When Malware Authors Combine Efforts

And just yesterday by Anonymous Coward · 2004-12-09 06:41 · Score: 5, Interesting

Re:And just yesterday by Tablizer · 2004-12-09 06:44 · Score: 2, Funny

New virus and malware combination causes duplicate articles, news at 11:00!

--
Table-ized A.I.
Re:And just yesterday by networkBoy · 2004-12-09 06:47 · Score: 3, Interesting

I think I can reconcile this:
There will be a few groups who work in strategic alliances. The very scary part about this will be the "power" behind some of the malware campaigns. I think CoreWars, running on every windowz box that isn't hardened really is going to happen.
This should prove to be interesting, especially when governments step in with the non-judiciary non-legislative branches because a real security leak is caused by one of these programs. Think a pissed off NSA (not a politicking one) of the "good 'ol days".
-nB

--
whois gawk date unzip strip find touch finger mount join nice man top fsck grep eject more yes exit umount sleep dump

Is this truly more scary than ... by jafomatic · 2004-12-09 06:42 · Score: 1

the exploits we've already seen?

Further, if I'm wrong, doesn't this announcement generate (or risk generating) more momentum in the "malware conglomerate" that's being reported?

--
::jafomatic

Re:Is this truly more scary than ... by topgun601 · 2004-12-10 01:09 · Score: 1

im still a student but i have had a few computer repair gigs, i dont know much but this is what i have learnd so far. the starnderd user dose not care how or why it works , they like the black box approch, they only care if it works and that it is easy to use use. when it dose not work they call an IT guy to come and fix it. when i show people firefox i tell them it is a little more secure then IE but most of my time is spent showing how tabbed browsing works, how the quick bookmarks link work, and the popup blocker. some of the more usefull featers that ie does not have by default.

--
This post brought to you by: the marketing division of The Sirus Cybernetics Corporation

Public disclosure... by PincheGab · 2004-12-09 06:43 · Score: 4, Interesting

So where does this place public disclosure advocates? Are people going to demand that makers of affected software have a 24/7 programming staff ready to plug leaks just so weakenesses can de disclosed immedately? In light of this even I would favor not publicly disclosing weaknesses immediately!

Re:Public disclosure... by techsoldaten · 2004-12-09 06:52 · Score: 4, Insightful

You know what? Business needs remain the same regardless of how fast hackers are writing exploits. Few companies, Microsoft included, could afford to have a 24x7 staff of patch writers for all of the applications they have deployed.

This is the greatest argument for open source software I have ever seen. A proprietary model of development is going to get creamed as people take advantage of their limited resources and exploit the woo wang out of their apps. FOSS apps, on the other hand, potentially have hundreds of thousands of people ready to go worldwide at any given moment to correct problems as they happen.

M
Re:Public disclosure... by RailGunner · 2004-12-09 06:52 · Score: 1

No, but this certainly favors Open Source - as severe exploits are typically fixed far faster in open source projects than they are in closed source projects.
Also - it's better to know there is a chance you could hit with an exploit, and take steps such as a backup, or closing down a firewall port, etc., then to be caught by an exploit with your pants down. If there's a possibility my machine could get 0wned, I want to know about immediately so I can keep an eye out for it if nothing else.
Re:Public disclosure... by _Sprocket_ · 2004-12-09 06:53 · Score: 3, Insightful

In light of this even I would favor not publicly disclosing weaknesses immediately!

How does this change anything? This situation already exists and has existed for years. There has always been an element of pay-to-attack behavior as well as gathering resources via mass shotgunned attacks. And, in fact, spammers have been taping in to this environment for a while.
Re:Public disclosure... by paulthomas · 2004-12-09 06:57 · Score: 2, Interesting

RFP has a fairly respected document on public disclosure methods. The idea is basically that public disclosure happens only when there is no vendor response or when vendor response irresponsibly wanes. I agree that immediate public disclosure is not the right approach to take.

http://www.wiretrip.net/rfp/policy.html
-Paul
Re:Public disclosure... by LnxAddct · 2004-12-09 07:00 · Score: 3, Insightful

I think you underestimate how many companies are told they have vulnerable software rather than find it themselves. Http-equiv from malware.com finds tons of stuff and the Samba team used to submit a number of vulnerabilites they found in Microsoft's implementation. And all the time vulnerabilities are disclosed, sometimes the company is told before hand and if they don't act quickly enough then they are disclosed publicly, otherwise the company may find out at the same time you do. Regardless, if some thrid party does find a vulnerability and 2 or more people know about it, the world will know about it within a week. "Three can keep a secret if two are dead". So in short, yes companies need to be prepared 24/7 to fix their faulty software as fast as possible.
Regards,
Steve
Re:Public disclosure... by jrl · 2004-12-09 07:07 · Score: 2, Interesting

The flip-side to your argument is that many of the exploits are found by "bad guys" before they are rediscovered by "good guys".

By definition, the "bad guys" don't typically believe in disclosure as it takes away another one of their 0day toys.

By disclosing weaknesses immediately you allow information owners to take precautions to protect their infrastructure, even if that means making the resource unavailable until a patch is provided by the vendor.

It is naive to believe that only "good guys" find problems. As soon as someone is considerate enough to share the problem, I believe it is in our best interest to be notified of it as soon as possible.
Re:Public disclosure... by dillon_rinker · 2004-12-09 07:18 · Score: 1

Not saying I believe everything the article suggests, but the way it COULD change everything is that now there may be a large profit motive for a large number of people to produce zero-day or even zero-hour exploits. It's one thing when hobbyists hackers think it's nifty to write an exploit to prove their leetness; it's something else entirely when a corporate entity writes exploits for profit.

I think you're right in that this isn't really a qualitatively new thing, but the quantity of pay-to-attack may increase substantially.

Maybe the sky is falling. Or maybe not.
Re:Public disclosure... by Ytsejam-03 · 2004-12-09 07:27 · Score: 2, Insightful

So where does this place public disclosure advocates? Are people going to demand that makers of affected software have a 24/7 programming staff ready to plug leaks just so weakenesses can de disclosed immedately?
IMHO, this makes little or no difference. How many of the viruses and trojans in recent years have been created before a patch was available? Not Blaster or Sasser. I'm sure there are some in this category, but I can't think of any.

Once a patch is released, most businesses will do their own testing before rolling it out into production. This will often take several days. It's not unheard of for a patch to break something, and they don't want that "something" to be one of their mission critical servers or apps. Even if the exploit and patch were released at the same time, it would still take days for many organizations to roll out the patch.

Before you decide that full disclosure is a bad thing, you should ask yourself if you're really better off not knowing about vulnerabilities in the software you're using. What incentive would the makers of this software have to find and fix the vulnerabilites in a timely manner if no one ever put pressure on them? How much testing would they do if no one else did their own vulnerability testing after the software was available?

How many of the "bad guys" do you suppose already know about vulnerabilies long before they're disclosed? If someone is actively exploiting an undisclosed vulnerability, do you think they would create a trojan and get the vendor's attention? The vulnerability that Blaster exploited was introduced in NT4 back in 1996. How many people exploited this vulnerability before it was disclosed? We have no way of knowing.
Re:Public disclosure... by SeaFox · 2004-12-09 07:31 · Score: 2, Interesting

You know what? Business needs remain the same regardless of how fast hackers are writing exploits. Few companies, Microsoft included, could afford to have a 24x7 staff of patch writers for all of the applications they have deployed.

Well, maybe if they tested the software better and built it more secure from the start they wouldn't need a 24x7 staff of patchers.

Haha. But that would imply the product is being driven by developers and engineers, not marketting people.
Re:Public disclosure... by dankney · 2004-12-09 07:36 · Score: 3, Insightful

I would disagree completely -- this is an argument against open source. The exploits are expected to come out within hours of disclosure, not hours of discovery.

Closed-source software has the ability to write the patch before disclosing the vulnerability.

I believe in open source 100%, I just think that this argument falls against, not for OSS.
Re:Public disclosure... by chrisopherpace · 2004-12-09 07:38 · Score: 1

Nothing is hackpoof. Coders are humans, and humans make mistakes.

--

Bored? Why not join a decent mess
Re:Public disclosure... by DaHat · 2004-12-09 07:44 · Score: 2, Interesting

Just because you can get a patch out faster in the OSS world doesn't mean you should. It's pretty easy to open up a block of code and fix a bug (provided you know what it is, where it is and how to fix it), it's the testing to make sure that your fix didn't break anything else and that your system still works exactly like before (other than the fixed bug of course) is the time consuming part.

Does Microsoft spend weeks doing regression and unit testing? I do not know, however making the assumption that a patch can get out in the OSS world faster is better is not a very good one.

Having patch writers on hand 24x7 would be great for the actual fix, but would not reduce the amount of time required to make sure that the fix works and is safe.

It should be pointed out that the advantage of a proprietary model of development vs the FOSS one is one of liability. A patch needs to have at least the same, if not better quality (speed, error proneness, etc) than the bits that it is replacing. It is far easier for a small FOSS group to release a quickly written and tested fix than it is for Microsoft too. Despite popular belief, Microsoft has extremely high quality standards. How many companies do you know who have programmers on call 24x7 should their code break a build?

--
Help Brendan pay off his student loans
Re:Public disclosure... by bensafrickingenius · 2004-12-09 07:51 · Score: 1

Uh, don't most of us work in IT or as programmers? I'd think that a sudden need for 24/7 staffing would be an attractive turn of events! No more crying about how hard it is to find a job!

--
I am not left-handed, either!
Re:Public disclosure... by ReelOddeeo · 2004-12-09 07:58 · Score: 2, Insightful

From TFA...
"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."

Wouldn't it be more important to be against anyone who creates vulnerabilities rather than those who inform us about them so we can patch or even shut off services if necessary?

--

Those who would give up liberty in exchange for security and DRM should switch to Microsoft Palladium!
Re:Public disclosure... by caino59 · 2004-12-09 08:02 · Score: 3, Insightful

as long as it is the software company itself who finds the virus...
Re:Public disclosure... by the+Jolyon · 2004-12-09 08:07 · Score: 1

They potentially, have hundreds of thousands of people but there's no guarantee and noone to shout at if it isn't done / doesn't work / breaks something.

I'd find that hard to sell to the people I have to convince to part with money.
Re:Public disclosure... by berkleyidiot · 2004-12-09 08:42 · Score: 1

i may be off on this, but i think a lot of public disclosure only happens after private disclosure. when you find a hole, i thought it was standard/ethical practice to report it to whoever it affects, wait some reasonable period of time, then publically disclose it.
Re:Public disclosure... by Anonymous Coward · 2004-12-09 08:52 · Score: 1, Funny

In practice? Every one I've ever worked for.

Sometimes it wasn't even 'on call' so much as 'we'll come to your house and kick the door in if you break the build.'
Re:Public disclosure... by techsoldaten · 2004-12-09 09:28 · Score: 1

I don't know if any software has the ability to write a patch, as you state, but I think I see your meaning.

The one problem with this idea is that the incentive for the company to patch the vulnerability has to come from within. Market forces are only beginning to force Microsoft into a position where they MUST fix the gaping holes in their products. I don't know if a smaller company (let's use Real Media for the sake of argument) would have a similar imperative.

I trust public disclosure for exactly that reason: business decisions are driven by business needs. If the perception of a problem goes away, you remove the impetus to fix it.

M
Re:Public disclosure... by aldoman · 2004-12-09 10:21 · Score: 2, Insightful

Microsoft's problem is testing.

When they have a patch, it has to be backported to hundreds of languages, versions, service packs, major releases, then tested on those and finally tested with a variety of applications before they get released.

Linux/OSS tends to break binary compatibility far more often than Linux so it's much easier: you just patch the latest version of the software and [for major projects] backport it to older releases. For example, you don't see Firefox backporting all of the security fixes to earlier versions. If it was Microsoft, they'd have to port them to IE5, IE5.5 and IE6, then test on all the various OSs etc. Firefox can just say 'here is 1.0.1. Upgrade to be safe'. They'd probably offer XPI files for older versions if it was very serve though.

But yes, I agree that OSS will win this battle, but it's not just because of developer numbers. As Joel Spolsky recently said in his interview with salon.com, 90% of Microsoft is basically red-tape.

--
IntechHosting - Free domain, 2GB, PHP, £4.95/$8.95
Re:Public disclosure... by _Sprocket_ · 2004-12-09 10:29 · Score: 1

...It's one thing when hobbyists hackers think it's nifty to write an exploit to prove their leetness; it's something else entirely when a corporate entity writes exploits for profit.

I think you're right in that this isn't really a qualitatively new thing, but the quantity of pay-to-attack may increase substantially.

Defining the principles as a "corporate entity" seems to imply much more organization and size than I think is really involved. But I agree that financial profit tends to change things. The question really is - have we already seen the change a long time ago... or are we about to jump another notch?

Spam has been an issue for years. But no matter how old the practice is, there are always new scammers and dupes entering the field. So while spamnets of compromised machines may not be new - it could be just the beginning of a new phase. The practice may be just entering the mainstream of the spamming industry, such as it is. And as such, we'll see not only more spammers trying to buy (or rent) spamnets, but more spamnet operators trying to create and maintain them.

Of course, any such increase in activity simply reinforces already existing issues that have been a part of infosec discussions for years.
Re:Public disclosure... by Ambassador+Kosh · 2004-12-09 11:03 · Score: 1

I disagree with this since there is also more variety of things in the linux world. So long as it is not a homogenous environment then it is safer from these kinds of attacks just because a mixed environment won't spread the stuff as fast.

Also while closed source can write a patch before disclosure it does not really matter. How long do people wait before installing a patch? How easy is it to get all the patches installed? If quicken came out with a patch tomorrow how long before people would install it? How about exchange, mssql server etc is there an EASY way to update all software installed on a windows system and how often does it break things?

On my linux systems it is trivial to update every installed program to the latest versions so they also tend to be very up to date. Ease of patching all software it at least as important as how long it takes to get a patch out. Given what I have seen of many windows users many programs have not been patched in years and that seems pretty rare of the linux stuff I have run into.

One thing I hope does happen is that stuff like selinux becomes default for all linux dists in the next 2 years and that more stuff is written with safer higher level languages. Between those two things it should cut stuff down even further.

--
Computer modeling for biotech drug manufacturing is HARD! :)
Re:Public disclosure... by Ambassador+Kosh · 2004-12-09 11:09 · Score: 1

Part of the difference is components. OSS software in general follows the unix method of smaller components with well defined interfaces and the components are also replacable with others that follow the same interface. This is inherently safer to debug then a large monolithic system.

It is far less likely that fixing a bug in OSS software will cause anywhere near the level of breakage I have seen in proprietary stuff. Actually I have only seen a few things break running debian sid in the past 3-4 years and all the problems have been trivial to roll back. Since you have lots of tiny components you can roll a component back easier. When you install a service pack in windows and a program breaks do you have any idea or even any way to find out what caused it to break? Can you roll back just that one fix?

--
Computer modeling for biotech drug manufacturing is HARD! :)
Re:Public disclosure... by frank_adrian314159 · 2004-12-09 11:54 · Score: 1

Few companies, Microsoft included, could afford to have a 24x7 staff of patch writers for all of the applications they have deployed.
Well, Symantec, McAffee, etc., seem to be able to do it pretty well. After all, what's a virus definition update other than a quickly deployed patch to an AV system that doesn't recognize a particular new virus? Any company that sees a profit in doing this kind of thing can do it fairly easily and inexpensively. The main issue is one of whether or not the company thinks it's profitable to do so and whether or not it wants to set up the infrastructure to support it. But it doesn't cost that much.

--
That is all.
Re:Public disclosure... by techsoldaten · 2004-12-09 12:37 · Score: 1

I cannot imagine MicroSoft hiring a team to develop Longhorn, then hiring another team to fix XP and Longhorn problems.

There's a big difference between virus definition updates and OS-level patches. A virus definition recognizes whether or not patterns exist on a machine and takes corrective steps. An OS patch affects how the machine works, and the teams of people knowledgable enough to correct problems are probably engaged in other tasks anyways.

There are hardware and software compatibility assurances contractually established between all large vendors, meaning OS level patches cannot be rapidly deployed without risk of legal action in the event of a problem. This kind of testing takes time, often cannot be completely automated, and would definitely be burdensome.

M
Re:Public disclosure... by hazah · 2004-12-09 12:47 · Score: 1

I don't see how this is against. For one, OSS is fixed much faster than propriatary. For two, b/c of one it would have less critical flaws to begin with, which will help to deter from attack. For three, when was the last time anyone here experience these attacks while not using windows? Yes, they'll have a good head start with OSS, but thankfully, OSS design isn't as flawed.

How many times do I have to tell you? by Anonymous Coward · 2004-12-09 06:43 · Score: 5, Funny

Get a firewall, block all inbound and outbound traffic, unplug your ethernet cable and shut off your computer. It's that easy to protect yourself.

Re:How many times do I have to tell you? by forrestt · 2004-12-09 06:47 · Score: 5, Funny

I think you can probably even skip the first couple steps.
Re:How many times do I have to tell you? by Anonymous Coward · 2004-12-09 06:58 · Score: 2, Insightful

I think you can probably even skip the first couple steps.

True, but having the additional steps is what makes it a +5 funny post. "Unplug your ethernet cable" would probably be modded troll.
Re:How many times do I have to tell you? by _Sprocket_ · 2004-12-09 07:03 · Score: 1

Take off and firewall it from orbit. It's the only way to be sure.
Re:How many times do I have to tell you? by (startx) · 2004-12-09 07:14 · Score: 1

Take off and firewall it from orbit. It's the only way to be sure.

Wow, talk about an obscure Clerks reference. That episode never even aired did it?
Re:How many times do I have to tell you? by SirTalon42 · 2004-12-09 07:15 · Score: 1

Unfortunately sometimes companies refuse to patch their products, and the only way you can make them fix the problem is by revealing it to the world. You can never assume the black hats don't already know the exploit.
Re:How many times do I have to tell you? by malsdavis · 2004-12-09 07:22 · Score: 1

I really wish my employer would start using Mozilla/Firefox and Thunderbird/Mozilla.

I spend a fair amount of time on the internet at work and send/recieve dozens of emails a day. I know its dangerous at the moment with Internet Explorer and Outlook both being so insecure, but as I work for a large company who have an IT policy of "DO NOT INSTALL ANY SOFTWARE ON COMPUTERS OR FACE BEING FIRED" I am forced to use them and hope that one of the websites I view doesn't hijack my computer or start scanning it for bank details.

The IT department said I can't as it would interupt systems designed to check on startup for any unauthorized software. Has anyone who works for a large company ever had any luck with getting the IT department to allow the replacement of IE/Outlook?

I suggested they should do consider doing it all over the company for security reasons but they just replied saying they would "look into it" ...meaning they can't be bothered doing anything.
Re:How many times do I have to tell you? by DarkSarin · 2004-12-09 07:27 · Score: 1

Not the best solution, but have you looked into the memory stick version of those apps. There was a story here the other day regarding that. Then you would not be installing anything, just using it.

--
"We don't know what we are doing, but we are doing it very carefully,..." Wherry, R.J. Personnel Psychology (1995)
Re:How many times do I have to tell you? by timster · 2004-12-09 08:01 · Score: 1

Also be aware that even when Microsoft does patch their product quickly, it's possible for the attacker to discover the vulnerability by examining the patch.

--
I have seen the future, and it is inconvenient.
Re:How many times do I have to tell you? by operagost · 2004-12-09 08:12 · Score: 1

Nuke your ISP from orbit. It's the only way to be sure.

--

Gamingmuseum.com: Give your 3D accelerator a rest.
Re:How many times do I have to tell you? by Glog · 2004-12-09 08:31 · Score: 1

You just wait till they start writing viruses for that brand spanking new cortex implant you got last week (circa 2067)... how are you going to unplug then?
Re:How many times do I have to tell you? by IvoryRing · 2004-12-09 08:31 · Score: 1

I'm pretty sure Aliens aired, once or twice.
Re:How many times do I have to tell you? by ScepticOne · 2004-12-09 09:17 · Score: 1

How would they react if your machine were to continually and repeatedly acquire malware due to IE security holes? Are you sure it's time to start being more careful? Just make sure you create backups of any important documents ;-)
Re:How many times do I have to tell you? by Wybaar · 2004-12-09 10:01 · Score: 1

I can't resist ...

In Soviet Russia, from orbit your ISP nukes you!

Oh wait ... that's not Pitr. He just bought the missile.

--
Y|
Re:How many times do I have to tell you? by dgatwood · 2004-12-09 10:08 · Score: 1

And the person who can't take a joke got modded -1. Sounds fair to me.

--
Check out my sci-fi/humor trilogy at PatriotsBooks.
Re:How many times do I have to tell you? by aldoman · 2004-12-09 10:24 · Score: 1

Negative. Most computers have wake-on-lan and could be turned on with a comprimised home router. You need to unplug to be totally safe ;).

--
IntechHosting - Free domain, 2GB, PHP, £4.95/$8.95
Re:How many times do I have to tell you? by quantaman · 2004-12-09 10:46 · Score: 1

Get a firewall, block all inbound and outbound traffic, unplug your ethernet cable and shut off your computer. It's that easy to protect yourself.

I think you can probably even skip the first couple steps.

Actually maybe not, I've heard (rumors) some network cards can start up your computer if they're pinged, as a result if your cable is still plugged and and your computer powered off it might power right back up and find yourself vulnerable!

--
I stole this Sig
Re:How many times do I have to tell you? by quantaman · 2004-12-09 10:49 · Score: 1

Get a firewall, block all inbound and outbound traffic, unplug your ethernet cable and shut off your computer. It's that easy to protect yourself.

I think you can probably even skip the first couple steps.

Actually maybe not, I've heard (rumors) some network cards have the ability to start up your computer if they're pinged, as a result if your cable is still plugged and and your computer powered off it might power right back up and find yourself vulnerable!

(missed preview the first time)

--
I stole this Sig
Re:How many times do I have to tell you? by ScrewMaster · 2004-12-09 11:10 · Score: 1

You forgot "bury it in a hermetically-sealed titanium-steel vault."

--
The higher the technology, the sharper that two-edged sword.
Re:How many times do I have to tell you? by _Sprocket_ · 2004-12-09 11:10 · Score: 1

Oh my God! Bear is driving! How can that be?!
Re:How many times do I have to tell you? by at_slashdot · 2004-12-09 11:24 · Score: 1

Why not go all the way: turn off the computer.

--
"It is our choices, Harry, that show what we truly are, far more than our abilities." -- Prof. Dumbledore
Re:How many times do I have to tell you? by Veramocor · 2004-12-09 13:38 · Score: 1

The trojans/viruses mostly come at night, mostly.

--
Veramocor
Re:How many times do I have to tell you? by forrestt · 2004-12-10 04:17 · Score: 1

A couple is typically regarded as two:

1) Get a firewall
2) Block all inbound and outbound traffic.

I wouldn't recommend skipping the rest if you wan't to be totally secure. I am fully aware of the wake on lan issues.

Oh, and it was supposed to be funny.
Re:How many times do I have to tell you? by 0racle · 2004-12-10 11:30 · Score: 1

Its called WOL, Wake on Lan, its not a rumour. However it needs a special WOL packet to trigger it, not just a ping.

--
"I use a Mac because I'm just better than you are."

Uhm.. You know those russian security experts by Phixxr · 2004-12-09 06:43 · Score: 5, Insightful

Is it just me, or does it seem that every story that lists the source as a "Russian Security Expert" is generally a load of crap?

-Phixxr

--
ungggghhhh

Re:Uhm.. You know those russian security experts by chris88 · 2004-12-09 06:48 · Score: 3, Informative

Kaspersky is to blame, not Russians in general.

They also predicted "Internet Terrorist Attack" in August.
Re:Uhm.. You know those russian security experts by SoTuA · 2004-12-09 06:57 · Score: 2, Funny

Yes, because russians get everything backwards.
I mean, in Soviet Russia efforts combine malware authors, for chrissake!
Re:Uhm.. You know those russian security experts by SuperBanana · 2004-12-09 07:22 · Score: 1

Is it just me, or does it seem that every story that lists the source as a "Russian Security Expert" is generally a load of crap?
After decades of communist rule, I think every Russian is a security expert.
That said, I really am disgusted by the number of unnamed sources in the press overall. Think of the last time you heard a US "government official" actually named. They claim it's "under condition of anonymity". Why does informing the public have to be done UCoA? There's no accountability...

--
Please help metamoderate.
Re:Uhm.. You know those russian security experts by Ironsides · 2004-12-09 07:33 · Score: 1

Thats, "In Soviet Russia, efforts combine authors malware."

--
Fly me to the moon Let me sing among those stars Let me see what spring is like On jupiter and mars
Re:Uhm.. You know those russian security experts by thePegan · 2004-12-09 07:58 · Score: 1

That said, I really am disgusted by the number of unnamed sources in the press overall. Think of the last time you heard a US "government official" actually named. They claim it's "under condition of anonymity". Why does informing the public have to be done UCoA? There's no accountability...

It's called getting your chestnuts roasted. But today, the stakes are higher than before. If you stick your neck out and are accountable in today's world, they don't just roast your nuts. They then cut them off and feed them to you.
Re:Uhm.. You know those russian security experts by Anonymous Coward · 2004-12-09 08:22 · Score: 1, Insightful

Nope, it's just KASPERSKY. These people are headline whores and you really shouldn't trust a word they say.
Re:Uhm.. You know those russian security experts by AndroidCat · 2004-12-09 08:42 · Score: 1

More like those unnamed government officials like to feel important. Like, who cares if a statement is from Joe Shmoe? But if it's from unnamed government official under condition of anonymity, it makes them a somebody--if we knew who they were...

--
One line blog. I hear that they're called Twitters now.
Re:Uhm.. You know those russian security experts by happyfrogcow · 2004-12-09 08:53 · Score: 1

In Soviet Russia, Security exports you.

...oh, security "experts", nevermind.

All the more reason.. by farsideofthemoon · 2004-12-09 06:43 · Score: 2, Informative

to lock down your enterprise with a File surveillence and security tool like i:scan... know what's happening before the user does...

--
I know what's on your hard dr

Re:All the more reason.. by saderax · 2004-12-09 07:01 · Score: 1

to lock down your enterprise with a File surveillence and security tool like i:scan [dciseries.com]... know what's happening before the user does...
--
I know what's on your hard drive.. =) [dciseries.com]

Anyone notice that the product advertised and the "I know whats on your hard drive" sig link to the same place? Hmmm....
Re:All the more reason.. by farsideofthemoon · 2004-12-09 07:27 · Score: 1

Hey, if you got a good product what's wrong with letting people know? =)

--
I know what's on your hard dr

Many shallow eyes... by Onimaru · 2004-12-09 06:44 · Score: 2, Interesting

...make deep bugs deeper. FOSS philosophy applied to viruses. Yikes.

--
adam b.

Re:Many shallow eyes... by ottawanker · 2004-12-09 06:56 · Score: 3, Funny

.. don't tell me you've been paying for your viruses all this time!? I always make sure the viruses I get use the GPL.

No big deal by MrRuslan · 2004-12-09 06:45 · Score: 3, Funny

this wont have an effect on computer litirate people who know how to protect themselves ...and for those who dont know things wont change much ether....some people still have blaster on there box..they dont know or wanna know how to take care of there box

Re:No big deal by kevin_conaway · 2004-12-09 06:46 · Score: 4, Funny

I'm trying to come up with a clever joke to poke fun at your grammar and spelling but I think I'll let your post speak for itself.
Re:No big deal by forrestt · 2004-12-09 06:54 · Score: 1

I don't know, I've already cleaned viri off of two family members' computers in the past month. One would only keep rebooting, and the other was so slow, it was unusable. All after being online without contacting me first. It's hard to say no, I won't fix your computer to family members. So, it will affect computer literate people. The real rub, I don't even dual boot Windows to play games anymore but I still can't get away from it.
Re:No big deal by j1bb3rj4bb3r · 2004-12-09 08:32 · Score: 1

I'm trying to come up with a clever joke to poke fun at your wanton cruelty but I think I'll let your post speak for itself.

--
*yawn*
Re:No big deal by Rightcoast · 2004-12-09 09:52 · Score: 1

It must be what...20 years since you were in public school at least?
My point is if you think your writing and English skills are below average, never mind far below average, you don't have even an inkling of what average really is.
Slashdot draws a crowd that would be considered brighter than average, the parent post is average.
Completely unrealated, I saw an article in a Connecticut newspaper about Pearl Harbor Day. 8 of 20 people knew what it was. A woman was quoted (and named) as saying she didn't know where Pearl Harbor was or why "It has a day."
Here is the kicker: I lean over to the guy in class next to me (a college course), and say "Wow imagine if you were pointed out in the paper as being a world-class dumbass?" and showed him her quote.
His reply: "How could anyone not know that's the day Hitler died?"
I didn't say anything.
Re:No big deal by plague*star · 2004-12-09 11:38 · Score: 1

You insensitive clod! *Anyone* could accidentally leave the "u" out of "donut".
Re:No big deal by arminw · 2004-12-09 16:55 · Score: 1

...cleaned viri off of two family members' computers...

I do that once for them and after that I tell them that I use a Mac that doesn't get any of that malware and that I don't have and never have wasted a penny on anti-virus software. Several of them have since turned off their virus and spyware infested Windows machines for good and switched to Mac and are very happy.

--
All theory is gray

Groups of Attackers by teiresias · 2004-12-09 06:45 · Score: 2, Informative

I don't think more people cooperating will really find new exploits, they will simply explore the ones they have already found. So, instead of an exploit coming out and than a derivative coming out a couple weeks later, we will see four or five derivates in quick succession of the original exploit.

Also, what "new" cooperation tools are malware writers using to communicate with each other? I'm fairly sure that IRC, Instant Messaging, VoIP, Bulletin Boards, and e-mail have all been standard communcation tools for these people. Maybe the groups now have more members.

--
-Teiresias

Re:Groups of Attackers by mrtroy · 2004-12-09 07:03 · Score: 1

I don't think more people cooperating will really find new exploits, they will simply explore the ones they have already found. So, instead of an exploit coming out and than a derivative coming out a couple weeks later, we will see four or five derivates in quick succession of the original exploit.

Well, I dont know how much faster things can get exploited and cracked...
Major warez groups usually try to get the first release of new software, and over half the time they have a cracked version out BEFORE the legitimate version is put for sale in stores.

I just had to download doom3 before it was out, and then buy the copy after.

But in the same way, people have been exploiting software in groups forever, this isnt new.

--
[I can picture a world without war, without hate. I can picture us attacking that world, because they'd never expect it]
Re:Groups of Attackers by bushidocoder · 2004-12-09 07:17 · Score: 1

I think you're right, and I think if this type of organization actually occurs, its much harder on the anti-virus companies than it is on software development companies. Companies like Symantec are going to have to learn to recognize, identify and respond to multiple similar yet distinct day-zero viruses and worms in a very short period of time, and when they start to analyze new outbreaks that exhibit similar symptoms but come from a variety of sources, I suspect it will slow down their ability to respond.
Re:Groups of Attackers by Heisenbug · 2004-12-09 07:41 · Score: 2, Insightful

Every time a new exploit travels around the internet, there are posts here saying things like "it's a good thing there was that bug ..." or "it's a good thing they used a relatively inefficient search for new hosts ..." or "it's a good thing it failed to disguise itself in this way ..."

If there's a movement towards greater code reuse, sharing of ideas, and debugging help among the people creating these exploits, we won't just see a speed difference -- we'll see a quality difference. We've been relying on security through malware incompetence for a little too long ...

Organized Crime? by jellomizer · 2004-12-09 06:46 · Score: 4, Interesting

Isn't this the same as orginized crime. So a bunch of internet thugs orginize to advertise more stuff, because they realized it will be more effective if they worked togeth. Will this rise the cost of protection money to use the internet?

--
If something is so important that you feel the need to post it on the internet... It probably isn't that important.

I'll from the head! by identity0 · 2004-12-09 06:46 · Score: 5, Funny

Hacker: I'll form the head!

Scammer: I'll form the heart!

Pornographer: I'll form the right hand!

Spammer: I'll form the crotch!

All: Together, we are - ASSHOLETRON!

(catchy theme music here)

Re:I'll from the head! by NardofDoom · 2004-12-09 06:56 · Score: 4, Funny

It's like Captain Planet, only worse. And evil.
"Captain Spam-it, he's our hero. Gonna make your compuer divide by zero!"

--
You have two hands and one brain, so always code twice as much as you think!
Re:I'll from the head! by Anonymous Coward · 2004-12-09 07:03 · Score: 1, Funny

5 Lions! You need 5!

IE programmer: I'll form the rectum!

(For entry, dontchaknow)
Re:I'll from the head! by TrollBridge · 2004-12-09 07:30 · Score: 1

Are you saying that Captain Planet wasn't really a villain?

Talk about your surprise endings!

--
There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.
Re:I'll from the head! by bludstone · 2004-12-09 07:56 · Score: 1

Which spammer gets to be "Heart?"

That sucked.

--

no .sig
Re:I'll from the head! by AndroidCat · 2004-12-09 08:53 · Score: 1

And don't you need some cutesy floating mascot/robot? Clippy...!

--
One line blog. I hear that they're called Twitters now.

No surprise- by IWantMoreSpamPlease · 2004-12-09 06:48 · Score: 5, Interesting

Used to be (way back in 2003 or so) AdAware was all you needed (and Norton AV or a workalike)

But now, man some of the things I've seen are really nasty!

You wipe 'em out, they come back, they hide from searches, morph into other programs, I've even seen one (I shit you not, I've been in IT for 10+ years, never seen anything like this one!) that was active even when the infected drive was placed as a slave on another machine, it started right up and infected the new PC.

This goes way beyond simple syware, these people are teaming up and it's just the beginning.

--
So rise up, all ye lost ones, as one, we'll claw the clouds.

Re:No surprise- by BicycloHexane · 2004-12-09 06:57 · Score: 1

can you put autorun.ini (same as the kind on a cdrom) on a hard drive and have it execute when you put the drive in another computer?
Re:No surprise- by MindStalker · 2004-12-09 07:22 · Score: 1

Not if it uses classic pre-internet era virus tricks. Obviously most anti-virus programs should know these tricks, but its still possible.
Re:No surprise- by Tuxedo+Jack · 2004-12-09 08:00 · Score: 1

Adware's a big component of this, especially the new VX2/ABetterInternet strain.

It's no real surprise, then, that large corporations and their ad dollars are behind a lot of this.

--

Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
Re:No surprise- by MindStalker · 2004-12-09 08:05 · Score: 1

Not nessessarly, boot sector viruses are still possible, though one coded for prewindows DOS wouldn't work with 2000 or XP they could easily be ported.
Re:No surprise- by RealAlaskan · 2004-12-09 08:47 · Score: 1

It still can't play anything better than Tux Racer.
I don't care about what the box can play. When I want to play, I don't use a computer.

--
See what I've been reading.
Re:No surprise- by gregfortune · 2004-12-09 09:31 · Score: 3, Funny

I've even seen one that was active even when the infected drive was placed as a slave on another machine

Dude, don't click on them *again*...
Re:No surprise- by RupW · 2004-12-09 09:41 · Score: 1

though one coded for prewindows DOS wouldn't work with 2000 or XP they could easily be ported.

Only if they intercept BIOS calls and somehow survive the transition into protected mode, and if the protected mode hardware drivers actually use the BIOS rather than go directly to the hardware. Which I think is very unlikely.

So no, I don't think this is possible *easily*. The best you could do would be to try and interfere with NTLDR and load a fake device driver than handles the re-infect, but that's a substantial amount of work, requiring a substantial amount of code to be hidden at boot time and would very likely be specific to a few versions of NTLDR.

In any case, to go back to the OP's case, you'd never trigger a boot sector virus on a slave drive.
Re:No surprise- by aldoman · 2004-12-09 10:28 · Score: 1

Yes.

--
IntechHosting - Free domain, 2GB, PHP, £4.95/$8.95
Re:No surprise- by sir+lox+elroy · 2004-12-09 10:56 · Score: 1

Oh wait I can do more than Tux Racer, That's right UT2K3, UT2K4, RTCW (Just a couple examples, if you'd like more I can send them to you, and screenshots). Oh, and yes, I can check my e-mail (Oh look another MS Worm from an AOHell User), and surf the web (Oh look a website trying to use an IE Exploit, isn't that quaint).

--
Kosh: "Understanding is a 3 edged sword, your side, their side, the Truth."
Re:No surprise- by ScrewMaster · 2004-12-09 11:20 · Score: 1

Well, sometimes NT, 2K and XP get very confused if they see two bootable devices in a system. When I've tried this (usually trying to recover data from the second drive) I've found that sometimes the operating system will attempt to boot a drive that is not the Primary Master. Very irritating behavior. So it is possible that the grand-grand-grand-whatever-parent poster did encounter a boot-sector infector but ... yeah, it's pretty unreasonable to expect it to have had much effect after the OS was loaded. Like you said, it's possible ... but I can't see that it would be worth the effort.

--
The higher the technology, the sharper that two-edged sword.
Re:No surprise- by Foolhardy · 2004-12-09 13:00 · Score: 1

NT confused? First, the bios decides which drive to boot off of; it loads the boot sector and executes it. If NTLDR is at the boot sector, it searches for "boot.ini" on the same volume. It'll see a list of OSes and a line like
default= multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
The first part is an ARC (Advanced RISC Computing) standard path to find the volume to boot off of. multi is the disk controller; how these are numbered is up to BIOS.
disk is for SCSI, rdisk is the drive number on the controller (0 for master, 1 for slave on IDE), and partition is self-explanitory.
The \WINDOWS is the path from the volume's root where the OS is installed. This could also be the name of a file to load and execute directly.
The volume that it should be booting off of is detirmined first by the BIOS and then explicitly by boot.ini
Here's a good link about it.

I'd say that NTLDR's internal implementation is so undocumented that it would be difficult, but possible, to infect with a boot virus. There are easier ways to infect the system, though.
Re:No surprise- by Pastis · 2004-12-09 13:20 · Score: 1

I for one find that funny.

We know that viruses have affected all sorts of population before. Some plagues killed as much as 30% of people in some countries years ago. AIDS has now about the same infection rates in some countries.

It's highly probable that one day a big bad virus will spread and destroy a huge number of PCs at a time. Perhaps 1 or 2 %.

That's just going to happen.

--
Sneak teach kids Algebra using a game
Re:No surprise- by Perianwyr+Stormcrow · 2004-12-09 18:40 · Score: 1

"i call it aohell because i'm a cocksucker"

god

--
What we call folk wisdom is often no more than a kind of expedient stupidity.-Edward Abbey

Re:Uhh, ok. by bigberk · 2004-12-09 06:48 · Score: 1

Well I've known about it since November 2003, dunno about you.

serve yourself and save by to_kallon · 2004-12-09 06:48 · Score: 3, Interesting

"They work in groups that exchange information with other groups on forums and Web sites."
erhmm....
ianase (i am not a security expert) but wouldn't that statement apply to, hmmmm....., oh i don't know.....THE INTERNET?? seriously, a broad, vague, statement like that suggests to me that this is mostly overreaction on the part of a group who could experience significant gains IF their statements were true.
fud? imho, yes.

--

The only way to get rid of a temptation is to yield to it.
-Oscar Wilde

Security Through Obscurity by TrollBridge · 2004-12-09 06:49 · Score: 2, Interesting

"This means that they reckon that weaknesses will be exploited in a matter of hours of being announced, rather thant the weeks and months that we're seeing now."

Kinda makes you think twice about publicly announcing vulnerabilities in your software before you have time to fix them, does it not?

--
There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.

Re:Security Through Obscurity by druhol · 2004-12-09 07:06 · Score: 2, Insightful

A good portion of the time, hackers and such learn about the exploits by reverse-engineering patches and updates. The problem isn't 'security through obscurity' so as just that most users are too lazy to patch their computers when a new update comes out.

--
WWD4D?
Re:Security Through Obscurity by TrollBridge · 2004-12-09 07:09 · Score: 1

I didn't mean to imply that security through obscurity was a problem here. In fact, I'd say it's not such a bad idea, given the information presented in this particular article, anyway. What is the benefit of publicly announcing a software vulnerability before the developer has had time to produce a patch?

--
There's a Mercedes gap too. I want one and can't afford one, but it's not government's job to do anything about it.
Re:Security Through Obscurity by Cid+Highwind · 2004-12-09 07:42 · Score: 2, Informative

Specific descriptions of a new vulnerability let sysadmins deploy new IDS/firewall rules to detect and block malware, write scripts to scan for infected hosts on their network, etc. Non-specific "there's a new remote-root hole in openSSH, but we're not telling you what it is" announcements just give people ulcers.

--
0 1 - just my two bits
Re:Security Through Obscurity by legirons · 2004-12-09 10:59 · Score: 1

"This means that they reckon that weaknesses will be exploited in a matter of hours of being announced, rather thant the weeks and months that we're seeing now." -- Kinda makes you think twice about publicly announcing vulnerabilities in your software before you have time to fix them, does it not?"

There's also the theory that exploits are already available and in moderate use, for (months|years) before the company involved knew about the vulnerability, and are part of peoples' own cracking toolkits.

Once the vulnerability is announced on a mailing list or by releasing patches, the exploit becomes much less valuable (or declines in value over the course of a week), so people may as well release their code and get bragging-rights for it (especially as the less-capable crackers will be starting to put together their own exploits from information in the announcement)

I guess it depends who you hope to secure against. Most people are happy to defend against automated virus-style attacks, but are wide-open to targeted attacks by someone who does their own security-testing on other peoples' products.

I've found exploitable security-related bugs in commercial products, just while trying to use them normally (not even looking for the bugs) so imagine how much more is going to be found by someone who goes looking for loopholes...

Anonymity is part of the problem by Anonymous Coward · 2004-12-09 06:49 · Score: 1, Insightful

Privacy is important, but isn't the general anonymity of the net a contributer to these sorts of problems?

It's a shame, but it seems some people are malicious in proportion to their anonymity.

Re:Anonymity is part of the problem by lucabrasi999 · 2004-12-09 06:55 · Score: 4, Funny

It's a shame, but it seems some people are malicious in proportion to their anonymity.
...And this was posted by an Anonymous Coward. Am I the only person to see the irony here?
Re:Anonymity is part of the problem by lucabrasi999 · 2004-12-09 07:23 · Score: 1

"people are stupid in propotion to their obviousness."
I guess I should have looked up, then I would have seen the point. I guess that means it's now time for my mid-afternoon coffee break.

This war can't be won ... by smoyer · 2004-12-09 06:50 · Score: 3, Insightful

The problem with detecting and deleting viruses, trojans, etc. is that you will never get ahead. At such time as a zero-day exploit is known to a hacker, they can create their malware of choice to exploit it. A skilled hacker may have an exploit ready in 6-12 hours.

Once done, they have a certain population size (vulnerable hosts) that can be almost instantly assaulted.

On the white-hat side, once the malware is noticed, it may take months to patch the initial security hole and even longer to patch the entire population of vulnerable hosts.

This is why vulnerability announcements are so important, the software that survives in the future will be the one with the shortest vulnerability to patch cycle. The others will die off ... only the strong survive!

Re:This war can't be won ... by Goeland86 · 2004-12-09 07:25 · Score: 1

Which is probably where Open Source software will eventually win. I remember a Mozilla/Firefox exploit that was patched in an hour... Compare that to the 6 months it took Microsoft to issue a few "simple" patches to Internet Explorer.
I think that to defeat these groups the easiest way is to use the least vulnerable software, which for an x86 platform right now seems to be OpenSource software.
Didn't apache have a bug that was fixed in less than 30 minutes after the flaw was discovered?
How many corporations can brag in the same way about their programs? Not that many, if not none.
Way to go, Linux and *BSDs! Eventually people will look for alternatives to Windows because windows will be the same as SkyNet for your computer: install windows and your box will fry under the assaults of virii and other remote-control bots. Use Linux and defeat all those little buggers by not offering the holes :)

--
---- I am certain of only one thing : I know nothing else.
Re:This war can't be won ... by fireboy1919 · 2004-12-09 07:35 · Score: 1

may take months to patch the initial security hole

This is the Windows way. Linux security fixes usually take a few hours up to a few days for services (ssh, apache, Bind, ntp). Also, if you use nonstandard ports for anything else and install active intrusion detection software then hackers won't get past the initial port scan.

Oh, and web browsers are inherently complex. I put a proxy in front of mine with ClamAV to innoculate any pages sent to the browser, just in case there is an exploit.

I will be very surprised if this level of vigilence doesn't continue to be enough to stop malware from ending up on my machine.

--
Mod me down and I will become more powerful than you can possibly imagine!
Re:This war can't be won ... by nacturation · 2004-12-09 07:45 · Score: 2, Insightful

This is the Windows way. Linux security fixes usually take a few hours up to a few days for services (ssh, apache, Bind, ntp).

That's great for simple products like Firefox, but what about when the product that has the security hole needs a fundamental change in its behavior? And if that product is used by every Fortune 500 company now you'll need to do compatibility testing to make sure that the product fix doesn't b0rk the dozens of other interoperable software which has been built on top of it.

Security is easy when all you need to do is fix a buffer overrun problem. It gets a bit more involved when making changes to software which has many dependencies.

--
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Re: This war can't be won ... by Alwin+Henseler · 2004-12-09 08:24 · Score: 1

"The software that survives in the future will be the one with the shortest vulnerability to patch cycle. The others will die off ... only the strong survive!"
Software with the quickest patch cycle may survive on the market, but not on the 'net. As you claim yourself, the bad guys are always ahead.
Just suppose: everybody gets automatic updates, malware producers are extremely skillful, vendors put out patches 2 seconds after they're informed of an exploit, and unpatched machines are compromised immediately when connected to the 'net. What happens then?
Black hat finds hole: numerous exploited machines before exploit is reported to vendor & the (remaining!) machines are patched. White hat finds hole: vendor puts out patch, black hat reverse engineers & makes exploit quickly, and manages to compromise some machines before the update reaches all corners of the 'net. Some holes will be found by black hats, some by white hats. Either way, there's always a pool of exploited/exploitable machines (likely a growing number, as the net keeps growing) at any given time, even IF vendors do a good job AND users patch their machines quickly. And any single machine has some chance of being compromised sooner or later.
The only software that truly survives here, isn't software that gets patched quickly, but software that doesn't need a patch. Software that only fails when the hardware does, but otherwise works, reliable, solid, period.
Possible? Some argue not, I think it can be done. Software is ultimately based on mathematical principles, and last time I checked, 1+1=2 was still valid. Hardware fails, 1+1=2 doesn't. The rest is a matter of design/software engineering in a broader sense. How to write reliable software, how to manage complexity? Hard, but not impossible.
The optimal solution is not needing one.
Re: This war can't be won ... by Ambassador+Kosh · 2004-12-09 11:33 · Score: 1

I think to get software that doesn't need to be patched will take many changes and many programmers will refuse to change. Some of the issues need to be fixed in the languages and just make certain kinds of bugs not possible to have to begin with. We also need better methods to split up programs into easily manageable and testable pieces and that would also need to be enforced by the language. I suspect such a system would not only lead to more secure programs but long term it would also lead to faster programs.

One thing I have always found strange when comparing c++ to python for example is that in a microbenchmark c++ always ends up faster then python. However my experience with larger projects is that python always end up faster then then c++ and is far less buggy. I am not entirely sure why but it has been true in my experience. That is one reason why I don't buy these benchmarks I keep seeing.

More code reuse would also help. Given that most software obeys that 90/10 rule. (90% of the performance is in 10% of the code). There will be a lot of programms that have the speed issues in the same place and that gives an opportunity to have video decode, image decode, fft, etc libraries that are very small in scope and very heavily tested to try and make it as small of a chance as possible to have security issues in those pieces. So not only does the high level language pass off the most processor intensive stuff to a lower level library you pass it to an extensively tested library and your programs are developer faster, run faster, are less buggy, easier to maintain and most importantly more secure.

--
Computer modeling for biotech drug manufacturing is HARD! :)
Re:This war can't be won ... by fireboy1919 · 2004-12-09 14:38 · Score: 1

Umm...browsers are one of the most complicated internet products in existence.

You're going to have to be more specific if you're talking about something that uses the internet which is more complicated than a browser - especially something more complicated that actually has other things that depend on it. I can't think of anything like that myself.

Are you sure you're not talking about Windows again? The place where the browser is part of the operating system?

--
Mod me down and I will become more powerful than you can possibly imagine!
Re:This war can't be won ... by nacturation · 2004-12-09 22:43 · Score: 1

Umm...browsers are one of the most complicated internet products in existence.

Yes, they can be complicated.

You're going to have to be more specific if you're talking about something that uses the internet which is more complicated than a browser - especially something more complicated that actually has other things that depend on it. I can't think of anything like that myself.

Well, how about a supply chain management software which integrates accounting software, inventory, ordering, procuring, messaging, etc. Maybe it has an API which has a subtle bug and the only way to fix it is to change the behavior of the API or to add a security layer which then depends on other applications. Think of an SAP implementation and the millions of dollars corporations spend just rolling it out as it needs to be customized to their particular business processes.

Are you sure you're not talking about Windows again? The place where the browser is part of the operating system?

I'm not necessarily speaking of Windows. But I assume you're speaking of Linux again? The place where there are no complementary products and applications can't be linked together? Uh-huh...

--
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.

focus change by derxob · 2004-12-09 06:50 · Score: 4, Insightful

Back in the day virus writers main intent or goal was to piss off users and to create the next 'big' virus. Now a days, it's all about the money. Those same virus writers are now focusing their attention on the same aspects of before, infecting and disrupting a users system, but when money is involved, the stakes get higher, and things become a lot more dangerous.

However, this article is pleading that we should *not* be publishing vulnerabilities, "because it gives hackers a tool", and I disagree with this. Publishing vulnerabilities is a way to alert the public of exploits that are present. What we need to do is make the publishing of vulnerabilities more popular than it is so that the general public is aware of problems and alerted on how to fix them.

--
Beat the computer, program your life.

Re:focus change by MinutiaeMan · 2004-12-09 09:53 · Score: 2, Interesting

I see a major problem with this, at least in some circumstances. If businesses start issuing too many warnings about vulnerabilities, at least some users might become "desensitized" to the urgent need to upgrade. Heck, already too many users don't bother upgrading until there's a big bad virus or worm out there threatening everyone.

Of course, by the same token, if businesses start issuing more warnings (cough*MICROSOFT*cough*) then maybe more people will realize that their software of choice is a piece of sh*t and start looking for a replacement.

I think that so far, the general effect of an increased emphasis on security has been the latter (people reconsidering options). But will it always stay that way? I don't know.

Scary? Sort of. And yet... by DanteBlack · 2004-12-09 06:51 · Score: 1

Is this scary? I suppose, but is it realistic to believe that this is a truely new development. Vulnerabilities get exploited and there's nothing that can be done about that. Consumers need to be aware of them so that they can attemt to deal with them while a advisory solution or patch is in the works.

Moreover developers aren't always aware of a vunerability and they need to be. If people don't know about a potential exploit, both companies/developers and consumers alike, they will be affected more severly.

--
I am invisble, and you can't see me.

Another group... by lucabrasi999 · 2004-12-09 06:53 · Score: 1

Another group of people is obviously conspiring to take over. I wonder if this is all related to the "Vast Right-Wing Conspiracy"? Or was that the "Conspiracy of the Liberal Elite"?

Microsoft should.... by Himring · 2004-12-09 06:53 · Score: 4, Funny

Microsoft should use the business model that's brought them where they are today, create a "virus" department in Redmond and beat these guys at their own game.

I can see it now: Active Virus (TM)

1. Make OS.
2. Build-in holes.
3. Release patches.
4. Create virus.
5. Still profit!

--
"All great things are simple & expressed in a single word: freedom, justice, honor, duty, mercy, hope." --Churchill

Re:Microsoft should.... by Turn-X+Alphonse · 2004-12-09 07:09 · Score: 2, Insightful

You missed some...

6. People get sick of it and whine
7. People move to Linux
8. Profit for someone else!

--
I like muppets.
Re:Microsoft should.... by DrYak · 2004-12-09 12:06 · Score: 1

I can see it now: Active Virus (TM)
1. Make OS.
4. Create virus.

Score -1, REDUNDANT

--
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]

Et tu, Slashdot? by menkhaura · 2004-12-09 06:55 · Score: 5, Insightful

Mistaking hacker for cracker is acceptable on the general media, where people aren't very aware of such subtleties. But on Slashdot? C'mon, I know Slashdot is crawling with Windows users, wannabes and such, but this is getting offhand!

--
Stupidity is an equal opportunity striker.
Fellow slashdotter Bill Dog

Re:Et tu, Slashdot? by gameboyhippo · 2004-12-09 07:27 · Score: 1

Eh? I think hackers and crackers are like birds and chickens. Chickens and birds have a "is a" relationship and I think the same goes for "crackers and hackers" or even "crackers and snackfood". Or something like that. So I don't think that /. was necessarily wrong in using the term Hacker.
Re:Et tu, Slashdot? by CumInHerTaco · 2004-12-09 08:34 · Score: 2, Funny

Slashdot is crawling with Windows users, wannabes and such...

w00t, we have wannabes?!

I feel cool now!

--
The only way to end war is for everyone to get a piece!
Re:Et tu, Slashdot? by BooRolla · 2004-12-09 08:58 · Score: 1

offhand == out of hand ?
Re:Et tu, Slashdot? by QuantumFTL · 2004-12-09 09:41 · Score: 2, Insightful

Mistaking hacker for cracker is acceptable on the general media, where people aren't very aware of such subtleties. But on Slashdot?

I know this won't be very popular, but maybe it's time the "hacker" community accepted that like many other english words, it can mean multiple things. Geeze, already it can refer to someone who is bad at golf, or someone who enjoys chopping at wood, why not someone who "hacks" into computers?

Maybe i'm silly but I'd rather trust the Oxford English Dictionary on something than the consensus of slashdot. It's part of the english language now, and probably will be for the rest of our lives. Get used to it.
Re:Et tu, Slashdot? by ScrewMaster · 2004-12-09 11:42 · Score: 1

Sometimes the dictionary is wrong. Not often, but when it comes to computer terms I no longer consider Oxford (or Webster, or any other) as the ultimate arbiter of the language. The consensus here is among thousands of computer professionals, people that know better, that have a sense of the history of the field and its dialects, even if the computer illiterates that maintain dictionaries do not.

The popular media has, for years, misapplied the word hacker. By definition, their are no evil hackers. Black hats, yes. Crackers, yes. Computer vandals, yes. White collar criminals, yes. But a "hacker" is simply one who enjoys pushing the envelope, an experimentalist. I'm a hacker ... hell, I disassembled the entire Apple ][ operating system years ago, just to see how it worked (and because my friends thought it was cool.) Hacked it up pretty good, actually, made it do some things that it wasn't supposed to be able to do. Did that make me a criminal (well, that was in 1980 ... probably would make me a criminal now)? No ... it made me a hacker. And I was proud of that.

By your logic, that talking head on the five o'clock news should determine the words we speak and how we should use them. Might as well just have the good people at Webster's call up the newsroom and ask for definitions. But if the dictionary folks can't be bothered to research the history of a commonly-used computer term then I'll simply scratch it out of my copy.

--
The higher the technology, the sharper that two-edged sword.

Its unprofessional to this.... but by Chembryl · 2004-12-09 06:55 · Score: 1

This is good news for us as it keeps most us and our skill sets relevent to our employers.

Sorry but some times they need reminding.

--
- This and all my posts are public domain. I am a Physicist. I am not your Physicist. This is not Physically advice

Move along, nothing to see here by worktheweb · 2004-12-09 06:57 · Score: 3, Informative

These are the same guys who were predicting an "Internet Meltdown" a little while back -- I'd take their prognostications with a grain of salt ...

http://it.slashdot.org/article.pl?sid=04/08/25/1 53 3213&tid=172&tid=95&tid=1

Latest Kapersky news by flibuste · 2004-12-09 07:00 · Score: 2, Insightful

Last time I heard about Kapersky labs, we were supposed to have an internet doom day. I'm still waiting for it, yet Kapersky is still blowing whistles.

How can you trust such a non-trustable source anywany?

Re:Latest Kapersky news by Schwartzboy · 2004-12-09 07:38 · Score: 1

How can you trust such a non-trustable source anywany?

As soon as you figure that out, give me a call. If I could understand why so many people continue placing their trust in individuals or institutions that seem to exist only to abuse that trust, I'd finally be able to understand why the political system in my country works as well as it does.

--
"Linux doesn't exist. Everyone knows Linux is an unlicensed version of Unix"- Kieren O'Shaughnessy
Re:Latest Kapersky news by satterth · 2004-12-09 10:56 · Score: 1

Last time I heard about Kapersky labs, we were supposed to have an internet doom day. I'm still waiting for it, yet Kapersky is still blowing whistles.
But you see, he told everyone about the internet doom day and saved the internet from doom. Yeah for Kapersky he saved us!
It's just wrong, but shouldn't someone thank him?

--
Being called a dork on Slashdot must be like being called the retard in special ed.

!News by oexeo · 2004-12-09 07:01 · Score: 1

This will probably get modded troll, but please hear me out:

Damn it /.! Please check the definition of news:

News
- Information about recent events or happenings, especially as reported by newspapers, periodicals, radio, or television.
- A presentation of such information, as in a newspaper or on a newscast.
- New information of any kind: The requirement was news to him.

This is not news! It's simply common sense that certain classes of people are going to conspire and associate with each other to some degree. Perhaps if the article was about a particular group of some importance, or interest it would be news, instead it's just another redundant research paper telling us what we already know. Outside of tech news, please imagine the headline "Safe crackers combine forces with bank robbers" appearing on the front page of any respectful publication, that's how stupid I think this is.

Nothing new here by genner · 2004-12-09 07:03 · Score: 1

Hackers teaming up is nothing new.
Most virus's are open source.
Quite possibley their the orignal open source community.

.....please dont flame me I use linux I swear!

Do we care? by Turn-X+Alphonse · 2004-12-09 07:03 · Score: 1

We all keep our PCs secure.. or should do. Then we make money off it, by fixing the PC's belong to who don't...

It's win-win for us. Lose-lose for the newbies.

--
I like muppets.

whee by ribo-bailey · 2004-12-09 07:04 · Score: 1

Spam! Hack! Virus! Go Russians! By your powers combined, I am captain pain in the ass!

Hear, their, everywear by Shadow+Labs · 2004-12-09 07:05 · Score: 1

some people still have blaster on there box..they dont know or wanna know how to take care of there box

And some people over their don't know what there getting they're own selves into grammatically speaking!

--

echo $SIG

The Legion of Doom by ro_coyote · 2004-12-09 07:06 · Score: 1

Oh no, someone call the Superfriends!

Call Gregory by CSG_SurferDude · 2004-12-09 07:06 · Score: 1

P-1 CUR ALLOC=8,058,044,651 CALL GREGORY

--

LongTail SSH Brute Force analysis tool is here!

Hacking just not what it used to be by The+Redwin · 2004-12-09 07:06 · Score: 1

Any one else remeber when hackers were just the type of people that hang out at slashdot? The kind of peopel that might hack into your system, but wouldn't break anything, and then leave a friendly note explaining how to secure it? Now it seems the only image the public associates with the hacker sterotype is jerks like this writing spyware/virus/ddos bot/spam relay/etc crap. =(

Why is parent modded "troll"? by rhakka · 2004-12-09 07:10 · Score: 1

like somehow using economic warfare to make someone pay attention isn't a rational thing to suggest?

open a can of whoop-ass by TheSHAD0W · 2004-12-09 07:10 · Score: 2, Interesting

This circumstance does have some advantages; by tying themselves together financially they open the possibility for one to be traced from the other.

It also opens the participants to criminal conspiracy charges. Can you say RICO, motherf***er?

Re:Spammers, Hackers and virus writers... by Adriax · 2004-12-09 07:11 · Score: 1

"We're off to see the Linux. The wonderful Linux OS!"

--
I don't suffer from insanity, I enjoy every minute of it!

Very dangerous meme... by CODiNE · 2004-12-09 07:15 · Score: 2, Insightful

"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."

This pushes security discussion underground, but doesn't stop the bad guys, just leaves the administrators vulnerable and unaware. Very easy to spread this sort of propaganda however... hopefully it doesn't lead to laws being passed.

--
Cwm, fjord-bank glyphs vext quiz

Now they'll find their own vulnerabilities by Animats · 2004-12-09 07:17 · Score: 1

If the attackers are getting that organized, they presumably can find their own vulnerabilities, instead of relying on published ones like the script kiddies.

Re:China: Spammers, Viruses, and Hackers by glennrrr · 2004-12-09 07:20 · Score: 1

I can't imagine how "slightly faster for casual browsing" justifies using Explorer. If anything, to maximize security, one should never use Explorer for casual browsing, and only use it to run Windows Update and perhaps other sites mandatory to doing one's job which use ActiveX controls. Otherwise use Firefox.

And for even better security, get a computer pre-installed with Safari.

Jabberwocky! by jaypifer · 2004-12-09 07:25 · Score: 5, Insightful

"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."

And this is why most people are against security by obscurity. Kaspersky is confused. The tired phrase of "If guns are outlawed, only outlaws will have guns." applies even more pertinently to software vulnerabilities.

By the time someone with enough motivation (read funding) to write an article on a vulnerability does so, the bad guys have already written exploits. Why? For the same reason...they get paid!

The published articles allow the moderately tech savvy user to protect themself. Additionally, it forces the software makers' hand to close the vulnerability faster than if they had no pressure at all. Ultimately, this is our only way of shaming large companies into creating proper software and delaying the releases until they've created a more hardened product.

Yes, hanging out the dirty laundry of vulnerabilities makes it easy for the junior hackers to create something out of nothing, but I'd rather we all know about the problems at the same time than a few sophisticated spam hackers knowing about the problems for an indefinite amount of time.

--
Never go to sea with two chronometers; take one or three.

Absolutely No Surprise by abb3w · 2004-12-09 07:28 · Score: 1

Well, what have you been doing in 'IT for 10+ years', surfing for p0rn?

Probably not all that different, really. And there's also the possibility he may have been doing IT in the porn industry for much of it.

--
//Information does not want to be free; it wants to breed.

Re:China: Spammers, Viruses, and Hackers by My+name+isn't+Tim · 2004-12-09 07:31 · Score: 2, Insightful

until even Firefox will be useless, because see they are gaining market share in leaps and bounds, which makes them a target for malware and exploits now. It's only a matter of time until only lynx will be safe.

Been there, done that.... by abb3w · 2004-12-09 07:38 · Score: 1

...nobody remembers their history...

--
//Information does not want to be free; it wants to breed.

Uniting could make them weaker by Woogiemonger · 2004-12-09 07:41 · Score: 1

By joining up, the malware author does exactly the opposite of what he needs to do to stay anonymous. It is easier to catch someone who communicates with colleagues about the very thing which he needs to keep private. By conversing about virii/trojans/etc, it is far easier for law-enforcers to monitor and hunt down these cybermischiefs and bring them to justice, Bill Gates's feet, a /. horde, etc.

Kapersky's scare tactics by Mr.+Cancelled · 2004-12-09 07:43 · Score: 1

Maybe it's just me, but it sure seems that a lot of the "doom and gloom" virus warnings come out of Kapersky.

Wasn't it just 6 months ago or so that they were warning of a big attack day from the script kiddies out there (Was a... Friday, or a Saturday it was supposed to happen - Can't recall which off-hand). It never happened, but you wouldn't have believed that from their press release.

Don't get me wrong... Kapersky's not the only one who feels that there's greater cooperation between the various virus/spyware/trojan writers out there, but they seem to always be the one using "shock" type campaigns to announce such things.

Perhaps they're hoping that one of these "apocolypse now" stories will someday come true, and then they'll get a bunch of new customers because they'll be the ones who foresaw the problem and tried to warn the world.

Or perhaps they're the ones writing the virus's in order to drive up demand for their anti-virus products... Who really knows at this point, but I don't see the McAffee's or Nortons of the world putting out these types of press releases. It's always Kapersky. Odd...

Mostly a windows problem by unoengborg · 2004-12-09 07:43 · Score: 1

I guess people would be much more secure if they switched to Linux and configured a good SELinux policy. One that prevented webbrowsers and e-mail clients from modifying binary files like shared libraries and applications.It could also prevent files that was downloaded by webbrowsers or e-mail clients to be executed by root. Make sure that only approved applications that really needs it are allowed to open sockets or connect to the internet. That would make life very difficult to most virus developers.

Today, Red Hat Fedora Core 3 turns on SELinux by default. Unfortunately the policy is mostly targeted at servers. Perhaps they (and other Linux distros) should target the desktop as well in their upcomming releases.

The problem is probably that most windows users will not go the Linux road. Instead they are likely to apply TCPA strategies that not only will lock out virus writers but also the owner of the computer.

--
God is REAL! Unless explicitly declared INTEGER

Et tu, menkhaura? by Anonymous Coward · 2004-12-09 07:47 · Score: 1, Informative

"C'mon, I know Slashdot is crawling with Windows users, wannabes and such, but this is getting offhand!"

Mistaking "offhand"(sic) for "out of hand" is acceptable on Slashdot, where people aren't very aware of such subtleties. But IN the general media?

(Off-hand means "casually dismissive", ie "I can't stand Fry's, their off-hand attitude is getting out of hand")

Re:Et tu, menkhaura? by menkhaura · 2004-12-09 08:05 · Score: 1

Hahahaha, thanks for pointing that out, I'm always willing to learn more.

--
Stupidity is an equal opportunity striker.
Fellow slashdotter Bill Dog

Teams == easier to infiltrate by lawpoop · 2004-12-09 07:56 · Score: 1

Instead of chasing down the lone cracker who created the GreatNewVirus, authorities can now pley members against each other in order to infiltrate a group. They can offer rewards for ratting out other members, or bribe them with reduced charges/punishment in exchange for squealing. This is a good thing.

--
Computers are useless. They can only give you answers.
-- Pablo Picasso

Re:Oh and let's not forget... by kcb93x · 2004-12-09 07:59 · Score: 2, Funny

Exactly. Which is one of the reasons I refuse to get rid of my old DOS box. 6.22/3.11 for Workgroups. If some 32-bit virii went around, hit everything...I've got my 486 to get the patch:)

--
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.

It was only a matter of time by Corellon+Larethian · 2004-12-09 08:04 · Score: 1

Honestly, if you still have a Windows box hooked to the net, whether it's behind ten firewalls and under 3 different antivirui, you deserve whatever kind of horrific disease you get.

Windows needs Palladium. Not tomorrow or the day afterwards. Today.

Right now.

Re:It was only a matter of time by lachlan76 · 2004-12-09 22:55 · Score: 1

You mean the Palladium which only allows Microsoft verified software to run?

Amen ... by jrl · 2004-12-09 08:24 · Score: 1

I will never understand the "let's bury our heads in the sand" defense to security problems.

It is either arrogance or naivety to want to surpress the vulnerability information from flowing...

Arrogance to think that only "good" people can find it .. or naivety to believe that no one else has already found it.

Re:Spammers, Hackers and virus writers... by Raistlin77 · 2004-12-09 08:26 · Score: 1

Don't worry... once Linux becomes half as mainstream as Windows, you'll get your fair share of viruses, malware, and the like. Hide behind Linux all you want, but pray to God that the masses don't start switching.

Arrogance or Naivety by jrl · 2004-12-09 08:26 · Score: 1

It is either arrogance or naivety to want to surpress the vulnerability information from flowing...

Arrogance to think that only "good" people can find it .. or naivety to believe that no one else has already found it.

I will never understand the "Let's bury our heads in the sand" defense to security problems.

Comment removed by account_deleted · 2004-12-09 08:32 · Score: 1

Comment removed based on user account deletion

And in other news ... by ANeufeld · 2004-12-09 08:36 · Score: 1

... the binary pattern
0x01 0x01 0x20 0x05
has been found in many executable files on many different and diverse operating systems.

Users are strongly cautioned not to use their computers on January 1st, 2005!

[Editor's note: many more executables also match the less restrictive byte patterns
0x01..0x12 0x01..0x31 0x20 0x05
Using your computer on any day in 2005 may be dangerous!]

Semantics by phorm · 2004-12-09 08:39 · Score: 1

Because a cracker is a black-hat form of hacker, but one can be a hacker without being a cracker?

Cracker is a more accurate definition, and certainly this otherwise paints a bad name for hackers. But realistically, given the use of hackers to describe such users perhaps a better name for white-hat hackers would be appropriate...

Re:Semantics by Anonymous Coward · 2004-12-09 13:48 · Score: 1, Funny

perhaps a better name for white-hat hackers would be appropriate...

I'm thinking "whacker".

It's probably more appropriate than one might expect...

Re:Indeed. I used Netscape 4.08 on WfW 3.11 to d/l by dosius · 2004-12-09 08:50 · Score: 1

It's nice to have a clunker around, though, it would be nicer if I could try getting online with it... Anyone know of any WFW 3.11-compatible DSL dialers (PPPoE)?

Moll.

--
What you hear in the ear, preach from the rooftop Matthew 10.27b

Mr, Kaspersky, F** you by Oriumpor · 2004-12-09 08:56 · Score: 1

"This is why vulnerabilities are so important," said Kaspersky. "We are against anyone who publishes vulnerabilities because it gives hackers a tool."

That's right keep them secret, keep them safe. So only the crackers and the uber-geeky know. And the little hairy foot developer can carry the exploit to mount doom before the evil minions of 50R0|\|666 get their hands on it.

How will we know what ports to block, what mutex to push via GPO, and what tools to use to prevent these attacks if we don't know about them beforehand?

pattern, anyone? by majest!k · 2004-12-09 08:59 · Score: 2, Interesting

i just read the article. i couldnt help but notice a striking resemblance with the agendas of Kaspersky and our very own Bush administration...

1) spread fear, its good for business.
2) create some fucked up 'axis of evil' shit to help further #1. ("Virus writers are combining their efforts with hackers and spammers to launch Swiss Army knife-like malware attacks on users")
3) throw in some fuzzy math for effect. ("The company said that it was seeing 200 new viruses a day.")
4) take a random stab at preventing free speech. ( "They work in groups that exchange information with other groups on forums and Web sites ... We need to cooperate to prevent this.")
5) and finally, say something really stupid that goes against something tried and true thats trusted in the industry - in this case, the idea of Full Disclosure. ("We are against anyone who publishes vulnerabilities because it gives hackers a tool.")

and to think i actually used to respect their work. maybe they should just stick to coding and save the PSA's for when they have a smarter PR rep.

just my 2 cents.

--
smattawichu

Not to burst Kaspersky 's bubble, by bitswapper · 2004-12-09 09:15 · Score: 1

But there is no way to actually verify that "Malware authors" are actually cooperating more now than in the past.

It clearly a "panic and run to us for help" article.

Protocols will have to get more resilient by Dr.+Manhattan · 2004-12-09 09:18 · Score: 2, Informative

I'm too scared to have my ssh server exposed to the raw net. Things like port knocking and so forth help, but suffer from reliability and resource problems. I created an authentication protocol that's correct by inspection and utterly immune to any attack short of actually finding out the secret key.

In these days of 0-day exploits, I just can't take the chance that someone will find a hole in ssh and create a Warhol-worm before I can install a patch. I sleep better now...

--
PHEM - party like it's 1997-2003!

A simpler method by Durandal64 · 2004-12-09 10:02 · Score: 1

Use an e-mail alias. If your e-mail address is, for example foobar@someserver.com, create an alias for that mail account called, say, foo.bar@someserver.com, and use that e-mail address on public forums, registrations and web pages. When the spam gets to be too much, just cancel the alias and create another one.

*yawn* Re:This war can't be won ... by Doctor+Memory · 2004-12-09 10:08 · Score: 1

I'm amazed that noone has figured this out yet. The defense against these viruses is software heterogeniety. Who cares if there's an Outlook virus if they're using Thunderbird? Or Firefox if they're using Opera? What we need to do is get enough people using enough different types of software to make it no longer worth an attacker's while to write virii -- hell, most web designers can't even get a moderately complex CSS to work properly on more than two browsers, you think anyone's going to write a virus that works cross-platform?

--
Just junk food for thought...

Re:*yawn* Re:This war can't be won ... by Ambassador+Kosh · 2004-12-09 11:24 · Score: 1

EXACTLY!

That is why we need standards so you can use any program for a given purpose. If we had true webstandards then firefox, mozilla, konqueror, opera, msie etc would all be able to render the same data the same way pretty much. This would give you the freedom to change to any of the others at any time with no lockin. This does give an inherent security advantage.

So if program A has a bug you can immediately stop using it until it is fixed and go use program B and not lose anything. You will even end up more meta program things like konqueror. Konqueror is not really web browser it is a component browser and it uses khtml by default to render but it could also use gecko to render. Lets say you added the ability for it to use the opera renderer also. If there is a bug with gecko you could just switch to a different renderer and lose nothing.

There are lots of advantages you get from having well defined standards that are followed and many implementations and one is a much higher resistance to bugs. It also doesn't take much of a mix of stuff to give a much better resistance to the crap out there. Think of what would happen if 1/4 of people use outlook, 1/4 used kmail, 1/4 use thunderbird and 1/4 use evolution. Any given exploit will be able to target one of those pretty much but everything that exploit hits a machine that is not vulnerable it stops there. So the time to get a complete infection of any given group is far far longer. During that time you can patch the program, switch to a different one etc. Either way the damage is going to be a lot lower with the mixed environment.

--
Computer modeling for biotech drug manufacturing is HARD! :)

Prime opportunity by WiPEOUT · 2004-12-09 10:27 · Score: 1

If this is true, it's a prime opportunity for law enforcement to infiltrate the newly-forming groups. Furthermore, unlike The Lone Hacker, these groups are going to be much more vulnerable. If just one of them is identified, the entire network will get done. As an added bonus for investigators, a confederation of specialised individuals will either:

1. contain some individuals that by virtue of not specialising in protecting their identities are going to be easier to catch

or

2. use best-of-breed tools produced by those specialising in staying anonymous and cleaning up their tracks. This is a double-edged sword for while it will make it harder to get the first individual in the chain, once you have one, you have them all.

Never mind that once they get caught, they're double screwed because not only will they get charged with whatever crimes they perpetrated, they will also be charged with conspiracy charges of all sorts. Given the current political climate, I wouldn't be surprised if terrorism charges were somehow included as a bonus >:)

Conspiracy by elfarto · 2004-12-09 10:49 · Score: 1

This is not a flamebait or a troll.

I always had the suspicion that
virus writers worked together with antivirus firms, gee,, there won't be any need of antivirus if there were no viruses. I'm tempted to say that people inside Kaspersky are of the black hat kind.

It would be if the virus authors sold anti-virus.. by TheLittleJetson · 2004-12-09 11:08 · Score: 1

First, this article is mostly about security exploits and virus authoring, not spyware/adware.

In order to really liken this to organized crime, there would have to be some profit motive, so as to make the racket a worthwhile venture. For instance, if they were creating viruses and also selling anti-virus software, you could then demand protection money. It doesn't sound like these folks are offering protection to anyone, it's just a bunch of punks that collectively form SUPER-PUNK. If you were going to liken this to any crime form, it would be something more along the line of a hate group or terrorist organization. However it really pisses me off when people do that, so let's not.

RE: argument against open source? by King_TJ · 2004-12-09 12:23 · Score: 2, Insightful

I know this has been stated MANY times before in various ways, but if "closed source" truly is effective in preventing malware/hacks/virii simply because the source isn't available for anyone's inspection - then why do we see all the security flaws popping up with IIS? Meanwhile Apache has comparable market-share and usage world-wide on the net as a web server, and it is considered far more secure?

By the same token, Linux and BSD have been chosen as the platform many commercial firewall/router products are based on, despite being open-source. If open-source really had a "disadvantage", security-wise, by the mere fact that it's freely available code - then wouldn't you think companies like Netgear or Cisco/Linksys would steer clear of them in security-related network appliances?

Of course "exploits are expected to come out within hours of disclosure" - but that seems like a pretty general statement to me. Far more people with malicious intent are capable of slapping together some code based on a documented flaw than figuring out a previously undiscovered flaw and exploiting it. If you disclose a Linux or BSD security flaw, I'd say it's just as likely to be exploited quickly as a Windows flaw.

Cynicism and real hacker ethics by wyrd_chao · 2004-12-09 12:57 · Score: 1

The gloom-and-doom and the 'Hacker' gaffe and other things.... this all dismays me.

Back when I did serious work (1997 or so), IT guys (LOTS of them former hackers and PC-geeks) had an informal code of ethics, which came down from the 'Hacker Dictionary' guys long, long ago. To reiterate:

'Hackers', while perfectly willing to use any means to tear apart and re-verse engineer software, hardware of any kind, etc. were ethically constrained from causing damage through their knowledge. Harassment of the powers that be, yes. The presentation of unpleasant facts, yet.

BUT, exploitation of knowledge for personal gain, definitely NOT. This doesn't just mean writing viruses, cracking systems for profit, breaking copyrights protection, etc.

Personally, I also took it to mean that one should not cynically exploit the ignorance of the public (and your bosses!) to line your own pockets. I put this in the category of war-profiteering or worse. I believe people in the medical professions might be familiar with this situation all so.

I got OUT of IT because I felt it was my mission to make the systems I was resposible for useful and secure; moreover, I spent a large part of each day trying to educate my users so that my job would be easier. I COULD have milked the job and told my people some bullshit that fed their mushroom-ness. I could have done the same to my bosses. I'd probably still be there and pulling in 60-70K a year, too.

Professional ethics used to mean something in the wider geek community. I don't believe that paranoia and greed will destroy it from within, but...

--
- - 'Go ahead, make my tea.' - Doow Tsae T'nilc -

Re:China: Spammers, Virus Writers, & Hackers by Long-EZ · 2004-12-09 12:58 · Score: 2, Interesting

Close. Actually, the two things you should do are:

1) Download and install Firefox.
2) Delete Internet Explorer (if you can).

On my computer, Internet Explorer is slightly faster for casual browsing than FireFox because Explorer is more tightly integrated into the operating system.

On my computer, I'm running Linux. IE is NOT integrated into the operating system. You can't see it, but I'm doing the Superior Dance.

If IE is integrated into your OS, there is a third thing you should do.

3) Upgrade to Linux or Mac.

I can't understand why everyone isn't more enraged by the fact that 80% of spam now comes from zombie Windows PCs. Lack of security hurts us all. As a society, we're far too complacent about PC security. We should take the attitude that a person's right to run an unpatched Windows box attached to a high speed cable ISP does not supercede the right of a million internet users not to drown in illegal V1aGr@ and warez spam.

--
>> My ultraviolent Linux switch video.

Re:Indeed. I used Netscape 4.08 on WfW 3.11 to d/l by Average · 2004-12-09 13:22 · Score: 2, Insightful

Ethernet socket driver for a simple ethernet card.

Trupmet winsock or similar to bind to the 0x60 DOS socket.

$20 router connected to your DSL to do the PPPoE login, as well as a bit of firewalling to any computers internally.

I would never suggest using a PPPoE utility on the computer when routers are so cheap and useful. Most DSL modems even have the router logic built-in nowadays.

There's public and then there's public by Joseph_Daniel_Zukige · 2004-12-09 13:48 · Score: 1

Depending on which public you mean, this will actually work out to "within a few days of disclosure to the cracker public" and "before disclosure to the public in general, including to the company that makes the stuff".

Come to think of it, there are already examples. And I'm with the guy who says it's time to start working on a class-action suit against Microsoft for helping us push ourselves into this position.

ipfw DENY all from $CHINA_IP_SPACE by the+angry+liberal · 2004-12-09 14:50 · Score: 1

I know I am going to hear from the Chinese karma police on this one, but does anyone have a list of all the Chinese IP space?

Perhaps we could start a grass-roots effort to disallow access from countries whose goverments aren't being responsible when it comes to their citizens respecting the rights of others in the online community?

Anyone have a list they could post or link to?

Re:ipfw DENY all from $CHINA_IP_SPACE by 1u3hr · 2004-12-09 21:41 · Score: 1

"...disallow access from countries whose goverments aren't being responsible when it comes to their citizens respecting the rights of others in the online community?"
MOST SPAMMERS LIVE IN FLORIDA.
Re:ipfw DENY all from $CHINA_IP_SPACE by 0racle · 2004-12-10 11:21 · Score: 1

Its no governments job to police the internet. I bet you post against the Great Firewall of China is every time it is mentioned, and yet here you are advocating the same thing. Blocking does nothing.

--
"I use a Mac because I'm just better than you are."
Re:ipfw DENY all from $CHINA_IP_SPACE by the+angry+liberal · 2004-12-13 20:44 · Score: 1

Perhaps you failed to read my post correctly. That is fine, since you seem rather pro-chinese and probably do not speak english fluently to begin with.

Note how the above paragraph was an assumption I pulled out of my ass, much like your entire post.

The fact is, I never mentioned government intervention. By its very mention "grass roots" is typically used to describe a non-government activity. How you missed this and thought I was pro-government intervention is beyond me.

Anyway, I don't post against the "great firewall of china" as you suggest. I really could care less about it since I don't live and china and really could care less what happens to people over there. What? Did you read my name and think "OH PANSEY LIBERAL MUST MAKE A WITTY REPLY"? Give me a break. Grow up. Don't be a nationalist little monkey.

I was speaking out of concern because I have been in Information Security for about 6 years now and about 3/4 of all the larger network scans and exploit attempts I have seen have come from chinese IP space. Unfortunately, I did not know I had to spell it out so morons wouldn't get a brown streak in their underwear thinking I am all anti-chinese.

So right now, you look like the complete Internet retard for trying to make a witty retort without even understanding the parent. You have one chance to redeem yourself by explaining how "Blocking does nothing". That is the very thing a firewall does and I would like for you to explain to all of us who have been running BSD and Linux for the last decade have been wasting our time with filters on routers, firewalls and various other security measures.

Kapersky took pages from mi2g and Sophos by gfecyk · 2004-12-09 15:29 · Score: 1

Sophos wants us to update our anti-virus software 8760 times a year. Once an hour every day, every year per computer (!) just to keep up with all of the variants of viruses.

mi2g? Well, they started calling vmyths a hate site. They need no further comment.

--
Use Evolution instead of Outlook? Bewa

Re:Kapersky took pages from mi2g and Sophos by fuzzybunny · 2004-12-09 21:38 · Score: 1

Quite possibly you're right--I have read neither site enough to judge it. However, what vmyths currently has on its front page is little short of cretinous.

Poorly researched, not founded in facts, throwing out a few terms with no background information, all to justify overly sweeping claims and opinions.

It may be a fine site for all I know, but they sure ought to consider filtering their front page content a bit better!

"Ramen" virus indeed. I sure hope that's a pisstake. :)

--
Cole's Law: Thinly sliced cabbage

Re:Indeed. I used Netscape 4.08 on WfW 3.11 to d/l by dosius · 2004-12-09 20:44 · Score: 1

Have a router already; think something's wrong with it as it has been unable to connect to my provider lately.

Moll.

--
What you hear in the ear, preach from the rooftop Matthew 10.27b

(whoops I should pay better attention) by fuzzybunny · 2004-12-09 21:42 · Score: 1

Ewps my bad, not front page content, rather the link in your .sig. The article's still date-stamped 3 days late...

--
Cole's Law: Thinly sliced cabbage

Re:Oh and let's not forget... by kcb93x · 2004-12-18 05:24 · Score: 1

Hopefully you're not refering to my 486...cuz we got it back in 1994. Stupid troll...

--
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.

Slashdot Mirror

When Malware Authors Combine Efforts

197 of 306 comments (clear)