This discussion has been archived.
No new comments can be posted.
New Linux Worm Found in the Wild
Related Links Top of the: day, week, month.
Work without a vision is slavery, Vision without work is a pipe dream, But vision with work is the hope of the world.
Re:A few hopes... (Score:2, Interesting)
Most likely they don't give a shit or didn't even consider it. Not everybody is politically motivated. Some people actually see computers as nothing more than a tool, and don't really care if we live in a communist "free" world or a market-driven capitalist one, as long as their computer helps them do what they want to do. It's just a hunk of silicon, steel and plastic - it has no soul, no social conscience and its configuration is no reflection on themselves.
What a revolutionary idea!
Having said that remember that people writing worms are not likely to care much about the effect of their actions, whether it's denying you connectivity or canonizing Bill Gates.
what does it look like? (Score:5, Interesting)
your friendly neighborhood AC
Questions: (Score:2, Interesting)
> I find it terribly amusing how for years the open-source community has used the larger number of holes found in Windows systems as one of their arguments against it. Yet now when the open-source community is also plagued with the same thing the comments tend to be along the line of 'Windows still sux.'...
"Wget"ing its source (Score:5, Interesting)
Rather than simply having deleted the page, I wonder if it would have possible to replace this source code with something else that acted as an "antibody"?
A false sense of security (Score:4, Interesting)
On the other hand, the adminstrators of Windows machines, because they are facing a new worm every second day, try to stay uptodate with the latest news and patches. Most of them have aautomatic update wizards running on their machines which download new patches instantly.
Infact I would prefer such an instant update wizard for Linux as well, especially for the Linux running security critical applications, so that even if the system adminstrator is too lazy to check a news site, he will still come to know abot the threat.
And because it will be running on linux, it will do what its supposed to do, not "God knows What and Gates knows what" as is the case with windows update wizard.
Comment removed (Score:4, Interesting)
Re:The Worm (Score:3, Interesting)
The Slashdot community, on the other hand, has for years appended a third comment: we're superior, we're Linux buffs, we're the best, and we apply patches.
Maybe the Slashdot community does. But let's face it -- in the face of this smug and elitist attitude comes the fact that thousands of Linux servers are being compromised because their administrators don't apply patches in a timely fashion. Remember, too, that when the Nimda et. al. worms hit, the Slashdot discussions included many regular readers who are also Windows administrators calmly pointing out that they had had no difficulties as they were patched long ago. Interesting, too, to note the (huge generalisation) often calm and mature reaction versus the yelling and screaming and chest-beating reaction of the "see-we-really-are-better-than-you-nyah-nyah-nyah
If you show me a list of documented, unpatched holes, I'll show you a mailing list / IRC channel / news group that just found a list of things to do for the afternoon.
Very valid point. So let me ask you (plural you here) -- when was the last time you spent an afternoon coding, testing, reviewing, and QCing a patch? Maybe you're one of the admirable group who actually does code patches in your spare time. But, more likely, I suspect, is that the vast majority of the readers of this message never have and never will submit a patch.
Inexperienced teenagers (a large subset of all teenagers) and newbies are unable to refute your statement that Linux is as bad as Windows
I'm sorry, but I couldn't let this one go. The original poster didn't make such a statement. Not even such an inference. The post, instead, merely pointed out the hypocrisy demonstrated by the attitudes described.
And it was correct.
Slapper author got caught! (Score:2, Interesting)
Sent: Tuesday, September 24, 2002 9:54 AM
To: firewalls@isc.org
Subject: Slapper worm redux;
Those folks relying upon security through obscurity might well wish to get
on the ball and fully patch-up;
September 23 VNUNET.COM.
A suspect has been arrested on suspicion of authoring the Slapper worm.
But although the threat of the worm seems to have been short-lived, a new
variant is already set to take up where its predecessor left off. Although
the ISC's 'most attacked ports' chart no longer features Slapper in its
Top 10 a variant, Slapper.B, has been spotted in the wild. Slapper.B has
several subtle differences, but is for the most part an updated version of
its predecessor. Both worms attempt to exploit a known vulnerability in
the Secure Sockets Layer 2.0 (SSLv2) handshake process. The two variants
also carry the same payload, a password-protected backdoor and denial of
service (DoS) capabilities. ISS's Morgan said that with the new variant on
the loose his company had calculated that about 10,000 servers were
probably now infected, and that the network was probably going to be used
for DoS attacks. He added that it was unlikely the original author created
the second worm. "It was significant that source code for the original
Slapper was distributed within the computer underground immediately after
the worm was detected in the wild," he said. Source:
http://www.vnunet.com/News/1135274
--
"Cutting the space budget really restores my faith in humanity. It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
***testing, only testing, and damn good at it too!***
OK, so you're a Ph.D. Just don't touch anything.
Think Pinto (Score:2, Interesting)
Ford new of the problem, and even had a "patch" to fix it (minor design change adding some shielding around the tank if I recall). They chose not to fix the problem because of economics.
The same principle applies to large companies and security patches - If there's no exploit and we don't tell anyone the problem exists, maybe we can get away without investing the time/money (programmers are expen$ive!) in fixing it. Much like Ford, they are gambling that the losses due to the bug/hole/whatever won't be significant enough to hurt their profits long-term.
Software is a business, like any other, and businesses tend to make stupid decisions when they see a way to save a few pennies. They may be wrong (VERY VERY WRONG), but until EVERYONE makes it clear that the "patch it when it gets exploited" mentality hurts their business, the companies will continue doing as they have done.