full-disclosure - MyDoom.b samples taken down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <401D116B.10198.10722251@localhost>
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: MyDoom.b samples taken down

Kurt Weiske <kweiske@...aan.org> wrote:

> Daniel and Mike, thanks for making those files available for those of us 
> who wish to research this virus firsthand, instead of relying on 
> (sometimes) wildly innacurate media and "expert" reporting.
> 
> Shame on McAfee for succeeding in intimidating a fellow researcher - I 

It seems that "intimidation" may have been too strong a word -- see  
Daniel's latest post -- but whatever...

> guess that's what happens when viruses become Big Business; use whatever 
> FUD is available to limit your competitio, increase market share and 
> maximize shareholder value. Foo.

No -- that's what happens when you actually have half a clue about the 
huge _further_ damage such things can do if actually successfully 
distributed.  Mydoom.B has largely _not_ taken off, but all it probably 
needs is a touch of the usual "luck" which is all that distinguishes 
most successful mass-mailers from the huge numbers of unsuccessful ones 
lamers, like those on this list clamouring to get a Mydoom.B sample, 
never see.

I know most of you will not believe this because you so stupid you 
already believe that live virus samples are _just_ information and 
therefore _should_ be subject to "full disclosure" (this is a special 
form of ignorance that very little empirical evidence seems able to 
budge -- at least until a holder of the ignorance is the person bitten 
by it), _but_ each extra copy of Mydoom.B downloaded from the various 
URLs published on this list increases the likelihood that the virus 
writer will have his "glory" with the Mydoom.B variant as well.  The 
cost of that far outweighs the value of the jollies a few of you will 
get from working out how to unpack the "hacked" UPX compression  used, 
poking a few clever comments into your disasm, or mastering ROT13 to 
"decrypt" the virus' internal strings.  In the process, some of you 
will run it in a VM connected via virtual network to the real Internet 
(because you are so stupid you believe that "because you run Linux you 
are safe" or you forgot you enabled bridged networking for some 
"special reason" and never got round to disabling it) and more copies 
of it will "escape" (we see this often).  And you want to subject the 
world to that threat because you want to spend hours and hours doing 
what has been done "well enough" in multiple professional security 
company labs for them to ship detection and repair utilities within 
minutes to an hour or two of first receiving a sample of it several 
days ago.  Get real...

Try handling dozens of these a day and then see what you feel about the 
quality of the work of those labs and that 'wildly innacurate [...] 
"expert" reporting'....

And save me the almost inevitable full-disclosure mantra BS replies!  I 
really do not want to hear your ignorance rephrased that way, again -- 
at least walk the walk before you try to talk the talk...

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854