LWN.net Logo

Advertisement

E-Commerce & credit card processing - the Open Source way!

Advertise here

New virus infects PCs, whacks SCO (ZDNet)

ZDNet reports that the current Microsoft worm clogging our mailboxes is actually intended to set up a denial of service attack on SCO. One assumes that, by the February trigger date, it will have been cleaned up reasonably well and SCO will be prepared; meanwhile it feels like a DOS attack on anybody with a mailbox. "Early data indicated an epidemic several times the size of the Sobig.F virus, which caused widespread infections last summer...."
(Log in to post comments)

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 8:01 UTC (Tue) by pjs (guest, #10927) [Link]

The attack against SCO is probably just a diversion. This malware, like Mimail (which it is based upon), installs a backdoor that the attacher can use to turn the infected machine into a spam relay, or web server to participate in a distributed hosting system ("bulletproof hosting" for those images that html spam messages reference). It also allows tcp/ip connections to be proxied anonymously, presumably for use in scams to defraud end users of their sensitive banking information ("phishing"). This outbreak is just another in a long line similar attacks, which are clearly serving the interested of scam artists, who use the results to conduct their scams, or resell control of the infected machines to be used by spammers.

Attacking SCO is a brilliant diversion. SCO will almost certainly publish a press release accusing the free software and open source communities of authoring a virus to attack their business. Several responses will come, as usual. The whole effect will be lots of news coverage, readily viewable to millions of suckers who were duped into executing the attachment, and want nothing more than a target to direct their anger.

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 9:06 UTC (Tue) by MathFox (subscriber, #6104) [Link]

I believe that a SCO DDoS attack is the intention of the one who spread the Mydoom version of Mimail. It could be that he even doesn't know about the backdoor.
One of the reasons I believe that is that I have been hit much harder than usual on the first day of a virus outbreak. And that the virus hits significant on my groklaw.net account (that I don't use for outgoing mail!) I allready deleted over a hundred copies of the worm :(

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 11:57 UTC (Tue) by Ross (subscriber, #4065) [Link]

If anyone that mailed you ran the attachment it would have a good chance
of selecting you as the sender or recipient. The fact you got hit hard
could just be because you have received messages from a lot of people
at that address. I personally received about 20 copies and about the same
number of bogus bounces and not-too-helpful virus warnings yesterday
evening. I haven't counted the number I've received since but it's
enough that I'm having trouble finding my real email.

Just a random anecdotal data point from the real world....

Posted Jan 27, 2004 8:09 UTC (Tue) by mattdm (subscriber, #18) [Link]

*My* early data indicates that it's going to be much smaller than Sobig.F. I've only caught 50 or so of these since last night; the morning after Sobig.F came out, I had ten times that.

Problem Not MS

Posted Jan 27, 2004 9:22 UTC (Tue) by ccyoung (subscriber, #16340) [Link]

Microsoft spokesman said virus spread was not caused by bugs or insecurities in MS. That's a relief!

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 9:41 UTC (Tue) by anamana (subscriber, #2787) [Link]

I would hope that the cause of this isn't some person who thinks that bashing SCO in this manner is a good thing to do.

It only shows (if this were the case) that the person has no clue on the effects of their actions - specifically this results in:

more PR for SCO, makes open source community (and the
person(s) who originated this) look childish

Doesn't solve any problems (or for that matter, significantly impact
SCO's operations - since they are obviously not making money from
products, just litigation)

If anything, I would expect SCO to be happy over such an attack - it gives them something to crow over in the media. If I was a suspicious sort, I might even see shadows showing that they commissioned the worm... but, of course, I don't think SCO is _that_ stupid, since the risk of it being found out and biting them is high.

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 9:57 UTC (Tue) by mattdm (subscriber, #18) [Link]

read the first reply here.

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 14:43 UTC (Tue) by bex (guest, #16960) [Link]

"more PR for SCO, makes open source community (and the
person(s) who originated this) look childish"

The person(s) who originated this probably _are_ childish

However, if SCO let their servers go down due to the impending DDoS attack then I'd hope the media reports on how sloppy their technical staff are. There's no real excuse for them not to handle this since they have prior warning.

"I don't think SCO is _that_ stupid, since the risk of it being found out and biting them is high."

You never know.... :)

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 10:38 UTC (Tue) by AeonTi (guest, #18360) [Link]

Advocates and members of the OSS community need to stop worrying about whether isolated attacks on web sites, corporations or individuals reflects badly on OSS. Anyone who is seriously analyzing the business value or worth of OSS is not going to be influenced by the actions of rogue virus writers who may target professed oponnents of OSS. Objective evaluators of OSS (and these people are whom OSS advocates should be directing their energies toward) are mature and intelligent enough to separate the potential value of OSS from the juvenile behaviour of some of its proponents.

Not in this case

Posted Jan 27, 2004 10:45 UTC (Tue) by proski (subscriber, #104) [Link]

SCO is likely to use this attack for a "dog ate my homework" defence in court.

Not in this case

Posted Jan 27, 2004 11:04 UTC (Tue) by hummassa (subscriber, #307) [Link]

Therefore, THEY are the virus' writers! ;-)

Not in this case

Posted Jan 27, 2004 11:06 UTC (Tue) by stormcoder (guest, #18985) [Link]

I wish this described my company. They are more the, "whichever the wind blows", kind of management.

Not in this case

Posted Jan 27, 2004 12:19 UTC (Tue) by mattdm (subscriber, #18) [Link]

I *hope* they try to pull that. The judge is only going to remain amused for so long.

Not in this case

Posted Jan 28, 2004 7:56 UTC (Wed) by freethinker (guest, #4397) [Link]

Yeah, they may do that. Be interesting to see them trying to explain how a mere DDOS attack could cause them to lose data or prevent them meeting court deadlines.

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 12:29 UTC (Tue) by maceto (guest, #16498) [Link]

Someone have the virus I wanna attac SCO hehe
and MS is soon to be totally wiped from my hd anyway...

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 14:04 UTC (Tue) by pblanco (guest, #16087) [Link]

Well, CNN sure thinks this virus is a direct result of the "Linux War"

http://www.cnn.com/2004/TECH/internet/01/27/mydoom.spread/index.html

This is exactly the kind of stuff you don't want to see in popular press...

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 14:55 UTC (Tue) by ccchips (guest, #3222) [Link]

Maybe this will wake people in the Internet community up to the fact that these people belong in jail? Now this slime is trying to get people to focus attention on *you.*

I've expressed that opinion before. If you know anyone involved in this crap, they belong *in jail.* If you don't, maybe some of Linux's supporters, with large amounts of money behind them, ought to start finding them and getting them prosecuted.

Also, I hope no one has ruled out the possibility that this diversion was created by a provocateur. If there is a "linux war," then there will be provocateurs working on SCO's (Microsoft's) side as well.

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 15:09 UTC (Tue) by pblanco (guest, #16087) [Link]

The really scary part here is that many people will take a report like the one I cited from CNN as gospel. The public in general doesn't care about SCO vs the rest of the world, but if their email from the kids away at school or something is blasted out of the water, they're gonna look for a scapegoat and guess where they're going to look thanks to articles like CNNs. What the community needs is someone with a high profile (and people skills) like Bruce to present 'our' side of this issue on an international forum like CNN. Anybody want to bet on how much airtime CNN would give him?

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 28, 2004 8:15 UTC (Wed) by freethinker (guest, #4397) [Link]

What do you expect from CNN? It started as TV news, after all. Of course they were careful to attribute the idea to anti-virus firms. You'll notice they also called SCO "owner of the UNIX operating system". Novell? Who dat?

One could make the argument that every big virus and worm helps spread OSS, because they highlight the fundamentally insecure nature of Windows and push everyone that much closer to switching. I'm surprised no one has suggested yet that OSS advocates are writing some of them. I suppose MS knows better than to say something like that in public. SCO, on the other hand, has repeatedly demonstrated that they'll say anything in public, no matter how bizarre, illogical or outrageous.

I suppose some worms may have been written by OSS advocates. Note I say "advocates", as opposed to creators or contributors. Some slashdot types people who like OSS may think this sort of direct attack is a good way to help it. If so, I hope they get a clue real soon.

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 14:20 UTC (Tue) by tjc (guest, #137) [Link]

Bruce Peren's take on the situation:

http://perens.com/Articles/SCO/DOS/

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 14:51 UTC (Tue) by ccchips (guest, #3222) [Link]

Not much of a take; I can't get to that page.

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 27, 2004 15:11 UTC (Tue) by proski (subscriber, #104) [Link]

Correct link: http://www.perens.com/Articles/SCO/DOS/

perens.com appears to be down, but www.perens.com is OK.

New virus infects PCs, whacks SCO (ZDNet)

Posted Jan 28, 2004 8:25 UTC (Wed) by freethinker (guest, #4397) [Link]

perens.com has been slashdotted. The slashdot article also points to an eWeek editorial blaming the worm on a "Linux fan". Some Linux fans, especially on slashdot, aren't helping.

Copyright © 2004, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds