Latest MyDoom Variant Gives Google Problems

← Back to Stories (view on slashdot.org)

Latest MyDoom Variant Gives Google Problems

Posted by simoniker on Monday July 26, 2004 @04:50AM from the down-and-out dept.

Devil's BSD writes "It seems like the latest MyDoom worm variant has caused a bit of an Internet storm. Google, at this time (12:28 EDT), is returning 503 errors on all queries submitted from certain locations. The MyDoom variant searches the user's address book for email domains (i.e. @yahoo.com) and searches various engines (such as Google) for email addresses in that domain."

17 of 607 comments (clear)

Alright, this means war by Anonymous Coward · 2004-07-26 04:51 · Score: 5, Funny

Virus writers want to attack Microsoft or SCO, fine... but this... this is war! YOU DO NOT ATTACK THE GOOGLE!!!
1. Re:Alright, this means war by didde · 2004-07-26 06:29 · Score: 5, Interesting
  
  This is the 403 Forbidden I get when submiting a gmail address... The most thourough 403 I've ever seen.
  
  Forbidden
  Your client does not have permission to get URL /search?q=anything@gmail.com&ie=UTF-8&oe=UTF-8 from this server. (Client IP address: [xx.xx.xx.xx])
  
  Please see Google's Terms of Service posted at http://www.google.com/terms_of_service.html
  
  If you believe that you have received this response in error, please send email to forbidden@google.com. Before sending this email, however, please make sure to take a look at our Terms of Service (http://www.google.com/terms_of_service.html). In your email, please send us the entire code displayed below. Please also send us any information you may know about how you are performing your Google searches-- for example, "I'm using the Opera browser on Linux to do searches from home. My Internet access is through a dial-up account I have with the FooCorp ISP." or "I'm using the Konqueror browser on Linux to search from my job at myFoo.com. My machine's IP address is 10.20.30.40, but all of myFoo's web traffic goes through some kind of proxy server whose IP address is 10.11.12.13." (If you don't know any information like this, that's OK. But this kind of information can help us track down problems, so please tell us what you can.)
  
  We will use all this information to diagnose the problem, and we'll hopefully have you back up and searching with Google again quickly!
  
  Please note that although we read all the email we receive, we are not always able to send a personal response to each and every email. So don't despair if you don't hear back from us!
  
  Also note that if you do not send us the entire code below, we will not be able to help you.
  
  [long-ass-code removed]
  
  ... Otherwise the service works as usual here in Scandinavia.
The end of the world! by Jamori · 2004-07-26 04:53 · Score: 5, Funny

Google is down ... the world is ending! The beginning of the apocalypse! (I can't even check if I spelled that right without google)
Nostradomus predicted this right? by craenor · 2004-07-26 04:54 · Score: 5, Funny

Google going down is the first sign of the apocalypse. Now if my wife asks me for sex (the second sign), I'll know the world is going to end...
1. Re:Nostradomus predicted this right? by Anonymous Coward · 2004-07-26 04:57 · Score: 5, Funny
  
  she asked me for sex - does that count? :)
Time for a new error by Quasar1999 · 2004-07-26 04:54 · Score: 5, Funny

503? screw that... why not have a new error number designated specifically for MS infected systems... error 999: The operating system you are using is insecure and has been exploited... you are partially responsible for bringing this server to its knees... Now go in the corner and think about what you've done.

--

---
Programming is like sex... Make one mistake and support it the rest of your life.
No Problem... by Pirogoeth · 2004-07-26 04:56 · Score: 5, Funny

...just use Google's alternate search form...

--
Happiness is like peeing yourself. Everybody can see it but only you can feel its warmth.
Google is doing fine for regular searches... by stienman · 2004-07-26 04:58 · Score: 5, Informative

Perhaps I'm simply 'located' better, but I can do regular google searches just fine.

But when I ask for "email slashdot.org" it returns a forbidden search page.

So it looks like Google is primarily stopping searches that are typical of this virus, but they may also have automated filtering that stops searches which are too many from IPs and netblocks. This part is probably something they implemented long ago.

But google is going slower for me today, and sometimes it stalls (some of the frontend machines dropping out a bit more frequently than usual?)

-Adam
Re:Ah hah by Jim+Hall · 2004-07-26 04:58 · Score: 5, Funny

I found it hard to remember the names of other search engines that I could use though.
You could do a Google search for them, I suppose... :-)
Browser Specific by nsingapu · 2004-07-26 05:00 · Score: 5, Interesting

Webmasterworld has an interesting thread which details the problems are user agent and locality specific (for me in SoCal IE and Firefox are borked, Konqueror is working, but others report no problem with Mozilla or no problems in certain locals).

--
How do I keep track of people who are fingering
I fear for zeitgeist by ILikeRed · 2004-07-26 05:12 · Score: 5, Funny

Talk about a boring upcoming Zietgeist... Top query in US: joejob@yahoo.com Top query in UK: joejob@yahoo.com.uk Browsers used to access Google: Internet Explorer ... 41% MyDoom ... 54% Other ... 05% I think they are just trying to keep Mozilla's percentage down.

--
I have come to a conclusion that one useless man is a shame, two is a law firm, and three or more is a congress -J Adams
Re:Why the unevenness? by WormholeFiend · 2004-07-26 05:16 · Score: 5, Funny

I tried google.fr and I saw that it had surrendered to the virus.
Fool me once ... fool me 14 times??? by shrubya · 2004-07-26 05:19 · Score: 5, Funny
I can accept ordinary computer illiteracy. People who don't know their mouse has multiple buttons, or who don't know how to quit a program, it's okay. I'm sure they're good at something else. But as long as they aren't complete intentional morons, EVEN ILLITERATES CAN BE TRAINED TO USE COMPUTERS PROPERLY.
But here we are at MyDoom.N, which is the 14th virus in a series that requires the user to:
1. receive an infected email
2. read the email and believe its contents
3. download the attachment
4. unzip the attachment, often password protected
5. run the resulting executable
After ignoring 13 previous warnings, I must move from sympathy to malice. For the sake of all humanity, I beg the author(s) of the MyDoom series and other viruses, in your next version, please include the following instructions:
1. locate a nearby table lamp with the light on
2. remove pants
3. break the bulb while it is glowing
4. insert testicles into bulb socket
If they're dumb enough to get fooled by MyDoom again, they're dumb enough to get themselves out of the gene pool.
Re:i was wondering by poptix_work · 2004-07-26 05:30 · Score: 5, Funny

They sent out the email to.. not open your email

How amazingly typical.

--
Just because you disagree doesn't make it offtopic or flamebait.
Re:Ah hah by gmuslera · 2004-07-26 05:30 · Score: 5, Informative

AllTheWeb and Teoma are good alternatives, as far I remember, and do some things in a smarter way than Google. MSN search is supposed to be improved in a beta URL (there was an history here about it some weeks ago)
And you have also metasearchers, that not only search google, but also others. If you want almost the opposite of google in simplicity, you can try Kartoo, where you can have graphs with aggrupations on search results, flash animations and things like that.
Last, but not least, there are a search engine that you can use to find search engines very close to you. If its good enough, probably there is a Slashdot article on it, so slashdot search is a good first step if all the other search engines you know are down but you still can access slashdot.
Re:Why the unevenness? by Tackhead · 2004-07-26 05:36 · Score: 5, Funny

> Google is BIG. VERY VERY BIG.
"You just won't believe how vastly, hugely, mindbogglingly big it is. I mean, you may think it's a long way down the OC-3 to boobies.chemist.com, but that's just peanuts to Google. Listen...", and so on.
(After a while the style settles down a bit and it begins to tell you things you really need to know, like the fact that Google has different DNS entries depending on which server you look them up from, which is only a partial solution to the bandwidth problem -- so that despite the DNS tricks, any net imbalance between the packets you send to Google and the packets Google sends back to you, must be surgically removed from your pipe: so every time you type "natalie portman hot grits" into images.google.com, it is vitally important to get a receipt.)
Timing is a little too close to be coincidence by Thagg · 2004-07-26 05:37 · Score: 5, Interesting

There have been many reports recently of virus writers attempting to blackmail companies. Having this virus, an obvious DDoS attack on Google, happen the same day that Google announced the price of its IPO shares is just what you would expect if the Google didn't pay the blackmail.

I don't know how we'll ever be able to test this hypothesis, but I think that something stinks here.

thad

--
I love Mondays. On a Monday, anything is possible.