full-disclosure - MyDoom download info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Paul Schmehl)
Subject: MyDoom download info 

--On Saturday, January 31, 2004 12:25 PM -0500 Valdis.Kletnieks@...edu 
wrote:

> On Sat, 31 Jan 2004 12:03:37 +1300, Steve Wray
> <steve.wray@...adise.net.nz>  said:
>
> What worries me is we haven't seen *either* an actual damaging virus
> (imagine if the last 2 lines of Mydoom were "sleep(4hours); exec("format
> c:);") or a "sleeper" virus.

This doesn't worry me much at all.  Since virus writing has been taken over 
by the scammers, spammers, criminals and thieves, the last thing they want 
to do is destroy their bots.  Their purpose isn't to infect and harm, it's 
to infect and use for their nefarious purposes - like the recent extortion 
attempts on online gambling sites (threatening to shut them down through 
DDoS during the Super Bowl thereby depriving them of large amounts of 
revenue.)

The irony is the vxers got replaced by the professional criminals.  Now the 
concern is not getting infected, it's making sure the computer is really 
and truly clean.  It would be nice if the malware *did* use exec(format 
C:).  It would save networks a lot of time cleaning up and identify the 
infected machines quickly. :-)

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu