Author Makes Symbian Virus Code Available 49
putko writes "The NY Times (registration required) has a story about a Brazilian software expert whose posted the code for his Bluetooth virus on his website.
The article has a general anti-free-exchange-of-information tone to it. Security firms call him bad. Nokia is concerned.
Here's his homepage (in Portuguese), so let's not unnecessarily DDoS him:
The most irritating bit of all this is that the guy writes the thing, distributes it, gives it a name (eponymous) and then the stupid virus firms go and butcher it -- e.g. "Lasco.A". What's so wrong with "Velasco" already? The guy clearly wants it to be named after himself."
Yeah (Score:1, Insightful)
Re:Yeah (Score:1, Funny)
Re:Yeah (Score:2, Informative)
It is the explicit (and logical) intention of AV comapanies not to name rogues in the fashion the author desires.
Symantec's Policy is as folloes
Virus names consist of a Prefix, a Name, and often a Suffix.
* The Prefix denotes the platform on which the virus replicates or the type of virus. A DOS virus usually does not contain a Prefix.
* The Name is the family name of the virus.
* The Suffix may not always exist. Suffixes distinguish among variants of the same family and are usually numbers d
A few examples (and commentary) (Score:2)
The infamous "netsky" viruses were released by a group calling itself "Sky Net".
It's a real nightmare for sysadmins trying to figure out if their software blocks a certain threat, when each A/V vendor picks their own name. Many of those names are selected independently, and it's understandable that they don't want to change their names after they've released their updates. So, the obvious solution is to have the virus-writers come up wi
Re:A few examples (and commentary) (Score:1)
I remember Bagle/Beagle well , I believe Sophos called it one name and Symantec the other. I do empathise , it is incredibly frustrating to get high level alerts from different vendors about apparently different rogues , all within the space of a few hours.
I recall one company even decided to try to coem onboa
I'm confused (Score:5, Insightful)
There's something to be said for being open and free, but there's also taking it too far.
Re:I'm confused (Score:3, Insightful)
But now, we, the customers suffer from it.
I don't think there should be any debate here (Score:5, Interesting)
If he were a bad guy, he would be playing with your credit card, or even worse, shutting the hell up, and letting someone else discover the vulnerability, and using it.
Maybe you think he should have contacted the responsible firms first, but that's too delicate, he could even end up with legal trouble because of that (think.. extortion)
This way he will probably get the vulnerability fixed, and bluetooth users are the ones who benefit.
I don't believe it's taking it too far.
Re:I don't think there should be any debate here (Score:2)
Now no one has to figure it out, they just have to do it how he told them to do it. It's certainly a lot easier to exploit when you tell the whole world how to do it.
Re:I don't think there should be any debate here (Score:4, Insightful)
Re:I don't think there should be any debate here (Score:4, Insightful)
Just because nice guys refrain from discovering vulnerabilities, it doesn't mean the bad guys will!!
The guy is just trying to force the hole to be closed.
The situation before this guy was that your phone was vulnerable, and you were ignorant. The situation now is that your phone is vulnerable, and you are aware of it, and probably won't buy another vulnerable bluetooth device until it's fixed.
I don't understand why you prefer the first scenario. It's actually possible to write vulnerability-free software. It is way too expensive, but maybe it should be required.
If people keep thinking that holes whuld just be overlooked instead of fixed, there will never be any value on providing secure software.
Re:I don't think there should be any debate here (Score:2)
Who are you kidding? The situation before was that my phone was vulnerable, and that only one guy knew anything about it. Now, everyone knows all about it, including people who will use it to create viruses. The odds are now higher that I will get a form of this vi
What is the right thing to do then? (Score:2, Interesting)
It seems the debate is split mostly along the line of whether or not the dude in question should have released the code. Correct me if I'm wrong, but both sides seem to agree that knowing about a vulnerability and keeping silent is bad. The dividing point is what and how much information do you release about what you know about this vulnerability?
On the one hand, releasing the full exploit code is probably pretty damned irresponsible. Now any idiot that can tweak a line of code or two can roll their own S
Re:What is the right thing to do then? (Score:1)
Virii is jargon, just like boxen. It doesn't have to fit grammar perfectly.
Re:I don't think there should be any debate here (Score:2)
Pleaaase!!
What makes you think that only one guy knew anything about it?
That's just what _you_ know.
I believe, given most new technologies, it only takes some knowledge, and much effort, to find exploitable vulnerabilities, if you have something to gain from it. The guy is _one_ of the people who knew the vulnerability.
After this, your next phone will have one vulnerability less. If it
I agree? (Score:2)
You can prove that a non-trivial program has an error, but you can't prove that it has not (Dijkstra?)
Re:I agree? (Score:2)
In functional languages, like Haskell, it would be easier to prove the program does what you want.
I think Hugs can help you derive error-free programs (I never attended the error free programming workshop, but that's what they claim).
You can always argue that the compiler is written in C or ASM, but you can get pretty close to error-free, at least with a much higher confidence.
Re:I don't think there should be any debate here (Score:2)
Re:I don't think there should be any debate here (Score:2)
Re:I don't think there should be any debate here (Score:2)
Yes, but in a city of 20,000 homes, one open door isn't likely to have a burglar find it. However, if some dickhead puts up a neon sign saying "this guy's door is open, someone could easily rob him", the the odds that a burglar find it go way up. And, really, what benefit was there in putting
Re:I don't think there should be any debate here (Score:2)
The problem here is that he can't just talk to the companies, and say he has an exploit.
If he mailed the companies and said that they should release a fix or else he releases the exploit, that's extortion.
If he just tells them of the exploit, and expects that they do the right thing, e would be putting his trust on the wrong entity, a
Re:I don't think there should be any debate here (Score:1)
Re:I don't think there should be any debate here (Score:2)
Consider these statements;
A. "May want to your fence, I'm getting a mastiff next month."
B. "If you don't fix your fence, I'm going to sic a mastiff on your cat."
C. "$500, or I'm going to kill your cat".
"A" is an informative statement, reminding a neighbor of his responsibility to maintain his fence.
"B" is a threat of violence. It effectivly promises a dead cat for a failure to do as told.
"C" is extortion.
Replace "fence" with "product
Re:I don't think there should be any debate here (Score:2)
Re:I don't think there should be any debate here (Score:2)
The security problem is more a legal problem than a technological problem. A typical house lock is extremely easy to
Re:I don't think there should be any debate here (Score:2)
This is why I brought up the house lock example. Nobody tries to make them truly secure. Many of them can be opened with a credit card. Most others can be opened with a bent paperclip.
Besides, you don't need exploits for an unlocked door. An exploit is the software equivalent of lockpicking equipment.
Honest people don't need to be "kept honest".
A lock is usually used to indicate that something is off-limits to the public. O
jealousy (Score:3, Insightful)
What good is antivirus software if it can't protect against all viruses? How better to protect against them to have written them yourself?
-1 flamebait
Why Lasco.A...? (Score:3, Informative)
As for using this guy's name, why would we want a virus writer and distributor to become famous?
Grab.
Malware routinely gets renamed (Score:4, Informative)
It's not much of a leap to assert that most malware is, on some level, a form of ego tripping, and most malware authors, much like the authors of any other software, would like to see their work spread far and wide.
Hence, antivirus companies always change the name.
Whether or not a virus had a name to begin with, each vendor will select a name of their own for it to deprive the author of that fame. Why encourage them, you know?
But there's the other bit of ego -- each vendor will select a name of their own. For a prominent attack, one of these names will make it into he wider media, and being the vendor that named it is itself an ego boost for that company.
So, all of this naming nonsense is just a stupid dickwaving ego contest. We'd almost be better off if we did like the National Weather Service and named each year's outbreaks in advance, before any of them are spotted in the wild, just to neutralize the stupid games that go on over what this junk gets called. Not that that'll ever happen, of course...
I wonder... (Score:3, Insightful)
You know, my gut reaction on reading the article as posted was, "What a goddamn piece of bullshit flamebait - who cares whether or not the guy doesn't get to name the virus he created?"
But then I thought about it. Regardless of what it is, it is something that this Brazilian dude wrote. It's his intellectual property. He should have the right to name it. For the antivirus companies to tag it with their own name is equivalent to WalMart getting a box of "Home on the range" DVD's, ripping the covers off and selling them as "WalMart presents: The Disney cow movie!".
And before anyone offers any arguments about "not wanting to encourage virus-writers", let me say: bullshit. It doesn't matter whether it's a program, a novel, a song or a painting ... or a virus - intellectual property is intellectual property. Even people in jail own the copyrights on their goddam prison tatoos. Even Osama bin Laden [msn.com] has his copyrights. The laws are quite clear on this.
So... yeah. Velasco it is.
Re:I wonder... (Score:2)
Why allow AV companies to do something society prohibits in all other lines of work?
Re:I wonder... (Score:1)
Granted, the IP in this actual case would be copied, so you have a point apart from the analogy.
Re:I wonder... (Score:1)
Copyrighted work is protected from defacement. An analogy to the analogy would if I took a TV show and overdubbed the dialog with my own. In fact, the author could insist that the store not display his books at all, and be in the right.
Re:I wonder... (Score:2)
If I'm wrong, could you cite the relevant case law or legal code? I'm interested.
Re:I wonder... (Score:2)