Fizzer Worm Uninstalling Itself 450
boredMDer writes "According to a recent update on the Dshield.org mailing list, apparently the Fizzer Task Force has gained control of the Geocities webpage from which Fizzer updates itself. From an IRC-Security mailing list: 'We have also postted a Fizzer cleaner to the actual URL that the bot downloads its updates from, as a self extracting and running executable.' The Fizzer-uninstaller posted there creates the file '%WinDir%\uninstall.pky', which then causes Fizzer to remove all of its registry keys. Looks like the Fizzer worm will soon come to an end."
In other News... (Score:5, Funny)
Not neccessarily the end. (Score:5, Informative)
We're crossing our fingers that the bots are looking for an executable
to update themselves..
Well if they're not then the page becomes semi-useless. Although I suppose it will still prevent 'legitimate' updates of the bots.
Not even the beginning of the end (Score:5, Informative)
To: irc-security@lists.noc.ic5.net, IRC.Admins@ldsn.org
Reply to: irc-security@lists.noc.ic5.net
Update: The file has now been removed for "testing".
I.E. we don't think the code is being executed.
Also, apparently the "update routine" on Fizzer only runs once a day, though that's totally unconfirmed.
James ('Herbster')
(Server Admin, irc.ZiRC.org)
Let this be a listen to self updating worm writers (Score:5, Funny)
We don't want a repeat of this fiasco...
Re:Let this be a listen to self updating worm writ (Score:5, Interesting)
Daniel
Sign the updates, and use a P2P network. (Score:4, Interesting)
Full Text of Article (Score:5, Informative)
now control the update page, and have posted a mirror of the
http://www.debugoutput.com/fizzer.php site on the geocities website that
fizzer uses to update itself.
We have also postted a fizzer cleaner to the actual URL that the bot
downloads its updates from, as a self extracting and running executable.
We're crossing our fingers that the bots are looking for an executable
to update themselves..
We'll keep you updated..
Regards,
--
John McGarrigle
IC5 Networks
Re:Full Text of Article (Score:4, Informative)
I applaud the sentiment, but do the ends justify the means? I don't think Joe Slashdotter would be too happy with the idea of enforced antivirus affecting _his_ PC, for example if the government mandated it, because you can be sure that that precident would soon be followed by anti-piracy, anti-crypto, anti-free-speech, anti-everything-else in short order.
I suppose you could argue that 'we aren't inserting the data ourselves, we just made it available' - but that's little more than sophistry.
Re:Full Text of Article (Score:5, Insightful)
Re:Full Text of Article (Score:3, Interesting)
Yes, but the people who put the file there cannot really claim that they didn't know that the file would be downloaded without the knowlage of computer users onto their machine. They could have just deleted the file.
Especially since there are ways to avoid such things from happening... (Starting with personal firewall that blocks IE from accessi
Re:Full Text of Article (Score:3, Insightful)
I guess that would make them liable to pay damages if their removal code did some damage, and doing something like that is sticking their necks out to be chopped off. Which makes them either unselfish and brave, or stupid.
Too bad there really isn't any "real-world" analogy for this case...
Pedantic ethic in a vaccuum... (Score:5, Insightful)
Sure, it's not ethical on its own to force a download on people... but it is likely MORE ethical than allowing these clueless infected types to continue to infect others.
If someone's unconcious and bleeding from their head, is it ethical to patch up their head wound without their permission? I'd hope so.
Re:Full Text of Article (Score:3, Insightful)
How is automatically downloading a antivirus any more legal or ethical than automatically downloading a virus without user permission?
Essentially, the same way the fire department has implied permission to save your house and pets should your house catch fire when you are unreachable.
That is, the worm presents a danger to other people's property (servers) and it's a good bet that anyone having it would sincerely like it to be gone. Anyone who WANTS the worm to remain, AND hasn't isolated it from the
Re:Full Text of Article (Score:3, Insightful)
But they don't have implied permission, they have explicit permission from an elected government (at least here). In this case the people doing this are akin to a band of vigilantes, something that civilised socienties all over the world have rejected in the real world.
They are more like a volunteer fire department. In the absense of an appropriate civil authority, sometimes, citizens must get together to do the appropriate thing.
Vigilanteism is an act of ignoring an existant and appropriate civil au
wow (Score:5, Insightful)
Now the computer security community gets to have a big debate over whether this was ethical or not...
Re:wow (Score:5, Insightful)
Want to show a case proving this? Even vaguely?
In fact, most states have "Good Samaratin" laws which are specifically designed to protect anyone attempting to save someone else's life against prosecution -- this comes up most often in CPR training, since some bozos have had the gaul to try and prosecute the CPR giver for providing CPR and not saving the person's life.
I'd say you were just a troll, but your posting history doesn't show that. So I'm guessing you're either stupid or grumpy.
In response to the original question - as long as it's done purely for the purpose of removing the worm in the first place I'd say it's ethical. You could argue that they should also patch the holes that let the worm in in the first place (presuming there were some - I believe Fizzer is just executed by unsuspecting people), but I'd say that's crossing the line -- you have no idea if there was a valid reason for the user to not patch -- it may be that the patch causes issues with their computer. Uninstalling the worm is unlikely to cause problems though, as long as the uninstaller does the job right.
Re:wow (Score:3, Interesting)
There was an instance about two months ago of a man whose apartment was on fire running into the burning building to save his dog. The fire department had the police arrest him.
The FD did not want to enter the building because it was too hot/dangerous, and wanted to let the hoses cool things down a bit at first (a perfectly sane decision, IMHO, since there was no human life at stake.) The pet owner didn't like that idea, so took matters into his own hands
Re:Helpfully (Score:3, Funny)
Harry Potter?
Gateway to Thousands of Machines (Score:5, Insightful)
I can only imagine that this is now the bullseye for hundreds of crackers who want to compromise people's computers. I hope the honest security people who have "taken control" of this page are making sure every few seconds that their true uninstaller program is there, and not someone else's kRaK program.
Re:Gateway to Thousands of Machines (Score:4, Insightful)
Hacked into Geocities? (Score:5, Interesting)
At what point does the vigalante hacking become acceptable when fighting against Something Bad?
If this worm updated itself from a random group of computers that it had infected (say for exmple, yours), would you mind if they took control of your computer if it meant stopping the worm?
Re:Hacked into Geocities? (Score:4, Informative)
Next time try doing a little research (like asking in the IRC channel) before posting.
Re:Hacked into Geocities? (Score:5, Funny)
Re:Hacked into Geocities? (Score:4, Interesting)
People get concerned about security as an end unto itself, forgetting the real world is messier than that. An excess of control can be as wasteful as a deficit. What's good for the RIAA is good us too. It's never good to be a battleground of course, but ants in the basement are better than roaches in the kitchen. If the one prevents the other, why not?
Thus we should patch security holes not to keep someone from using a few resources we wouldn't miss, or indeed use in the meantime, but because someone might combine those resources with ten thousand other compromised machines to perform a nuisance attack on another host, or with ten million to do the same to the net at large.
Re:Hacked into Geocities? (Score:3, Insightful)
I would. I wanted those weeds there, dandelion makes a good salad.
*Sigh* (Score:5, Funny)
If you're going to write a worm, do it right.
Re:*Sigh* (Score:5, Funny)
Then sue.
Re:*Sigh* (Score:3, Insightful)
(mod self -1, Silly)
Quota? (Score:5, Interesting)
outrageous (Score:5, Funny)
to use the innate homing behavior of a wild natural creature like this virus against it...
to warp it's natural instincts to find home into the means by which it kills itself displays a craven lack of respect for computer worm/ virus entities
do not these strange and wonderful beings deserve our respect and encouragement? is there no natural sanctuary of a subnet on which these beautiful beings can live out their imperative to reproduce? unburdened by the ill wishes of mankind?
is there no compassion on the internet?
outrageous
Nice.. (Score:4, Interesting)
Re:Nice.. (Score:4, Insightful)
Fact Checking (Score:5, Informative)
Had anybody bothered following the link to the geocities page before posting the story, they would have seen that the file was "removed for the time being, until further testing on Fizzer's update routine can be done." There has been a great deal of argument in #fizzer as to the legality of such things, and I do not believe that the Fizzer Task Force as a whole decided to do anything of that sort.
Ansivirus companies' advice (Score:5, Interesting)
Re:Ansivirus companies' advice (Score:5, Informative)
That's actually what the de-fizzer executable was designed to do. Unfortunately, it looks like there are timing/logic issues with the update that haven't been worked out (different threads of the worm are run conditionally, at different times)
Another vector that people (including myself) are working on is using the "PING" buffer overflow to launch the self-destruct mechanism from the IRC server.
My submission:
2003-05-15 16:36:12 Fizzer Worm Self-Destruct Sequence Triggered by Fizzer Task Force (articles,security) (rejected)
the worm has proved itself to be a new lifeform (Score:4, Funny)
(see star trek for more on this topic....)
Somound needs to be more creative... (Score:5, Funny)
Don't worry... (Score:3, Funny)
Good thing Symantec.... (Score:5, Funny)
-Rob
Great! (Score:3, Funny)
DMCA violation? (Score:4, Interesting)
Don't get me wrong; I applaud the efforts of the virus busters; I just figured it was yet another example of unintended DMCA side-effects.
Just walk without a rhythm... (Score:4, Funny)
I just Googled uninstall.pky (Score:3, Insightful)
Props to the White Hats (Score:4, Interesting)
wtf is going on here? (Score:5, Insightful)
If someone broke into your house, would you mind if a friendly neighbor quietly quietly followed them in and escorted the intruder out? Or perhaps you'd prefer your neighbor to let the intruder rob you, or whatever they intended to do.
They also didn't "hack" geocities like some have suggested...
I dunno, I just don't see anything wrong here.
Re:wtf is going on here? (Score:5, Interesting)
An look at ethical issues involved in "hacking-back" was written by a cow-orker of mine. It looks at different ethical systems and how they might be applied here.
It's called "Crossing the Line: Ethics for the Security Professional [lurhq.com]"
Reverse Engineered Fizzer? (Score:3, Funny)
Sure i agree its a good solutoin, but if they all get sued for it.... no good deed goes unpunished..
Re:Reverse Engineered Fizzer? (Score:3, Funny)
Great idea! Next let's... (Score:4, Funny)
But won't Micro$oft get upset when... (Score:5, Funny)
definitely a good thing. (Score:5, Insightful)
Have you ever tried to explain to an end user what a virus is and how it works? Few have a decent understanding of what viruses are all about. Even folks with a technical background have a hard time keeping up with them, and knowing all the types.
As operating systems and viruses get more complicated, this gap will only get wider. I saw that article/paper arguing that as computers becom almost biological in complexity, they must be able to fix their own minor problems. Same type thing.
No more fizzer (Score:3, Funny)
i got nothin' this morning
Something wrong here? (Score:4, Insightful)
I mean I can't even link a picture from geocities to another site.. but Geocities lets this worm update itself from something on the webpage?
Even past that i saw something mentioned about bandwidth.. if Fizzer is that bad wouldn't its constant updating overload the free bandwidth from the geocities site?
Educate me please.. I'm kinda confused here.
Fizzer is not Curious Yellow, but it's close. (Score:4, Informative)
And I worked out how to kill it in a post in the Curious Yellow Discusion [slashdot.org].
subsequent posters suggested that designing a worm using crypto and a truly distributed archetecture would make us a lot less smug in future.
we've been warned folks. What are we going to do about it?
how is this ok and code green wasn't? (Score:5, Insightful)
Looks like it's better to ask forgiveness than seek permission.
worm should have used DRM kind of stuff. (Score:3, Insightful)
Right idea, wrong URL. (Score:5, Funny)
-- this is not a
Re:Huh? (Score:5, Insightful)
Seems similar to RIAA requests... (Score:3, Insightful)
I mean this in the context of the Geocities web page. Do they have permission to alter the contents of that page??
Solution is elegant, but lets be consistent and understand the implications.
Re:Seems similar to RIAA requests... (Score:4, Interesting)
Re:Seems similar to RIAA requests... (Score:3, Funny)
I set up a Geocities page in 1997. After they were bought by Yahoo, my password stopped working and I haven't been able to delete the page in years- which sucks because it's embarrassing to have a page with the digging man GIF in 2003. Geocities is unresponsive. I guess the solution is to release a worm that checks to see if the page is still there!
Does anybody have a copy of Fizzer? I have to edit one of its resource strings and post t
Re:Seems similar to RIAA requests... (Score:4, Insightful)
DRM itself isn't wrong, it's just a technology. Government mandated DRM is wrong because it eliminates the choice of using it or not. I don't see how that relates to this situation at all, since no laws say people have to have the Fizzer installed.
Re:Seems similar to RIAA requests... (Score:4, Interesting)
Pure genius, really.
Mad props, Reddog.
-- Antiarc
Re:Huh? (Score:4, Insightful)
Re:Huh? (Score:4, Insightful)
Realistically, I'm not opposed the act. Its a good solution to real problem. But it is more important to maintain civil order. If there was a government approval along the lines of a search warrant to do this, than I say okay. Not that I trust the government, or think it is competent in these matters, but this is what the government should do. It's got its hand in a lot of pies where it doesn't belong, but it's real purpose is civil order and public defense.
Re:Huh? (Score:3, Insightful)
Be realistic. They're not hijacking your computer. They're removing a virus.
Don't rely on this advice, though. I am just a student.
Re:Huh? (Score:5, Informative)
Re:Huh? (Score:3, Interesting)
Except that they went out of their way to delibrately place this executable where they knew an automated process (which was almost certainly installed without user consent) would execute it from. While I agree with the notion of trying to clean up the Fizzer worm, it's possible they may be going about in a way that's less than lega
Re:Huh? (Score:5, Interesting)
Let's try another analogy then:
Let's say that you are just an average person going in to get a flu-shot at the doctor.
The flu vaccine wasn't manufactured correctly and has a small amount of contamination that causes people to become slightly feverish. It's not fatal, but it's uncomfortable.
The health authorities, rather than trying to re-vaccinate everyone effected, put the cure (100% safe and effective) into the public water system to help everyone as quickly as possible, prevent the spread of the problem, etc.
How do you feel?
Re:Huh? (Score:4, Interesting)
Re:Huh? (Score:5, Funny)
Re:Huh? (Score:5, Funny)
Re:Huh? (Score:5, Interesting)
Even better, it should not go to a hardcoded URL. This makes it too easy for the enemy to take over a vulnerable web page and attack the worm operation.
The worm should download its code via. P2P, maybe IRC, or maybe even Freenet. Especially Freenet. This way, the more the worm updates are requested, the more they replicate.
Maybe the worms could even try to keep track of each other, forming their own network, in a very low-key, low bandwidth, gnutella kind of way.
Finally, you had better not be shown to have the private key when the bad guys come knocking.
Re:Huh? (Score:5, Insightful)
Yup. Untraceable, but probably useless if you want to use machines behind nat/firewall.
Maybe the worms could even try to keep track of each other, forming their own network, in a very low-key, low bandwidth, gnutella kind of way.
This was the idea behind the Curious Yellow [blanu.net] concept. It was featured on Slashdot a while ago.
Re:Huh? (Score:5, Funny)
Viruses should put EULA's on them! I mean how many times do you see them posted to bugtraq, or disected and discussed. This is a clear violation of the copyright the author has on the code!
Of course, I'd love to see that author try to sue someone over it.
Cracker: He stole my virus.
Judge: I award you $1000 in damages, and 20 years in jail.
Re:Huh? (Score:5, Funny)
Re:Huh? (Score:4, Funny)
Hmmm... yes, it seems as though this is opening a can of worms...
Sorry, I couldn't resist it.
Re:Huh? (Score:5, Funny)
Re:wtf? (Score:5, Insightful)
Yeah.. what adverse effects? Can they be any worse than what's already there? Seems to me if you don't have the worm stop worrying about the effects. If you do have the worm.. get rid of it on your own.
The rest of us (the IRC Community) have to deal with the threats as they come down the pike.
Re:wtf? (Score:3, Interesting)
Exactly. As opposed to Windows Update, which (coincidentally) was vilified just yesterday on these hallowed pages, and will prompt you to allow the update unless you've explicitly turned it off.
Oh wait...
Re:wtf? (Score:4, Funny)
Fizzer uninstaller:
format c:
I don't see any adverse effects.
Re:wtf? (Score:3, Insightful)
Imagine you were in the bizarre situation where you had to shoot a terrorist to stop him from blowing up the entire world, killing everyone.
It is wrong to kill - but in this situation surely it would be right to.
Re:wtf? (Score:4, Insightful)
2 Wrongs would be if the terrorist blew up the world, so then you kill him.
I guess 1 wrong can make a right!
Re:wtf? (Score:4, Insightful)
Re:wtf? (Score:3, Insightful)
It is wrong to kill
Obviously not. If someone is trying to kill me, I am well within my rights to kill him first. It is only murder that is wrong.
But 3 Lefts Do! (Score:4, Interesting)
1) Run the risk of potentially damaging peoples' computers by running code on them that hasn't been thorougly tested on all platforms.
2) Leave a massive network of compromised systems in place which could be used to launch a massive DDOS against banks, internet connected water and electrical grids or law enforcement networks.
IIRC (IANAL) the law gives you a good amount of latitude in defending others. This includes the little-used ability to make a citizen's arrest and also allows you to kill to protect others in some circumstances.
I'd put my money on the correct choice being to remove the weapon from the hands of the criminals.
Re:wtf? (Score:4, Funny)
"Yes, yes, I know that, Sydney
Re:wtf? (Score:3, Insightful)
No, this is different (Score:5, Informative)
Also, intent does factor in to laws. What you intend to do can affect whant kind of crime you are guilt of, or even if you are guilty at all.
Re:wtf? (Score:4, Informative)
Yeah considering the worm never really got anything from that site in the first place. because the geocities account never existed.
From http://www.livejournal.com/users/kalyan/84241.html [livejournal.com]
Re:wtf? (Score:3, Informative)
Re:wtf? (Score:3, Informative)
http://www.geocities.com/spkyupdate/upd1.jpg
when in FACT the page is:
http://www.geocities.com/updatesparky/sp1.7ls
Of course, the detective work I had to do to locate this information consisted of READING THE COMMENTS from the actual page you linked to.
Re:wtf? (Score:3, Interesting)
I don't know why this is modded as flamebait. I think it's a perfectly valid question. Especially with all the people on slashdot that complain about Windows Update breaking more things than it fixes.
I agree that this now self worm is a good thing and I don't really know what exactly it does but what if there's some infected computer that the fix has an adverse effect on? Are
Re:wtf? (Score:5, Insightful)
Nope. This is perfectly legal. They aren't breaking any security on the infected machines, and they aren't contacting them.
All they're doing is putting a file on a webpage. It's not their fault that the infected machines run whatever is on that page.
Generally, have illegaly used someone else's computer, you have to have defeated some sort of access control mechanism. At least that's how it is in NYS.
Since the remote computer is initiating everything, and all they're doing is answering requests, it would be pretty hard to charge them with unauthorized use of your machine.
Think of it this way:
1. The remote computer goes: "What do I do?"
2. The server goes: "Well, since you're asking, I think you should do this."
There's no stolen password, and there's no exploit needed.
Here's another example:
I put a box on the internet, let's call it pk12.foobar.com. This box is a Linux box which accepts any username/password combo as root, and no notices that it is for private use only. Under NYS law (I'm not sure about federal) you can come along and use any services my box provides, including telnet, http, ftp, etc.
IMO, if the fix trashes your data, tough shit. Are owners of DDOS zombies held responsible for the damage their computers are doing?
Morally, this is like parking in front of a hydrant and then bitching because they smashed your windows to run the hose though your car or towed it. It's doesn't matter if you knew you were parked in front of the hydrant. Your car was causing a danger and it had to be dealt with. If you don't want that happening to your car, you should make sure you don't park in front of hydrants. It's your car. You are responsible for it.
Re:wtf? (Score:4, Interesting)
RIAA's counterpoint:
All we're doing is putting a virus-infected MP3 file on our own machines and running KaZaA. It's not our fault that people download it and run it on exploitable software.
Is there a difference here?
Truthfully, maybe not. If somebody had hacked the geocities page in question and caused fizzer to completely toast the OS it's running on, that would certainly be illegal (even if the person was not the original creator of fizzer). The fact that you are doing something good does not necessarily factor into the law.
However, the key point here is this: nobody is about to go out and sue the Fizzer Task Force for doing this. We are all pretty happy about it, and most of us think it's a pretty clever solution to a real problem.
Re: (Score:5, Informative)
All they're doing is putting a file on a webpage. It's not their fault that the infected machines run whatever is on that page.
Generally, have illegaly used someone else's computer, you have to have defeated some sort of access control mechanism. At least that's how it is in NYS.
Except that the "access control mechanism" is already broken. The [illegal] virus has already set up shop on that PC. The "fix" merely exploits the behavior of the virus to get a file onto you PC.
Put another way: Just because you didn't create the *original* hole, doesn't give you *any* right to crawl into it on your own.
Put another way: If your software ends up on my machine, ends up *running* on my machine, and I didn't agree to have it there, or run it, you're still in the wrong, no matter your intentions.
So, for the sake of my argument, and because it's what the fix really is, I'm going to call it was it is: an EXPLOIT.
Those infected with the virus are pretty fortunate that the folks who posted the exploit to the Geocities site were well-intentioned folks, instead of someone with more destruction in mind.
Had a black-hat type gotten to the Geocities page first and posted an even _more_ malicious exploit, I have a feeling the opinions here would be very different. If it Were RIAA or the MPAA?!? Look out, man! The bitching and moaning would never cease.
But, it's the whole road to hell/good intentions pavement thing. Eh.
Re: (Score:3, Insightful)
If a burglar drops his gun, and you pick it up and shoot the burglar, that is a good (and usually legal) thing. If you pick up the gun and shoot the bank teller, you're gonna fry. That should be obvious.
Using an exploit to remove the exploit is a pretty good idea. Of course it should be tested beforehand, and shouldn't do anything risky (like deleting infected files). In this case they said all it does is remove the registry keys
Re:wtf? (Score:4, Insightful)
Good intention does not turn an illegal act into something legal.
Actually there are plenty of laws which consider intent. Here are the NYS computer crime laws [cobleskill.edu] for example. Go ahead, Control-F, type "intent".
Re:wtf? (Score:4, Insightful)
In your examples a deception, misrepresentation, or a deliberate circumvention of existing security mechanisms is being employed. None of these things are happening here.
In the situation at hand neither of these things is happening. The worm is looking for an
they haven't tested this update on a wide variety of systems, and it may cause a lot of damage and data loss. It's not their place to make that kind of a decision.
Cry me a river. These systems are already hacked. If you want your system to be reliable, you shouldn't have worms on it. It's not like this is the first day Fizzer hit or something.
If you don't want your system to automatically download and execute code at a certain URL, why don't you make sure your system doesn't do so?
I wouldn't be suprised if this method was totally legal.
How about this: Why don't you try and tell me what law you think they're actually breaking?
Normally, I would be against any sort of "hack them back" actions, but I just can't see how this is hacking them. If the infected machines were just checking the webpage for the word "monkey", would adding the work monkey to that page be illegal? I just can't see how it would be.
Re:Could be done better... (Score:3, Insightful)
An analogy. I regard this as the equivalent of walking by a a car with its windows down in the rain and rolling them up. It's just goo