Slashdot Mirror
Mac Worm Author Gets Death Threats
StonyandCher write(s) to spread news about the strange story of the reported Apple OS X worm, which is growing stranger by the day. The blog of the researcher who claimed to have created the malware reportedly received death threats. The blog was then hijacked, according to the researcher, who calls him/herself InfoSec Sellout. InfoSec blamed David Maynor for hacking the blog. For his part, Maynor apparently unmasked himself as "LMH" and InfoSec as Jon Ramsey. The post to the Fuzzing mailing list has not been independently confirmed.
Update: 07/19 13:48 GMT by KD : David Maynor wrote in and denies that he is LMH.
Update: 07/19 13:48 GMT by KD : David Maynor wrote in and denies that he is LMH.
Don't cross a mac fanboy....
"Action without philosophy is a lethal weapon; philosophy without action is worthless."
It's been far too long since we had a nice bit of hacker drama! Now, where did I put my popcorn and my MOD vs LOD t-shirt...
Slashdot Burying Stories About Slashdot Media Owned
He would have been better off picking a weaker target such Islam. You don't want to mess with those Mac zealots.
Now we know the real reason there is less malware for the Macintosh.
Well, that's one way to keep an OS safe, I guess. Just think how secure Windows would be if Bill Gates focused his vast resources on killing every malware author. Ballmer would probably do the dirty work cheap ... just for the thrill of it all.
Why, Bill might even have a few million bucks left over at the end of the day.
Wasn't there some stories about religious zealots threating professors who taught evolution recently? It all begins to make sense now...
If nothing else works, a total pig-headed unwillingness to look facts in the face will see us through.
More likely it is another publicity stunt, to make their work to look more "legitimate", to get more people to side with them (the "I may not agree with what you say, but would defend to death your right to say it" crowd), to generalize even more the feeling that Mac users are dangerous fanboys disconnected with the reality, etc.
The only thing easier than to make threats to people on the Internet is to fake threats to oneself on the Internet. We got plenty of these drama queens in the nineties, hopefully this is not a trend that will come back.
It is as if the fanatics actually believed their OS was so secure it had no security holes.
Bearded Dragon
[fuzzing] The truth Lance M. Havok:
>br> "Since the cover is becoming more difficult to maintain, I've decided to stop this. It simply can't stand anymore and I can't let this harm my company and its customers.
I am David Maynor. I made up the LMH identity for bashing Apple and appearing on the media while I was preparing for launching Errata Security with Robert. Since my credibility was severely damaged after the wireless driver exploit, I needed a sock puppet. The idea of LMH and the Month of Apple Bugs came a while after I resigned from SecureWorks."
The high pricetag of a Mac is enough protection money to last a lifetime.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
The Spanish Inquisition?
You're assuming he hosts his own blog and you know what they say about assuming. Beyond that, why is his message less credible? if he can prove the worm works, the message is still the same, even if his blog is hacked. Perhaps the person responsible for hacking his blog is simply a much better hacker? There are so many variables to consider that your comment seems ridiculous when you even begin to look at even a tiny fraction of them.
They just implied not to release the worm or he would be dealt with using their iphones like they did at duke
Wait, so someone who claims, without providing proof, that they found/created a vulnerability in an operating system is now claiming to have received death threats and claiming that their blog was hacked? Again, without providing any real proof?
Uh, yeah. Count me skeptical.
Can anyone say "attention whore."
Cognitive dissonance is truly a funny thing. It's fascinating the lengths the human brain will go to in order to protect its version of reality.
PC: Hi, I'm a PC.
Mac: And I'm a Mac. PC, who are all those people smacking you in the head and rifling your pockets?
PC: [Sigh] Those are viruses and worms. Even though I scream "DENY! DENY!" as loudly as I can, they keep smacking me in the head and rifling my pockets. You know how it is.
Mac: Actually, I don't. You see, with a Mac...
[One of the worms moves sinisterly toward the Mac. A man in a black suit appears suddenly from the right and collars the worm, shaking it roughly.]
Man In Black Suit: Listen, woim. If you takes one more step taword da Mac kid, I'm gonna whack you and yer whole family, see?
Worm: Uh... uh... I'm just a proof of concept.
MIBS: Concept shmoncept. Not only will I whack you and yer family, I'm going to hack yer blog so bad it'll look like AintItCool.com.
Worm: [panics, runs away, screaming]
MIBS: [Claps hands as though rubbing dirt off. As he leaves to the right, Mac slips him a small paper sack.] Tanks, kid.
Mac: As I was saying, with a Mac, there are no viruses.
Rich And Stupid is not so bad as Working For Rich And Stupid.
Sheesh.
... and recipes and utilities for disabling both have been around for years.
Now we have unverified claims of death threats to add credibility to unverified claims of worms attacking a deep flaw in mDNSresponder... a flaw so subtle that Apple wouldn't be able to fix it without the help of said anonymous researcher who's allegedly received death threats over it.
Now this could all be true, but then SCO could really have thousands of lines of Linux code copied from UNIX they're still hiding so they can bring it out in a dramatic eleventh-hour release and snatch victory from the jaws of defeat.
I don't doubt that there's flaws in mDNSresponder. I don't doubt that you could write a worm to exploit them. I don't doubt that Apple is capable of fixing one symptom of a flaw rather than the cause... they've done it before. But there's nothing new here... schemes like Rendozvous/Bonjour/Zeroconf and the superficially similar "Universal Plug and Play" in Windows are a compelling target for potential attacks and have been criticized in the past. They're not needed for the normal operation of the system, and should be disabled unless you actually know you need them and are on a known secure LAN
But there is no way that any legitimate security professional would proceed in the manner that the people alleged to be involved in have been behaving over the past several months. The whole presentation of this affair seems almost designed to discredit the security community in the public eye.
Notify Apple, then release the details. There's no other ethical course of action.
This whole thing is getting a lot of coverage for what basically amounts to "random dude claims OSX vulnerability, produces no evidence to substantiate claim".
The responses are entertaining to read though. Hoards of morons attacking the Mac platform and users without any evidence that there is anything actually wrong. Lots of straw man arguments (nobody with half a brain ever said OSX was impervious to security issues), lots of hate... so much hate.
Like a bunch of catty middle school girls...
David Maynor just posted this to Full Disclosure; the post claiming to be from him and asserting that he's LMH was spoofed. Who'd a-thunk it, mail spoofing on a security list... DUH!
Everything I needed to know about life, I learnt from Blake's Seven
Macs are equally or less expensive than an equivalent Dell. Why not give me your address and we'll talk this over? Can I have a picture of your children?
// MD_Update(&m,buf,j);
Apple betters Microsoft once more.
Dispatch Tuesday is so much cooler than Patch Tuesday.
From the dictionary
Dispatch == To put to death summarily.
Don't blame apple fans. Look, if Windows had 95% of the market share you'd be reading about this kind of thing all the ti...
oh damn.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Cancel or Allow?
Let's focus on the fact that there are only two black-hat hackers for Mac that have (claimed) to have received death threats for their troubles. David Maynor and the "creator" of the rapeOSX worm. Since death threats are fairly juvenile (and often only exist in the paranoid minds of those that receive them), who does this worm creator remind you of?
:-)
IMO, the "voice" behind the worm threat sounds exactly the same as that behind the infamous WiFi exploit/hoax to me. The same juvenile phrasing, the same outrageous claims, poor logic and blindness to the facts. The same sense of humor and the same death-threats.
There is also a psychological truism about hoaxes that's often the cause of their downfall. The hoaxer usually finds it almost irresistible not to associate their name or their identity with the hoax in some way, even if it's obscure or disguised in some way.
What is the very last statement from the "creator" of rapeosx before he signed off for good?
"I am not David Maynor."
Add to this, the fact that this slashdot thread is unusually full of "humorous" one-line anti-Apple jokes made by innumerable slash-dotters that never seem to post on other threads and are primarily new accounts, and I think you have a picture of an egomaniac stirring his own pot and trying to grab at yet another 15 minutes of fame.
Gee... who is it that fits this profile of a juvenile, paranoid, dishonest, black-hat hacker with a certain amount of skill, but not very smart, hates Apple with an unreasoning passion, has a history of outrageous claims that turn out to be untrue, and often tries to manipulate the media and online communities to their ends?
Hmmm....
That's a puzzler for sure.