Slashdot Log In
SCO Offers $250K Bounty for MyDoom Author's Arrest
Posted by
timothy
on Tue Jan 27, 2004 08:23 PM
from the make-it-snappy-now dept.
from the make-it-snappy-now dept.
Performer Guy writes "This SCO press release indicates that they are offering a $250,000 reward for information leading to the arrest & conviction of the MyDoom DDoS worm authors. Let's hope they catch them. Not merely because MyDoom is one of the most mindless attacks on our internet infrastructure in memory, but also when they pay up it'll be less cash for SCO's litigation engine."
Thanks to Tin Foil Hat and prostoalex for pointing out links at ComputerWorld and CNET, too. Related to this: stealth.c writes "Bruce Perens has written a letter to the Open Source community, discouraging us from cheering on the MyDOOM virus, as it would falsely implicate the FOSS communities and almost certainly cause the success of the virus writer's mission of discrediting these movements. This letter is also posted on NewsForge and on Groklaw." Unfortunately, with columns like this one blaming the worm on "some ticked-off Linux fan", it needs to be said.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Hey, d00d! (Score:5, Funny)
Re:Hey, d00d! (Score:5, Funny)
Parent
Re:Hey, d00d! (Score:5, Funny)
Parent
Re:Hey, d00d! (Score:5, Funny)
Parent
I know this is meant to be funny but. (Score:5, Insightful)
Plus, also the likelyhood that whoever did this will be publicly revered and hated (not liked) by the Open Source community, and blacklisted from getting a programming job anywhere else in the world, most likely for life?
Also, there's the chance of being treated like Mitnick, and charged as a "terrorist." All for the sum of just under $32,000 a year.
No thanks. If I were the worm writer, I'd hope to God that the virus can't be traced back to me. Either that, or I'd move to Iran or North Korea.
Parent
Re:I know this is meant to be funny but. (Score:5, Informative)
Parent
Re:I know this is meant to be funny but. (Score:5, Funny)
Pretty much a love/hate relationship...
Parent
Re:I know this is meant to be funny but. (Score:5, Funny)
1. Release virus to DDoS SCO
2. Go to federal pound-me-in-the-ass prison
3. ???
4. Profit!
Parent
Re:Hey, d00d! (Score:5, Funny)
Parent
www.linuxstolescocode.com (Score:5, Funny)
Parent
Copyright. (Score:5, Funny)
It's that SCO thinks that MyDoom's source code is owned by them. :)
Re:Copyright. (Score:5, Funny)
Parent
Re:Copyright. (Score:5, Funny)
Obviously, SCO wrote MyDoom. Part of the payload is several lines of unix code copyrighted by SCO. Notice how the worm is reporting back to SCO? That's not a DDOS; that's the worm reporting the IP addresses of everybody who now owes SCO $699 for copyright infrigement.
Parent
Trying to throw us off the trail, huh? (Score:5, Interesting)
Re:Trying to throw us off the trail, huh? (Score:5, Interesting)
Bruce
Parent
Re:DDOS is SCO submission to the court of public o (Score:5, Funny)
Parent
Re:Trying to throw us off the trail, huh? (Score:5, Insightful)
Parent
cash money (Score:5, Funny)
How did they get that kind of money?
Oh right...
$699 at a time : (
--
In London? Need a Physics Tutor? [colingregorypalmer.net]
American Weblog in London [colingregorypalmer.net]
Fine Print: (Score:5, Funny)
Re:Fine Print: (Score:5, Interesting)
All this is is a nice PR move by SCO so they look like heros trying to stamp out malicious hackers.
Parent
The plan (Score:5, Interesting)
Someone needs to do the following:
1. Turn the culprit in.
2. Collect SCO's reward.
3. Give the money to the OSDL SCO defense fund.
Re:The plan (Score:5, Insightful)
Parent
I'd do the opposite (Score:5, Funny)
Parent
Re:The plan (Score:5, Funny)
2. Collect SCO's reward.
3. Give the money to the OSDL SCO defense fund.
WHAT?!
Lemme tell you something. I'd get a bigass Winnebago and I'd get "SCO SUCKS" airbrushed onto the sides of it. I'd then proceed to camp out across the street from SCO headquarters.
LK
Parent
And the sum will be paid out as... (Score:5, Funny)
The message from Bruce Perens (Score:5, Informative)
Message to the Linux and Free Software Community Regarding the SCO Denial-of-Service Virus
Bruce Perens <bruce@perens.com> (U.S.) 510-526-1165
Version 2, January 27, 2004.
The master version of this notice is at http://perens.com/Articles/SCO/DOS/ [perens.com]
Please check that location for a more recent version. You may re-publish this material. You may excerpt it, reformat it and translate it as necessary for your presentation. You may not edit it to deliberately misrepresent my opinion.
On January 26, 2004, a new virus became rampant. I have read reports that the virus payload has two purposes: to install a remote-execution back-end of a type commonly used by spammers to redistribute email, and to perform a denial-of-service attack on SCO's web site.
Denial-of-service attacks via virus have been a common trick of email spammers. They were first used to take out some of the anti-spam blacklist sites. Several of those sites had their (non-spam-related) business so heavily disrupted that they closed the doors of their anti-spam projects rather than be attacked again.
The Open Source developers are a target of spammers. We are the creators of most high-profile anti-spam technology. For example, SpamAssassin started out as, and remains today, an Open Source project. The predominant mail delivery programs of the Internet are Open Source projects such as Sendmail and Postfix, and thus most efforts to spam-proof those programs are Open Source as well. This is important, because it gives spammers a reason to defame us.
SCO also has a reason to defame us, as part of their stock-kiting scheme. We have assembled ample evidence that they have lied under oath in court. Such a company would not balk at attacking their own site in order to paint their opponents in a bad light.
Thus, it is likely that this virus has been assembled for the purpose of defaming the Linux developers by spammers, SCO, or others. Your behavior will influence whether or not it succeeds in this mission.
Thus, I urge all persons who have sympathy for Free Software, Open Source, and Linux:
Remember that your actions count. You are ambassadors of our community.
I couldn't help but notice.... (Score:5, Funny)
Now I wonder why you put that in there?
Parent
Re:I couldn't help but notice.... (Score:5, Funny)
No idea.
Parent
Re:The message from Bruce Perens (Score:5, Funny)
Umm.. yeah, right pal- like we can't figure out when someone is worried his karma is going downhill!
Parent
Re:The message from Bruce Perens (Score:5, Insightful)
Bruce
Parent
Re:The message from Bruce Perens (Score:5, Interesting)
Here it is for anyone else who missed it:
http://www.cnn.com/2004/TECH/internet/01/27/
Your right Bruce that is no laughing matter at all.
I hadn't dreamed anyone (other than SCO) would take
claims like this against the Linux Community seriously.
Parent
The Usual Suspects (Score:5, Insightful)
Are you sure the virus is just meant to hurt SCO? Note that like previous variations of this virus, it installs a back door (specifically the ability to execute supplied code and port forwarding). This same functionality has been used by spammers in the past (and indeed, the DoS portions of previous versions have targeted anti-spam sites).
As the saying goes, "you must be new here." The Linux fanbase is not alone in its share of zealots and childish behavior.
Who said anything about MS? Bruce's comments mentioned SCO. And spammers. That's it.
Google for "gobbles". There are plenty of folks who would love to take a swipe at Open Source (or specific groups under that banner). And why not. They're just as tempting a target as anything else that gains notoriety. After all, what would an individual gain from attacking... say... Microsoft?
You're on the money on that last bit. This will hand SCO more ammo to fling at the OSS community. And SCO will undoubtedly do their best to get it in the press and in front of Congress (which in turn is fodder for the unlikely possibility that this is SCO's own doing - they'll skuttle their own company for a buck, why not their own site?).
So what if this is not the work of a ticked off kid? Who would do this?
Again - this is a variant of previous malware. It is possible that someone got mad and just did the basic changes needed to vent their frustration. Or it could be from the same source as other recent attacks. And that source is undoubtedly some part of the spammer "industry" / community.
So why attack SCO? Bruce touched on one possibility - discredit a community that's been working hard to make spammers' operations difficult to maintain. Others have suggested it is an attempt to distract people from the virus' real intention - providing another fleet of zombie proxy machines. I've toyed with the idea that attacking SCO may appeal to the very ones who are usually cleaning up malware and the virus author hopes that these individuals would just let this one slip by.
In short, there are plenty of possibilities. And while the lone malcontent is still a very valid one, it is by no means the only likely candidate.
Parent
OT, but I just submitted this story: (Score:5, Funny)
Thank you to all
Congratulations, everybody!
On a side note, simply searching for "bastards" brings up SCO). [google.com] If Google happens to notice and block it (as in the past), a screenshot is here. [herrvinny.com] Please be kind to my server
The Press Release (Score:5, Informative)
SCO Offers Reward for Arrest and Conviction of Mydoom Virus Author
LINDON, Utah, Jan 27, 2004 /PRNewswire-FirstCall via COMTEX/ -- The SCO Group, Inc. (Nasdaq: SCOX), the owner of the UNIX(R) operating system and a leading provider of UNIX-based solutions, today confirmed that it is experiencing a distributed Denial-of-Service (DDOS) attack. SCO announced that it is offering a reward of up to a total of $250,000 for information leading to the arrest and conviction of the individual or individuals responsible for creating the Mydoom virus.
(Logo: http://www.newscom.com/cgi-bin/prnh/19990421/SCOLO GO )
"During the past ten months SCO has been the target of several DDOS attacks," said Darl McBride, president and CEO, The SCO Group, Inc. "This one is different and much more troubling, since it harms not just our company, but also damages the systems and productivity of a large number of other companies and organizations around the world. The perpetrator of this virus is attacking SCO, but hurting many others at the same time. We do not know the origins or reasons for this attack, although we have our suspicions. This is criminal activity and it must be stopped. To this end, SCO is offering a total of $250,000 reward for information leading to the arrest and conviction of those responsible for this crime."
SCO is also working with U.S. law enforcement authorities including the U.S. Secret Service and Federal Bureau of Investigation (FBI) to determine the identity of the individual(s) involved. Anyone with this information may contact their local FBI office.
The Mydoom worm, also known as Novarg, is a mass-mailing worm that arrives as an attachment with the file extension .bat, .cmd, .exe, .pif, .scr, or .zip. When a user opens the attachment their computer becomes infected and uses their computer with the intention of connecting to the www.sco.com Web site on February 1, 2004. Network security firms including Network Associates and Symantec have already issued software updates to combat this particular worm.
About The SCO Group
The SCO Group, Inc. (Nasdaq: SCOX) helps millions of customers in more than 82 countries to grow their businesses with UNIX business solutions. Headquartered in Lindon, Utah, SCO has a worldwide network of more than 11,000 resellers and 4,000 developers. SCO Global Services provides reliable localized support and services to all partners and customers. For more information on SCO products and services visit http://www.sco.com .
SCO and the associated SCO logo are trademarks or registered trademarks of The SCO Group, Inc., in the U.S. and other countries. UNIX is a registered trademark of The Open Group in the United States and other countries. All other brand or product names are or may be trademarks of, and are used to identify products or services of, their respective owners.
SOURCE SCO Group
Blake Stowell of The SCO Group, +1-801-932-5703, bstowell@sco.com; or Payal Patel, or Avi Dines, both of Schwartz Communications, +1-781-684-0770, sco@schwartz-pr.com, for The SCO GroupCopyright (C) 2004 PR Newswire. All rights reserved.
News Provided by COMTEX
Now on the journalist-blacklist (Score:5, Interesting)
Robyn Peterson [eweek.com], robyn_peterson@ziffdavis.com, is probably pretty safe to ignore at this point.
From eWeek's (heh) "Online Jubilation About MyDoom's SCO Attack" [eweek.com] article:Reactions on Slashdot, arguably the largest discussion board for technophiles, displayed a cathartic wave of pleasure, "Finally a worthwhile virus!" exclaims one poster. While another adds, "So, uh where can I download a copy?" (Robyn here included links to relevant /. comments)
While the person who gets paid to write this for a living (wtf?) ignores that the majority of the +4/5 comments that aren't rated "Funny" are
1) Reminding people that DDoSing is always stupid and silly2) Anticipating this kind of silly article
and 3) yelling at people who post unsupported theories about SCO.
But hold on, Robyn has more to say:
Another Slashdot poster goes as far as saying, "SCO has used past denial of service attacks as 'the dog ate my homework' type of excuses in court." It went on to suggest that "SCO's next court date is in early February, maybe they haven't done all their homework this time," implying that SCO itself released the worm. (Robyn will report next month on the inability of SCO to find evidence because IBM is being a big meanie.)
I know it's an advertising publication, but some people read eWeek and expect some of the things in it to be true. Rather than mention the tangible allegations against SCO with regards to insider trading, lying to stockholders, and inconsistent policies, Robyn reports what he's paid to. And that's fine - a half-truth is not quite libel - but it's kind of disturbing to read.
Bad Robyn Peterson, robyn_peterson@ziffdavis.com. Bad.
Re:Now on the journalist-blacklist (Score:5, Insightful)
Sure, most of us aren't going to cry for SCO when they get DOSed, given that they have repeatedly threatened many of our livelihoods with lawsuits against our employers, and attempts to destroy the community we've built and undermine the legitimacy of the licenses we choose as individuals to use for our software. But most of us realize that the damage these DOS attacks do to the infrastructure and reliability of the Internet is more potentially damaging to our careers and livelihood in the long term than any childish glee you could get from watching a crappy company's website go down.
And I think it's pretty obvious that the SCO DDOS is probably just a cover for using compromised hosts as spam zombies.
Parent
You must be kidding (Score:5, Funny)
I wonder who exactly are those people who expect some of it to be true. I have some nice bridges in various American cities for sale and we are also handling the pre-sale of some real state in the Moon and in Mars for Nasa. So if you know anyone who believes in articles whose main source of information are Slashdot comments, please ask them to give me a call.
Parent
It's like watching children fight (Score:5, Insightful)
As has been pointed out . . . (Score:5, Insightful)
While it couldn't happen to a "nicer" company, it seems very likely this virus wasn't written by a "Pissed off Linux advocate" or even a "Rabid SCO hater." The DDoS is probably just incidental to the real payload, serving to deflect suspicion from the culprit.
Yet another Bottom Feeding spammer . .
What a loser. (Score:5, Informative)
DDoS == Slashdot (Score:5, Insightful)
I bet they didn't think about the number of people (not just from Slashdot, but everywhere) that were going to DDoS them just by reading their press release...
Yet another showing of intelligence from SCO.
it's not real money to Darl (Score:5, Insightful)
Which is what makes this press release so...so...strange. We all know that the FBI goes ballistic over this kind of thing. And unless the worm author was incredibly careful, he's probably got federal agents tramping around his bedroom and emptying out his dresser drawers even as I write this.
So why then, is SCO so eager to hand over $250,000 for an informant? SCO's moaning about how much this worm has cost them, but, really, can we take that seriously? I could see if this worm targeted Dell or IBM, or, you know, some company that actually has customers visit their website. But who is SCO selling anything to anymore? It's just a litigation house. What do they care if their site drops down for a day or two? The FBI is likely to be hot on the worm author's heels, so why is SCO so eager to hand over 250 thousand smackers without any clear reason?
When you see spending decisions like this, it's a pretty good sign that a company is being run by bozos. You get the sense this press release was rushed out the door in an effort to capitalize on media attention. But was there any real reason why SCO needs the attention, or why it's in their best interest to part with so much money given that the culprit will likely be found anyway?
So here's my crystal ball prediction: the worm author will be found. But SCO won't pay up. This is all about publicity, and for some reason I don't foresee Darl rushing to sign a check.
eWeek needs a lobotomy. (Score:5, Funny)
Anyone worth their while knows that Linux fans don't code anything for Windows unless they are paid for it. It's something called 'taint,' which money readily removes. :-P
Hell has frozen over (Score:5, Funny)
Hand me those earmuffs, Mr. Lucifer. Chilly, huh? You just never know about the weather around here.
The author is a spammer, not an anti-SCO nut (Score:5, Interesting)
I think it means very little that the worm launches an attack against SCO. The primary purpose of this worm, like the Mimails that preceded it, is the wide-spread distribution of a zombie network for the purpose of propagating spam. You see, spammers hire programmers to do this coding for them (read up a bit on Mimail and spam [spamhaus.org]) in order to help their spam biz. While the hired programmer was at it, he probably threw in the SCO bit for shits and giggles. Or maybe he's a younger programmer and just kind of immature. Either way, the spammers (the people commissioning the construction of the worm) don't care.
To me this sounds like the most likely scenario -- remember that spam and viruses are linked [sysdesign.ca]. The SCO thing is just throwing people off track.
Scene - the virus writer's parents' basement (Score:5, Funny)
Scene - the virus writer's parents' basement
Script Kiddie #1: OK, dude, like, I got the, y'know, latest version of, like, Virus Creator, dude.
Script Kiddie #2: Swheeet! Dude, like, run it!
Script Kiddie #1: Fuxor! Like, I clicked on it, and, like, it didn't go!
SK2: Dude! You have to, like, double click! Lamer!
SK1: STFU! I know that! Fag!
SK1: Uhhh, like, it's doing sumthing. Oh - kewl! It's like, installing stuff.
SK2: Shweet! Man, this rox!
Virus Creator: Virus Creator Wizard - page 1 of 5 - Do you want to install a backdoor? [yes] [no] [help]
SK1: Shweet! Yeah, let's set up my army of zombies! Huh-huh-huh!
Virus Creator: Virus Creator Wizard - page 2 of 5 - Do you want to install a spam relay? [yes] [no] [help]
SK2: Dude! We can, like, make money! Do it, dude!
Virus Creator: Virus Creator Wizard - page 3 of 5 - Do you want to install an HTTP relay ? [yes] [no] [help]
SK1: WTF? (clicks help)
Virus Creator: This lets us serve PR0N through your zombies - click yes and we will let you have the password to see some of it.
SK1 and SK2 (together): DUDE! SHWEEET!
Virus Creator: Virus Creator Wizard - page 4 of 5 - Do you want to DDOS somebody ? [yes] [no] [help]
SK2: Yeah!
Virus Creator: Virus Creator Wizard - DDOS setup - Who do you want to DDOS? [enter URL here]
SK1: Who should we fuxor? School?
SK2: DUDE! If you fuxor school how can we look at pr0n during class? (dope-smacks SK1)
SK1: OW! Fag! OK, uhhh, dude, like, the RAII?
SK2: YEAH! Fuxoring with our MP3s!
Virus Creator: Virus Creator Wizard - URL "www.raii.com" not found - try again [enter URL here]
SK2: Fuxor!
SK1: Dude, like, what's something with less letters, man?
SK2: SCO?
SK1: Yeah! FUXOR JOO, SCO!
Virus Creator: Virus Creator Wizard - page 5 of 5 - Virus ready - click here to email [ok]
SK1 and SK2 (together): SHWEET!
In other words, I think the DDOS against SCO is incidental to the real purpose of this virus - which is to spread spam. Like as not the choice of SCO was just because they are in the news, and to shift the blame to somebody else.
One thing that doesn't jibe ... (Score:5, Insightful)
So how is it that SCO is supposedly already feeling the effects of the DDoS from the virus?
Re:Let me be the first to say... (Score:5, Insightful)
And then you can go to jail for obstruction of justice. Paying people to not turn in evidance of a crime is a federal offence.
Parent
Re:Dear Bruce Perens (Score:5, Insightful)
Shut the fuck up It's kind of obvious that this is a doing of a Linux user, so please stop writing your pointless letters, no one cares. Heed my advice, and once and for all Shut the fuck up
Seeing as Bruce is considered to be one of the leaders/spokesmen of the Free/Open Source Software Community, he has a responsibility to speak out on issues such as this. Since so many people, organizations, and companies pay heed to what he says, his silence would be considered tacit approval by some.
Additionally, this single worm has the potential to do more harm to the Free/Open Source Software Community than all of SCO's shenanigans combined. evereyone really needs to speak out against this.
Parent
Re:Oh c'mon... (Score:5, Interesting)
Parent