Arrest In The ILOVEYOU Case 340
jacobm writes "All the news sources- CNN, ABC News, Security Focus, CNET news, and everyone else on the planet- are reporting that a man in the Phillipines has been arrested in the ILOVEYOU virus case. It appears that the virus had identifying information all over it, which makes me a bit suspicious that this could be a set-up, but on the other hand, you should never attribute to malice what can be explained by stupidity." Update: 05/08 12:50 by J : Because you haven't yet read enough about ILOVEYOU,
read this (Gates opines that breaking up MS will lead to more viruses).
Re:True sign (Score:1)
Oh, are you the guy that does the quake skins? Nice work, if so
Re:True sign (Score:1)
CORRECTION (Score:1)
the sad thing (Score:1)
What about the children? (Score:1)
What is the lesson here? That it's somehow wrong to spread a message of love and understanding throughout the world? A picture may be worth a thousand words, but what about a simple message of love? If all of my images and all of my music got replaced by messages from those who love me and care for me, I think my life would be much better.
In fact, these people did us a favor. They created something that let us know our loved ones that we care for them simply by having them in our address books - we didn't even have to do anything. Shouldn't all love be this simple and easy and straightforward?
But the true reason that I write this is that my eleven-year old daughter saw this story headline over my shoulder as I read it. She asked me if we can really be arrested just for loving people.
What am I supposed to tell her? I used to be able to tell her no, but what now? "No, unless you're in the Philippines?" "No, unless you say it over email?" "No, unless you have an internet connection?" All of these answers are inadequate. The only teaching that this brings to our children is that unconditional love cannot and will not be tolerated by our society. What kind of lesson is that?
Re:Man... (Score:1)
> shutdown time, but it did not *destroy* systems.
True enough, but it did eat up a lot of time containing it. For those of us who are already stupidly busy at work, stuff like this is more than a minor inconvenience. I've lost the best three working days to stopping this bloody worm spreading and trying to make sure our systems are protected against variants.
As a result I have no sympathy for whoever wrote it, regardless of their motivations. If someone smashed a window on your car just to show you how shitty your alarm system was, I doubt you'd want to write them a thank you note.
Re:Legal (Score:1)
Re:Identifying Information... (Score:1)
Re:Either... (Score:1)
After reading this very nice paper [auckland.ac.nz], I would go to even greater lengths to destroy evidence. I would make a quick trip down to the local computer store and buy more RAM a new HD, and maybe a few floppies, then I would completely destroy my current RAM, HD, and any floppies with incriminating evidence on it. And I mean destroy it to the extent that even God himself would have trouble putting it back together. Then I would go to some lengths to make sure my system doesn't look like it has been completely replaced from the inside out in the last couple of days (which it has). If you have 2 or 3 days forewarning, there is no reason why you should have any incriminating evidence left on your system, unless you are dumb enough to write a virus with malicious intent in the first place.
Brilliant Name (Score:1)
Re:Legalize viruses (Score:1)
Stupid Ideas (Score:1)
Washington Post article (Score:1)
They say he was arrested and that his girlfriend is a possible accomplice.
NO . . *pause* . .FREAKING . . *pause* . . WAY !! (Score:1)
Re:Security through obscurity (Score:2)
Wouldn't that void the warranty?
(sorry, couldn't resist)
Re:So do I say.... (Score:2)
2) Food for thought: If you go on CNN and do their little unscientific cyber-poll about ILOVEYOU, something like 50% of the respondents never received it (me, included). I keep on seeing this "43 million users affected" number popping up in news reports. I wonder what the real numbers are...
Hard to say. The company I work for, f'rinstance, someone got the ILOVEYOU message, ran it, and bang, everyone in the global address list (i.e., the entire company) got mailed. The mail server overloaded, it got shut down, and was down until IT had cleaned it out. But all this happened early Friday morning, so most people just got in to work and found email switched off.
So, one way of looking at it is that only a few people here received the virus. Another was is to say that 1000 people did.
Presumably all the large estimates (like the 43 million you mentioned) are based on how many people the virus was sent to, not how many people actually received it.
Re:Legalize viruses (Score:2)
Government policies make the massive propogation of damaging viruses inevitable because they cause under exposure of the immune system. We don't need world wide policy changes, one country with reasonable technological sohphistication would be sufficient.
> It does absolutely nothing to address the real issue: preventing virii like this from affecting so many people in such a drastic way.
No, it does absolutely everything to prevent virii like this from effecting (look it up) people in such a drastic way. Within weeks of some variation of this policy being taken up, the number of exploitable holes left in computer systems would plummit. This way, the holes which are exploited will cause limited damage. It will soon be beyond the reach of lone nutters to cause any damage.
I'm saying that viruses are potentially damaging, and all we've seen so far is a tiny taster of what is to come. If people continue to bury their heads in the sand, we are going to see some real damage, and it won't be some script kiddie wiping out a few files, it will be some well funded fanatical group with an axe to grind indulging in cyber-warefare.
I'm not sure whether payment for fixing is necessary, it's the most secure, but it might be overkill.
But... (Score:2)
How likely is the production of nasty viruses without encouragement ?
computer viruses: inevitable
real viruses: unlikely (for the moment)
How much protection from similar exploits does one gain from an exposed exploit ?
computer viruses: substantial
real viruses: minimal
In the long run, your reductio ad absurdum argument might be less preposterous than you suppose.
Virus protection insurance pays (Score:2)
As for malicious, rm *.mp3 *.jpg is nasty, but
format f:
format e:
format d:
format c:
would be malicious. The author was going for maximum propogation, not maximum damage.
Responsiblity (Score:2)
You own a computer which is connected to a worldwide network. In the wrong hands your computer could cause untold damage. As computers become ever more tightly integrated into the fabric of civilisation, the damage that can be caused grows. If you own a gun and leave it loaded and lying in a playground, you can blame the kid for stealing it and shooting someone, but you're also at fault for not exercising due dilligence. A malicious virus gaining control of as many computers as ILOVEYOU managed could cause more damage than a postal worker. Suppose the virus contained voice software and dialed in hoax messages to emergency services, etc etc.
If the network is to have any chance of robustness, then everybody has to take responsiblity for their part of the network. It's worse than useless to say "virus writing is illegal, so if I catch a virus I'm a victim". Unless we have some relatively harmless mechanism to continually stress test the network, we leave ourselves open to catastrophy.
PS, when I said ILOVEYOU was not malicious, I meant it. The author simply didn't give a damn how much damage he caused. Which is not the same as deliberately causing maximum damge (eg format c: | rm -rf
Legalize viruses (Score:2)
Who's really responsible for ILOVEYOU virus ? Conventional wisdom would blame one of these groups:
1. The virus author
2. Clueless users
3. Microsoft
4. System Administrators
these are all wrong.
1. It takes one person to create a virus, there are 6,000,000,000 people on the planet. A policy of trying to dissuade anyone from writing a virus is unlikely to be successful.
2. You can't really expect everybody to become a computer security expert, they're unaware of the dangers until they've been hit. Also, not all viruses propagate through user stupidity.
3. Microsoft is only partly to blame. Their main crime here is encouraging user ignorance.
4. System Administrators do what they can, but there will always be a trade-off between how much power the user has and how much damage they can cause through carelessness. Also, management won't pay for the extra security unless they know it's necessary, ie holes will only be plugged after they're exploited.
The real culprit is short-sited government policies, where as ever they believe that the best way to make a problem go away is to legislate against it. The stupidity of these policies is driven home by the fact that the more successful law enforcement is at pursuing virus writers, the more dangerous the situation becomes.
Suppose the FBI manages to catch and prosecute almost every 37337 loser who puts together a virus. A strong chance of getting caught will discourage legions of mostly harmless experimenters from trying out new viruses. This will certainly cut down on the number of exploits explored. User carelessness will steadily grow, security measures will become half hearted and forgotten, meanwhile reliance on computer/networked infrastructure will increase, backups will be ignored. However, someone sometime is going to put together a truly effective, malicious virus. Even ILOVEYOU was not deliberately malicious, and furthermore only relied on a single propogation exploit. Without a constant flow of new viruses a dedicated team will be able to exploit multiple unguarded exploits.
The role of the FBI here is that of an overprotective mother who tries to make sure that her precious (corporate America) never gets exposed to any germs. She does everything in her power to keep her baby out of harm's way and pumps it full of anti-biotics as soon it gets the sniffles.
So far, no great harm has come to her child, except for a recent nasty cold. This last outbreak has the FBI desperately searching for the nasty virus writer to seek out and punish him/her (more anti-biotics). The anxious mother wants more resources to keep those nasty bugs away from her baby (corporate America).
Trouble is, this policy has left her child sickly and pitifully devoid of natural defences. When a really nasty bug comes along it's going to hurt. Mummy's heart is in the right place, but her head is lodged deep in her anal cavity. If she had any sense, she would send her kid off to play at Kenny's house, he'll probably complain, but it's for his own good.
If you want your children to grow up healthy and strong they must be exposed to viruses. Instead of clamping down on virus writers, we should reward them. Encourage a legalised virus industry. The user periodically looks at a file called c:/gotcha which would occasionally pop into existence with a message along the lines of:
HI, THIS MACHINE HAS CAUGHT A VIRUS FROM VIRAL INFECTIONS CORPORATION A CURE FOR THIS VIRUS CAN BE PURCHASED FROM WWW.VIRALINFECTIONS.COM AT $2 PER MACHINE, THE ID FOR THIS MACHINE IS 239884623
Purchasing the official fix would repair any damage done by the virus, and also provide an explanation of the exploit used to gain access to the users machine. Viruses that caused data corruption without an available fix would still be illegal.
The scheme needs a little fine-tuning, like a maximum chargeable fix-up fee etc, but something like this is the only workable long term solution. The current approach is leading to a situation where a truly malicious virus will cause serious harm.
It's worth reflecting that the Mellisa author achieved far more in protecting society from harmful computer viruses than the FBI could possibly hope to achieve. So he gets blamed for "billions of dollars" worth of damage, and gets a longer jail sentence than the average rapist. There is no way of directly calculating how much more money would have been lost if ILOVEYOU had arrived on the scene before Mellisa.
Even ILOVEYOU has probably done more good than harm. Suppose ILOVEYOU had deliberately corrupted harddrives at random instead of just mp3/jpg/etc files. Suppose it had done something really nasty. For instance, searched for Quicken files and appended "Transfer-Balance" instructions to the end of your home banking todo list. This was a clever little exploit put together by some German hackers who wanted to demonstrate the dangers of ActiveX, another nutrious primordial soup Microsoft created for viruses. The beauty of this exploit was, you would go through all the security procedures, entering passwords, the bank calling your computer back, etc, and without knowing it you were escorting the rogue instructions past security. There's worse things that can happen than losing a few songs or images.
Paying not to be shot (Score:2)
I would prefer to have the option of paying not be shot, and buying a bullet proof jacket rather than just getting shot. If you had read fully you would see that I proposed a (fairly small) limit be set on maximum chargeable fee. Do you really think that professional teams of terrorist programmers would be deferred by the (minimal) danger of capture ? Is it really wise to leave vast amounts of infrastructure at the mercy of anybody anywhere ?
Why aren't there any lawsuits? (Score:2)
Self moderation (Score:2)
Though, I just had the idea of targetting the virus aginst anybody who doesn't share some particular genetic trait of mine. E.g.: against males or females or younger people or people on a certain diet,... (shiver)
__
the bill gates threat... (Score:2)
but in all seriousness there's a nugget of truth in there. keeping in mind that there *may* have been a backdoor in iis for about four years, and that w2k was released with thousands of bugs (demonstrating that no one person understands the whole rats nest), and that microsoft employees supposedly have a devotion of sorts to their leader... well, what might happen if ms gets broken up?
lets say some programmer there really wanted to work on the "kernel," even though she was slaving away on outlook or office, etc. ms splits and suddenly any hopes she has of going on the nt dev team vanish. she's stuck in the apps company, but she's very familiar with the kernel internals (the minus to closed s/w - black hats having access to it can be much more destructive) so she redirects her rage to the society that robbed her of her chance. "you destoyed microsoft! you've taken away our ability to innovate! you'll get yours now you ungrateful world!"
sounds a bit extreme but ms hires thousands of people, surely there are some that would follow that path. if i had nt servers, i'd be nervous about now - particularly since gates has given folks like that the seed of the idea.
Re:Why Blame the Hacker? (Score:2)
It's insane to allow execution of arbitrary programs by naive users that arrive in your mailbox from unknown places.
I'm sorry, but that's just not realistic.
Please provide a shred of support for that statement.
I really don't see how this is Microsoft's fault at all.
Goodness me. It's Microsoft's fault for leaving a gun on the livingroom table where the kids can play with it. Or, equivalently, leaving the gate to their yard open where there is an empty swimming pool that kids can fall into.
Many, many mail programs allow running of attachments just with a single click...
That is utterly wrong. At best, java programs should be runnable, only in a sandbox. Or similarly restricted quasi-executables. Frankly, I don't see why *anyone* is better off by being able to execute attachments. Save them first, make them executable, then execute them. If that's too much work for you, you write a script yourself to do it. It's wrong for email programs to do this for you - it's an invitation to disaster as we've clearly seen.
it just so happened that this particular worm was written to interact with Outlook through MAPI.
Yes, and it happened that Outlook with MAPI was an ideal thing to interact with because its so brainlessly constructed.
--
This is yet another "need a victim" case (Score:2)
Legal proof may be obtained from the person's machine, though one may argue it has not been hacked as well.
Just the fact that the virus list four different accounts at a phlippines ISP as sources for the additional payload and all of these are different from the account in the comments will make me highly suspicious.
Anyway, we will see. Though I have the gut feeling that someone will be convicted to a very high term on the basis of circumstantial or no evidence. Just another case of a witch hunt...
Hrrrm, A sex change since earlier today? (Score:2)
Or are they just stooges for the real culprit(The german student in Australia mentioned elsewhere)?
Re:Hrrrm, A sex change since earlier today? (Score:2)
Aren't they all? If you're going to write code that's malicious, be the life and soul of the party. They won't suspect you.
Anyway, there's a story at bloomberg [newsnow.co.uk], which states they have both been released.
Has no other news source noticed this, or is the feeding frenzy causing a red mist?
Re:ABCNews "Tips" (Score:2)
Woo-hoo! Step right up, folks! We've got the cure to last week's pandemic!
> Don?t open files sent to you via e-mail from unfamiliar sources.
I'm sure "billions and billions" of people are congratulating themselves right now for doing exactly that last week.
> Check with colleagues and associates before opening files they send you without notification.
To: myboss@my.com
From: byzantine.general@my.com
Subject: That message you just sent.
Hey Boss,
I just got an e-message from you. Is it safe to read? Shouldn't you start sending a notification message first, so we'll know the next message is safe?
\me
> Be aware of how viruses operate, and watch for the telltale signs.
Hmmm. I sure do have a lot of free disk space now that I've read my mail. Maybe I'd better call tech support.
> Don?t download anything from unfamiliar Web sites.
Alas, we'll see an economic downturn if people quit p0rnsh0pping.
--
Re:Caught doing what? (Score:2)
That's really an interesting question.
He wrote a program, and users had the option of whether or not they wanted to run it.
Of course there was deception involved to lure people into running the program, and the deception led people to run it and get unwanted effects.
Of other-course, if we base a decision on that way of looking at it, does that also make it a crime when "legitimate" software makers include a back door, easter egg, or anything else that you didn't know you were buying, if you take them to court and claim that you were decieved into running something you didn't want? (As it stands, I suspect that this would result in lawsuits rather than criminal prosecution. But what is the fundamental difference?)
At any rate, is it even possible to write a law that makes "bad stuff" illegal, without loopholes? Or will we be saddled with the old "I know it when I see it" parody of law?
--
Re:Stupid (Score:2)
========
Re:Caught doing what? (Score:2)
From my ignorant techie point of view, and yes, I'm ignoringa luser psychology here....
This virus was a human-readable vbscript (.vbs), mailed as an attachment. It didn't run on it's own, it required the user to do that. It's not like it hid itself inside another program like virii of old, either.. really, it's a worm, not a virus. Viruses hide within something. This thing just exists on it's own.
So.. if I write a perl script that, when run, mails itself to every email address on the system, then does a rm -rf
He/she didn't ask if the virus could use those resources, but he/she didn't RUN the virus, and ditn' even ASK for it to be run. Of course, he did say 'please read the attached loveletter'.. but gee.. billy.. even the ICON is totally different!
Re:A security hole that big=criminal neglegence? (Score:2)
Which opening is this? The one that let's users manually run a program that was mailed as an attachment? How is that something new?
Re:Funny, Mr. Gates (Score:2)
Re:Why Blame the Hacker? (Score:2)
It still doesn't run aotmatically, even in the preview window. As it was sent, it required a MOUSE CLICK to open the attachment.
I'm not one to yell "Karma Whore", but... (Score:2)
First you make the totally specious comparison between food poisoning and virus spreading. As if I could "accidentally" create a virus by leaving some code on my desk for a while the same way mayonaise can go bad.
Then you try to get the
Moderators: Please moderate based on post content, not name recognition.
CmdrTaco: Maybe there should be an additional restriction on moderators so they can't see the name of the poster.
--
Have Exchange users? Want to run Linux? Can't afford OpenMail?
Re:Legalize viruses (Score:2)
Your argument is poor. You have no link between the government and this virus, yet you blame them for it.
Your proposed "solution" is equally asinine. The notion of commercializing virii (which, by the way, is an idiotic idea, in and of itself) is inherently tangential to the issue of the ILOVEYOU virus. It is phenomenally feasible for the following to occur:
- we elect to put your ridiculous system in place
- policies are changed world-wide to fit your schema
- an entire industry is born centered around the crap you outline in your post (commercialization of virii-creation and fixing, etc.)
- some loser from the Phillipines writes a virus, it spreads, and screws up lots of computers
Wow! That's a great idea you've got there. It does absolutely nothing to address the real issue: preventing virii like this from affecting so many people in such a drastic way.This "virus" talk... (Score:2)
But on the other hand, these thingies seem to spread a bit faster than the good ol' viriis. Big thanks to Microsoft for that.
Re:I'm not one to yell "Karma Whore", but... (Score:2)
As a way to set an example? Crucify the guy to scare away anyone else? What I'm saying, is why the huge expense tracking down one guy? People aren't going to stop writing the viruses, but there is a simpler way to make them less effective.... Maybe nature has an answer...
CmdrTaco: Maybe there should be an additional restriction on moderators so they can't see the name of the poster.
Like him or not Sig11 is usually quite insightful, just post early, often, and on-topic and you too can benefit from massive flames by generating too much karma.
--
Microsoft's Modus Operandi (Score:2)
That relationship would suffer because the Justice Department's proposal for breaking up the company would result in fewer innovations of Windows programs, he said.
The breakup order also would end improvements to the Internet software in Windows and cripple company efforts to develop a write-on tablet that allows notes to be transferred seamlessly to a personal computer, Gates said.
"The benefits of developing operating systems and applications software under the same roof will increase as new intelligent devices emerge over the next few years," he said.
This solidifies something that has been in the back of my mind for a long time. From the eyes of Slashdot, MS and Gates are evil maurauders hell-bent on collecting their taxes and ruining life for all other software developers. But of course, we rarely see things the ways our adversaries do. I think that the above quotes help me understand why Gates and Microsoft behave the way they do. All below is my take on what Microsoft thinks of itself, not what I directly think of the company.
Microsoft is in it, altruistically, for the end user. Sure, they're not completely altruistic--after all, they have to make a profit like the rest of us. However, they are really trying to give something back to the customer, not screw them over.
To Microsoft, the end user is a computer illeterate whose definition of good software is easy software. They don't want to spend a lot of time understanding the alien machine, just using it.
Furthermore, Microsoft believes that the way to simplify is to homogenize the environment. That is, if you have three different vendors with three different software brands on your desktop, you have to learn three times the stuff.
Microsoft needs their monopoly because they have no other way to provide a homogenous user environment. Third party software pollutes the environment, and makes the machine harder to use. Therefore, Microsoft will do anything and everything in its power to prevent such pollution. This is why it works so hard to foil anyone else's attempt to make significant inroads.
This is what they mean by freedom to innovate. If everybody just left them alone, they could make a beautiful user experience without worrying about fighting off things like Java, Netscape, and Linux.
They're in it for the users.
(now my own takes).
This is completely opposite the Slashdot worldview. Each side thinks that the other is inherantly evil because we can't see eye to eye.
I used to think they were inherently evil. I'm not sure anymore, but I do believe that they are horribly wrongheaded.
No wait! I think Bill really does get it! (Score:2)
The front line of defense against such sophisticated viruses is a continually evolving computer-operating system that attracts the efforts of eager software developers, Gates said
Indeed :)
The press, and Microsoft's responsibilty (Score:2)
Microsoft's post-Melissa failure to deal with this particular security fiasco is reprehensible because there's a very simple solution to the problem exploited by the Melissa and ILOVEYOU trojans -- and no, it's not making the programs unscriptable.
Any system which excecutes scripts embedded in documents should require that scripts be cryptographically signed by an authorized party before running them.
Lotus Notes has been doing this for something like nigh on ten years now, even backin the salad days of the '386. This solution is not that different from the IE mechanism for granting trust to downloaded programs -- but now in the context of Office and Exchange, practically all downloaded documents are potentially programs.
Re:A necessary solution (Score:2)
Kid: "Mommy, can I make a web page? Johnny showed me his -- it's really neato! It has all sorts of cool graphics and links and stuff!"
Mom: (flipping through file cabinet) "Oh, I'm sorry hon, you have to take your Internet Usage Authorization Test first! You'll get an Internet Authorization Learner's Permit, good until you turn 18. We'll call the Global Access International Association and ask them to send over the forms. You'll be up on the web in 8-10 years."
Please. If you're so concerned about what happens on the Internet, get yourself some software that blocks all sites except mainstream sources that you deem personally acceptable. After all, what you think is "racist hate" could be satire, research, or something else of value to others.
Besides, one of the principal reasons that the Internet has grown so quickly is that it is free and anonymous (for the most part, at least). People don't need to worry about things that social graces prevent in the real world. When's the last time you went to a store and were able to ask the salesperson for recommendations, features, and comparisons between hundreds of items without him/her getting pissed at you for not buying anything?
Regulating the 'Net always seems like a good idea, until you realize the sheer arrogance that its proponents always have.
That's not the point (Score:2)
Bill is right about "the front line of defence"... (Score:2)
He's quite right, of course. One of the worst things that can happen, from a virus writer's point of view, is a mass migration from DOS-based Win9X and Macro-happy Outlook to a platform with permissions which isn't controlled by a monopoly vendor who wants to force Outlook on everyone. Of course, I dunno if he had that OS in mind ...
Re:Probably the wrong person (Score:2)
Re:Excellent point (Score:2)
Now, a few big caveats: Technically, Outlook does run random code, but only random VBScript/JScript. VBScript and JScript are both designed with security in mind. The ILOVEYOU trojan could not have run as an embedded script in an email message. Do you browse the web with Javascript turned on? If so, your browser is "executing random code" too.
Caveat two: Yes, Outlook has had a few notorious bugs [microsoft.com] in its scripting security. A lot of programs have security bugs, even UN*X programs. Does Outlook have too many? Maybe, or maybe they're just more obvious, because more people use Outlook. Is Outlook more susceptible to bugs, because it tries to do too much? Quite possibly. But if that bothers you, just set your email security zone to "restricted" (which disables scripts in email, among other things.)
Caveat three: Win9x doesn't have any intra-system security, so any malicious code can do more damage on a Win9x machine than it could on a UN*X machine. But Win9x isn't supposed to have that sort of protection. If you need it, you can always run Windows 2000 (which, like UN*X systems, would not allow one user's carelessness to affect anyone else.)
But, again, none of these caveats has any bearing on ILOVEYOU, which would work just as well on any mail program that can handle attachments.
Re:Excellent point (Score:2)
Excellent point (Score:2)
You've got it right... there is a reason why attacks like these happen to Windows and not other OSs, but it's not security holes, it's just population. Linux viruses don't spread, because Linux machines are far less likely to communicate with other Linux machines than Windows machines are.
I hope you realize, though, that "inbreeding" of code is a much more difficult problem to solve than a simple security hole. In fact, multiple platforms might just cause more problems than they solve; I think it would be more effective to spend time educating users, and the media, and politicians, (and, hell, most Slashdot readers,) so they don't allow incidents like this to happen in the future.
Re:Excellent point (Score:2)
A lot of people are complaining that Outlook just makes it too easy to launch executable attachments. It may be true that ILOVEYOU wouldn't have spread as much if users had to save the attachment to a file, then run it from the shell... but isn't it better to handle it directly? That would be kind of like requiring an obscure key combination to close a document without saving it. Instead of making it hard for users to do something that might be bad, why not make it easy, but explicitly warn them of the danger?
When you get down to it, it's still a matter of education. We wouldn't have this problem if users knew the difference between code and data, and what it means to execute code. But then, a lot of folks have an interest in obscuring this sort of thing. (I.e. computer security companies.)
The RELEVANT questions: (Score:2)
(2) Did he send the virus to a US site or release it locally where it eventually spread worldwide and to the US (i.e., he himself did not attack a US computer directly).
(3) Why extradite? If this is deemed necessary, then so too must it be necessary to extradite hundreds of thousands of US based web site operators for transmitting porn to places in the world where it's highly illegal like Saudi Arabia. A double standard here?
The media remains silent on these issues.
Re:witch hunt (Score:2)
Not only that, but everyone wants to feel safe. Like justice has been done. This is a prime example of the main theme of Arlington Road (if you haven't seen it, do.)
The film deals with the idea of a scapegoat being convicted for a crime that involved the arrested, but the conspirators were never found or caught.
Same thing here. People love to feel all good and like 'justice has been done'. People feel safe now that this person has been arrested. What's to say if they really did it? or more likely if they were the only person involved. Personally, I'm not going to bet 100% that this is the actual person who created it or distributed it. Even if they produce some kind of proof, what's to say that it's not just that, produced?
Remember the DDoS attacks of February? They arrested some kid in Montreal. Now everyone feels all safe because the 'bad guy' is in jail. Same thing.
It's hard to decide what to trust nowadays.
Re:Opportunistic lies from Bill Gates (Score:2)
I can't wait until Microsoft is broken into tiny little pieces. Only problem is that Gates is still going to come out of this a billionaire, unless the private antitrust litigants tear him apart. Which might happen.
Re:Legalize viruses (Score:2)
Skipping his talk of commercializing virus creation, there's merit to the idea of de-criminalizing digital "crimes" - cracking, virus writing, etc.
1. It saves law enforcement money
2. It forces systems to be well designed to resist this activity
3. The damage done by this activity is not life-threatening (and if you're going to argue that it could be, like for air-traffic controller software or military software, then go check out #2 again and think about it).
Someone else parodied his idea based on real viruses, but if you think about it, you can't legislate away real viruses. What good does it do to arrest, convict, and (gasp!) put to death the virus that killed you? None. We instead want bio-technology to come up with defenses for our bodies against viruses. The fact that people are the creators of the virus is no reason to forget this.
You can't legislate morality. Nor solutions to problems. In the end, action is required. Find the most efficient action to take - who really thinks the best counter to viruses is sending the FBI to investigate all the time? Why not make security a blatantly visible part of our computer/network design. Seems to me we'll just wind up with a better system and better users.
If writing the ILOVEYOU virus were legal, do you think Microsoft would get away with enabling Outlook to do this? As it is, they have a convenient scapegoat - "it's not us, it's a criminal!" Take away the criminal, and what do you have? Criminally negligent software from Microsoft. No one would tolerate it, no matter how big Microsoft got.
Computers are unreliable. What else is new? (Score:2)
The difference between ten years ago and now is that these junky and unreliable systems are now ubiquitious in business and are connected to the internet; back then, there were commonly standalone database and word processing PCs. None of these systems were designed for the kind of use they're now getting. An insurance agency runs out and gets ten machines from Best Buy, gets internet access through AOL or a local ISP, and uses the freebie versions of Outlook, Word, and Excel that came with those machines.
This is a terrible situation. Machines that crash frequently and are difficult to configure have become commonplace and are being used for important work. The virus issue aside, look at some of the issues that have to be dealt with:
Most consumer level machines don't come with Zip drives or any way of making backups, other than 1.44M floppies. Yet these same machines come with 8 gigabyte hard drives. Even a Zip disk isn't going to make a dent in that. Linux is not any better than Windows in this regard.
When you get in a hole and have to reinstall Windows, you lose the registry. This means you have to reinstall every piece of software over again, even though it may already be on your hard drive and perfectly usable otherwise.
Shared libraries and DLLs are complete hell to maintain. Install a new program and watch one or some of your old ones stop working. Don't be smug; Gnome and KDE are just as bad as Windows in this regard.
Virii are just another kink in the system, maybe no worse than any of the above. If a hard drive crashed today on 95% of the computers in existence today, the information on it would be irretreivably lost. Heck, at every company I've worked at the usual followup to such a disaster is "The backup seems to be corrupted," and then "The safety backup is bad too." Would losing your system to a virus be any worse?
Re:Stupid Ideas (Score:2)
1) Everyone continuing to use Outlook
2) Someone wondering why I don't just write my own CORBA ORB
Not Exactly (Score:2)
I think your interpretation is accurate given what is in the article, however, the article doesn't provide all the information.
What Sky Internet was (presumably unknowingly) distributing was copies of the file WIN-BUGFIX.EXE which the ILOVEYOU trojan downloaded to users harddrives AFTER they had run the ILOVEYOU
Once Sky Internet was aware someone was using their site to distribute this second piece of software, they yanked the accounts used to host the file.
I don't think Sky Internet wouldn't have had any access to the original trojan (other than anyone else that has received a copy) and wouldn't have edited it out part of it but then forwarded the rest.
Reminds me of UCITA (Score:2)
Re:Hrrrm, A sex change since earlier today? (Score:2)
With that excuse, you could claim *any* crime should go unpunished, as theft, rape and murder all show how weak the security and protection is.
It would be much, much better if societity didn't have to spend billions of dollars to protect itself from idiots. We could have gone to Mars by now for that money.
-- Abigail
Re:Opportunistic lies from Bill Gates (Score:2)
umm, that's not what was happening. people are double-clicking the attachments. yeah, it would be nice if the e-mail program had a good way to distingish among "harmless text", "mostly harmless text" (might force a ctrl-alt-del at most), "executable script", and "binary executable".
(striking the above-quoted part of your sentence wouldn't kill your main point, though, which is really good: but now Gates is using his own shitty programming as an excuse to keep the company together)
--
Re:Opportunistic lies from Bill Gates (Score:2)
Summary:
innovative/innovation: used 4 times
protect the children: used once
janet reno is a nazi: zero
So I guess this debate isn't over yet...
numb
software packages with compatible formats (Score:2)
Say for an example you have 3 different Word Processors with the same file format. You've just trippled your training budget for Word processors. Your tech support staff now has to support 3 times as many products. You're also 3 times as likely to run into a bug that keeps you from setting up standard templates you're trying to develop, and now the people working on them need to know 3 different word processors and spend time testing on all of them to make sure it all works.
It doesn't take too long until managment and support figure out that this is just too costly. A virus can take them down for several days each quarter, and they're still better off. So they standardize on one of the word processors for their company. Other companies may standardize on a different word processor, but then you have to train people when you hire them from other companies. Soon enough a clear leader shows up, and you have a monopoly in the word processor world.
This is assuming they all have the same features. If one has better features (including stability) than the others, then it may win out sooner.
Diversity is a pretty costly solution to the problem. You always have to balance security against other benifits. The problem is that for a lot of companies, a system with poor security suits their needs pretty well. Managers can always hope that a virus won't take them down at a really bad time, but even if it does it may be less costly than some of the solutions.
Re:software packages with compatible formats (Score:2)
---
He's talking about open source (Score:2)
coninually evolving?
Open source software is released early and released often. Not to mention it's free!
attracting eager software developers?
Since MSs stock price has gone down like a white house intern, open source it atracing more venture capitol and eager software developers.
___
a super summation (Score:2)
ABCNews "Tips" (Score:2)
- Use anti-virus software, and be sure to regularly update the software from the vendor's Web site.
- Don't open files sent to you via e-mail from unfamiliar sources. Check with colleagues and associates before opening files they send you without notification.
- Be aware of how viruses operate, and watch for the telltale signs.
- Don't download anything from unfamiliar Web sites.
Can't someone add the obvious:Don't give web pages and e-mail control over your computer!
Nobody gives Joe User good instructions how to shut off scripting in LookOut and Internet Exploiter. All media focus on how much damage has been done without really telling how to protect oneself. C'mon journalists. Simply tell your readers what to shut off!
witch hunt (Score:2)
So focus on the virus maker (or a scapegoat) instead of the (l)users who really mostly have themselves to blame.
This loveletter had "VIRUS" written all over it. Nevertheless people who *knew* what a VBscript can do fell for it. I'm not surprised that they want to nail someone.
Re:Excellent point (Score:2)
Check again. Jscript and VBScript can create FileSystemObject, Javascript cannot.
(Course you get a warning, but people tend to klick "OK whatever")
Wrong GIRL under suspicion/arrested?? (Score:2)
Do they have the wrong person under suspicion/arrested?
The hacker is the one that broke the law. (Score:2)
Now, the contractor may get sued. The people who got broken into may have learned a lesson about taking charge of their own security. But none of this reduces the legal repercussions on the person who actually went out and broke the law.
Thats the way it is in the real world. You leave your car unlocked, you may have trouble with the insurance company if it gets stolen, but the car thief doesn't get any lighter charges. A pickpocket isn't committing less of a crime if your wallet is in your back or front pocket, even if one makes it easier on him. And a person who writes and distributes a virus to cause damage to people's systems isn't going to get any less blame because it was an "easy" system to damage. That doesn't mean that the makers of the system have no responsibility to those financially injured, but it has no bearing on how activly the virus creator should be prosecuted.
-Kahuna Burger
Re:Why Blame the Hacker? (Score:2)
So you'd want to stop all executable attachments then, I'm assuming? I'm sorry, but that's just not realistic. I really don't see how this is Microsoft's fault at all. Many, many mail programs allow running of attachments just with a single click...it just so happened that this particular worm was written to interact with Outlook through MAPI.
Re:Why Blame the Hacker? (Score:2)
Well, not being a naive user myself, I quite like the ability to run attachments with one (or two) clicks. So you're telling me that for the good of the less-experienced user I should have to go to extra trouble to do something? Maybe what we need is Outlook For Idiots, or something like that. But don't touch my mail program. There's just no need to.
Goodness me. It's Microsoft's fault for leaving a gun on the livingroom table where the kids can play with it. Or, equivalently, leaving the gate to their yard open where there is an empty swimming pool that kids can fall into.
Please provide a shred of support for that statement. Microsoft is not alone in letting users execute attachments. There's no way you can possibly blame Microsoft for this looking at it from a standpoint of the executablity of attachments.. they're far from alone in providing this feature.
I said: Many, many mail programs allow running of attachments just with a single click...
You said: That is utterly wrong. At best, java programs should be runnable, only in a sandbox. Or similarly restricted quasi-executables. Frankly, I don't see why *anyone* is better off by being able to execute attachments. Save them first, make them executable, then execute them. If that's too much work for you, you write a script yourself to do it. It's wrong for email programs to do this for you - it's an invitation to disaster as we've clearly seen.
Sorry, but it's not utterly wrong. Pegasus, Eudora, and many others provide the feature. You don't see why anyone's better off by being able to execute attachments? Are you kidding? I don't even think that's worth a response.
fix (Score:2)
a couple quick notes, first Microsoft is releasing a patch to all it's customers called "IHATEYOU" as the subject like, and the anti-virii fix is called "Microsoft_hates_all_it's_users.vbs", double click to install the fix.
Second, this is what will be an everyday thing if Microsoft relases more information on it's API. This is a total lack of security on Microsofts part, they never should have relased any documenation on visual basic.
Re:Man... (Score:2)
Now if only . . . (Score:2)
"By Double-clicking on this attachment you are taking full responsibility for the consequences of this program . . . Not valid in Idaho . . ."
This has been a test of the Slashdot Broadcast Network . . .
So do I say.... (Score:2)
Some thoughts...
1)Are the authorities going to investigate the folks who are so happily presenting new and improved permutations of the virus? (I especially liked the resume variation).
2) Food for thought: If you go on CNN and do their little unscientific cyber-poll about ILOVEYOU, something like 50% of the respondents never received it (me, included). I keep on seeing this "43 million users affected" number popping up in news reports. I wonder what the real numbers are...
3)Also, I am seeing signs that there is going to be a push for world wide cyberpolice (after this little incident). I happened to read this weekend somewhere that Canadian authorities are looking into creating some sort of world wide law enforcement cyber bureau. Interesting...
Re:Opportunistic lies from Bill Gates (Score:2)
Here is the Actual Time Article by Gates
http://www.time.com /time/magazine/articles/0,3266,44557,00.html [time.com]
It's in Time [time.com] But it belongs on Segfault [segfault.org]
Re:Opportunistic lies from Bill Gates (Score:3)
I believe the only true solution to Microsoft's abusive monopoly is to have at least three independent companies each offering their own compatible version of Windows. Each company could choose its own priorities -- adding features, fixing bugs, improving security -- and the market would decide which version of Windows suited its needs best, instead of the current arrangement where the market is forced to accept whatever Microsoft chooses to release. Have a look at some of the Windows 2000 features listed at "http:/ /www.microsoft.com/windows2000/guide/professional/ features/default.asp [microsoft.com]"; wouldn't you readily give up some of those new features in return for not having to worry about the next macro virus trashing your company's computers again?
Skeptics claim this would overly complicate the market, but I don't think it would confuse matters any more than having so many different versions of Windows already out there. They also say that this would result in many incompatible versions of Windows running around, but to that I say that any company releasing a version of Windows with compatibility problems would suffer in the market, so they have an incentive to strive for simplicity and compatibility... and, besides, how many compatibility issues are there between Windows 95/98/NT/2000 already?
Meanwhile, Microsoft is making noise about trying to appease the government by offering a version of Windows which merely 'hides' browser access, thereby demonstrating that they have no interest in legally recognizing their illegal tie of two products. They've shown that they have no qualms about breaking the law as long as they can defer or escape punishment [slashdot.org] (by tying it up in drawn-out courtroom cases); it should be obvious by now that any further legal restrictions on the company would be pointless, and that any 'solution' which results in a single company still being responsible for the operating system isn't a solution at all.
Legalize _real_ viruses (Score:3)
Who's really responsible for genetically-engineered virus? Conventional wisdom would blame one of these groups:
1. The virus author
2. Clueless victims
3. Microsoft
4. Public health systems
[...]
these are all wrong.
1. It takes one mad scientist to create a virus, there are 6,000,000,000 people on the planet. A policy of trying to dissuade anyone from engineering a virus is unlikely to be successful.
2. You can't really expect everybody to become a medical expert, they're unaware of the dangers until they've been hit. Also, not all viruses propagate through people stupidity.
3. Microsoft is only partly to blame. Their main crime here is encouraging user ignorance (you get your medical information form Encarta?).
4. Public health systems do what they can, but there will always be a trade-off between how much power the patient has and how much damage they can cause through carelessness. Also, goverments won't pay for the extra care unless they know it's necessary, ie illnesses will only be cured after they're extended.
[...]
Suppose the FBI manages to catch and prosecute almost every mad scientist who puts together a virus. A strong chance of getting caught will discourage legions of mostly harmless experimenters from trying out new viruses. This will certainly cut down on the number of weaknesses explored. Patient carelessness will steadily grow, security measures will become half hearted and forgotten, meanwhile reliance on body health will increase, healthy habits will be ignored. However, someone sometime is going to put together a truly effective, malicious virus. Even AIDS was not deliberately malicious, and furthermore only relied on a single propogation exploit. Without a constant flow of new viruses a dedicated team will be able to exploit multiple unguarded vulnerabilities.
[...]
Trouble is, this policy has left her child sickly and pitifully devoid of natural defences.
[...]
If you want your children to grow up healthy and strong they must be exposed to viruses. Instead of clamping down on virus developers, we should reward them. Encourage a legalised virus industry. Everybody periodically gets injected which would occasionally pop into existence with symptoms along the lines of:
HI, YOUR LEFT KIDNEY HAS CAUGHT A VIRUS FROM VIRAL INFECTIONS CORPORATION A CURE FOR THIS VIRUS CAN BE PURCHASED FROM WWW.VIRALINFECTIONS.COM AT $2 PER PERSON, YOUR ID FOR THIS MACHINE IS 239884623. THANK YOU FOR GETTING CAUGHT. WE'RE OUT TO HELP YOU (tm)
[...]
It's worth reflecting that the AIDS virus achieved far more in protecting society from careless sex, junkies and Third World people than the FBI could possibly hope to achieve. So a would-be author gets blamed for "billions of dollars" worth of damage, and gets a longer jail sentence than the average rapist. There is no way of directly calculating how much more money would have been lost if AIDS had arrived on the scene before smallpox.
[...]
Isn't cut 'n' paste great?
__
Bill Gates endorses Linux! (Score:3)
OK, so he didn't endorse it BY NAME...;-)
Security through obscurity (Score:3)
If I were inclined to destroy the information on a HD, I'd (1) remove the HD, (2) drive several nails through it, (3) drop it in the nearest reasonably deep body of water, and (4) install a new HD. This process can be performed in fifteen minutes or less, not counting travel time, and works with any version of PGPwipe.
Caught doing what? (Score:3)
What crime did the virus author commit? How does this crime differ from companies placing hidden functions within their software (ie, spy-ware and delete-the-competition's-dll-ware)?
What I'm getting at here is that any prosecution of this fellow would require dragging Steve Case and Bill Gates into court also.
Microsoft's Modus Operandi (Score:3)
That relationship would suffer because the Justice Department's proposal for breaking up the company would result in fewer innovations of Windows programs, he said.
The breakup order also would end improvements to the Internet software in Windows and cripple company efforts to develop a write-on tablet that allows notes to be transferred seamlessly to a personal computer, Gates said.
"The benefits of developing operating systems and applications software under the same roof will increase as new intelligent devices emerge over the next few years," he said.
Having read that, I understand Microsoft a lot more. It is hard for a company to consistently spout the same lies and ignore reality as consistently as they have--unless they don't think they're lying.
Microsoft doesn't see themselves as megalomaniacs trying to take over the world. They are here to help us.
Microsoft believes that the single worst thing in software today is chaos and incompatibility. They are trying their best to save us from it, and these damned Government nincompoops are getting in the way!
My honest belief is that Microsoft truly believes that the way to provide the best user experience is for one company to provide a unified suite of products, untainted by those of other vendors. They, of course, are in the position to do just that, providing that the government get off their backs and pesky competitors such as Linux, Netscape, and Java stop polluting the computing environment.
They believe the Devo quote: "Freedom of choice is what you've got. Freedom from choice is what you want."
To Microsoft, this isn't about billions of dollars. This isn't about market share, though market share is the best measure of how they are doing. This is completely altruistic, and is about giving the end user the best possible computing experience.
This sounds patently ludicrous to the open source/free software crowd that hangs around Slashdot. Here, the general belief is that open standards is all you need, and that competing implementations of these standards will provide better software. Unity of software is less important than technical excellence among Slashdotters.
The above may explain Microsoft's near-religious bullheadedness, and why Bill simply can't understand why so many people think that he is the Antichrist. We're starting from absolutely different base assumptions, and have completely different goals, and we both think that we are doing what is best for computing as a whole.
Personally, I think that he is reaching for quite laudable goals with entirely the wrong tools.
Death penalty for virus writers? (Score:3)
As for what the Philippines will do with the guy, I'd hate to be in his shoes. Remember, the Philippines is the country that is most expanding its use of the death penalty (whereas most countries are banning it or continuing to enforce it for certain established crimes like murder). Legislators in the Philippines have recently called for the death penalty for negligent ferry operators (in response to the recent ferry disastors there). Perhaps we'll soon see calls for the death penalty for billion-dollar-in-losses virus writers?
Back when the Philippines were a US colony, they were bound by the equivalent of the US's constitution, including the right against cruel and unusual punishments. My understanding is that the modern Philippines have moved away from such standards. It's sad, really.
Re:Opportunistic lies from Bill Gates (Score:3)
This is super funny, you _could_ think it was posted on The Union...
Thimo
--
Bullshit Fear-Mongering by Gates (Score:3)
"Such as virus writers":
Bullshit:
Sounds like another attempt to ship an intentionally crippled and broken product for the sole purpose of then saying, "see, we told you so": Bust them up! Any company so fat and arrogant that they feel safe making threats at their customers, the economy and the justice system needs to be spanked and put in the corner
Honk if you hate Microsoft
Paying the firing squad to shoot you ? (Score:3)
Umm so lets get this straight. I write a malicious virus that encrypts every file on the system so you can't access them without knowing the key. I distribute this around the world and 1,000,000 people use it. I then charge them $1000 dollars a time (hey I'm allowing the fix out and I can name my price as they're buggered if they don't) to send them the patch.
This has to be just about the 3rd stupidest idea I've heard so far this month.
There is a name for the above mentioned "legalised virus industry" its called "blackmail" or "extortion".
People who write this stuff deserve to be forced to pay the associated costs of the damage they cause, and if they can't they should be declare bankrupt and sent to prison. There is NO noble side to virus writing.
TBTF has simple Registry fix to disable VBscript (Score:3)
By saving the fix to a
Either... (Score:3)
Either this is a setup, either the government needing a scaprgoat, or the real author misdirecting the authorities...
... or this guy is the king of all idiots and desperately deserves to be caught and removed from the gene pool.
Okay, for starters, it's worth repeating that the security experts who traced the melissia virus think the REAL author is some German kid living in Australia.
But, if this Phillipine guy *IS* the author of the "Love Bug", he is desprately in need of a good bludgeoning.
Think about it for a sec. The media (CNN, AP, and Fox at least) was reporting ALL WEEKEND that "authorities" suspected him, but they could NOT get a search or arrest warrant because the courts were closed over the weekend.
Now, if *I* had done the "love bug", and *I* had a whole weekend of warning that the cops were coming on monday, I would have spent most of the weekend shredding and burning any hard copy of the virus code; and, more importantly, PGPwipeing every related file AND free space on my hard drive. Then I'd move my swap file to a new partition and PGPwipe the old swap partition. Then, for good measure, I'd prolly pull out the HD and give it a good round with a bulk eraser or speaker magnent.
Reformat, reinstall, and restore. No evidence, no worries.
With two days warning, if he left enough evidence that they really DID arrest him today, he's too dumb to breed anyway, and deserves to be caught.
All of which assumes, of course, that the cops are right, and the computer guys who trackes Melessia are wrong; which is, amittedly, a rathar dubious assumption at best, but WTF.
john
Weird imagery (Score:3)
The suspect was tracked down by locating the phone line that may have been used to inject the virus into the Internet.
Am I the only one that gets a mental image of a lurking figure with a big syringe sticking a needle into a router in the middle of the night?
Question: If Irene has confessed to writing the Virus why is her husband being arrested as well?
Quite a plan (Score:3)
Great... (Score:3)
Stupid (Score:4)
Would this include using Exchange and Outlook as your corporate electronic mail standard?
Re:Stupid (Score:4)
> Would this include using Exchange and Outlook as your corporate electronic mail standard?
I heard some TV news this morning describe it as "a wakeup call". Forgot Melissa already, eh? How many wakeup calls does it take?
\methinks wakeup calls now come with a snooze control.
--
Re:Why Blame the Hacker? (Score:5)
This was not due to any bug. It was straight, clean vbscript (analogous to mailing a perl script)
It did not execute automatically, unless users had their machines configured very strangely.
I could mail you a perl script as attachemnt that did the exact same thing. The only reason it wouldn't work is because you would be smart enough not to run it.
So. Blame the stupid users who, even though it's repeated over and over again, execute email attachments without thinking about it first.
Opportunistic lies from Bill Gates (Score:5)
Re:Opportunistic lies from Bill Gates (Score:5)
"Arrested?" (Score:5)
is there a real distinction between being detained and being arrested in the Philippines? i know there's a huge one here in the US, but i imagine the area might be a little grayer elsewhere. . .can anyone enlighten?
Does the world really need any more proof?? (Score:5)
BUT I do know that this whole saga has proved a point that I've been shouting about for ages:
The computer world can be compared to the natural world. You need a good gene pool. If all of us had the same genetic make-up, we would get wiped out by the first new disease to come along. So why does the entire world insist on using the same software?
If everyone and his dog is using MS Windows and Outlook, then of course if a virus comes along which hits that combination, everyone and his dog will be affected.
The world is not a safe place if everyone uses the same thing. It doesn't matter if it's an MS app, or an open-source server, you have to have healthy competition. Diversity is the only way we can protect ourselves.
Usually, when I start off like this, people say "Oh, but I need to be compatible".
I say: "You don't need to run the same software to be compatible - just use compatible file formats".
Sorry if my ranting is straying off-topic; I needed to say it.