. i know its been tried before, i think it was code red/nimda ?, where someone made a patch spreading in same manner, but instead it patched the systems.
.
:)
About time to try that concept again ?
I know its gonna generate some traffic, but 1 new variant amongst 50+ new others isnt much.
Consider pro/cons
+ you could patch most of the vulnerable systems by including the official M$ patch
+ inform the user that the pc is victim of a virus and lead him/her to a virusscan.
+ remove the original virus, or some of the variants.
+ save bandwidth/spam for each pc fixed [1]
-generate more traffic [1] nothing compared to the current amount of net traffic and spam it generates.
-would be illegal
Worth to consider imho, if you write it properly and not suffer from same flaws as the codered one did. Im sure you could do far more good than harm
beagle.sourceforge.net might not be the proper place for it though
*sigh* Please don't release another anti-virus-virus. The last one was at least as much a pain as the one it was supposed to cure.
If it's encrypted, how did they find out it's source code? They must have already cracked it.
And the author has already filed his DMCA suit against them for cracking his encryption.
Johnkoerner.com
Does it also point out where to get an assembler? I suspect that'll be a barrier of entry for a lot of kiddies.
I cannot tell if you are being sarcastic or serious so I will assume that you are serious.
Just about every skript kiddiot out there has a copy of MASM, TASM and/or NASM on his machine. If you do not believe me then you are underestimating the average skript kiddy. Go hang out in some script kiddy message boards or especially IRC and you will see that they may be obnoxious little scum but they are not quite as naive and incompetant as you make them out to be.