When Malware Authors Combine Efforts

And just yesterday by Anonymous Coward · 2004-12-09 06:41 · Score: 5, Interesting

Re:And just yesterday by Tablizer · 2004-12-09 06:44 · Score: 2, Funny

New virus and malware combination causes duplicate articles, news at 11:00!

--
Table-ized A.I.
Re:And just yesterday by networkBoy · 2004-12-09 06:47 · Score: 3, Interesting

I think I can reconcile this:
There will be a few groups who work in strategic alliances. The very scary part about this will be the "power" behind some of the malware campaigns. I think CoreWars, running on every windowz box that isn't hardened really is going to happen.
This should prove to be interesting, especially when governments step in with the non-judiciary non-legislative branches because a real security leak is caused by one of these programs. Think a pissed off NSA (not a politicking one) of the "good 'ol days".
-nB

--
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump

Is this truly more scary than ... by jafomatic · 2004-12-09 06:42 · Score: 1

the exploits we've already seen?

Further, if I'm wrong, doesn't this announcement generate (or risk generating) more momentum in the "malware conglomerate" that's being reported?

--
::jafomatic

Re:Is this truly more scary than ... by CrashPanic · 2004-12-09 06:46 · Score: 0

In Korea, only old people write malware in teams.

--
"There's no set architecture in Linux. All roads lead to madness" -Microsoft
Re:Is this truly more scary than ... by Anonymous Coward · 2004-12-09 06:53 · Score: 0, Troll

It's the poisonous anti-MS attitude that sites like this breed that promote the onslaught of security exploits that are crippling users around the world. At some point /. users will have to realize that most users don't even know where the file menu is, so switching to Firefox is not a real easy sell to them. They take what comes with their PC, and all they know is the brand name Windows.

To me this is the reckless media that drew too much attention to school violence causing more to occur. The popular media learned to not play up those stories resulting in less and less over the past few years. Perhaps /. should take the responsible approach and stop proliferating the hate of MS. I'm all for reporting exploits after the fact however.

In your heart of hearts, your love of products like Firefox are underdog approaches to life that seem to forget that no major innovation has occurred at the browser in years. If your best argument for Firefox is security I must remind you that all software is inherently insecure because it was created by human beings. There is nothing in Firefox, Mozilla, Opera or IE for that matter that has changed in the past 5 years that makes banking, shopping, etc. easier or more rich. The innovation stopped in 2000. All of these gimicks like running Firefox from a flash drive are just parlour tricks with no real world value to 99% of users.
Re:Is this truly more scary than ... by Anonymous Coward · 2004-12-09 07:06 · Score: 0, Flamebait

An incredibley insightful statement that was for some reason modded down. I think it's obvious from the way modding occurs here that any rational argument that sheds bad light on either Linux, Firefox or the responsibility of this website will never get a respectful rating. If you want unbiased, respectable modding this is not the forum for that. And the people on this site expect you to go to bat in your organization pushing their opinions.
Re:Is this truly more scary than ... by Anonymous Coward · 2004-12-09 07:18 · Score: 0

u r funny
Re:Is this truly more scary than ... by Anonymous Coward · 2004-12-09 11:03 · Score: 0

I would have modded you funny but I see that you are serious.

Unfortunately there is no mod for ignorant.
Re:Is this truly more scary than ... by topgun601 · 2004-12-10 01:09 · Score: 1

im still a student but i have had a few computer repair gigs, i dont know much but this is what i have learnd so far. the starnderd user dose not care how or why it works , they like the black box approch, they only care if it works and that it is easy to use use. when it dose not work they call an IT guy to come and fix it. when i show people firefox i tell them it is a little more secure then IE but most of my time is spent showing how tabbed browsing works, how the quick bookmarks link work, and the popup blocker. some of the more usefull featers that ie does not have by default.

--
This post brought to you by: the marketing division of The Sirus Cybernetics Corporation

Public disclosure... by PincheGab · 2004-12-09 06:43 · Score: 4, Interesting

So where does this place public disclosure advocates? Are people going to demand that makers of affected software have a 24/7 programming staff ready to plug leaks just so weakenesses can de disclosed immedately? In light of this even I would favor not publicly disclosing weaknesses immediately!

Re:Public disclosure... by techsoldaten · 2004-12-09 06:52 · Score: 4, Insightful

You know what? Business needs remain the same regardless of how fast hackers are writing exploits. Few companies, Microsoft included, could afford to have a 24x7 staff of patch writers for all of the applications they have deployed.

This is the greatest argument for open source software I have ever seen. A proprietary model of development is going to get creamed as people take advantage of their limited resources and exploit the woo wang out of their apps. FOSS apps, on the other hand, potentially have hundreds of thousands of people ready to go worldwide at any given moment to correct problems as they happen.

M
Re:Public disclosure... by RailGunner · 2004-12-09 06:52 · Score: 1

No, but this certainly favors Open Source - as severe exploits are typically fixed far faster in open source projects than they are in closed source projects.
Also - it's better to know there is a chance you could hit with an exploit, and take steps such as a backup, or closing down a firewall port, etc., then to be caught by an exploit with your pants down. If there's a possibility my machine could get 0wned, I want to know about immediately so I can keep an eye out for it if nothing else.
Re:Public disclosure... by _Sprocket_ · 2004-12-09 06:53 · Score: 3, Insightful

In light of this even I would favor not publicly disclosing weaknesses immediately!

How does this change anything? This situation already exists and has existed for years. There has always been an element of pay-to-attack behavior as well as gathering resources via mass shotgunned attacks. And, in fact, spammers have been taping in to this environment for a while.
Re:Public disclosure... by paulthomas · 2004-12-09 06:57 · Score: 2, Interesting

RFP has a fairly respected document on public disclosure methods. The idea is basically that public disclosure happens only when there is no vendor response or when vendor response irresponsibly wanes. I agree that immediate public disclosure is not the right approach to take.

http://www.wiretrip.net/rfp/policy.html
-Paul
Re:Public disclosure... by LnxAddct · 2004-12-09 07:00 · Score: 3, Insightful

I think you underestimate how many companies are told they have vulnerable software rather than find it themselves. Http-equiv from malware.com finds tons of stuff and the Samba team used to submit a number of vulnerabilites they found in Microsoft's implementation. And all the time vulnerabilities are disclosed, sometimes the company is told before hand and if they don't act quickly enough then they are disclosed publicly, otherwise the company may find out at the same time you do. Regardless, if some thrid party does find a vulnerability and 2 or more people know about it, the world will know about it within a week. "Three can keep a secret if two are dead". So in short, yes companies need to be prepared 24/7 to fix their faulty software as fast as possible.
Regards,
Steve
Re:Public disclosure... by Anonymous Coward · 2004-12-09 07:03 · Score: 0

No disclosure huh??
just like microsoft and Eye Security did for 6 months a few years back??

meanwhile people were at risk and did not even know about it.........
Re:Public disclosure... by jrl · 2004-12-09 07:07 · Score: 2, Interesting

The flip-side to your argument is that many of the exploits are found by "bad guys" before they are rediscovered by "good guys".

By definition, the "bad guys" don't typically believe in disclosure as it takes away another one of their 0day toys.

By disclosing weaknesses immediately you allow information owners to take precautions to protect their infrastructure, even if that means making the resource unavailable until a patch is provided by the vendor.

It is naive to believe that only "good guys" find problems. As soon as someone is considerate enough to share the problem, I believe it is in our best interest to be notified of it as soon as possible.
Re:Public disclosure... by Anonymous Coward · 2004-12-09 07:12 · Score: 0

Any respectable security researcher, or security research company normally allows plenty of time to fix the problem. Usually a minimum of 30 days, usually. Does this require a programmer staff 24/7? Probably not. I don't think the real issue is full disclosure, it's companies actually realizing the threat is getting bigger and bigger. Companies such as HP shouldn't strong arm attempts to inform them of security vulns. Software providers need to recognize the threats, fix the problems else be held accountable.
Re:Public disclosure... by dillon_rinker · 2004-12-09 07:18 · Score: 1

Not saying I believe everything the article suggests, but the way it COULD change everything is that now there may be a large profit motive for a large number of people to produce zero-day or even zero-hour exploits. It's one thing when hobbyists hackers think it's nifty to write an exploit to prove their leetness; it's something else entirely when a corporate entity writes exploits for profit.

I think you're right in that this isn't really a qualitatively new thing, but the quantity of pay-to-attack may increase substantially.

Maybe the sky is falling. Or maybe not.
Re:Public disclosure... by Ytsejam-03 · 2004-12-09 07:27 · Score: 2, Insightful

So where does this place public disclosure advocates? Are people going to demand that makers of affected software have a 24/7 programming staff ready to plug leaks just so weakenesses can de disclosed immedately?
IMHO, this makes little or no difference. How many of the viruses and trojans in recent years have been created before a patch was available? Not Blaster or Sasser. I'm sure there are some in this category, but I can't think of any.

Once a patch is released, most businesses will do their own testing before rolling it out into production. This will often take several days. It's not unheard of for a patch to break something, and they don't want that "something" to be one of their mission critical servers or apps. Even if the exploit and patch were released at the same time, it would still take days for many organizations to roll out the patch.

Before you decide that full disclosure is a bad thing, you should ask yourself if you're really better off not knowing about vulnerabilities in the software you're using. What incentive would the makers of this software have to find and fix the vulnerabilites in a timely manner if no one ever put pressure on them? How much testing would they do if no one else did their own vulnerability testing after the software was available?

How many of the "bad guys" do you suppose already know about vulnerabilies long before they're disclosed? If someone is actively exploiting an undisclosed vulnerability, do you think they would create a trojan and get the vendor's attention? The vulnerability that Blaster exploited was introduced in NT4 back in 1996. How many people exploited this vulnerability before it was disclosed? We have no way of knowing.
Re:Public disclosure... by SeaFox · 2004-12-09 07:31 · Score: 2, Interesting

You know what? Business needs remain the same regardless of how fast hackers are writing exploits. Few companies, Microsoft included, could afford to have a 24x7 staff of patch writers for all of the applications they have deployed.

Well, maybe if they tested the software better and built it more secure from the start they wouldn't need a 24x7 staff of patchers.

Haha. But that would imply the product is being driven by developers and engineers, not marketting people.
Re:Public disclosure... by dankney · 2004-12-09 07:36 · Score: 3, Insightful

I would disagree completely -- this is an argument against open source. The exploits are expected to come out within hours of disclosure, not hours of discovery.

Closed-source software has the ability to write the patch before disclosing the vulnerability.

I believe in open source 100%, I just think that this argument falls against, not for OSS.
Re:Public disclosure... by chrisopherpace · 2004-12-09 07:38 · Score: 1

Nothing is hackpoof. Coders are humans, and humans make mistakes.

--

Bored? Why not join a decent mess
Re:Public disclosure... by DaHat · 2004-12-09 07:44 · Score: 2, Interesting

Just because you can get a patch out faster in the OSS world doesn't mean you should. It's pretty easy to open up a block of code and fix a bug (provided you know what it is, where it is and how to fix it), it's the testing to make sure that your fix didn't break anything else and that your system still works exactly like before (other than the fixed bug of course) is the time consuming part.

Does Microsoft spend weeks doing regression and unit testing? I do not know, however making the assumption that a patch can get out in the OSS world faster is better is not a very good one.

Having patch writers on hand 24x7 would be great for the actual fix, but would not reduce the amount of time required to make sure that the fix works and is safe.

It should be pointed out that the advantage of a proprietary model of development vs the FOSS one is one of liability. A patch needs to have at least the same, if not better quality (speed, error proneness, etc) than the bits that it is replacing. It is far easier for a small FOSS group to release a quickly written and tested fix than it is for Microsoft too. Despite popular belief, Microsoft has extremely high quality standards. How many companies do you know who have programmers on call 24x7 should their code break a build?

--
Help Brendan pay off his student loans
Re:Public disclosure... by bensafrickingenius · 2004-12-09 07:51 · Score: 1

Uh, don't most of us work in IT or as programmers? I'd think that a sudden need for 24/7 staffing would be an attractive turn of events! No more crying about how hard it is to find a job!

--
I am not left-handed, either!
Re:Public disclosure... by ReelOddeeo · 2004-12-09 07:58 · Score: 2, Insightful

From TFA...
"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."

Wouldn't it be more important to be against anyone who creates vulnerabilities rather than those who inform us about them so we can patch or even shut off services if necessary?

--

Those who would give up liberty in exchange for security and DRM should switch to Microsoft Palladium!
Re:Public disclosure... by caino59 · 2004-12-09 08:02 · Score: 3, Insightful

as long as it is the software company itself who finds the virus...
Re:Public disclosure... by the+Jolyon · 2004-12-09 08:07 · Score: 1

They potentially, have hundreds of thousands of people but there's no guarantee and noone to shout at if it isn't done / doesn't work / breaks something.

I'd find that hard to sell to the people I have to convince to part with money.
Re:Public disclosure... by ChrisPee · 2004-12-09 08:30 · Score: 0

This is the greatest argument for open source software I have ever seen.
Really? I see it as an argument for secure software. But I guess if you like swinging a hammer, everything looks like a nail...

--

Share and rate p
Re:Public disclosure... by berkleyidiot · 2004-12-09 08:42 · Score: 1

i may be off on this, but i think a lot of public disclosure only happens after private disclosure. when you find a hole, i thought it was standard/ethical practice to report it to whoever it affects, wait some reasonable period of time, then publically disclose it.
Re:Public disclosure... by Anonymous Coward · 2004-12-09 08:52 · Score: 1, Funny

In practice? Every one I've ever worked for.

Sometimes it wasn't even 'on call' so much as 'we'll come to your house and kick the door in if you break the build.'
Re:Public disclosure... by Anonymous Coward · 2004-12-09 09:26 · Score: 0

This isn't that big of an issue. If you know of a flaw you can write an exploit for it regardless of whether or not you have the source code for the app or not.
Open source also has the ability to write the patch before publically disclosing the vulnerability. The major Linux vendors already have a partnership to do exactly this.
Re:Public disclosure... by techsoldaten · 2004-12-09 09:28 · Score: 1

I don't know if any software has the ability to write a patch, as you state, but I think I see your meaning.

The one problem with this idea is that the incentive for the company to patch the vulnerability has to come from within. Market forces are only beginning to force Microsoft into a position where they MUST fix the gaping holes in their products. I don't know if a smaller company (let's use Real Media for the sake of argument) would have a similar imperative.

I trust public disclosure for exactly that reason: business decisions are driven by business needs. If the perception of a problem goes away, you remove the impetus to fix it.

M
Re:Public disclosure... by Anonymous Coward · 2004-12-09 09:34 · Score: 0

If you want someone to shout at then you can hire a couple of those "hundreds of thousands of people" to make sure that it is done, works, and doesn't break anything. If they screw up really bad, you have the added benefit of easily(well, relatively) finding people to replace them as well.
Re:Public disclosure... by aldoman · 2004-12-09 10:21 · Score: 2, Insightful

Microsoft's problem is testing.

When they have a patch, it has to be backported to hundreds of languages, versions, service packs, major releases, then tested on those and finally tested with a variety of applications before they get released.

Linux/OSS tends to break binary compatibility far more often than Linux so it's much easier: you just patch the latest version of the software and [for major projects] backport it to older releases. For example, you don't see Firefox backporting all of the security fixes to earlier versions. If it was Microsoft, they'd have to port them to IE5, IE5.5 and IE6, then test on all the various OSs etc. Firefox can just say 'here is 1.0.1. Upgrade to be safe'. They'd probably offer XPI files for older versions if it was very serve though.

But yes, I agree that OSS will win this battle, but it's not just because of developer numbers. As Joel Spolsky recently said in his interview with salon.com, 90% of Microsoft is basically red-tape.

--
IntechHosting - Free domain, 2GB, PHP, £4.95/$8.95
Re:Public disclosure... by _Sprocket_ · 2004-12-09 10:29 · Score: 1

...It's one thing when hobbyists hackers think it's nifty to write an exploit to prove their leetness; it's something else entirely when a corporate entity writes exploits for profit.

I think you're right in that this isn't really a qualitatively new thing, but the quantity of pay-to-attack may increase substantially.

Defining the principles as a "corporate entity" seems to imply much more organization and size than I think is really involved. But I agree that financial profit tends to change things. The question really is - have we already seen the change a long time ago... or are we about to jump another notch?

Spam has been an issue for years. But no matter how old the practice is, there are always new scammers and dupes entering the field. So while spamnets of compromised machines may not be new - it could be just the beginning of a new phase. The practice may be just entering the mainstream of the spamming industry, such as it is. And as such, we'll see not only more spammers trying to buy (or rent) spamnets, but more spamnet operators trying to create and maintain them.

Of course, any such increase in activity simply reinforces already existing issues that have been a part of infosec discussions for years.
Re:Public disclosure... by Ambassador+Kosh · 2004-12-09 11:03 · Score: 1

I disagree with this since there is also more variety of things in the linux world. So long as it is not a homogenous environment then it is safer from these kinds of attacks just because a mixed environment won't spread the stuff as fast.

Also while closed source can write a patch before disclosure it does not really matter. How long do people wait before installing a patch? How easy is it to get all the patches installed? If quicken came out with a patch tomorrow how long before people would install it? How about exchange, mssql server etc is there an EASY way to update all software installed on a windows system and how often does it break things?

On my linux systems it is trivial to update every installed program to the latest versions so they also tend to be very up to date. Ease of patching all software it at least as important as how long it takes to get a patch out. Given what I have seen of many windows users many programs have not been patched in years and that seems pretty rare of the linux stuff I have run into.

One thing I hope does happen is that stuff like selinux becomes default for all linux dists in the next 2 years and that more stuff is written with safer higher level languages. Between those two things it should cut stuff down even further.

--
Computer modeling for biotech drug manufacturing is HARD! :)
Re:Public disclosure... by Ambassador+Kosh · 2004-12-09 11:09 · Score: 1

Part of the difference is components. OSS software in general follows the unix method of smaller components with well defined interfaces and the components are also replacable with others that follow the same interface. This is inherently safer to debug then a large monolithic system.

It is far less likely that fixing a bug in OSS software will cause anywhere near the level of breakage I have seen in proprietary stuff. Actually I have only seen a few things break running debian sid in the past 3-4 years and all the problems have been trivial to roll back. Since you have lots of tiny components you can roll a component back easier. When you install a service pack in windows and a program breaks do you have any idea or even any way to find out what caused it to break? Can you roll back just that one fix?

--
Computer modeling for biotech drug manufacturing is HARD! :)
Re:Public disclosure... by frank_adrian314159 · 2004-12-09 11:54 · Score: 1

Few companies, Microsoft included, could afford to have a 24x7 staff of patch writers for all of the applications they have deployed.
Well, Symantec, McAffee, etc., seem to be able to do it pretty well. After all, what's a virus definition update other than a quickly deployed patch to an AV system that doesn't recognize a particular new virus? Any company that sees a profit in doing this kind of thing can do it fairly easily and inexpensively. The main issue is one of whether or not the company thinks it's profitable to do so and whether or not it wants to set up the infrastructure to support it. But it doesn't cost that much.

--
That is all.
Re:Public disclosure... by techsoldaten · 2004-12-09 12:37 · Score: 1

I cannot imagine MicroSoft hiring a team to develop Longhorn, then hiring another team to fix XP and Longhorn problems.

There's a big difference between virus definition updates and OS-level patches. A virus definition recognizes whether or not patterns exist on a machine and takes corrective steps. An OS patch affects how the machine works, and the teams of people knowledgable enough to correct problems are probably engaged in other tasks anyways.

There are hardware and software compatibility assurances contractually established between all large vendors, meaning OS level patches cannot be rapidly deployed without risk of legal action in the event of a problem. This kind of testing takes time, often cannot be completely automated, and would definitely be burdensome.

M
Re:Public disclosure... by hazah · 2004-12-09 12:47 · Score: 1

I don't see how this is against. For one, OSS is fixed much faster than propriatary. For two, b/c of one it would have less critical flaws to begin with, which will help to deter from attack. For three, when was the last time anyone here experience these attacks while not using windows? Yes, they'll have a good head start with OSS, but thankfully, OSS design isn't as flawed.
Re:Public disclosure... by Anonymous Coward · 2004-12-09 14:27 · Score: 0

"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."
The flaw with this argument lies in the assumption that the mal-ware writers are incapable of finding vulnerabilities. Restricting public disclosure does nothing when "Virus writers are cooperating...They work in groups that exchange information with other groups on forums and Web sites.". The attackers can discover a vulnerability, disclose it among themselves, and release an exploit before developers, FOSS or proprietary, discover the problem (let alone deploy a patch). In other words a "code of silence" prevents users from protecting themselves (they won't even have a chance to stop using the compromised program until it's patched). At the same time, it does little to inhibit the outlaws.

How many times do I have to tell you? by Anonymous Coward · 2004-12-09 06:43 · Score: 5, Funny

Get a firewall, block all inbound and outbound traffic, unplug your ethernet cable and shut off your computer. It's that easy to protect yourself.

Re:How many times do I have to tell you? by forrestt · 2004-12-09 06:47 · Score: 5, Funny

I think you can probably even skip the first couple steps.
Re:How many times do I have to tell you? by Anonymous Coward · 2004-12-09 06:50 · Score: 0

The first few steps are not required, just shut off the PC.
Re:How many times do I have to tell you? by Anonymous Coward · 2004-12-09 06:58 · Score: 2, Insightful

I think you can probably even skip the first couple steps.

True, but having the additional steps is what makes it a +5 funny post. "Unplug your ethernet cable" would probably be modded troll.
Re:How many times do I have to tell you? by cybersaga · 2004-12-09 07:00 · Score: 0

Or just don't announce the exploits.
If the problem is with Windows, tell Microsoft. If it's with Firefox, tell the Mozilla Foundation. Tell whoever needs to know to fix it. But don't announce it to the whole bloody world. All you're doing is helping the bastards find extra features to put into their programs.

--
Web Design Tips
Re:How many times do I have to tell you? by _Sprocket_ · 2004-12-09 07:03 · Score: 1

Take off and firewall it from orbit. It's the only way to be sure.
Re:How many times do I have to tell you? by (startx) · 2004-12-09 07:14 · Score: 1

Take off and firewall it from orbit. It's the only way to be sure.

Wow, talk about an obscure Clerks reference. That episode never even aired did it?
Re:How many times do I have to tell you? by SirTalon42 · 2004-12-09 07:15 · Score: 1

Unfortunately sometimes companies refuse to patch their products, and the only way you can make them fix the problem is by revealing it to the world. You can never assume the black hats don't already know the exploit.
Re:How many times do I have to tell you? by Anonymous Coward · 2004-12-09 07:17 · Score: 0

Actually, the (paraphased) quote is from Aliens, so it's not really that obscure...
Re:How many times do I have to tell you? by malsdavis · 2004-12-09 07:22 · Score: 1

I really wish my employer would start using Mozilla/Firefox and Thunderbird/Mozilla.

I spend a fair amount of time on the internet at work and send/recieve dozens of emails a day. I know its dangerous at the moment with Internet Explorer and Outlook both being so insecure, but as I work for a large company who have an IT policy of "DO NOT INSTALL ANY SOFTWARE ON COMPUTERS OR FACE BEING FIRED" I am forced to use them and hope that one of the websites I view doesn't hijack my computer or start scanning it for bank details.

The IT department said I can't as it would interupt systems designed to check on startup for any unauthorized software. Has anyone who works for a large company ever had any luck with getting the IT department to allow the replacement of IE/Outlook?

I suggested they should do consider doing it all over the company for security reasons but they just replied saying they would "look into it" ...meaning they can't be bothered doing anything.
Re:How many times do I have to tell you? by DarkSarin · 2004-12-09 07:27 · Score: 1

Not the best solution, but have you looked into the memory stick version of those apps. There was a story here the other day regarding that. Then you would not be installing anything, just using it.

--
"We don't know what we are doing, but we are doing it very carefully,..." Wherry, R.J. Personnel Psychology (1995)
Re:How many times do I have to tell you? by timster · 2004-12-09 08:01 · Score: 1

Also be aware that even when Microsoft does patch their product quickly, it's possible for the attacker to discover the vulnerability by examining the patch.

--
I have seen the future, and it is inconvenient.
Re:How many times do I have to tell you? by operagost · 2004-12-09 08:12 · Score: 1

Nuke your ISP from orbit. It's the only way to be sure.

--

Gamingmuseum.com: Give your 3D accelerator a rest.
Re:How many times do I have to tell you? by Glog · 2004-12-09 08:31 · Score: 1

You just wait till they start writing viruses for that brand spanking new cortex implant you got last week (circa 2067)... how are you going to unplug then?
Re:How many times do I have to tell you? by IvoryRing · 2004-12-09 08:31 · Score: 1

I'm pretty sure Aliens aired, once or twice.
Re:How many times do I have to tell you? by ScepticOne · 2004-12-09 09:17 · Score: 1

How would they react if your machine were to continually and repeatedly acquire malware due to IE security holes? Are you sure it's time to start being more careful? Just make sure you create backups of any important documents ;-)
Re:How many times do I have to tell you? by Wybaar · 2004-12-09 10:01 · Score: 1

I can't resist ...

In Soviet Russia, from orbit your ISP nukes you!

Oh wait ... that's not Pitr. He just bought the missile.

--
Y|
Re:How many times do I have to tell you? by dgatwood · 2004-12-09 10:08 · Score: 1

And the person who can't take a joke got modded -1. Sounds fair to me.

--
Check out my sci-fi/humor trilogy at PatriotsBooks.
Re:How many times do I have to tell you? by aldoman · 2004-12-09 10:24 · Score: 1

Negative. Most computers have wake-on-lan and could be turned on with a comprimised home router. You need to unplug to be totally safe ;).

--
IntechHosting - Free domain, 2GB, PHP, £4.95/$8.95
Re:How many times do I have to tell you? by quantaman · 2004-12-09 10:46 · Score: 1

Get a firewall, block all inbound and outbound traffic, unplug your ethernet cable and shut off your computer. It's that easy to protect yourself.

I think you can probably even skip the first couple steps.

Actually maybe not, I've heard (rumors) some network cards can start up your computer if they're pinged, as a result if your cable is still plugged and and your computer powered off it might power right back up and find yourself vulnerable!

--
I stole this Sig
Re:How many times do I have to tell you? by quantaman · 2004-12-09 10:49 · Score: 1

Get a firewall, block all inbound and outbound traffic, unplug your ethernet cable and shut off your computer. It's that easy to protect yourself.

I think you can probably even skip the first couple steps.

Actually maybe not, I've heard (rumors) some network cards have the ability to start up your computer if they're pinged, as a result if your cable is still plugged and and your computer powered off it might power right back up and find yourself vulnerable!

(missed preview the first time)

--
I stole this Sig
Re:How many times do I have to tell you? by ScrewMaster · 2004-12-09 11:10 · Score: 1

You forgot "bury it in a hermetically-sealed titanium-steel vault."

--
The higher the technology, the sharper that two-edged sword.
Re:How many times do I have to tell you? by _Sprocket_ · 2004-12-09 11:10 · Score: 1

Oh my God! Bear is driving! How can that be?!
Re:How many times do I have to tell you? by at_slashdot · 2004-12-09 11:24 · Score: 1

Why not go all the way: turn off the computer.

--
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
Re:How many times do I have to tell you? by Veramocor · 2004-12-09 13:38 · Score: 1

The trojans/viruses mostly come at night, mostly.

--
Veramocor
Re:How many times do I have to tell you? by Anonymous Coward · 2004-12-09 17:41 · Score: 0

It's called wake on lan and it's been around since the 80's...
Re:How many times do I have to tell you? by forrestt · 2004-12-10 04:17 · Score: 1

A couple is typically regarded as two:

1) Get a firewall
2) Block all inbound and outbound traffic.

I wouldn't recommend skipping the rest if you wan't to be totally secure. I am fully aware of the wake on lan issues.

Oh, and it was supposed to be funny.
Re:How many times do I have to tell you? by 0racle · 2004-12-10 11:30 · Score: 1

Its called WOL, Wake on Lan, its not a rumour. However it needs a special WOL packet to trigger it, not just a ping.

--
"I use a Mac because I'm just better than you are."

Uhm.. You know those russian security experts by Phixxr · 2004-12-09 06:43 · Score: 5, Insightful

Is it just me, or does it seem that every story that lists the source as a "Russian Security Expert" is generally a load of crap?

-Phixxr

--
ungggghhhh

Re:Uhm.. You know those russian security experts by chris88 · 2004-12-09 06:48 · Score: 3, Informative

Kaspersky is to blame, not Russians in general.

They also predicted "Internet Terrorist Attack" in August.
Re:Uhm.. You know those russian security experts by SoTuA · 2004-12-09 06:57 · Score: 2, Funny

Yes, because russians get everything backwards.
I mean, in Soviet Russia efforts combine malware authors, for chrissake!
Re:Uhm.. You know those russian security experts by Anonymous Coward · 2004-12-09 06:57 · Score: 0

In Soviet Russia, experts secure you!
Re:Uhm.. You know those russian security experts by SuperBanana · 2004-12-09 07:22 · Score: 1

Is it just me, or does it seem that every story that lists the source as a "Russian Security Expert" is generally a load of crap?
After decades of communist rule, I think every Russian is a security expert.
That said, I really am disgusted by the number of unnamed sources in the press overall. Think of the last time you heard a US "government official" actually named. They claim it's "under condition of anonymity". Why does informing the public have to be done UCoA? There's no accountability...

--
Please help metamoderate.
Re:Uhm.. You know those russian security experts by Ironsides · 2004-12-09 07:33 · Score: 1

Thats, "In Soviet Russia, efforts combine authors malware."

--
Fly me to the moon Let me sing among those stars Let me see what spring is like On jupiter and mars
Re:Uhm.. You know those russian security experts by Anonymous Coward · 2004-12-09 07:52 · Score: 0

How dare you say that about the politics section!
Re:Uhm.. You know those russian security experts by thePegan · 2004-12-09 07:58 · Score: 1

That said, I really am disgusted by the number of unnamed sources in the press overall. Think of the last time you heard a US "government official" actually named. They claim it's "under condition of anonymity". Why does informing the public have to be done UCoA? There's no accountability...

It's called getting your chestnuts roasted. But today, the stakes are higher than before. If you stick your neck out and are accountable in today's world, they don't just roast your nuts. They then cut them off and feed them to you.
Re:Uhm.. You know those russian security experts by Anonymous Coward · 2004-12-09 08:22 · Score: 1, Insightful

Nope, it's just KASPERSKY. These people are headline whores and you really shouldn't trust a word they say.
Re:Uhm.. You know those russian security experts by AndroidCat · 2004-12-09 08:42 · Score: 1

More like those unnamed government officials like to feel important. Like, who cares if a statement is from Joe Shmoe? But if it's from unnamed government official under condition of anonymity, it makes them a somebody--if we knew who they were...

--
One line blog. I hear that they're called Twitters now.
Re:Uhm.. You know those russian security experts by happyfrogcow · 2004-12-09 08:53 · Score: 1

In Soviet Russia, Security exports you.

...oh, security "experts", nevermind.

All the more reason.. by farsideofthemoon · 2004-12-09 06:43 · Score: 2, Informative

to lock down your enterprise with a File surveillence and security tool like i:scan... know what's happening before the user does...

--
I know what's on your hard dr

Re:All the more reason.. by Anonymous Coward · 2004-12-09 06:53 · Score: 0

Piss off spammer...
Re:All the more reason.. by saderax · 2004-12-09 07:01 · Score: 1

to lock down your enterprise with a File surveillence and security tool like i:scan [dciseries.com]... know what's happening before the user does...
--
I know what's on your hard drive.. =) [dciseries.com]

Anyone notice that the product advertised and the "I know whats on your hard drive" sig link to the same place? Hmmm....
Re:All the more reason.. by Anonymous Coward · 2004-12-09 07:04 · Score: 0

I noticed his message was written like a filthy spammer. Hence my cutting reply! ;-)
Re:All the more reason.. by farsideofthemoon · 2004-12-09 07:27 · Score: 1

Hey, if you got a good product what's wrong with letting people know? =)

--
I know what's on your hard dr

Many shallow eyes... by Onimaru · 2004-12-09 06:44 · Score: 2, Interesting

...make deep bugs deeper. FOSS philosophy applied to viruses. Yikes.

--
adam b.

Re:Many shallow eyes... by ottawanker · 2004-12-09 06:56 · Score: 3, Funny

.. don't tell me you've been paying for your viruses all this time!? I always make sure the viruses I get use the GPL.
Re:Many shallow eyes... by Anonymous Coward · 2004-12-09 10:12 · Score: 0

.. don't tell me you've been paying for your viruses all this time!? I always make sure the viruses I get use the GPL.
But GPL doesn't mean free beer, they can still charge $$ for supporting their virus.

Uhh, ok. by mangledspine · 2004-12-09 06:44 · Score: 0

Don't we know this already? Isn't it common knowledge? Department of Redundancy calling...

Re:Uhh, ok. by bigberk · 2004-12-09 06:48 · Score: 1

Well I've known about it since November 2003, dunno about you.

Windows 3.1 by BicycloHexane · 2004-12-09 06:44 · Score: 0

It might be time to switch back to the most stable and secure OS ever.

Re:Windows 3.1 by Anonymous Coward · 2004-12-09 06:46 · Score: 0

Why did you put Windows 3.1 in the subject when you were talking about DOS?

No big deal by MrRuslan · 2004-12-09 06:45 · Score: 3, Funny

this wont have an effect on computer litirate people who know how to protect themselves ...and for those who dont know things wont change much ether....some people still have blaster on there box..they dont know or wanna know how to take care of there box

Re:No big deal by kevin_conaway · 2004-12-09 06:46 · Score: 4, Funny

I'm trying to come up with a clever joke to poke fun at your grammar and spelling but I think I'll let your post speak for itself.
Re:No big deal by forrestt · 2004-12-09 06:54 · Score: 1

I don't know, I've already cleaned viri off of two family members' computers in the past month. One would only keep rebooting, and the other was so slow, it was unusable. All after being online without contacting me first. It's hard to say no, I won't fix your computer to family members. So, it will affect computer literate people. The real rub, I don't even dual boot Windows to play games anymore but I still can't get away from it.
Re:No big deal by smileaf · 2004-12-09 07:32 · Score: 0

I did not see anything in his post that would warrent such a rude comment. how this got to be 3 funny is beyond me.
Re:No big deal by Anonymous Coward · 2004-12-09 07:35 · Score: 0

"warrant"
Re:No big deal by Anonymous Coward · 2004-12-09 07:38 · Score: 0

How many times do I have to tell you: one should never start a sentence with "but".
Re:No big deal by Anonymous Coward · 2004-12-09 08:30 · Score: 0

run it through ispell then and learn from the result.
Re:No big deal by j1bb3rj4bb3r · 2004-12-09 08:32 · Score: 1

I'm trying to come up with a clever joke to poke fun at your wanton cruelty but I think I'll let your post speak for itself.

--
*yawn*
Re:No big deal by Anonymous Coward · 2004-12-09 08:33 · Score: 0

Based on your grammar skills, I can see why you would have no problems with the parent poster...
Re:No big deal by Anonymous Coward · 2004-12-09 09:09 · Score: 0

Waahhhh, I'm confusing pointing out the obvious on a website with "cruelty".

Fact is, if you try to educate these morons, they don't pay any attention, and continue posting like fuckwits, so it's much more effective to shame their stupid asses into learning about the language they abuse.
Re:No big deal by Anonymous Coward · 2004-12-09 09:29 · Score: 0

Do you believe it is appropriate to use the 'word' fuckwits and then complain about other people abusing the language?

You are a complete fuckwit.
Re:No big deal by Anonymous Coward · 2004-12-09 09:35 · Score: 0

You seem to associate english skills or level with an overall level of compentence. There is no direct relationship between the two. I have outstanding problem solving skills and at my own choosing, I am on my third career, one with electronics fixing radar and communications systems, one as a nuclear power operator and technician, and I have currently worked my way up through IT to Network Engineer. All of this in 15 years. Although I can spit out and solve heat transfer and fluid flow equations, describe and calculate macroscopic cross section for absorbtion of thermal and fast level neutrons with various nuclear materials, troubleshoot and repair many radar systems and communications gear and even replace a timing belt, CV joints, or transmission on my car. English and grammar? My skills in writing English are far below average. That does not mean I do not understand the launguage, just some issues with the correct useage of some of the spelling and grammar. I was never interested in English, only math and science. Just because someone is not good with writing english, does not mean they are stuck at a minimum wage job and a moron.
Re:No big deal by Rightcoast · 2004-12-09 09:52 · Score: 1

It must be what...20 years since you were in public school at least?
My point is if you think your writing and English skills are below average, never mind far below average, you don't have even an inkling of what average really is.
Slashdot draws a crowd that would be considered brighter than average, the parent post is average.
Completely unrealated, I saw an article in a Connecticut newspaper about Pearl Harbor Day. 8 of 20 people knew what it was. A woman was quoted (and named) as saying she didn't know where Pearl Harbor was or why "It has a day."
Here is the kicker: I lean over to the guy in class next to me (a college course), and say "Wow imagine if you were pointed out in the paper as being a world-class dumbass?" and showed him her quote.
His reply: "How could anyone not know that's the day Hitler died?"
I didn't say anything.
Re:No big deal by Anonymous Coward · 2004-12-09 10:20 · Score: 0

litirate people, that's what we need.
Re:No big deal by plague*star · 2004-12-09 11:38 · Score: 1

You insensitive clod! *Anyone* could accidentally leave the "u" out of "donut".
Re:No big deal by Anonymous Coward · 2004-12-09 12:13 · Score: 0

I'm trying to come up with a clever joke about missing punctuation between two independent clauses connected with a coordinating conjunction but I seem to be unable to do that and I think that's too bad.
Re:No big deal by Anonymous Coward · 2004-12-09 13:57 · Score: 0

Your post is well ABOVE average, with relatively few spelling errors. It shows you are in fact a reasonably educated person who can distinguish between simple concepts like "there|they're|their", unlike the post that kicked all of this off. No-one is going to get all ballistic over trivial things (like, say, the distinction between 'who' and 'whom'), it's only the people who garble the language beyond all recognition that receive (and deserve) so much contempt.

Incidentally I hated English classes too, but (I suspect much like yourself) I enjoy reading, and with enough exposure to correctly written English it becomes second nature to use the correct words in the correct places. I would suggest that people who can't spell simple words correctly are either illiterate or morons.
Re:No big deal by arminw · 2004-12-09 16:55 · Score: 1

...cleaned viri off of two family members' computers...

I do that once for them and after that I tell them that I use a Mac that doesn't get any of that malware and that I don't have and never have wasted a penny on anti-virus software. Several of them have since turned off their virus and spyware infested Windows machines for good and switched to Mac and are very happy.

--
All theory is gray
Re:No big deal by Anonymous Coward · 2004-12-10 03:43 · Score: 0

Everyone repeat after me: It was a joke. Its funny. Laugh.

Groups of Attackers by teiresias · 2004-12-09 06:45 · Score: 2, Informative

I don't think more people cooperating will really find new exploits, they will simply explore the ones they have already found. So, instead of an exploit coming out and than a derivative coming out a couple weeks later, we will see four or five derivates in quick succession of the original exploit.

Also, what "new" cooperation tools are malware writers using to communicate with each other? I'm fairly sure that IRC, Instant Messaging, VoIP, Bulletin Boards, and e-mail have all been standard communcation tools for these people. Maybe the groups now have more members.

--
-Teiresias

Re:Groups of Attackers by mrtroy · 2004-12-09 07:03 · Score: 1

I don't think more people cooperating will really find new exploits, they will simply explore the ones they have already found. So, instead of an exploit coming out and than a derivative coming out a couple weeks later, we will see four or five derivates in quick succession of the original exploit.

Well, I dont know how much faster things can get exploited and cracked...
Major warez groups usually try to get the first release of new software, and over half the time they have a cracked version out BEFORE the legitimate version is put for sale in stores.

I just had to download doom3 before it was out, and then buy the copy after.

But in the same way, people have been exploiting software in groups forever, this isnt new.

--
[I can picture a world without war, without hate. I can picture us attacking that world, because they'd never expect it]
Re:Groups of Attackers by bushidocoder · 2004-12-09 07:17 · Score: 1

I think you're right, and I think if this type of organization actually occurs, its much harder on the anti-virus companies than it is on software development companies. Companies like Symantec are going to have to learn to recognize, identify and respond to multiple similar yet distinct day-zero viruses and worms in a very short period of time, and when they start to analyze new outbreaks that exhibit similar symptoms but come from a variety of sources, I suspect it will slow down their ability to respond.
Re:Groups of Attackers by Heisenbug · 2004-12-09 07:41 · Score: 2, Insightful

Every time a new exploit travels around the internet, there are posts here saying things like "it's a good thing there was that bug ..." or "it's a good thing they used a relatively inefficient search for new hosts ..." or "it's a good thing it failed to disguise itself in this way ..."

If there's a movement towards greater code reuse, sharing of ideas, and debugging help among the people creating these exploits, we won't just see a speed difference -- we'll see a quality difference. We've been relying on security through malware incompetence for a little too long ...
Re:Groups of Attackers by Anonymous Coward · 2004-12-11 15:23 · Score: 0

Also, what "new" cooperation tools are malware writers using to communicate with each other? I'm fairly sure that IRC, Instant Messaging, VoIP, Bulletin Boards, and e-mail have all been standard communcation tools for these people. Maybe the groups now have more members.
I hear all the 1337 h4x0rz are using Lotus Notes because it's teh r0x0rz.

Spammers, Hackers and virus writers... by Anonymous Coward · 2004-12-09 06:45 · Score: 0

Oh my!

Re:Spammers, Hackers and virus writers... by Adriax · 2004-12-09 07:11 · Score: 1

"We're off to see the Linux. The wonderful Linux OS!"

--
I don't suffer from insanity, I enjoy every minute of it!
Re:Spammers, Hackers and virus writers... by Raistlin77 · 2004-12-09 08:26 · Score: 1

Don't worry... once Linux becomes half as mainstream as Windows, you'll get your fair share of viruses, malware, and the like. Hide behind Linux all you want, but pray to God that the masses don't start switching.

Organized Crime? by jellomizer · 2004-12-09 06:46 · Score: 4, Interesting

Isn't this the same as orginized crime. So a bunch of internet thugs orginize to advertise more stuff, because they realized it will be more effective if they worked togeth. Will this rise the cost of protection money to use the internet?

--
If something is so important that you feel the need to post it on the internet... It probably isn't that important.

Re:Organized Crime? by Anonymous Coward · 2004-12-09 07:01 · Score: 0

No.. this is not like organised crime.

And is there something wrong with your keyboard? There seem to be several letters missing from your post.

I'll from the head! by identity0 · 2004-12-09 06:46 · Score: 5, Funny

Hacker: I'll form the head!

Scammer: I'll form the heart!

Pornographer: I'll form the right hand!

Spammer: I'll form the crotch!

All: Together, we are - ASSHOLETRON!

(catchy theme music here)

Re:I'll from the head! by NardofDoom · 2004-12-09 06:56 · Score: 4, Funny

It's like Captain Planet, only worse. And evil.
"Captain Spam-it, he's our hero. Gonna make your compuer divide by zero!"

--
You have two hands and one brain, so always code twice as much as you think!
Re:I'll from the head! by Anonymous Coward · 2004-12-09 07:03 · Score: 1, Funny

5 Lions! You need 5!

IE programmer: I'll form the rectum!

(For entry, dontchaknow)
Re:I'll from the head! by TrollBridge · 2004-12-09 07:30 · Score: 1

Are you saying that Captain Planet wasn't really a villain?

Talk about your surprise endings!

--
There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.
Re:I'll from the head! by bludstone · 2004-12-09 07:56 · Score: 1

Which spammer gets to be "Heart?"

That sucked.

--

no .sig
Re:I'll from the head! by AndroidCat · 2004-12-09 08:53 · Score: 1

And don't you need some cutesy floating mascot/robot? Clippy...!

--
One line blog. I hear that they're called Twitters now.

Not a surprise by Anonymous Coward · 2004-12-09 06:46 · Score: 0

Could have seen this coming from a mile away. This is a business to these people. Think of this as just-in-time supply chain theory, or vertical integration by acquisition. Not surprising in the least.

No surprise- by IWantMoreSpamPlease · 2004-12-09 06:48 · Score: 5, Interesting

Used to be (way back in 2003 or so) AdAware was all you needed (and Norton AV or a workalike)

But now, man some of the things I've seen are really nasty!

You wipe 'em out, they come back, they hide from searches, morph into other programs, I've even seen one (I shit you not, I've been in IT for 10+ years, never seen anything like this one!) that was active even when the infected drive was placed as a slave on another machine, it started right up and infected the new PC.

This goes way beyond simple syware, these people are teaming up and it's just the beginning.

--
So rise up, all ye lost ones, as one, we'll claw the clouds.

Re:No surprise- by Anonymous Coward · 2004-12-09 06:54 · Score: 0

hey mister, i call bologna on the life after slave drive...
Re:No surprise- by BicycloHexane · 2004-12-09 06:57 · Score: 1

can you put autorun.ini (same as the kind on a cdrom) on a hard drive and have it execute when you put the drive in another computer?
Re:No surprise- by Anonymous Coward · 2004-12-09 07:08 · Score: 0

> I've even seen one (I shit you not, I've been in IT for 10+ years, never seen anything like this one!)

Well, what have you been doing in 'IT for 10+ years', surfing for p0rn?
Re:No surprise- by MindStalker · 2004-12-09 07:22 · Score: 1

Not if it uses classic pre-internet era virus tricks. Obviously most anti-virus programs should know these tricks, but its still possible.
Re:No surprise- by Anonymous Coward · 2004-12-09 07:25 · Score: 0

touche, i did a little thinking after posting, funny how it happens in that order, but yeah i was thinking its possible but wouldnt he also have to use an older OS ?
Re:No surprise- by RealAlaskan · 2004-12-09 07:32 · Score: 0, Troll

some of the things I've seen are really nasty!
No, don't tell me, let me guess: you run Windows, right?
I've heard about these virus thingies, but I've never seen any. Could you send me a few? I'm starting to feel deprived. That's what comes of not using Windows.

--
See what I've been reading.
Re:No surprise- by Tuxedo+Jack · 2004-12-09 08:00 · Score: 1

Adware's a big component of this, especially the new VX2/ABetterInternet strain.

It's no real surprise, then, that large corporations and their ad dollars are behind a lot of this.

--

Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
Re:No surprise- by MindStalker · 2004-12-09 08:05 · Score: 1

Not nessessarly, boot sector viruses are still possible, though one coded for prewindows DOS wouldn't work with 2000 or XP they could easily be ported.
Re:No surprise- by Anonymous Coward · 2004-12-09 08:13 · Score: 0

Congratulations, you now have a box that can surf the 'net... and get e-mail..and....um...run a server! It still can't play anything better than Tux Racer.

Deal with it zealot, and get off my /.
Re:No surprise- by RealAlaskan · 2004-12-09 08:47 · Score: 1

It still can't play anything better than Tux Racer.
I don't care about what the box can play. When I want to play, I don't use a computer.

--
See what I've been reading.
Re:No surprise- by Anonymous Coward · 2004-12-09 09:17 · Score: 0

I've got an old linux virus sitting on a backup hard disk somewhere. I got the sample of BugTraq back in... 98 or so? Check the archives if you're really curious.

Sure, it doesn't do much if it can't get root, but such things do exist, you know.
Re:No surprise- by gregfortune · 2004-12-09 09:31 · Score: 3, Funny

I've even seen one that was active even when the infected drive was placed as a slave on another machine

Dude, don't click on them *again*...
Re:No surprise- by RupW · 2004-12-09 09:41 · Score: 1

though one coded for prewindows DOS wouldn't work with 2000 or XP they could easily be ported.

Only if they intercept BIOS calls and somehow survive the transition into protected mode, and if the protected mode hardware drivers actually use the BIOS rather than go directly to the hardware. Which I think is very unlikely.

So no, I don't think this is possible *easily*. The best you could do would be to try and interfere with NTLDR and load a fake device driver than handles the re-infect, but that's a substantial amount of work, requiring a substantial amount of code to be hidden at boot time and would very likely be specific to a few versions of NTLDR.

In any case, to go back to the OP's case, you'd never trigger a boot sector virus on a slave drive.
Re:No surprise- by aldoman · 2004-12-09 10:28 · Score: 1

Yes.

--
IntechHosting - Free domain, 2GB, PHP, £4.95/$8.95
Re:No surprise- by sir+lox+elroy · 2004-12-09 10:56 · Score: 1

Oh wait I can do more than Tux Racer, That's right UT2K3, UT2K4, RTCW (Just a couple examples, if you'd like more I can send them to you, and screenshots). Oh, and yes, I can check my e-mail (Oh look another MS Worm from an AOHell User), and surf the web (Oh look a website trying to use an IE Exploit, isn't that quaint).

--
Kosh: "Understanding is a 3 edged sword, your side, their side, the Truth."
Re:No surprise- by ScrewMaster · 2004-12-09 11:20 · Score: 1

Well, sometimes NT, 2K and XP get very confused if they see two bootable devices in a system. When I've tried this (usually trying to recover data from the second drive) I've found that sometimes the operating system will attempt to boot a drive that is not the Primary Master. Very irritating behavior. So it is possible that the grand-grand-grand-whatever-parent poster did encounter a boot-sector infector but ... yeah, it's pretty unreasonable to expect it to have had much effect after the OS was loaded. Like you said, it's possible ... but I can't see that it would be worth the effort.

--
The higher the technology, the sharper that two-edged sword.
Re:No surprise- by Foolhardy · 2004-12-09 13:00 · Score: 1

NT confused? First, the bios decides which drive to boot off of; it loads the boot sector and executes it. If NTLDR is at the boot sector, it searches for "boot.ini" on the same volume. It'll see a list of OSes and a line like
default= multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
The first part is an ARC (Advanced RISC Computing) standard path to find the volume to boot off of. multi is the disk controller; how these are numbered is up to BIOS.
disk is for SCSI, rdisk is the drive number on the controller (0 for master, 1 for slave on IDE), and partition is self-explanitory.
The \WINDOWS is the path from the volume's root where the OS is installed. This could also be the name of a file to load and execute directly.
The volume that it should be booting off of is detirmined first by the BIOS and then explicitly by boot.ini
Here's a good link about it.

I'd say that NTLDR's internal implementation is so undocumented that it would be difficult, but possible, to infect with a boot virus. There are easier ways to infect the system, though.
Re:No surprise- by Pastis · 2004-12-09 13:20 · Score: 1

I for one find that funny.

We know that viruses have affected all sorts of population before. Some plagues killed as much as 30% of people in some countries years ago. AIDS has now about the same infection rates in some countries.

It's highly probable that one day a big bad virus will spread and destroy a huge number of PCs at a time. Perhaps 1 or 2 %.

That's just going to happen.

--
Sneak teach kids Algebra using a game
Re:No surprise- by Anonymous Coward · 2004-12-09 14:36 · Score: 0

autorun doesn't go if the CD was in when the machine was started. So unless you're hot-swapping hard drives, no. (And if you are, I'm not sure.)
Re:No surprise- by Anonymous Coward · 2004-12-09 17:35 · Score: 0

Theres nothing better than lbreakout2
Re:No surprise- by Perianwyr+Stormcrow · 2004-12-09 18:40 · Score: 1

"i call it aohell because i'm a cocksucker"

god

--
What we call folk wisdom is often no more than a kind of expedient stupidity.-Edward Abbey

serve yourself and save by to_kallon · 2004-12-09 06:48 · Score: 3, Interesting

"They work in groups that exchange information with other groups on forums and Web sites."
erhmm....
ianase (i am not a security expert) but wouldn't that statement apply to, hmmmm....., oh i don't know.....THE INTERNET?? seriously, a broad, vague, statement like that suggests to me that this is mostly overreaction on the part of a group who could experience significant gains IF their statements were true.
fud? imho, yes.

--

The only way to get rid of a temptation is to yield to it.
-Oscar Wilde

Security Through Obscurity by TrollBridge · 2004-12-09 06:49 · Score: 2, Interesting

"This means that they reckon that weaknesses will be exploited in a matter of hours of being announced, rather thant the weeks and months that we're seeing now."

Kinda makes you think twice about publicly announcing vulnerabilities in your software before you have time to fix them, does it not?

--
There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.

Re:Security Through Obscurity by druhol · 2004-12-09 07:06 · Score: 2, Insightful

A good portion of the time, hackers and such learn about the exploits by reverse-engineering patches and updates. The problem isn't 'security through obscurity' so as just that most users are too lazy to patch their computers when a new update comes out.

--
WWD4D?
Re:Security Through Obscurity by TrollBridge · 2004-12-09 07:09 · Score: 1

I didn't mean to imply that security through obscurity was a problem here. In fact, I'd say it's not such a bad idea, given the information presented in this particular article, anyway. What is the benefit of publicly announcing a software vulnerability before the developer has had time to produce a patch?

--
There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.
Re:Security Through Obscurity by Cid+Highwind · 2004-12-09 07:42 · Score: 2, Informative

Specific descriptions of a new vulnerability let sysadmins deploy new IDS/firewall rules to detect and block malware, write scripts to scan for infected hosts on their network, etc. Non-specific "there's a new remote-root hole in openSSH, but we're not telling you what it is" announcements just give people ulcers.

--
0 1 - just my two bits
Re:Security Through Obscurity by legirons · 2004-12-09 10:59 · Score: 1

"This means that they reckon that weaknesses will be exploited in a matter of hours of being announced, rather thant the weeks and months that we're seeing now." -- Kinda makes you think twice about publicly announcing vulnerabilities in your software before you have time to fix them, does it not?"

There's also the theory that exploits are already available and in moderate use, for (months|years) before the company involved knew about the vulnerability, and are part of peoples' own cracking toolkits.

Once the vulnerability is announced on a mailing list or by releasing patches, the exploit becomes much less valuable (or declines in value over the course of a week), so people may as well release their code and get bragging-rights for it (especially as the less-capable crackers will be starting to put together their own exploits from information in the announcement)

I guess it depends who you hope to secure against. Most people are happy to defend against automated virus-style attacks, but are wide-open to targeted attacks by someone who does their own security-testing on other peoples' products.

I've found exploitable security-related bugs in commercial products, just while trying to use them normally (not even looking for the bugs) so imagine how much more is going to be found by someone who goes looking for loopholes...

Anonymity is part of the problem by Anonymous Coward · 2004-12-09 06:49 · Score: 1, Insightful

Privacy is important, but isn't the general anonymity of the net a contributer to these sorts of problems?

It's a shame, but it seems some people are malicious in proportion to their anonymity.

Re:Anonymity is part of the problem by lucabrasi999 · 2004-12-09 06:55 · Score: 4, Funny

It's a shame, but it seems some people are malicious in proportion to their anonymity.
...And this was posted by an Anonymous Coward. Am I the only person to see the irony here?
Re:Anonymity is part of the problem by Anonymous Coward · 2004-12-09 07:06 · Score: 0

Yep, you and OP are both unusually insightful. Thanks for pointing these things out.
Re:Anonymity is part of the problem by Anonymous Coward · 2004-12-09 07:17 · Score: 0

So, a corollary might be:

"people are stupid in propotion to their obviousness."

'cept I'm really not all sure the last word is even a real word.....
Re:Anonymity is part of the problem by Anonymous Coward · 2004-12-09 07:22 · Score: 0

...And this was posted by an Anonymous Coward. Am I the only person to see the irony here?

If I had not posted AC, my Karma would have been beaten down by anonymous moderators.

It's so easy to mod-down if you don't have to explain your reasoning.

I've got to be anonymous as a form of self-defense.

Really, I'd have no problem posting with my name if I could know who my "accusers" were. Instead we have "hit-and-run" moderation.

I'm just trying to stay out of the street.
Re:Anonymity is part of the problem by lucabrasi999 · 2004-12-09 07:23 · Score: 1

"people are stupid in propotion to their obviousness."
I guess I should have looked up, then I would have seen the point. I guess that means it's now time for my mid-afternoon coffee break.
Re:Anonymity is part of the problem by Anonymous Coward · 2004-12-09 08:05 · Score: 0

Uh, the GP did say "some people".

Hopefully ... by Anonymous Coward · 2004-12-09 06:50 · Score: 0

... this will not only push software writers to consider putting more time into writing better software, but also underline the benefits of the open-source model.

This war can't be won ... by smoyer · 2004-12-09 06:50 · Score: 3, Insightful

The problem with detecting and deleting viruses, trojans, etc. is that you will never get ahead. At such time as a zero-day exploit is known to a hacker, they can create their malware of choice to exploit it. A skilled hacker may have an exploit ready in 6-12 hours.

Once done, they have a certain population size (vulnerable hosts) that can be almost instantly assaulted.

On the white-hat side, once the malware is noticed, it may take months to patch the initial security hole and even longer to patch the entire population of vulnerable hosts.

This is why vulnerability announcements are so important, the software that survives in the future will be the one with the shortest vulnerability to patch cycle. The others will die off ... only the strong survive!

Re:This war can't be won ... by Goeland86 · 2004-12-09 07:25 · Score: 1

Which is probably where Open Source software will eventually win. I remember a Mozilla/Firefox exploit that was patched in an hour... Compare that to the 6 months it took Microsoft to issue a few "simple" patches to Internet Explorer.
I think that to defeat these groups the easiest way is to use the least vulnerable software, which for an x86 platform right now seems to be OpenSource software.
Didn't apache have a bug that was fixed in less than 30 minutes after the flaw was discovered?
How many corporations can brag in the same way about their programs? Not that many, if not none.
Way to go, Linux and *BSDs! Eventually people will look for alternatives to Windows because windows will be the same as SkyNet for your computer: install windows and your box will fry under the assaults of virii and other remote-control bots. Use Linux and defeat all those little buggers by not offering the holes :)

--
---- I am certain of only one thing : I know nothing else.
Re:This war can't be won ... by Anonymous Coward · 2004-12-09 07:31 · Score: 0

"...the software that survives in the future will be the one with the shortest vulnerability to patch cycle. The others will die off ... only the strong survive!"

The flaw in comparing software development to evolution is that most life forms don't have a marketing department. The gazelle survives because it actually can outrun a lion, not because its spent millions advertising its speed to lions...
Re:This war can't be won ... by fireboy1919 · 2004-12-09 07:35 · Score: 1

may take months to patch the initial security hole

This is the Windows way. Linux security fixes usually take a few hours up to a few days for services (ssh, apache, Bind, ntp). Also, if you use nonstandard ports for anything else and install active intrusion detection software then hackers won't get past the initial port scan.

Oh, and web browsers are inherently complex. I put a proxy in front of mine with ClamAV to innoculate any pages sent to the browser, just in case there is an exploit.

I will be very surprised if this level of vigilence doesn't continue to be enough to stop malware from ending up on my machine.

--
Mod me down and I will become more powerful than you can possibly imagine!
Re:This war can't be won ... by nacturation · 2004-12-09 07:45 · Score: 2, Insightful

This is the Windows way. Linux security fixes usually take a few hours up to a few days for services (ssh, apache, Bind, ntp).

That's great for simple products like Firefox, but what about when the product that has the security hole needs a fundamental change in its behavior? And if that product is used by every Fortune 500 company now you'll need to do compatibility testing to make sure that the product fix doesn't b0rk the dozens of other interoperable software which has been built on top of it.

Security is easy when all you need to do is fix a buffer overrun problem. It gets a bit more involved when making changes to software which has many dependencies.

--
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Re: This war can't be won ... by Alwin+Henseler · 2004-12-09 08:24 · Score: 1

"The software that survives in the future will be the one with the shortest vulnerability to patch cycle. The others will die off ... only the strong survive!"
Software with the quickest patch cycle may survive on the market, but not on the 'net. As you claim yourself, the bad guys are always ahead.
Just suppose: everybody gets automatic updates, malware producers are extremely skillful, vendors put out patches 2 seconds after they're informed of an exploit, and unpatched machines are compromised immediately when connected to the 'net. What happens then?
Black hat finds hole: numerous exploited machines before exploit is reported to vendor & the (remaining!) machines are patched. White hat finds hole: vendor puts out patch, black hat reverse engineers & makes exploit quickly, and manages to compromise some machines before the update reaches all corners of the 'net. Some holes will be found by black hats, some by white hats. Either way, there's always a pool of exploited/exploitable machines (likely a growing number, as the net keeps growing) at any given time, even IF vendors do a good job AND users patch their machines quickly. And any single machine has some chance of being compromised sooner or later.
The only software that truly survives here, isn't software that gets patched quickly, but software that doesn't need a patch. Software that only fails when the hardware does, but otherwise works, reliable, solid, period.
Possible? Some argue not, I think it can be done. Software is ultimately based on mathematical principles, and last time I checked, 1+1=2 was still valid. Hardware fails, 1+1=2 doesn't. The rest is a matter of design/software engineering in a broader sense. How to write reliable software, how to manage complexity? Hard, but not impossible.
The optimal solution is not needing one.
Re: This war can't be won ... by Ambassador+Kosh · 2004-12-09 11:33 · Score: 1

I think to get software that doesn't need to be patched will take many changes and many programmers will refuse to change. Some of the issues need to be fixed in the languages and just make certain kinds of bugs not possible to have to begin with. We also need better methods to split up programs into easily manageable and testable pieces and that would also need to be enforced by the language. I suspect such a system would not only lead to more secure programs but long term it would also lead to faster programs.

One thing I have always found strange when comparing c++ to python for example is that in a microbenchmark c++ always ends up faster then python. However my experience with larger projects is that python always end up faster then then c++ and is far less buggy. I am not entirely sure why but it has been true in my experience. That is one reason why I don't buy these benchmarks I keep seeing.

More code reuse would also help. Given that most software obeys that 90/10 rule. (90% of the performance is in 10% of the code). There will be a lot of programms that have the speed issues in the same place and that gives an opportunity to have video decode, image decode, fft, etc libraries that are very small in scope and very heavily tested to try and make it as small of a chance as possible to have security issues in those pieces. So not only does the high level language pass off the most processor intensive stuff to a lower level library you pass it to an extensively tested library and your programs are developer faster, run faster, are less buggy, easier to maintain and most importantly more secure.

--
Computer modeling for biotech drug manufacturing is HARD! :)
Re:This war can't be won ... by fireboy1919 · 2004-12-09 14:38 · Score: 1

Umm...browsers are one of the most complicated internet products in existence.

You're going to have to be more specific if you're talking about something that uses the internet which is more complicated than a browser - especially something more complicated that actually has other things that depend on it. I can't think of anything like that myself.

Are you sure you're not talking about Windows again? The place where the browser is part of the operating system?

--
Mod me down and I will become more powerful than you can possibly imagine!
Re:This war can't be won ... by Anonymous Coward · 2004-12-09 14:55 · Score: 0
Why not switch from a blacklist strategy to a whitelist strategy? 'Blacklist strategy' =
1. Receive news of new virus/trojan/other executable
2. Mad rush to update AV software to block it
3. Despite 2) malware writers still have sufficient time (hours) to exploit weakness before it's shut off
4. ... And that assumes everyone finds out about the exploit immediately, the patch/A/V update is written promptly, and absolutely everyone downloads the fix at the first opportunity
Yeah, right, like that happens, even now. Even when the A/V companies or the patch-writers are 100% on the ball, the window of opportunity for damage is becoming unacceptably large. This 'blacklist' technique is becoming totally inadequate.
'Whitelist' strategy =
1. Define a list of trusted applications, per computer
2. Use a modified version of A/V software that only permits whitelisted software to run, and blocks everything else.
This means keeping your A/V software updated is no longer time-critical, which is the problem with the current system. If you buy a new piece of software, and it's not on the whitelist, yes, you can't use that software until it's added, but, if it's a benign piece of software, the fact that you cannot run it yet, and you might have to wait a day or two before you can, does no harm. Compare with malware, where permitting it to run just once can do serious damage. Most users - I'm thinking of your generic office employee here - use the same software day in day out. Say, IE, Word, Excel. Once those three apps are on the whitelist, that user is covered, and their IT environment is stable. What's more they cannot add unauthorised software without the say-so of the IT department - because in a corporate environment the IT guys will be the people managing the whitelist. Presto, no more viruses (in theory), no more pirate software, no more unauthorised screensavers and other crud compromising system stability. At home, again, most users don't add new software that often, and use only as fraction of what comes installed on their systems. So, again, they're easy to lock down. The people who are constantly downloading new stuff can reasonably be expected to be savvy enough to protect themselves. Developers can have a designated sandbox area where the A/V software does permit them to run their new code, or a power-user-level 'authorise this program to run' feature can be provided. Yes, there is an enormous volume of software that would need to be defined as 'legitimate', but then it would be in the interests of all software vendors to provide the authentication codes with their software as they ship it. These 'this program is safe to run' certificates can be PGP-signed or otherwise made secure. Occasionally a piece of malware might manage to get itself authorised, but then this will get caught and it will be added to the blacklist, which would take precedence over the whitelist.
And even if this suggestion is too complicated to implement, merely forbidding a new executable to run for a configurable 48 hour period after it was installed would give the A/V people time to keep up!
Re:This war can't be won ... by nacturation · 2004-12-09 22:43 · Score: 1

Umm...browsers are one of the most complicated internet products in existence.

Yes, they can be complicated.

You're going to have to be more specific if you're talking about something that uses the internet which is more complicated than a browser - especially something more complicated that actually has other things that depend on it. I can't think of anything like that myself.

Well, how about a supply chain management software which integrates accounting software, inventory, ordering, procuring, messaging, etc. Maybe it has an API which has a subtle bug and the only way to fix it is to change the behavior of the API or to add a security layer which then depends on other applications. Think of an SAP implementation and the millions of dollars corporations spend just rolling it out as it needs to be customized to their particular business processes.

Are you sure you're not talking about Windows again? The place where the browser is part of the operating system?

I'm not necessarily speaking of Windows. But I assume you're speaking of Linux again? The place where there are no complementary products and applications can't be linked together? Uh-huh...

--
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.

focus change by derxob · 2004-12-09 06:50 · Score: 4, Insightful

Back in the day virus writers main intent or goal was to piss off users and to create the next 'big' virus. Now a days, it's all about the money. Those same virus writers are now focusing their attention on the same aspects of before, infecting and disrupting a users system, but when money is involved, the stakes get higher, and things become a lot more dangerous.

However, this article is pleading that we should *not* be publishing vulnerabilities, "because it gives hackers a tool", and I disagree with this. Publishing vulnerabilities is a way to alert the public of exploits that are present. What we need to do is make the publishing of vulnerabilities more popular than it is so that the general public is aware of problems and alerted on how to fix them.

--
Beat the computer, program your life.

Re:focus change by MinutiaeMan · 2004-12-09 09:53 · Score: 2, Interesting

I see a major problem with this, at least in some circumstances. If businesses start issuing too many warnings about vulnerabilities, at least some users might become "desensitized" to the urgent need to upgrade. Heck, already too many users don't bother upgrading until there's a big bad virus or worm out there threatening everyone.

Of course, by the same token, if businesses start issuing more warnings (cough*MICROSOFT*cough*) then maybe more people will realize that their software of choice is a piece of sh*t and start looking for a replacement.

I think that so far, the general effect of an increased emphasis on security has been the latter (people reconsidering options). But will it always stay that way? I don't know.

A classic by Anonymous Coward · 2004-12-09 06:51 · Score: 0

In Soviet Russia, Security Weaknesses exploits YOU!

China: Spammers, Virus Writers, & Hackers by Anonymous Coward · 2004-12-09 06:51 · Score: 0, Troll

The bulk of the spammers, virus writers, and hackers originate in China (which includes Taiwan province and Hong Kong). They are beyond the reach of American laws.

Nonetheless, we can do 2 things to protect ourselves. First, download and install FireFox. Use it for all secure transactions (i.e. "https") on the web. Set the security on your Internet Explorer to "HIGH", disabling Java, JavaScript, ActiveX, etc. Use Internet Explorer only for casual browsing.

On my computer, Internet Explorer is slightly faster for casual browsing than FireFox because Explorer is more tightly integrated into the operating system.

Anyhow, the second thing that you can do to protect yourself and the rest of Western society is to join the boycott of products that are "Made in China". It is having an effect on the West Coast. The boycott includes products made in Hong Kong and Taiwan province. Hurt the Chinese economy, and you will slap the Chinese to attention, forcing the brutes to fix the problem with spammers, etc.

Scary? Sort of. And yet... by DanteBlack · 2004-12-09 06:51 · Score: 1

Is this scary? I suppose, but is it realistic to believe that this is a truely new development. Vulnerabilities get exploited and there's nothing that can be done about that. Consumers need to be aware of them so that they can attemt to deal with them while a advisory solution or patch is in the works.

Moreover developers aren't always aware of a vunerability and they need to be. If people don't know about a potential exploit, both companies/developers and consumers alike, they will be affected more severly.

--
I am invisble, and you can't see me.

Another group... by lucabrasi999 · 2004-12-09 06:53 · Score: 1

Another group of people is obviously conspiring to take over. I wonder if this is all related to the "Vast Right-Wing Conspiracy"? Or was that the "Conspiracy of the Liberal Elite"?

Re:Another group... by Anonymous Coward · 2004-12-09 07:14 · Score: 0

"The biggest conspiracy is there are no conspiracies."

Microsoft should.... by Himring · 2004-12-09 06:53 · Score: 4, Funny

Microsoft should use the business model that's brought them where they are today, create a "virus" department in Redmond and beat these guys at their own game.

I can see it now: Active Virus (TM)

1. Make OS.
2. Build-in holes.
3. Release patches.
4. Create virus.
5. Still profit!

--
"All great things are simple & expressed in a single word: freedom, justice, honor, duty, mercy, hope." --Churchill

Re:Microsoft should.... by Turn-X+Alphonse · 2004-12-09 07:09 · Score: 2, Insightful

You missed some...

6. People get sick of it and whine
7. People move to Linux
8. Profit for someone else!

--
I like muppets.
Re:Microsoft should.... by Anonymous Coward · 2004-12-09 07:24 · Score: 0

Well Linux is up to step 3... Get market share up to 25% and watch #4 to arrive!
Re:Microsoft should.... by Anonymous Coward · 2004-12-09 09:24 · Score: 0

Yeah, but you forgot

6.5 Thirty years of claims that "This will be THE year of LINUX!!!"
Re:Microsoft should.... by DrYak · 2004-12-09 12:06 · Score: 1

I can see it now: Active Virus (TM)
1. Make OS.
4. Create virus.

Score -1, REDUNDANT

--
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]

Is this the famous... by Anonymous Coward · 2004-12-09 06:55 · Score: 0

Axis of evil... or was it Axis of email...

Et tu, Slashdot? by menkhaura · 2004-12-09 06:55 · Score: 5, Insightful

Mistaking hacker for cracker is acceptable on the general media, where people aren't very aware of such subtleties. But on Slashdot? C'mon, I know Slashdot is crawling with Windows users, wannabes and such, but this is getting offhand!

--
Stupidity is an equal opportunity striker.
Fellow slashdotter Bill Dog

Re:Et tu, Slashdot? by gameboyhippo · 2004-12-09 07:27 · Score: 1

Eh? I think hackers and crackers are like birds and chickens. Chickens and birds have a "is a" relationship and I think the same goes for "crackers and hackers" or even "crackers and snackfood". Or something like that. So I don't think that /. was necessarily wrong in using the term Hacker.
Re:Et tu, Slashdot? by CumInHerTaco · 2004-12-09 08:34 · Score: 2, Funny

Slashdot is crawling with Windows users, wannabes and such...

w00t, we have wannabes?!

I feel cool now!

--
The only way to end war is for everyone to get a piece!
Re:Et tu, Slashdot? by BooRolla · 2004-12-09 08:58 · Score: 1

offhand == out of hand ?
Re:Et tu, Slashdot? by QuantumFTL · 2004-12-09 09:41 · Score: 2, Insightful

Mistaking hacker for cracker is acceptable on the general media, where people aren't very aware of such subtleties. But on Slashdot?

I know this won't be very popular, but maybe it's time the "hacker" community accepted that like many other english words, it can mean multiple things. Geeze, already it can refer to someone who is bad at golf, or someone who enjoys chopping at wood, why not someone who "hacks" into computers?

Maybe i'm silly but I'd rather trust the Oxford English Dictionary on something than the consensus of slashdot. It's part of the english language now, and probably will be for the rest of our lives. Get used to it.
Re:Et tu, Slashdot? by ScrewMaster · 2004-12-09 11:42 · Score: 1

Sometimes the dictionary is wrong. Not often, but when it comes to computer terms I no longer consider Oxford (or Webster, or any other) as the ultimate arbiter of the language. The consensus here is among thousands of computer professionals, people that know better, that have a sense of the history of the field and its dialects, even if the computer illiterates that maintain dictionaries do not.

The popular media has, for years, misapplied the word hacker. By definition, their are no evil hackers. Black hats, yes. Crackers, yes. Computer vandals, yes. White collar criminals, yes. But a "hacker" is simply one who enjoys pushing the envelope, an experimentalist. I'm a hacker ... hell, I disassembled the entire Apple ][ operating system years ago, just to see how it worked (and because my friends thought it was cool.) Hacked it up pretty good, actually, made it do some things that it wasn't supposed to be able to do. Did that make me a criminal (well, that was in 1980 ... probably would make me a criminal now)? No ... it made me a hacker. And I was proud of that.

By your logic, that talking head on the five o'clock news should determine the words we speak and how we should use them. Might as well just have the good people at Webster's call up the newsroom and ask for definitions. But if the dictionary folks can't be bothered to research the history of a commonly-used computer term then I'll simply scratch it out of my copy.

--
The higher the technology, the sharper that two-edged sword.

Its unprofessional to this.... but by Chembryl · 2004-12-09 06:55 · Score: 1

This is good news for us as it keeps most us and our skill sets relevent to our employers.

Sorry but some times they need reminding.

--
- This and all my posts are public domain. I am a Physicist. I am not your Physicist. This is not Physically advice

Re:China: Spammers, Virus Writers, & Hackers by Anonymous Coward · 2004-12-09 06:56 · Score: 0

Parent == TROLL!

Move along, nothing to see here by worktheweb · 2004-12-09 06:57 · Score: 3, Informative

These are the same guys who were predicting an "Internet Meltdown" a little while back -- I'd take their prognostications with a grain of salt ...

http://it.slashdot.org/article.pl?sid=04/08/25/1 53 3213&tid=172&tid=95&tid=1

this is not scary at all. by Anonymous Coward · 2004-12-09 06:57 · Score: 0

all you have to do is either:

#1 SECURE YOUR DAMN WINDOWS MACHINE! i mean holy shit, firewalls, hello, patches, hello!!!!! anyone remember something called security?

#2 STOP opening attachments ending in .EXE, .VBS, .COM. actually stop opening attachments period.

#3 stop using windows. yeah yeah, i know, i have heard it. but my games only run on or software X only runs on ..... then at least buck up and take it like a man. you use windows therefore you get assraped.

#4 go outside. nature rocks, but it wont rock forever. i mean comon, the replublicans are not only destroying our economy buy writing checks no governenment can cash, and also that no enviornment can sustain.

Re:this is not scary at all. by Anonymous Coward · 2004-12-09 07:12 · Score: 0

...nature rocks...

Never has a truer phrase been said.
Re:this is not scary at all. by Anonymous Coward · 2004-12-09 08:56 · Score: 0

Should be:
Nature has rocks.

Rocks can be very pretty, sometimes.

mod post -1, troll by Anonymous Coward · 2004-12-09 07:00 · Score: 0

there is absolutely no evidence provided in TFA! worrying over this is comparable to worrying about the bum with the sign reading "the end is near!" in times square... jesus christ.

Latest Kapersky news by flibuste · 2004-12-09 07:00 · Score: 2, Insightful

Last time I heard about Kapersky labs, we were supposed to have an internet doom day. I'm still waiting for it, yet Kapersky is still blowing whistles.

How can you trust such a non-trustable source anywany?

Re:Latest Kapersky news by Schwartzboy · 2004-12-09 07:38 · Score: 1

How can you trust such a non-trustable source anywany?

As soon as you figure that out, give me a call. If I could understand why so many people continue placing their trust in individuals or institutions that seem to exist only to abuse that trust, I'd finally be able to understand why the political system in my country works as well as it does.

--
"Linux doesn't exist. Everyone knows Linux is an unlicensed version of Unix"- Kieren O'Shaughnessy
Re:Latest Kapersky news by satterth · 2004-12-09 10:56 · Score: 1

Last time I heard about Kapersky labs, we were supposed to have an internet doom day. I'm still waiting for it, yet Kapersky is still blowing whistles.
But you see, he told everyone about the internet doom day and saved the internet from doom. Yeah for Kapersky he saved us!
It's just wrong, but shouldn't someone thank him?

--
Being called a dork on Slashdot must be like being called the retard in special ed.

!News by oexeo · 2004-12-09 07:01 · Score: 1

This will probably get modded troll, but please hear me out:

Damn it /.! Please check the definition of news:

News
- Information about recent events or happenings, especially as reported by newspapers, periodicals, radio, or television.
- A presentation of such information, as in a newspaper or on a newscast.
- New information of any kind: The requirement was news to him.

This is not news! It's simply common sense that certain classes of people are going to conspire and associate with each other to some degree. Perhaps if the article was about a particular group of some importance, or interest it would be news, instead it's just another redundant research paper telling us what we already know. Outside of tech news, please imagine the headline "Safe crackers combine forces with bank robbers" appearing on the front page of any respectful publication, that's how stupid I think this is.

Good 'ol days???? Screw that! by Anonymous Coward · 2004-12-09 07:01 · Score: 0

"good 'ol days"?????
You mean, "pissourpantsohshithereitcomeseverybodyrun 'ol days"!!!!

Nothing new here by genner · 2004-12-09 07:03 · Score: 1

Hackers teaming up is nothing new.
Most virus's are open source.
Quite possibley their the orignal open source community.

.....please dont flame me I use linux I swear!

Re:Nothing new here by Anonymous Coward · 2004-12-09 17:28 · Score: 0

I will only flame you for the same thing 99% of slashdot users seem to need a good flaming for:

Their: As in beling to this group. I.e. "Their computer is broken".
They're: As in this group are doing this (they are). I.e. "They're not coming to the party..."
There: As in "over there".

C'mon people. Did any of you go to school?

Do we care? by Turn-X+Alphonse · 2004-12-09 07:03 · Score: 1

We all keep our PCs secure.. or should do. Then we make money off it, by fixing the PC's belong to who don't...

It's win-win for us. Lose-lose for the newbies.

--
I like muppets.

Re:Do we care? by Anonymous Coward · 2004-12-09 08:02 · Score: 0

When old people start knocking at your door telling you you have to take care of them, you'd better watch out...newbie

Within hours??? How about BEFORE!!! by Anonymous Coward · 2004-12-09 07:03 · Score: 0

I can't beleive that I here this sort of talk time to time. People who are ignorant enough to beleive that anouncing vunerabilities are causing machines to be hacked.

Stupid stupid stupid.

Announcing vunerabilities is a GOOD THING. Otherwise most people won't know about it. Some of these spammers/virus makers/worm makers/script makers are as skilled as programmers as your going to find anywere and are perfectly capable of
discovering these vunerabilities on their own.

What we have to worry about is well funded, and well trained professional programmers being paid to find lots of people's computers to exploit will begin outstripping the white hats capabilities to discover these vunerabilities FIRST.

Beleive me, there are a lot of software out their that maliciously attacks computers in ways that MS and freinds are unaware of.

Defending Windows 3.1 (and especially WfW 3.11) by Anonymous Coward · 2004-12-09 07:04 · Score: 0

While not technically an OS, Windows 3.x flies on a Pentium 3 using Windows 9x's built in DOS (7.1) via a patch to the IO.SYS called OSR2fix. By default, NO ports are open on Windows for Workgroups 3.11 when I run the ShieldsUp test on grc.com. Among the other versions of Windows hooked to the Internet, Windows 95 is probably the next most secure operating environment with only port 139 open by default. Windows XP (again, unfirewalled) naturally has the most ports open.

yeeeeehaaaaaa! by flacco · 2004-12-09 07:04 · Score: 0, Troll

die, microsoft, Die, DIE!

--
pr0n - keeping monitor glass spotless since 1981.

Re:yeeeeehaaaaaa! by Anonymous Coward · 2004-12-09 07:10 · Score: 0

And that hole that was just reported today in Mozilla/Firefox means "Die! Linux! Die! Die!".

Watch where that froth is spewing...
Re:yeeeeehaaaaaa! by PenGun · 2004-12-09 07:52 · Score: 0

We can play this game happily. One monster for your target, M$. A million rats partying , Linux.

PenGun
Do What Now ??? ... Standards and Practices !

Dear Sir by Anonymous Coward · 2004-12-09 07:04 · Score: 0

Although your user ID has crossed the six digit barrier, I would like to reward you with an honorary 5 digit UID for your fine work pointing out the old Slashdot vs. the new Slashdot. On the old Slashdot, it would've been cracker, but now... well, it's just sad.

whee by ribo-bailey · 2004-12-09 07:04 · Score: 1

Spam! Hack! Virus! Go Russians! By your powers combined, I am captain pain in the ass!

Hear, their, everywear by Shadow+Labs · 2004-12-09 07:05 · Score: 1

some people still have blaster on there box..they dont know or wanna know how to take care of there box

And some people over their don't know what there getting they're own selves into grammatically speaking!

--

echo $SIG

Re:Hear, their, everywear by Anonymous Coward · 2004-12-09 21:07 · Score: 0

Your spelling is worse than the GP. Were you trying to be funny or something?

The Legion of Doom by ro_coyote · 2004-12-09 07:06 · Score: 1

Oh no, someone call the Superfriends!

Call Gregory by CSG_SurferDude · 2004-12-09 07:06 · Score: 1

P-1 CUR ALLOC=8,058,044,651 CALL GREGORY

--

LongTail SSH Brute Force analysis tool is here!

Hacking just not what it used to be by The+Redwin · 2004-12-09 07:06 · Score: 1

Any one else remeber when hackers were just the type of people that hang out at slashdot? The kind of peopel that might hack into your system, but wouldn't break anything, and then leave a friendly note explaining how to secure it? Now it seems the only image the public associates with the hacker sterotype is jerks like this writing spyware/virus/ddos bot/spam relay/etc crap. =(

Why is parent modded "troll"? by rhakka · 2004-12-09 07:10 · Score: 1

like somehow using economic warfare to make someone pay attention isn't a rational thing to suggest?

Re:Why is parent modded "troll"? by Anonymous Coward · 2004-12-09 07:19 · Score: 0

Articles which criticize anything in Chinese society (which includes Taiwan province and Hong Kong) is usually modded "Troll" or "Flamebait".
Articles which praise anything in Chinese society is usually modded "Insightful", "Interesting", or "Informative".
Re:Why is parent modded "troll"? by Anonymous Coward · 2004-12-09 07:23 · Score: 0

because this post shows up everywhere, in threads where it isn't relavant. Someone is GNAAing or some such and trying to get an insightful mod on the trolling. -nB
Re:Why is parent modded "troll"? by Anonymous Coward · 2004-12-09 07:30 · Score: 0

Oh... I assumed it was because he said a Microsoft product did something better than an open source product (in this case IE faster than Firefox). That's usually the cause for a -1 Troll.

open a can of whoop-ass by TheSHAD0W · 2004-12-09 07:10 · Score: 2, Interesting

This circumstance does have some advantages; by tying themselves together financially they open the possibility for one to be traced from the other.

It also opens the participants to criminal conspiracy charges. Can you say RICO, motherf***er?

Very dangerous meme... by CODiNE · 2004-12-09 07:15 · Score: 2, Insightful

"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."

This pushes security discussion underground, but doesn't stop the bad guys, just leaves the administrators vulnerable and unaware. Very easy to spread this sort of propaganda however... hopefully it doesn't lead to laws being passed.

--
Cwm, fjord-bank glyphs vext quiz

Now they'll find their own vulnerabilities by Animats · 2004-12-09 07:17 · Score: 1

If the attackers are getting that organized, they presumably can find their own vulnerabilities, instead of relying on published ones like the script kiddies.

Re:China: Spammers, Viruses, and Hackers by glennrrr · 2004-12-09 07:20 · Score: 1

I can't imagine how "slightly faster for casual browsing" justifies using Explorer. If anything, to maximize security, one should never use Explorer for casual browsing, and only use it to run Windows Update and perhaps other sites mandatory to doing one's job which use ActiveX controls. Otherwise use Firefox.

And for even better security, get a computer pre-installed with Safari.

"Bad" Industry? by Anonymous Coward · 2004-12-09 07:21 · Score: 0

I know I will be instantly flamed and modded as troll, but I'm starting to feel disgusted about this good versus bad scenario that's being used since 09/11 (or 11/09 for the rest of the world). Freedom versus Terror. The "good ones" versus the "bad ones".

Bad industry, in my opinion, is making use of software patents to suffocate small business. Bad Industry, in my opinion, is to spread lies about FOSS software out there. DMCA. DRM. WinXP (sorry...).

I just think that, outsourcing jobs back and forth and don't letting these hard-working jobless people create their own business, is the cause of this.

Too bad Microsoft created a crappy OS. Let's make money out of it (just like anti-virus companies, anti-spyware companies and others do).

I was going to use my name on this post... but I will post as AC. And, no, I'm not a "malware" developer. Just someone that find its funny for the software industry to blame the "bad guys" for all their mistakes.

and here the world is all using bathgatesOS by Anonymous Coward · 2004-12-09 07:25 · Score: 0

quite an exposure

Jabberwocky! by jaypifer · 2004-12-09 07:25 · Score: 5, Insightful

"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."

And this is why most people are against security by obscurity. Kaspersky is confused. The tired phrase of "If guns are outlawed, only outlaws will have guns." applies even more pertinently to software vulnerabilities.

By the time someone with enough motivation (read funding) to write an article on a vulnerability does so, the bad guys have already written exploits. Why? For the same reason...they get paid!

The published articles allow the moderately tech savvy user to protect themself. Additionally, it forces the software makers' hand to close the vulnerability faster than if they had no pressure at all. Ultimately, this is our only way of shaming large companies into creating proper software and delaying the releases until they've created a more hardened product.

Yes, hanging out the dirty laundry of vulnerabilities makes it easy for the junior hackers to create something out of nothing, but I'd rather we all know about the problems at the same time than a few sophisticated spam hackers knowing about the problems for an indefinite amount of time.

--
Never go to sea with two chronometers; take one or three.

Absolutely No Surprise by abb3w · 2004-12-09 07:28 · Score: 1

Well, what have you been doing in 'IT for 10+ years', surfing for p0rn?

Probably not all that different, really. And there's also the possibility he may have been doing IT in the porn industry for much of it.

--
//Information does not want to be free; it wants to breed.

Oh and let's not forget... by Anonymous Coward · 2004-12-09 07:30 · Score: 0

... no worries about catching any Win32 virii. :)

Re:Oh and let's not forget... by kcb93x · 2004-12-09 07:59 · Score: 2, Funny

Exactly. Which is one of the reasons I refuse to get rid of my old DOS box. 6.22/3.11 for Workgroups. If some 32-bit virii went around, hit everything...I've got my 486 to get the patch:)

--
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Re:Oh and let's not forget... by Anonymous Coward · 2004-12-09 09:17 · Score: 0

(aside) This 486 was 0wned in 1992. This guy still doesn't know that that's exactly how the virus got through to all his other system.
Re:Oh and let's not forget... by Anonymous Coward · 2004-12-09 13:09 · Score: 0

DOS and much of Win3.1 will also run from a bootable CD. An Arachne/DOS bootable floppy for web browsing is also available.
Re:Oh and let's not forget... by kcb93x · 2004-12-18 05:24 · Score: 1

Hopefully you're not refering to my 486...cuz we got it back in 1994. Stupid troll...

--
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.

Re:China: Spammers, Viruses, and Hackers by My+name+isn't+Tim · 2004-12-09 07:31 · Score: 2, Insightful

until even Firefox will be useless, because see they are gaining market share in leaps and bounds, which makes them a target for malware and exploits now. It's only a matter of time until only lynx will be safe.

Been there, done that.... by abb3w · 2004-12-09 07:38 · Score: 1

...nobody remembers their history...

--
//Information does not want to be free; it wants to breed.

protection money: $0.50 by Anonymous Coward · 2004-12-09 07:40 · Score: 0

Cost of a download of a linux distribution and a few cd-rs.

Rely on Managed Security Provider by Anonymous Coward · 2004-12-09 07:40 · Score: 0

Small and medium size network need to rely on a Managed Network Infrastructure provider like Vistawiz (http://www.vistawiz.com) to defend themselves from such attacks, versus doing such intelligent fight inhouse.

Uniting could make them weaker by Woogiemonger · 2004-12-09 07:41 · Score: 1

By joining up, the malware author does exactly the opposite of what he needs to do to stay anonymous. It is easier to catch someone who communicates with colleagues about the very thing which he needs to keep private. By conversing about virii/trojans/etc, it is far easier for law-enforcers to monitor and hunt down these cybermischiefs and bring them to justice, Bill Gates's feet, a /. horde, etc.

Kapersky's scare tactics by Mr.+Cancelled · 2004-12-09 07:43 · Score: 1

Maybe it's just me, but it sure seems that a lot of the "doom and gloom" virus warnings come out of Kapersky.

Wasn't it just 6 months ago or so that they were warning of a big attack day from the script kiddies out there (Was a... Friday, or a Saturday it was supposed to happen - Can't recall which off-hand). It never happened, but you wouldn't have believed that from their press release.

Don't get me wrong... Kapersky's not the only one who feels that there's greater cooperation between the various virus/spyware/trojan writers out there, but they seem to always be the one using "shock" type campaigns to announce such things.

Perhaps they're hoping that one of these "apocolypse now" stories will someday come true, and then they'll get a bunch of new customers because they'll be the ones who foresaw the problem and tried to warn the world.

Or perhaps they're the ones writing the virus's in order to drive up demand for their anti-virus products... Who really knows at this point, but I don't see the McAffee's or Nortons of the world putting out these types of press releases. It's always Kapersky. Odd...

Mostly a windows problem by unoengborg · 2004-12-09 07:43 · Score: 1

I guess people would be much more secure if they switched to Linux and configured a good SELinux policy. One that prevented webbrowsers and e-mail clients from modifying binary files like shared libraries and applications.It could also prevent files that was downloaded by webbrowsers or e-mail clients to be executed by root. Make sure that only approved applications that really needs it are allowed to open sockets or connect to the internet. That would make life very difficult to most virus developers.

Today, Red Hat Fedora Core 3 turns on SELinux by default. Unfortunately the policy is mostly targeted at servers. Perhaps they (and other Linux distros) should target the desktop as well in their upcomming releases.

The problem is probably that most windows users will not go the Linux road. Instead they are likely to apply TCPA strategies that not only will lock out virus writers but also the owner of the computer.

--
God is REAL! Unless explicitly declared INTEGER

Et tu, menkhaura? by Anonymous Coward · 2004-12-09 07:47 · Score: 1, Informative

"C'mon, I know Slashdot is crawling with Windows users, wannabes and such, but this is getting offhand!"

Mistaking "offhand"(sic) for "out of hand" is acceptable on Slashdot, where people aren't very aware of such subtleties. But IN the general media?

(Off-hand means "casually dismissive", ie "I can't stand Fry's, their off-hand attitude is getting out of hand")

Re:Et tu, menkhaura? by menkhaura · 2004-12-09 08:05 · Score: 1

Hahahaha, thanks for pointing that out, I'm always willing to learn more.

--
Stupidity is an equal opportunity striker.
Fellow slashdotter Bill Dog
Re:Et tu, menkhaura? by Anonymous Coward · 2004-12-09 21:13 · Score: 0

Nice to see someone who can take a gentle ribbing. I salute you.

American Jackass by Anonymous Coward · 2004-12-09 07:53 · Score: 0

Them commies over in Russia are the ones who are working together to hack the world and undermine good clean capitalist values! Of course the researchers know about it, THEY are the ones DOING it!!! Never trust a Russki. That's what my uncle told me. He was in Nam and he knows the score. He sida the problem with kids these days is that they have no sense of what it means to be an American. First and foremost you need to stand up proud and acknowledge that we never fell victim to commies here because we stood our ground. If some dirty reds came over here to start causing trouble, you better believe I'd lay down my life to support good christian capitalist Americans! Remember, don't EVER trust Russkis. Never.

Teams == easier to infiltrate by lawpoop · 2004-12-09 07:56 · Score: 1

Instead of chasing down the lone cracker who created the GreatNewVirus, authorities can now pley members against each other in order to infiltrate a group. They can offer rewards for ratting out other members, or bribe them with reduced charges/punishment in exchange for squealing. This is a good thing.

--
Computers are useless. They can only give you answers.
-- Pablo Picasso

I think you mean autorun.inf by Anonymous Coward · 2004-12-09 07:59 · Score: 0

... or perhaps it's hiding in desktop.ini? I can think of a few clever places to hide something like this.

It was only a matter of time by Corellon+Larethian · 2004-12-09 08:04 · Score: 1

Honestly, if you still have a Windows box hooked to the net, whether it's behind ten firewalls and under 3 different antivirui, you deserve whatever kind of horrific disease you get.

Windows needs Palladium. Not tomorrow or the day afterwards. Today.

Right now.

Re:It was only a matter of time by lachlan76 · 2004-12-09 22:55 · Score: 1

You mean the Palladium which only allows Microsoft verified software to run?

Indeed. I used Netscape 4.08 on WfW 3.11 to d/l... by Anonymous Coward · 2004-12-09 08:05 · Score: 0

... the patch for Sasser when it came out. Then I burned it to a CD and transferred the patch off of Windows Update onto an XP box. There was absolutely NO way I was going to take the chance of exposing that XP box by logging on to the net to get the update directly.

Amen ... by jrl · 2004-12-09 08:24 · Score: 1

I will never understand the "let's bury our heads in the sand" defense to security problems.

It is either arrogance or naivety to want to surpress the vulnerability information from flowing...

Arrogance to think that only "good" people can find it .. or naivety to believe that no one else has already found it.

Arrogance or Naivety by jrl · 2004-12-09 08:26 · Score: 1

It is either arrogance or naivety to want to surpress the vulnerability information from flowing...

Arrogance to think that only "good" people can find it .. or naivety to believe that no one else has already found it.

I will never understand the "Let's bury our heads in the sand" defense to security problems.

Comment removed by account_deleted · 2004-12-09 08:32 · Score: 1

Comment removed based on user account deletion

And in other news ... by ANeufeld · 2004-12-09 08:36 · Score: 1

... the binary pattern
0x01 0x01 0x20 0x05
has been found in many executable files on many different and diverse operating systems.

Users are strongly cautioned not to use their computers on January 1st, 2005!

[Editor's note: many more executables also match the less restrictive byte patterns
0x01..0x12 0x01..0x31 0x20 0x05
Using your computer on any day in 2005 may be dangerous!]

Semantics by phorm · 2004-12-09 08:39 · Score: 1

Because a cracker is a black-hat form of hacker, but one can be a hacker without being a cracker?

Cracker is a more accurate definition, and certainly this otherwise paints a bad name for hackers. But realistically, given the use of hackers to describe such users perhaps a better name for white-hat hackers would be appropriate...

Re:Semantics by Anonymous Coward · 2004-12-09 13:48 · Score: 1, Funny

perhaps a better name for white-hat hackers would be appropriate...

I'm thinking "whacker".

It's probably more appropriate than one might expect...

Was this written by voirus writers? by Anonymous Coward · 2004-12-09 08:46 · Score: 0

"We are against anyone who publishes vulnerabilities because it gives hackers a tool."

Oh, bullshit!

I have heard this time and time again. Once again, the assumption is that virus writers and spammers only write after an exploit has been discovered and shown to them. I heard this after Blaster, I heard this after Slammer and, damnit, my firewall logs showed that these things were being exploited before any description of the vulnerabilities was released!

The problem is that you only see incompetents writng defective software that exploits the holes after they are found. I am of the opinion that competent writers have already taken advantage of the vulnerabilties before they were published; many times that is how they get found in the first place. Being competent, they wrote exploits that didn't advertise themselves after infecting a mchine.

To advocate NOT publishing vulnerabilties just prevents people from protecting themselves from being infected. For instance, both Blaster and Slammer did not require a patch from Microsoft to stop infection: simple port blocking at the firewall was sufficient. Would you have systems unprotected while Microsoft determined a way to patch?

Re:Indeed. I used Netscape 4.08 on WfW 3.11 to d/l by dosius · 2004-12-09 08:50 · Score: 1

It's nice to have a clunker around, though, it would be nicer if I could try getting online with it... Anyone know of any WFW 3.11-compatible DSL dialers (PPPoE)?

Moll.

--
What you hear in the ear, preach from the rooftop Matthew 10.27b

Mr, Kaspersky, F** you by Oriumpor · 2004-12-09 08:56 · Score: 1

"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."

That's right keep them secret, keep them safe. So only the crackers and the uber-geeky know. And the little hairy foot developer can carry the exploit to mount doom before the evil minions of 50R0|\|666 get their hands on it.

How will we know what ports to block, what mutex to push via GPO, and what tools to use to prevent these attacks if we don't know about them beforehand?

pattern, anyone? by majest!k · 2004-12-09 08:59 · Score: 2, Interesting

i just read the article. i couldnt help but notice a striking resemblance with the agendas of Kaspersky and our very own Bush administration...

1) spread fear, its good for business.
2) create some fucked up 'axis of evil' shit to help further #1. ("Virus writers are combining their efforts with hackers and spammers to launch Swiss Army knife-like malware attacks on users")
3) throw in some fuzzy math for effect. ("The company said that it was seeing 200 new viruses a day.")
4) take a random stab at preventing free speech. ( "They work in groups that exchange information with other groups on forums and Web sites ... We need to cooperate to prevent this.")
5) and finally, say something really stupid that goes against something tried and true thats trusted in the industry - in this case, the idea of Full Disclosure. ("We are against anyone who publishes vulnerabilities because it gives hackers a tool.")

and to think i actually used to respect their work. maybe they should just stick to coding and save the PSA's for when they have a smarter PR rep.

just my 2 cents.

--
smattawichu

Re:Indeed. I used Netscape 4.08 on WfW 3.11 to d/l by Anonymous Coward · 2004-12-09 09:09 · Score: 0

Certainly. I personally use Trumpet Winsock on WfW 3.11. Some others use the dialer that comes with IE 3.03. Either should work fine on WfW.

Not to burst Kaspersky 's bubble, by bitswapper · 2004-12-09 09:15 · Score: 1

But there is no way to actually verify that "Malware authors" are actually cooperating more now than in the past.

It clearly a "panic and run to us for help" article.

Protocols will have to get more resilient by Dr.+Manhattan · 2004-12-09 09:18 · Score: 2, Informative

I'm too scared to have my ssh server exposed to the raw net. Things like port knocking and so forth help, but suffer from reliability and resource problems. I created an authentication protocol that's correct by inspection and utterly immune to any attack short of actually finding out the secret key.

In these days of 0-day exploits, I just can't take the chance that someone will find a hole in ssh and create a Warhol-worm before I can install a patch. I sleep better now...

--
PHEM - party like it's 1997-2003!

Same shit, different venue. by Anonymous Coward · 2004-12-09 09:37 · Score: 0

A lot of these people already work for organized crime in Russia, Ukraine, and other countries in that region (and some countries in Asia too from what I hear). Organized crime sees the Internet as just another venue where they can run protection rackets. The hackers and script kiddies they employ on the Internet are synonymous to the ruffians and thugs they employ in real life to intimidate/beat people into going their way and paying up.

Blame it on Outsourcing.... by Anonymous Coward · 2004-12-09 09:38 · Score: 0

Yea - another reason why outsourcing is hurting us.. with so many programmers out of work in US and other places due to outsourcing, it's no WONDER there is never a lack of individuals that will jump on the chance to make a quick $25,000 by writing a virus...

Rent, Mortgage, and Car payments have to be made, and when one is 3 months behind in their rent and facing evictions, OF COURSE they are going to accept such an offer.

A simpler method by Durandal64 · 2004-12-09 10:02 · Score: 1

Use an e-mail alias. If your e-mail address is, for example foobar@someserver.com, create an alias for that mail account called, say, foo.bar@someserver.com, and use that e-mail address on public forums, registrations and web pages. When the spam gets to be too much, just cancel the alias and create another one.

*yawn* Re:This war can't be won ... by Doctor+Memory · 2004-12-09 10:08 · Score: 1

I'm amazed that noone has figured this out yet. The defense against these viruses is software heterogeniety. Who cares if there's an Outlook virus if they're using Thunderbird? Or Firefox if they're using Opera? What we need to do is get enough people using enough different types of software to make it no longer worth an attacker's while to write virii -- hell, most web designers can't even get a moderately complex CSS to work properly on more than two browsers, you think anyone's going to write a virus that works cross-platform?

--
Just junk food for thought...

Re:*yawn* Re:This war can't be won ... by Ambassador+Kosh · 2004-12-09 11:24 · Score: 1

EXACTLY!

That is why we need standards so you can use any program for a given purpose. If we had true webstandards then firefox, mozilla, konqueror, opera, msie etc would all be able to render the same data the same way pretty much. This would give you the freedom to change to any of the others at any time with no lockin. This does give an inherent security advantage.

So if program A has a bug you can immediately stop using it until it is fixed and go use program B and not lose anything. You will even end up more meta program things like konqueror. Konqueror is not really web browser it is a component browser and it uses khtml by default to render but it could also use gecko to render. Lets say you added the ability for it to use the opera renderer also. If there is a bug with gecko you could just switch to a different renderer and lose nothing.

There are lots of advantages you get from having well defined standards that are followed and many implementations and one is a much higher resistance to bugs. It also doesn't take much of a mix of stuff to give a much better resistance to the crap out there. Think of what would happen if 1/4 of people use outlook, 1/4 used kmail, 1/4 use thunderbird and 1/4 use evolution. Any given exploit will be able to target one of those pretty much but everything that exploit hits a machine that is not vulnerable it stops there. So the time to get a complete infection of any given group is far far longer. During that time you can patch the program, switch to a different one etc. Either way the damage is going to be a lot lower with the mixed environment.

--
Computer modeling for biotech drug manufacturing is HARD! :)

I have the RIGHT TO KNOW! by Anonymous Coward · 2004-12-09 10:16 · Score: 0

I have the RIGHT to know if the software I am using has a vulnerability, and I have the RIGHT TO KNOW IMMEDIATELY after its discovery so that I can take what ever steps are necessary to reduce or eliminate risks to my data, even if that means accessing the internet from a PC not connected to my network and running a LiveCD on that PC.

Rest assured, the black hats probably already KNOW about the vulnerability and are exploiting it to the fullest, even while proprietary software houses (MS) bludgeon security companies into silence. Some ID holes, for example, have been leaking for months and a few for years, yet MS refuses to acknowledge them, much less patch them, electing to grind more $$ from its upgrade mill. It's no wonder people got fed up and are switching to FireFox in droves. Many are also switching to Linux in droves too.

NO BUSINESS has the right to keep news of their vulnerabilities SECRET to protect their public image and/or bottom line. It should be an illegal act punishable by fines for the corporation and imprisonment for the CEOs, for aiding and abeting theft.

Prime opportunity by WiPEOUT · 2004-12-09 10:27 · Score: 1

If this is true, it's a prime opportunity for law enforcement to infiltrate the newly-forming groups. Furthermore, unlike The Lone Hacker, these groups are going to be much more vulnerable. If just one of them is identified, the entire network will get done. As an added bonus for investigators, a confederation of specialised individuals will either:

1. contain some individuals that by virtue of not specialising in protecting their identities are going to be easier to catch

or

2. use best-of-breed tools produced by those specialising in staying anonymous and cleaning up their tracks. This is a double-edged sword for while it will make it harder to get the first individual in the chain, once you have one, you have them all.

Never mind that once they get caught, they're double screwed because not only will they get charged with whatever crimes they perpetrated, they will also be charged with conspiracy charges of all sorts. Given the current political climate, I wouldn't be surprised if terrorism charges were somehow included as a bonus >:)

Re:Prime opportunity by Anonymous Coward · 2004-12-09 13:03 · Score: 0

Do it in a country where they can get to be part of an Abu Ghraib Love Huddle after they are arrested.

Conspiracy by elfarto · 2004-12-09 10:49 · Score: 1

This is not a flamebait or a troll.

I always had the suspicion that
virus writers worked together with antivirus firms, gee,, there won't be any need of antivirus if there were no viruses. I'm tempted to say that people inside Kaspersky are of the black hat kind.

just imagine... by Anonymous Coward · 2004-12-09 11:08 · Score: 0

..the world where you have to download worms and viruses, while updates and patches spreading like hell...

_this_ would be scary ;)

It would be if the virus authors sold anti-virus.. by TheLittleJetson · 2004-12-09 11:08 · Score: 1

First, this article is mostly about security exploits and virus authoring, not spyware/adware.

In order to really liken this to organized crime, there would have to be some profit motive, so as to make the racket a worthwhile venture. For instance, if they were creating viruses and also selling anti-virus software, you could then demand protection money. It doesn't sound like these folks are offering protection to anyone, it's just a bunch of punks that collectively form SUPER-PUNK. If you were going to liken this to any crime form, it would be something more along the line of a hate group or terrorist organization. However it really pisses me off when people do that, so let's not.

RE: argument against open source? by King_TJ · 2004-12-09 12:23 · Score: 2, Insightful

I know this has been stated MANY times before in various ways, but if "closed source" truly is effective in preventing malware/hacks/virii simply because the source isn't available for anyone's inspection - then why do we see all the security flaws popping up with IIS? Meanwhile Apache has comparable market-share and usage world-wide on the net as a web server, and it is considered far more secure?

By the same token, Linux and BSD have been chosen as the platform many commercial firewall/router products are based on, despite being open-source. If open-source really had a "disadvantage", security-wise, by the mere fact that it's freely available code - then wouldn't you think companies like Netgear or Cisco/Linksys would steer clear of them in security-related network appliances?

Of course "exploits are expected to come out within hours of disclosure" - but that seems like a pretty general statement to me. Far more people with malicious intent are capable of slapping together some code based on a documented flaw than figuring out a previously undiscovered flaw and exploiting it. If you disclose a Linux or BSD security flaw, I'd say it's just as likely to be exploited quickly as a Windows flaw.

Readable version by Anonymous Coward · 2004-12-09 12:50 · Score: 0

http://shit.slashdot.org/article.pl?sid=04/12/09/1 710212

Cynicism and real hacker ethics by wyrd_chao · 2004-12-09 12:57 · Score: 1

The gloom-and-doom and the 'Hacker' gaffe and other things.... this all dismays me.

Back when I did serious work (1997 or so), IT guys (LOTS of them former hackers and PC-geeks) had an informal code of ethics, which came down from the 'Hacker Dictionary' guys long, long ago. To reiterate:

'Hackers', while perfectly willing to use any means to tear apart and re-verse engineer software, hardware of any kind, etc. were ethically constrained from causing damage through their knowledge. Harassment of the powers that be, yes. The presentation of unpleasant facts, yet.

BUT, exploitation of knowledge for personal gain, definitely NOT. This doesn't just mean writing viruses, cracking systems for profit, breaking copyrights protection, etc.

Personally, I also took it to mean that one should not cynically exploit the ignorance of the public (and your bosses!) to line your own pockets. I put this in the category of war-profiteering or worse. I believe people in the medical professions might be familiar with this situation all so.

I got OUT of IT because I felt it was my mission to make the systems I was resposible for useful and secure; moreover, I spent a large part of each day trying to educate my users so that my job would be easier. I COULD have milked the job and told my people some bullshit that fed their mushroom-ness. I could have done the same to my bosses. I'd probably still be there and pulling in 60-70K a year, too.

Professional ethics used to mean something in the wider geek community. I don't believe that paranoia and greed will destroy it from within, but...

--
- - 'Go ahead, make my tea.' - Doow Tsae T'nilc -

Re:China: Spammers, Virus Writers, & Hackers by Long-EZ · 2004-12-09 12:58 · Score: 2, Interesting

Close. Actually, the two things you should do are:

1) Download and install Firefox.
2) Delete Internet Explorer (if you can).

On my computer, Internet Explorer is slightly faster for casual browsing than FireFox because Explorer is more tightly integrated into the operating system.

On my computer, I'm running Linux. IE is NOT integrated into the operating system. You can't see it, but I'm doing the Superior Dance.

If IE is integrated into your OS, there is a third thing you should do.

3) Upgrade to Linux or Mac.

I can't understand why everyone isn't more enraged by the fact that 80% of spam now comes from zombie Windows PCs. Lack of security hurts us all. As a society, we're far too complacent about PC security. We should take the attitude that a person's right to run an unpatched Windows box attached to a high speed cable ISP does not supercede the right of a million internet users not to drown in illegal V1aGr@ and warez spam.

--
>> My ultraviolent Linux switch video.

Re:Indeed. I used Netscape 4.08 on WfW 3.11 to d/l by Average · 2004-12-09 13:22 · Score: 2, Insightful

Ethernet socket driver for a simple ethernet card.

Trupmet winsock or similar to bind to the 0x60 DOS socket.

$20 router connected to your DSL to do the PPPoE login, as well as a bit of firewalling to any computers internally.

I would never suggest using a PPPoE utility on the computer when routers are so cheap and useful. Most DSL modems even have the router logic built-in nowadays.

There's public and then there's public by Joseph_Daniel_Zukige · 2004-12-09 13:48 · Score: 1

Depending on which public you mean, this will actually work out to "within a few days of disclosure to the cracker public" and "before disclosure to the public in general, including to the company that makes the stuff".

Come to think of it, there are already examples. And I'm with the guy who says it's time to start working on a class-action suit against Microsoft for helping us push ourselves into this position.

Groups of Attackers-P2P Protection. by Anonymous Coward · 2004-12-09 13:51 · Score: 0

"Also, what "new" cooperation tools are malware writers using to communicate with each other? I'm fairly sure that IRC, Instant Messaging, VoIP, Bulletin Boards, and e-mail have all been standard communcation tools for these people. Maybe the groups now have more members."'

Add VPN's and P2P to that soup. Distributed cracking tools, yum. Ain't technology grand?

ipfw DENY all from $CHINA_IP_SPACE by the+angry+liberal · 2004-12-09 14:50 · Score: 1

I know I am going to hear from the Chinese karma police on this one, but does anyone have a list of all the Chinese IP space?

Perhaps we could start a grass-roots effort to disallow access from countries whose goverments aren't being responsible when it comes to their citizens respecting the rights of others in the online community?

Anyone have a list they could post or link to?

Re:ipfw DENY all from $CHINA_IP_SPACE by 1u3hr · 2004-12-09 21:41 · Score: 1

"...disallow access from countries whose goverments aren't being responsible when it comes to their citizens respecting the rights of others in the online community?"
MOST SPAMMERS LIVE IN FLORIDA.
Re:ipfw DENY all from $CHINA_IP_SPACE by 0racle · 2004-12-10 11:21 · Score: 1

Its no governments job to police the internet. I bet you post against the Great Firewall of China is every time it is mentioned, and yet here you are advocating the same thing. Blocking does nothing.

--
"I use a Mac because I'm just better than you are."
Re:ipfw DENY all from $CHINA_IP_SPACE by the+angry+liberal · 2004-12-13 20:44 · Score: 1

Perhaps you failed to read my post correctly. That is fine, since you seem rather pro-chinese and probably do not speak english fluently to begin with.

Note how the above paragraph was an assumption I pulled out of my ass, much like your entire post.

The fact is, I never mentioned government intervention. By its very mention "grass roots" is typically used to describe a non-government activity. How you missed this and thought I was pro-government intervention is beyond me.

Anyway, I don't post against the "great firewall of china" as you suggest. I really could care less about it since I don't live and china and really could care less what happens to people over there. What? Did you read my name and think "OH PANSEY LIBERAL MUST MAKE A WITTY REPLY"? Give me a break. Grow up. Don't be a nationalist little monkey.

I was speaking out of concern because I have been in Information Security for about 6 years now and about 3/4 of all the larger network scans and exploit attempts I have seen have come from chinese IP space. Unfortunately, I did not know I had to spell it out so morons wouldn't get a brown streak in their underwear thinking I am all anti-chinese.

So right now, you look like the complete Internet retard for trying to make a witty retort without even understanding the parent. You have one chance to redeem yourself by explaining how "Blocking does nothing". That is the very thing a firewall does and I would like for you to explain to all of us who have been running BSD and Linux for the last decade have been wasting our time with filters on routers, firewalls and various other security measures.

Kapersky took pages from mi2g and Sophos by gfecyk · 2004-12-09 15:29 · Score: 1

Sophos wants us to update our anti-virus software 8760 times a year. Once an hour every day, every year per computer (!) just to keep up with all of the variants of viruses.

mi2g? Well, they started calling vmyths a hate site. They need no further comment.

--
Use Evolution instead of Outlook? Bewa

Re:Kapersky took pages from mi2g and Sophos by fuzzybunny · 2004-12-09 21:38 · Score: 1

Quite possibly you're right--I have read neither site enough to judge it. However, what vmyths currently has on its front page is little short of cretinous.

Poorly researched, not founded in facts, throwing out a few terms with no background information, all to justify overly sweeping claims and opinions.

It may be a fine site for all I know, but they sure ought to consider filtering their front page content a bit better!

"Ramen" virus indeed. I sure hope that's a pisstake. :)

--
Cole's Law: Thinly sliced cabbage

Nop You Missed this is Microsoft Model by Anonymous Coward · 2004-12-09 18:08 · Score: 0

Os life
1. Make OS.
2. Save money on doing the tests On the OS.
3. Add spyware to OS Yep Windows XP ships with Spyware.
3. Release Patches to fix exploted holes.
4. Stop providing updates after next os is developed
5. Virus writes have a party forcing update to the new OS.

This is to really Profit.

Re:Indeed. I used Netscape 4.08 on WfW 3.11 to d/l by dosius · 2004-12-09 20:44 · Score: 1

Have a router already; think something's wrong with it as it has been unable to connect to my provider lately.

Moll.

--
What you hear in the ear, preach from the rooftop Matthew 10.27b

Re:China: Spammers, Virus Writers, & Hackers by Anonymous Coward · 2004-12-09 21:33 · Score: 0

Boycott? Here. Suck.

(whoops I should pay better attention) by fuzzybunny · 2004-12-09 21:42 · Score: 1

Ewps my bad, not front page content, rather the link in your .sig. The article's still date-stamped 3 days late...

--
Cole's Law: Thinly sliced cabbage

But this time they are TERRORISTS!!! by Anonymous Coward · 2004-12-10 00:51 · Score: 0

Yeah, good point. This is probably just another of those homeland-security hype projects. Criminalizing technology; exaggerating shadowy bogeymen.

It always was the hackers getting the exploit as soon as possible for the fun of it, or even sooner for criminal purposes. If spammers happen to be the paymast this time around... Nothing new here. Absolutely nothing new.

Slashdot Mirror

When Malware Authors Combine Efforts

306 comments