Slashdot Mirror
Latest MyDoom Variant Gives Google Problems
Devil's BSD writes "It seems like the latest MyDoom worm variant has caused a bit of an Internet storm. Google, at this time (12:28 EDT), is returning 503 errors on all queries submitted from certain locations. The MyDoom variant searches the user's address book for email domains (i.e. @yahoo.com) and searches various engines (such as Google) for email addresses in that domain."
Virus writers want to attack Microsoft or SCO, fine... but this... this is war! YOU DO NOT ATTACK THE GOOGLE!!!
Now my hotmail account will start getting spammed :(
i was getting errors when trying to search, but people i was talkin to online elsewhere in the country were fine. my whole office was screwin up.
gmail still works tho, hrm.
I thought I was going nuts, I've never had google give me problems.
I found it hard to remember the names of other search engines that I could use though.
Everything else seems to be ticking ok (news, images, Froogle, etc...)
I'm getting "
Server Error
The service you requested is not available at this time.
Service error -27
"
for all of my search attempts.
If MyDoom uses certain search strings, you just dump all such searches? Worse case, just dump any search for anything which looks like an e-mail account?
CNN is on behind me, and they've been talking about nothing but Google's IPO. Seems like really bad timing for Google. :-(
Javascript + Nintendo DSi = DSiCade
Google is down ... the world is ending! The beginning of the apocalypse! (I can't even check if I spelled that right without google)
Google going down is the first sign of the apocalypse. Now if my wife asks me for sex (the second sign), I'll know the world is going to end...
To use the Google API you need a key generated by Google, which requires a small registration, so, while of course, if the perpetrator did fill it out, he probably put in fake information, it would still be a good place to start looking.
503? screw that... why not have a new error number designated specifically for MS infected systems... error 999: The operating system you are using is insecure and has been exploited... you are partially responsible for bringing this server to its knees... Now go in the corner and think about what you've done.
---
Programming is like sex... Make one mistake and support it the rest of your life.
The fact that Google went down appears to have affected the BBC, given that it was given headline news on the radio. Proof that Google has become a world wide institution(or maybe just where the BBC does some of it's "research" :) )
is returning 503 errors on all queries submitted from certain locations
Is that geographic locations, IP blocks, or what? I can use Google just fine at the moment, but have heard of trouble in California (I am in Colorado). TFA gives no details. Anyone have answers?
bash: rtfm: command not found
The query that google seems to block in order to work around this problem is a query for "mailer-daemon@domain.com" where "domain.com" is pretty much anything.
...just use Google's alternate search form...
Happiness is like peeing yourself. Everybody can see it but only you can feel its warmth.
I would normally use Google to figure out the answer to your question, but, uh...
OK, so if Microsoft comes out with an antivirus product, what incentive do they have to immunize Windows-based computers against worms that attack their competitors? (i.e. Google vs MSN Search).
Bill Clinton: Pimp we can believe in. - The Shirt!!!
All Hail My Doom.
For doing the very thing we always failed at doing.
OH MY GOD, YOU SLASHDOTTED GOOGLE, YOU BASTARDS!
Yo Grark
Canadian Bred with American Buttering
Perhaps I'm simply 'located' better, but I can do regular google searches just fine.
But when I ask for "email slashdot.org" it returns a forbidden search page.
So it looks like Google is primarily stopping searches that are typical of this virus, but they may also have automated filtering that stops searches which are too many from IPs and netblocks. This part is probably something they implemented long ago.
But google is going slower for me today, and sometimes it stalls (some of the frontend machines dropping out a bit more frequently than usual?)
-Adam
Webmasterworld has an interesting thread which details the problems are user agent and locality specific (for me in SoCal IE and Firefox are borked, Konqueror is working, but others report no problem with Mozilla or no problems in certain locals).
How do I keep track of people who are fingering
use mirrors instead:
http://www.google.co.jp/
http://www.google.fr/
http://www.google.se/
http://www.google.fi/
http://www.google.ca/
all above seem to be responsive atleast to me
There are no atheists when recovering from tape backup.
How dare this amazingly useful -- cant live without -- service i pay nothing for go down?!?!
Sometimes I wish computers were less friendly.
I can't do any searches, and I tried both of the ones you referred to, and they both give this error message.
moo
I'm in Mexico and Google is still not working! It is amazing that we're so tied to Google that we forget the others search engines (in fact when I couldn't search into Google I thought "well I'll wait a couple of minutes" instead of using another search engine like Yahoo!)
Free iPods, no trick, no steal, (almost) no pain:
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
My Systems
No problem, what's your e-mail address? I can forward you ten examples of the results of this error...
-Rob
Marriage doesn't have to suck!
also, doing whois google.com, returns:
.com and .net domains can now be registered
M
E .THAN.SECZY.COM
Whois Server Version 1.3
Domain names in the
with many different competing registrars. Go to http://www.internic.net
for detailed information.
Server Name: GOOGLE.COM.SUCKS.FIND.CRACKZ.WITH.SEARCH.GULLI.CO
IP Address: 80.190.192.24
Registrar: GANDI
Whois Server: whois.gandi.net
Referral URL: http://www.gandi.net
Server Name: GOOGLE.COM.HAS.LESS.FREE.PORN.IN.ITS.SEARCH.ENGIN
IP Address: 209.187.114.130
Registrar: INNERWISE, INC. D/B/A ITSYOURDOMAIN.COM
Whois Server: whois.itsyourdomain.com
Referral URL: http://www.itsyourdomain.com
Domain Name: GOOGLE.COM
Registrar: ALLDOMAINS.COM INC.
Whois Server: whois.alldomains.com
Referral URL: http://www.alldomains.com
Name Server: NS2.GOOGLE.COM
Name Server: NS1.GOOGLE.COM
Name Server: NS3.GOOGLE.COM
Name Server: NS4.GOOGLE.COM
Status: REGISTRAR-LOCK
Updated Date: 03-oct-2002
Creation Date: 15-sep-1997
Expiration Date: 14-sep-2011
>>> Last update of whois database: Mon, 26 Jul 2004 08:37:55 EDT
"If anything can go wrong, it will." - Murphy
I tried google.fr and I saw that it had surrendered to the virus.
Probably not the virus directly but the extra load of google refugees.
# cat
Damn, my RAM is full of llamas.
has gone to hell.
My coworkers may realize I really don't know anything if I can't google up answers real soon now...
XML is like violence. If it doesn't solve the problem, use more.
But here we are at MyDoom.N, which is the 14th virus in a series that requires the user to:
After ignoring 13 previous warnings, I must move from sympathy to malice. For the sake of all humanity, I beg the author(s) of the MyDoom series and other viruses, in your next version, please include the following instructions:
- locate a nearby table lamp with the light on
- remove pants
- break the bulb while it is glowing
- insert testicles into bulb socket
If they're dumb enough to get fooled by MyDoom again, they're dumb enough to get themselves out of the gene pool.I don't believe it's a local browser issue... might've just been a coincidence, kind of like what might have had happened if I spelled coincidence correctly.
CowsAnonymous: We're here to help moo.
I have a domain that I host mail for, let's call it thedomain.net. Every day 24 hours a day I get connections from thousands of different computers all sending mail to bernard@thedomain.net, ashley@thedomain.net, and any one of a hundred thousand other possible names at @thedomain.net that don't exist. These machines that connect to my machine are using the user unknown bounces to send spam to forged return addresses.
Naturally I put in a script to watch for this, drop the mails and ban the ips but I've been running the thing for a few days and I have 5000 banned ip addresses in my ipchains firewall!!! I am beginning to think that the number of compromised windows machines out there has led to an absolute security CATASTROPHE of science fiction proportions. The machines attacking me, according to ARIN, are located all over the world.
I'm not really that important or interesting a target, having a measily DSL line but yes I get constant connections from many different computers all over the world all day trying to use me to bounce mail.
I really think, if people knew how huge the number of compromised windows machines there were out there, people would be embarassed to recommend Microsoft products.
"You just won't believe how vastly, hugely, mindbogglingly big it is. I mean, you may think it's a long way down the OC-3 to boobies.chemist.com, but that's just peanuts to Google. Listen...", and so on.
(After a while the style settles down a bit and it begins to tell you things you really need to know, like the fact that Google has different DNS entries depending on which server you look them up from, which is only a partial solution to the bandwidth problem -- so that despite the DNS tricks, any net imbalance between the packets you send to Google and the packets Google sends back to you, must be surgically removed from your pipe: so every time you type "natalie portman hot grits" into images.google.com, it is vitally important to get a receipt.)
There have been many reports recently of virus writers attempting to blackmail companies. Having this virus, an obvious DDoS attack on Google, happen the same day that Google announced the price of its IPO shares is just what you would expect if the Google didn't pay the blackmail.
I don't know how we'll ever be able to test this hypothesis, but I think that something stinks here.
thad
I love Mondays. On a Monday, anything is possible.
People, its a server-side problem, you can have the problem running lynx on your toaster
All of my queries that are sent directly through google's website return "Service error -27.", however, all queries sent through the Opera web browser have no problem. Once I've succeeded in a search I cannot do anything else through google (next, cache, etc), because it does not contain a "sourceid=opera" in the query. By copying the address created by Opera, I was able to successfully search using IE. The address I used was "http://www.google.com/search?q=test&sourceid=oper a&num=0&ie=utf-8&oe=utf-8", where "test" was what I was searching for.
I get a -27 error:
Clearly Google is running on pre OS X Macs:
-27 abortEr IO call aborted by KillIO
-S
We've received a copy of the virus (stopped at the gateway, of course), but here's the text of it for those who are curious:
Dear user xxxxx@domain.com, administration of domain.com would like to inform you
Your email account has been used to send a large amount of junk e-mail during the recent week. We suspect that your computer was compromised and now runs a hidden proxy server.
We recommend that you follow instruction in the attachment in order to keep your computer safe.
Best regards, The domain.com team.
The virus is then attached at the bottom of the message.
...isn't really realized until it goes down. We were researching Linear PCM formats over here when it went down.
I got the error message... "Service Error -27" and immediately though "hm... I wonder what that is," and opened up a new browser window, absentmindedly typing in my query to the Google toolbar...
!@#$!@#$
I laughed for a while, scratched my head, and decided to discuss with my co-workers what the decent "second place" search engine was... Dogpile seemed to be the most common answer. No relevant results, though. Geez, Dogpile is ugly.
[an error occured while processing this directive]
Some of the systems, both Windows and Linux are having this problem, while others are not, dispite being on the same subnet (on our NOC lan here in the UK).
Go figure. Session handling switches deciding which IP's go where and some end servers of Google's being borked is my best guess.
Oh the days of Mozilla, Navigator Gold & Mortal Kombat (the first one) - [gets teary eyed]
... I do not think it means what you think it means.
i.e. is an abbreviation for the Latin id est, "that is". It's a synonym for "in other words", "that is to say", or (sort of) "specifically". It does NOT mean "for example", or "such as". For those expressions, you're looking for the Latin abbreviation e.g. - exempli gratia, which means "for example".
Saying this virus "searches your machine for email domains, i.e. yahoo.com", you're actually saying that it "searches for email domains, in other words yahoo.com". This implies that yahoo.com is the only email domain it searches for (or that you are an idiot, and honestly believe that 'email domains' is synonymous with 'yahoo.com'), which makes it seem like a rather pointless search, to say the least.
I.e./e.g. confusion seems to be increasingly common, which surprises me, because it doesn't seem to me that their meanings are at all similar. It seems rather like confusing the phrases 'In spite of which' and 'since Thursday'. Since Thursday, people still seem to do it.
If you really can't remember whether you mean i.e. or e.g., then just write out 'for example' or 'in other words' in full... it doesn't take that much longer.
400 Bad Request
Bad Request. Bad! Go sit in the corner. Go on. Corner! Sit!
("400" errors are invalid request errors. See RFC2616)br>
409 Conflicting Request
An attack is a form of conflict...
412 Precondition Failed
There are conditions of use for Google. One says something to the effect of:
"You can't use automated request things which make an excessive number of requests."
A precondition of using this service is YOU ARE NOT A WORM.
There could, however, be a new one... br>
411 Problem exists between keyboard and chair
Catch all for human caused errors.
Ok... so it's not exactly accurate use for these codes, but close enough?
If you still want to use google, but are getting blocked (like me), try using Google Personalized
Works like a charm. (but a little bit slow)
try adding "&num=0" to the search url.
-monique
I remember that old David Letterman tv joke ad that went something like Dave saying:
"Imagine what the world would be like without television?"
[TV static for 5 seconds then Dave comes back on]
"Scary, wasn't it?"
Now imagine the world without the Internet... +++NO CARRIER
Works fine for me... just search for "Google Server Error" and click "I'm Feeling Lucky" =)
Google has a lot of computer scientists and techies, and all they need to do is write a quick regex to match these "banned" searches, slap a 72-hour ban on any IP that's the source of more than, say, 1000 "banned" searches in a day, reply with a static page that says "SOL, your request came from an infected computer, contact your sysadmin" and then start looking for a more fundamental and elegant solution for a long-term fix.
They'll have this patched over in less than 24 hours, for certain.
May we never see th
It is efficient enough to spread fast and wide. By the time Google had a chance to respond to this the virus had probably attacked 90% of the targets at least once. All Google could do is to reduce followon attacks somewhat. I was hit 450 times, that is not counting the attacks that the spam filter just disconnected on.
I don't think the real target was Google. MyDoom has been launched several times and 2 out of 3 times there has been an uptick in phishing fraud attacks just afterwards. I don't think that the target was really SCO or Microsoft. Attacking them was just a way to throw investigators off the trail and also to work out which machines would make reliable zombies.
These guys use zombie machines for several purposes. they use them to send spam, to capture credit card numbers and to hide their tracks.
I think it is time to admit defeat with the anti-virus scanning software. We should simply block all executable attachments and zip files containing executable code. Fortunately most encrypted zip file formats do not encrypt the manifest so encrypted files can be blocked.
This type of technology can be written once and is then pretty much maintenance free. Maybe an occasional tweak but nothing like the constant need to work out the signatures of new viruses.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
Yeah and google.us is currently invading the penguins of Antarctica for their weapons of mass searches
Repeat after me: We are all individuals
Give it a rest you penguin-humping retard. The virus spreads through user action. Stupid users spread the virus. What the fuck is so complicated about that? Virus writers have started sending zipped viruses with attached installation instructions and these dipshits are STILL getting infected. You think if someone wrote a virus and instructed the stupid users to set the execution bit they wouldn't do it? History says you're wrong. History shows that people will follow even more complex instructions than that in order to run a virus.
Maybe if you religious rejects would spend a little more time fixing user space threats like the crufty old X system or finishing up your little game of desktop catch up that Microsoft has so sorely outpaced you in, you'd actually have a desktop system now instead of a kludged together ball of shit that wants to pretend it's UNIX while it tries to play with Windows. Pick a fucking goal and stop spending so much time and wasted breath bashing Microsoft. Christ. You little Linux and Windows zealots have got to be the stupidest subsets of all of the computer holy wars... you get on my fucking nerves. At least the BSD people have the decency to keep it to infighting that I can just ignore.
Yea yea, whatever. I'm a troll because I'm not felating your stupid little penguin. Give it a rest and just use your fucking system. You sound like a total dumbass when you sit there and blame "micro$oft" (please, spare me the droll attempt at witicism that wasn't even witty the first time someone used the dollar sign) for a problem that's clearly perpetuated by explicit user action.
Alito: A vote for Alito is a punch in the eye to put that bitch back in her place!