Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security

WebTV/MSNTV Virus Dials 911 577

Posted by timothy from the well-it's-only-a-minor-emergency dept.
Semji Rkim writes: "Though not the first virus to direct modems at 911, ABC News is reporting a bug in WebTV (Now branded as MSNTV) units which causes the infected unit to hang-up and dial 911. The virus spreads via email and Microsoft officials are looking into how it is able to replicate and also control the modem. Affected users are advised to delete the email and call Microsoft at 1-800-469-3288."
This discussion has been archived. No new comments can be posted.

WebTV/MSNTV Virus Dials 911 More

WebTV/MSNTV Virus Dials 911

Comments Filter:

  • Can't be true (Score:5, Funny)

    by CodeWheeney ( 314094 ) <JimCassidy.mail@com> on Tuesday July 23, 2002 @03:56PM (#3939920) Homepage
    This can't be true. Microsoft just spent a whole month focusing on security. There must be some mistake.

  • This is serious (Score:5, Insightful)

    by jandrese ( 485 ) <kensama@vt.edu> on Tuesday July 23, 2002 @03:56PM (#3939926) Homepage Journal
    Tying up 911 lines costs lives. In many jurisdictions you can be fined for prank calling 911, especially if you are a repeat offender. WebTV users would be well advised to be very careful with their email until this problem is resolved.

    • Re:This is serious (Score:5, Funny)

      by Jonny Ringo ( 444580 ) on Tuesday July 23, 2002 @04:00PM (#3939971)
      WebTV users would be well advised to be very careful with their email until this problem is resolved.

      I'd one up you on that, and advise WebTV users to take their WebTV out to the back yard with a baseball bat. You know like on Office space.

      Then, call the MS 1800 number and say that you found a fix.

    • Re:This is serious (Score:5, Informative)

      by HanzoSan ( 251665 ) on Tuesday July 23, 2002 @04:00PM (#3939980) Homepage Journal


      Yeah Its wrong to tie up 911 but 911 is the only number which could fit into the command string for ATH0.

      Yes its ATH0, not a virus.

      ATH0 Exploit [timeless.co.zw]

      ATH0 info [seclabs.org]

      • I doubt it.. webtvs use a software modem wich most likely doesn't even respond to AT commands. Theres also the matter of the virus shutting down the system after.

        OTH this is proof that "Trusted Computing" won't fix anything.

        • Re:This is serious (Score:2, Informative)

          by tomhudson ( 43916 )
          most software modems respond to the AT (Hayes) command set, either in hardware, or in software, or a bit of both. Depends on the implementation. Just a quick fyi :-)

      • What about 411? Last time I checked, they were the same number of digits. 411: 1+1+1=3. 911: 1+1+1=3. Okay, another quick doublecheck proves it, 911 and 411 have the same number of digits.

      • Re:This is serious (Score:5, Interesting)

        by murphj ( 321112 ) on Tuesday July 23, 2002 @05:13PM (#3940480) Homepage
        Quoted from parent's link:
        The patent was a "submarine" patent -- that is, one that issues long after others in the industry have begun using the same technique or technology ... The patent involved the timing of the escape sequence: The characters "+++" followed by a 1-second pause. To get around the patent, some modem vendors simply eliminated the pause, so that the sequence +++AT would bring the modem back to command mode in all cases.
        It's interesting that the only reason this works is that Hayes pulled the same trick Forgent is trying with JPEG.

        • Re:This is serious (Score:3, Insightful)

          by rarose ( 36450 )
          Yeah but at least Hayes *invented* the patent and used it to actually create product instead of being a Johnny-come-lately shake down artist.
    • Under the new hacking legislation reported in slashdot earlier, could this make the creator liable for the death penalty?

    • Re:This is serious (Score:2, Interesting)

      by Anonymous Coward
      Yeah. It's funny, this ex-microsoft chief is running around screaming about how worms will destroy everything by 2005 [slashdot.org], but right here we have a worm tying up 911 lines and possibly ending lives, today.

      Oh, wait, except that the ex-microsoft chief seems to be blaming TCP/IP and power companies and traffic light manufacturers and, well, everyone except Microsoft, for how much of a problem these "zero-day worms" are, and very distantly implying a palladium style global user-distrust technology would be the answer, from looking at that article. Funny how this sort of thing (massive-scale destructive worms) never seems to happen anymore except through Microsoft products.. I personally wonder if we'd see less of this Code Red / Klez stuff if we had less of a computing monoculture.

    • Palladium (Score:2, Interesting)

      by mizhi ( 186984 )
      So this is the company we're supposed to trust to make the internet more secure with Palladium?

  • Hehe... (Score:4, Funny)

    by brogdon ( 65526 ) on Tuesday July 23, 2002 @03:57PM (#3939931) Homepage
    "911, what's your emergency?" "I've got a Microsoft product in my living room!" "What?" "I've got a Microsoft product in my living room! AIIIIGH!"

  • Don't be fooled! (Score:4, Funny)

    by quantaman ( 517394 ) on Tuesday July 23, 2002 @03:57PM (#3939933)
    It's not a virus!
    It's just the poor MSN infected boxes crying out for help!!

  • Voice of Stephen Hawking.... (Score:4, Funny)

    by simetra ( 155655 ) on Tuesday July 23, 2002 @03:57PM (#3939941) Homepage Journal
    When 911 operator answers, the virus plays a wav file, in the voice of Stephen Hawking's voice thing:
    "Help Me. I have Web TV. Help Me"
  • I would call 911 if Microsoft took over me...

  • ATH0 (Score:5, Informative)

    by HanzoSan ( 251665 ) on Tuesday July 23, 2002 @03:57PM (#3939946) Homepage Journal

    Any knowledgeable hacker knows about ATH0, it effects around 50 percent of 56k/33/28 modems.

    With this, I was able to hang up peoples connections and even make them dial phone numbers, you send the modem commands and because of a bug, the modems obey the commands.

    Its not a virus, Its something thats been going on for years, its an old trick/exploit.hack
    • For information: First google hit on ATH0 [timeless.co.zw]

      • Re:ATH0 (Score:3, Informative)

        by Mr Guy ( 547690 )
        Actually, a later hit was more interesting: Explanation of what is happening [216.239.51.100]
        • So when did/does the Hayes patent expire? Can they be sued for consequential damage and loss of life?

        • Re:ATH0 (Score:3, Interesting)

          by toastyman ( 23954 )
          What's really amusing....

          Back when this was first "discovered", I was one of the people on Bugtraq discussing how this could be exploited.

          I very stupidly posted what I typed to knock myself off, with my real nickname included: //raw NOTICE ToastyMan : $+ $chr(1) $+ PING +++ATH0 $+ $chr(1)

          For the longest time, I couldn't sign on IRC on any major network without someone actually typing that verbatim, and sending that to me.

          In the past couple of years I've received thousands of those. Kinda funny. :)

    • Nice troll. (Score:2, Informative)

      by dave-fu ( 86011 )
      In order to be able to pass Hayes commands to the modem, you first have to establish a terminal session to the modem itself; if you can do this, it's already game over.
      Otherwise, knowing about ATH0, ATA, ATDT and ATM0 (well, the last is useful if you're dialing late at night and don't want to wake others) isn't so much l33t as having paged through the manual while waiting to get an open line.
      OTOH, figuring out that you can down a BBS you don't like by requesting a file named COM1:? That's getting warmer...

      • Re:Nice troll. (Score:4, Insightful)

        by kwishot ( 453761 ) on Tuesday July 23, 2002 @04:21PM (#3940137)
        You're dumb.

        If you translate the commands into hex and send it as a ping it works:
        ping -p 2b2b2b415448300d -c 5 xxx.xxx.xxx.xxx

        By the way, 2b2b2b415448300d = +++ATH0
        The modem receives the command and doesn't even pass it up to the "higher" networking layers so it's virtually untraceable, as well.

    • Re:ATH0 (Score:3, Insightful)

      by CaffeineAddict2001 ( 518485 )
      wow, that's pretty scary.
      If you can make it hang up, can you make it dial (ATDT)?

      Imagine some goon on IRC makes your modem dial his number so he can grab it on CallerId and then harass you. :\

    • Its not a virus, Its something thats been going on for years, its an old trick/exploit.hack
      That's akin to saying "this so-called 'virus' that deletes files is not a virus - I've been deleting files for years!" Its the behavior of the code, not its payload, that defines it. In other words - if the email itself includes code that infects the host device and then attempts to replicate, its pretty much met the definition of a virus.

      Granted - this article is rather light on detail. It doesn't specifically state that is what's going on - only that Microsoft tech support is reseting devices. It could simply be a mass emailing.

      Of course, that might be the point HanzoSan was trying to make.

    • Re:ATH0 (Score:4, Informative)

      by Neon Spiral Injector ( 21234 ) on Tuesday July 23, 2002 @04:37PM (#3940258)
      That's why good PPP implimentations escape the '+' character. And why smart people include "S2=255" in their init string. The S2 register defaults to 43. (The decimal value for the '+' character.) Setting it to 255 disables the the "+++" feature. Of course with out being able to go "+++" (wait) "ATH0" you need to be able to hang up the modem by manipulating the control lines (which most programs can do). Oh, I say "wait" cause good modems require a 3 second pause after the "+++" to enter command mode. I think that is how some modems go uneffected as you can't get the "+++" to be the only thing sent for 3 seconds and then continue with the commands.

      Ah the old BBS days. I remember some fool on the local board I hung out on had some crappy term program that would hang up if it saw "NO CARRIER" at the start of a line. Now why would a communication program issue an ATH0 after the carrier had been dropped?

  • Colour me impressed (Score:5, Funny)

    by Aexia ( 517457 ) on Tuesday July 23, 2002 @03:58PM (#3939947)
    that a virii could hack a MSN/WebTV unit *and* propagate itself to other MSN/WebTV users.

    Microsoft advises affected customers to delete the email and call 1-800-469-3288.

    Suggestion for next iteration of virus: dial this number instead.

  • Trustworthy Computing.... (Score:3, Funny)

    by Barondude ( 245739 ) on Tuesday July 23, 2002 @03:58PM (#3939949)
    I guess they never said trustworthy phone dialing.

  • Legal Consequences? (Score:2, Interesting)

    by jonman_d ( 465049 )
    If (incredibly hypothetical?) the guy/gal who wrote this virus gets caught, can he/she be fined/jailed for each and every call made to 911? If so, how long would you be in jail for/how much would you have to pay?

  • Liability? (Score:2, Interesting)

    by Quixote ( 154172 )
    This is bad, because 911 services cost real taxpayer money. The question is: can Microsoft be held liable for wasting my taxpayer dollars because of their product's flaws?

    • Re:Liability? (Score:3, Insightful)

      by t0qer ( 230538 )
      You're saying it's MS's fault someone not an MS employee wrote this malicious code?

      If it's anyone's liability it comes down to the person that wrote the virus. The same thing COULD be done on a linux system too, should linus be held liable? Should the whole open source community be held liable?

      Your comment was stupid, I just wanted to point that out.
      • This vulnerability has a simple patch. All modems are known to be vulnerable to ATH0 commands. You can disable command mode by making a change in the registry in windows.

        Can Microsoft be held liable for selling a product with a LONG-KNOWN vulnerability and NOT fixing it with the WebTV auto-updating functionality. Assuming that it is easy to fix, of course, which I am (of course) assuming.

        And by the way, YES, WebTV has always been able to auto-update.

      • I can just see the FBI going to Redmond to settle the issue of liability:

        FBI: "The kid says your computer called 911. What the hell is going on, Bill? I woke up the president and told him we were under attack by the Russians. Do you have any idea what kind of an idiot that makes me look like?"

        Bill: "David, machines don't call people."

    • Tying up emergency lines can cost lives.

      Compared to that I say BOLLOCKS to the small amount of taxpayer dollars it costs you.
  • None of this will be possible once you all surrender minute-by-minute control over all your computing devices to Microsoft. Duh.
  • Kinda makes you ache for a phone-firewall, doesn't it? Heh.

    Hmm I could block 911 & telemarketers...
    • Great idea for a geeky horror flick.

      When your firewall is up, no one can hear you scream.

  • The next version? (Score:4, Funny)

    by giantsfan89 ( 536448 ) <linuxwebguy@noSPAM.gmail.com> on Tuesday July 23, 2002 @04:01PM (#3939986) Homepage Journal
    • The virus spreads via email and Microsoft officials are looking into how it is able to replicate and also control the modem. Affected users are advised to delete the email and call Microsoft at 1-800-469-3288.

    Hmmm maybe the next virus can dial 1-800-469-3288?

    =)
    • Hmmm maybe the next virus can dial 1-800-469-3288?

      I find it very remarkably that Microsoft is now offering customers so much support to deal with security problems in their software. Maybe they think: if we can't make it secure, let's make it agreeable to our customers.

      Na, probably not.
  • Operator: "911, Whats your emergency?"
    WebTV Unit: "All your base are belong to us."
  • Affected users are advised to delete the email and call Microsoft at 1-800-469-3288.

    ... or just launch the attachment that we've conveniently included here in this e-mail, and we'll do so automagically for you!

  • "delete the email"? (Score:3, Funny)

    by xavii ( 92017 ) on Tuesday July 23, 2002 @04:02PM (#3940003)
    Just delete the email?

    but i must find out how to:

    1. enlarge my penis.
    2. lose those extra pounds
    3. find the girl of my dreams or
    4. see those insert random celebrity name here naked photos!

  • How much longer until 1-900? (Score:5, Interesting)

    by magicsquid ( 85985 ) on Tuesday July 23, 2002 @04:05PM (#3940028) Homepage
    How much longer will it be before unscrupulous 900 number operators enlist people to alter this virus to make it dial their numbers? Given that it takes a month to get a phone bill, the culprits can close up shop and move on long before anyone even realizes there is a probem...
    • Someone Mod the parent up! Squid that has to be about the most insightful thing i've read so far on this thread.

      --toq
    • In Germany there is already a huge problem with dialer programs which try to sneak themselves into your system and replace your default dial-up connection with an expensive 0198 etc numbers. There were programs which caused 200 Euro to be charged per dial-in.
      However these program come as some kind of trojan, usually springing up some "accept box" (only on install). However, these boxes often don't say that an expensive connection will be created - sometimes they even claim to be a "screensaver update"

    • Wouldn't work (Score:2, Informative)

      by Anonymous Coward
      For one thing, I doubt the operators get paid until the customer pays the phone company. In most states, the phone company cannot disconnect your service if you refuse to pay for calls to 900 numbers. The worst they can do is block your access to those numbers in the future...which might be a good thing in this case!

      Second, once the complaints came in, the phone company would quickly cease all payments to the operator, and turn their info over to the district attorney's office for prosecution.

    • "How much longer will it be before unscrupulous 900 number operators enlist people to alter this virus to make it dial their numbers? Given that it takes a month to get a phone bill, the culprits can close up shop and move on long before anyone even realizes there is a probem..."

      It's been done. I remember reading in the newspapers about pr0n sites that asked you to download their special pr0n viewer program. The thing is, this viewer program actually did view the adult content. It also turned off your modem's speaker and dialed some pay-per-minute line in Russia. But since you were looking at pr0n, you would probably spend quite a while racking up charges without noticing anything was amiss until your next phone bill.

  • Why can't the fucking virus writers understand that they need to be portable across platforms? It seems most virus writers these days are targetting Microsoft products without so much as a thought about portability. What about users running MacOS, Linux, Solaris, *BSD or any other operating system? What about users who don't even have a modem? And what about users in other countries where the emergency number is different from that in the US? This virus is buggy as hell, I wouldn't want it if my life depended on it! (pun intended).

  • Interm Solution (Score:5, Insightful)

    by t0qer ( 230538 ) on Tuesday July 23, 2002 @04:09PM (#3940049) Homepage Journal
    M$ sends an automated voice message out to all their subscibers. Either that or make all the access numbers just play this instead of sending any actual data.

    "Services will not be availiable today because of a virus that affects webtv users. The virus takes control of the webTV modem and causes it to dial 911. Please unplug your webtv unit from the phone line until we can fix the problem. Please call 555-1212 if you suspect your webtv has been affected"

    Clean up your mail servers. Install something to filter out the virus and any varients. Even the least tech savvy people will understand "It dials 911" and "Unplug your webtv"

    Just some advice.

    --toq
    • Why would M$ do this?

      It doesn't make them any money. Right now many WebTV users probably don't consider WebTV to be a computer. Remember, computers are complex, buggy, get hacked, and get viruses therefore if WebTV is suseptible to viruses it is a computer. By sending out an alert to all their subscribers they will alert everybody to the fact that WebTV is a type of computer and will lower its popularity because of that. That being said it is an interesting test to see if M$ will stand to possibly lose a little PR in order to stop a life saving service from being tied up.
      • It doesn't make them any money.

        It's one less day they need phone support.
        It's one less day they have to provide service.
        It's one less day they have to do anything but have their top techs in the office fixing the problem (Who are probably in the office all the time anyways)
        On top of all the less they have to provide for a day, they're still charging the customers money. So they don't really lose anything at all by doing this, they gain alot.

        Add that all up, and I see black for that day.
  • There's an argument to be made that having a Microsoft product in your living room could be termed an emergency.

    I personally find this alleged virus' behaviour entirely appropriate.

    It's just trying to help.

    Can't you see that?

  • Why not... (Score:3, Interesting)

    by curunir ( 98273 ) on Tuesday July 23, 2002 @04:16PM (#3940098) Homepage Journal
    ...just have the MSNTV units call the 1-800-469-3288 number directly.

    Why don't the people who write viruses ever have a sense of humor?

  • Full service virus (Score:2, Interesting)

    by Maniakes ( 216039 )
    Part of the purpose of 911 is to report crimes.
    Hacking is a serious crime [slashdot.org].

    The virus is just calling 911 to report itself.
  • if after it dialed it played popular music using only dial tones.

    Maybe the rolling stones "Start me up"..

  • How... timely (Score:4, Insightful)

    by 0xdeadbeef ( 28836 ) on Tuesday July 23, 2002 @04:19PM (#3940125) Homepage Journal
    This, right about the time ax-Microsoftie security snake oil salesman is harping about the dangers to our infrastructure [slashdot.org] because of the Internet, and when Microsoft is promoting Palladium [slashdot.org] as the solution to its MUA scripting bugs.

    Coincidence? Probably. But geez, you can bet they will spin this to their favor. Instead of apologizing for their incompetence, they will use it as evidence of the dangerous new world we live in, and request us to please bend over for all their new security initiatives.

    Our infrastructure is under threat from hacker terrorists! The free world is at stake! Join up at your NET Guard recruiting office now!
  • Hello, operator? Give me the number for nine one one!"

  • Its very simple to do this... (Score:3, Interesting)

    by Critical_ ( 25211 ) on Tuesday July 23, 2002 @04:23PM (#3940156) Homepage
    I don't know the exact in's-and-out's of the webtv e-mail system but back in the BBS days, we used to send each other (amongst friends) DOS TSR's that would be disguised as a trusted executable file for a legit program. The person would run it and hang up their modem used ATH0. And dial out numbers using ATDT. To get rid of it, they would have to reboot using a bootdisk since the TSR would be in their autoexec.bat file. Anyway, the point is that this method of modem-"hacking" is very easy to do and shouldn't be tough to adapt for the modern day webtv.

    A part of me actually finds the idea of Microsoft being held liable for the 911 calls pretty amusing. But the reality is that it costs money and unfortunately it could cost lives. I hope all of you people make sure to tell your moms/dads/grandparents/spouses/friends/etc. to disconnect their boxes from the phones lines.
  • Back in the days of 2400bps, when modems touted features like "auto-dial," every night when one of my friends made his BBS rounds, the cops would show up at his house.

    This went on for days. And no one really put it together until, one night, while listening to the dial-tones coming out the speak of his Avatar 2400 modem, he noticed that anytime the modem attempted to dial an 8, nothing would come out.

    And one of the BBSs he dialed started thus:
    (8)91-1xxx

  • According to the article, microsoft is claiming 18 reports.

    That should be just about everyone on webtv...

    Maybe that's why this hasn't hit other news outlets... hmmm...

    --mandi

  • How long before your X-Box has you deeply involved in a scheme to help siphon illegal funds from a Nigerian bank account?

  • IRC (Score:2, Interesting)

    by owenc ( 255848 )
    I had a ctcp command do that on undernet once. Like[1] an idiot, I ran it, and nothing seemed to happen. It had however hung up the modem and dialled 911. I tried it four times. I forgot about it and carried on for about 15 minutes. Then at midnight I heard a knock on the door. I thought maybe a neighbor had some sort of an emergency or something. It was the police. He asked if everything was ok, but wouldn't leave until he saw my mother to make sure I didn't hack them up or something. It was kind of hard to explain that someone on undernet had sent me this command and said that it actually done something else. I wish I could say I learned something from that experience...

    [1] maybe "like" is not the best word
  • From the article,
    This virus only affects Microsoft WebTV/MSNTV units. Windows PCs, Macs, Unix, and Linux machines are unaffected.

    Huh!? I thought viruses affected EVERY computer and email client the same! I mean they've never suggested anything different on the news before this?!? Do you mean that when checking my email on Red Hat using Pine I won't get klez or code red???

  • Well, it's a good thing (Score:4, Funny)

    by ZaMoose ( 24734 ) on Tuesday July 23, 2002 @05:11PM (#3940471)
    It's great that the virus dials 911. I mean, my local Stonecutter lodgemaster told me only suckers dial 911.

    The real emergency number is 912.

    *grin*

  • My only hope... (Score:5, Insightful)

    by erat ( 2665 ) on Tuesday July 23, 2002 @05:55PM (#3940781)
    ...is that the loser who made this all happen has a heartattack and can't get through to 911 emergency services because his/her own virus/hack/whatever is tying up the line.

    Sometimes these pranks go too far.

  • The Big Question... (Score:4, Insightful)

    by sterno ( 16320 ) on Tuesday July 23, 2002 @06:16PM (#3940914) Homepage
    If the person who wrote this virus has caused 911 to be tied up, and this has possibly caused somebody to die, would they be prosecutable under the new anti-hacker law that Congress put together?

  • And this is on a closed system (Score:4, Insightful)

    by Animats ( 122034 ) on Tuesday July 23, 2002 @07:47PM (#3941357) Homepage
    This demonstrates the total failure of Microsoft's "authorized code" approach to security. WebTV is a completely closed system; it is designed to run only the code it comes with. Yet it has been cracked. None of the DRM-type "security" stuff Microsoft has been talking about would have prevented this.

    Since this apparently affects pre-Microsoft WebTV boxes, though, it may be in code from the original WebTV people in Palo Alto. But that was a long time ago. Microsoft owns it now, and has to take the blame.

    Is it actually running unauthorized code, or does the exploit just change what it dials?

Slashdot Top Deals

I THINK THEY SHOULD CONTINUE the policy of not giving a Nobel Prize for paneling. -- Jack Handley, The New Mexican, 1988.

Close