Slashdot Mirror
Creative Zens Ship with Worms
An anonymous reader writes "Engadget reports about 3700 Creative Zen "Neeons" shipped with a virus. The virus in question was the W32.Wullik.B@mm worm. Creative released a statement today to help consumers pinpoint the possibly effected devices."
Ouch - that's going to be a black eye. Although it isn't the first case of software shipping with malware, IIRC there was some kid's game on CD that included a Bonus Virus inside.
Now a comment and a question for the peanut gallery - it's always been a pet peeve of mine that software companies aren't held to any real sort of accountability for shipping product that is clearly flawed. They hide behind the "shrink wrap" license, and (at least IMHO) get away with murder. Imagine if GM or Ford or Daimler-Chrysler put such a waiver of liability on a sticker on the doors of their new cars. The courts would tear them a new one so fast it'd be like lightning.
The question - what sort of liability does Creative have in this case, and what's fair recompense for shipping a clearly flawed product where said flaw has the possibility of harming the user's computer, data integrity and / or privacy?
How much is enough? Should Creative be given a hard enough pranging to get the attention of other software manufacturers?
Personally, I say "Yes". GM spends a hell of a lot of time and energy making sure their brakes work, I'd like to see software companies (and you all know exactly who I've got my sights on here) make sure they ship product that isn't horribly broken right out of the box.
but shouldn't it be affected?
the possibly effected devices means the devices that possibly came into existence because of the worm.
iPod and Mac zealots are now going to proclaim that "iPods don't get viruses!" ?
When you run Windows, you must run anti-virus ~all~ the time!
Agile Artisans
because you are desparately trying to start a flamewar?
IBM is running its new 90-nm microelectronics fab (in Fishkill, NY) entirely on Linux. So if it's feasible for a plant of that complexity, it should be feasible for a small assembly plant such as Zen Creative's.
--
Mad science! Robots! Underwear! Cute girls! Full comic online! http://www.girlgeniusonline.com/
Scrawny man in PE kit, about to lift a small weight: "Will this affect me?"
Muscular man, lifting two larger weight with each hand: "Look at the effect it had on me!"
From a poster in the Remedial Studies unit at my secondary school.
Je fume. Tu fumes. Nous fûmes!
Come to think of it, how does this worm manifest itself on a player device?
I doubt it executes on the player itself. Can it infect the PCs that you connect the player to for syncing?One line blog. I hear that they're called Twitters now.
Is this virus on the software/driver CD or the actual device itself?
If it's on the device, how is it running on the zen, since I'd imagine the zen doesn't run windows, and how does it get from the zen to the operating system? (Wouldn't a zen be just like a bulk transfer device or something, and require the user to download and run the virus from it?)
The author of W32.Wullik.B@mm is suing Creative Zen for copyright infringement under the DMCA.
``This is exactly why having windows machines in a production process is a bad idea.''
Although Windows has a deserved reputation for being susceptible to viruses and break-ins, this problem is not unique to Windows. Any software written in unsafe languages (like C and C++) is bound to contain exploitable vulnerabilities. Any system that allows the user to run software that they bring to it is susceptible to trojans.
AFAIK, no current operating system is both usable and provides adequate protection mechanisms against viruses. A fine-grained permission system might help, though. Allow the MP3 player's software access to your music directory, but nothing else. Allow the word processor access to your documents directory, but nothing else.
I wrote a utility called chrootexec that allows you to run a program in a chroot jail (it cannot access files outside that directory). It's basically the same as the chroot command, except that you don't need to be root to use it (but it does have to be installed suid root to work).
However, some programs (file managers come to mind) need access to many directories to be useful. These will still be exploitable.
Please correct me if I got my facts wrong.
>> the quality of the so-called "translation" spat out by Babelfish make me feel a lot better about my long-term job security...
It don't make me feel so goods about you job security. q:]
I used to have a sig, but I set it free and it never came back.
Why does this sound like some Mac/iPod anonymous fanatic kicking dust?