It is literally the new Wild Wild West...

[Cyxeris]

MyDoom knocks down U.S. Web site
Sunday, February 1, 2004 Posted: 7:43 PM EST (0043 GMT)

SEATTLE, Washington (Reuters) -- The MyDoom Internet worm has knocked down the Web site of a software company by bombarding it with a flood of data as Microsoft Corp. prepared for a similar, planned attack by the virus-like program this week.

The SCO Group Inc., a software company that has drawn the ire of Linux advocates for trying to collect license fees for the freely available software system, confirmed MyDoom had knocked its Web site, http://www.sco.com, out of commission.

After defending the site in the early stage of the attack, SCO shut its site down entirely.

"Rather than try to continue to fight, we felt it was more advantageous to bring the site down and make that bandwidth available or other users," SCO spokesman Blake Stowell said Sunday.

He added SCO and Microsoft, which is being targeted by a variant of the MyDoom worm, have each offered a bounty of $250,000 for information leading to the capture of the author of the malicious program.

The world's largest software maker said was it preparing for an attack by the variant worm, called MyDoom.B, which security experts have said will happen on Tuesday.

"Microsoft remains diligent," a company spokesman said.

The speed and severity of the attack surprised security officials, although there were no other reports of outages or slowdowns elsewhere online due to the worm.

But experts warned that the main threat remained to unsuspecting recipients of the worm, which spreads by spamming itself to millions e-mail accounts around the globe.

"At this particular point people shouldn't lose sight of the fact that the virus is still spreading," said Vincent Gullotto, vice president of the anti-virus emergency response team at Network Associates Inc.

Will it get worse?
MyDoom.A, also known as Novarg or Shimgapi, emerged nearly a week ago in the form of a spam e-mail message that contained a well-disguised virus attachment and has been described as the most-damaging attack since last summer's twin Blaster and SoBig outbreaks.

MyDoom was programmed to take control of unsuspecting computer users' PCs from which it launched a debilitating denial-of-service attack on SCO on Sunday.

SCO has drawn the ire of the so-called "open source" programming community who object to the company's claim that it has copyright control over key pieces of the Linux operating system.

The MyDoom attack trigger was set for 1609 GMT on Sunday.

But with so many computer clocks incorrectly set, the infected machines began firing off data requests at SCO.com hours earlier, said Mikko Hypponen, research manager at Finnish anti-virus firm F-Secure.

[I find that somewhat amusing, myself]

"It will only get worse for SCO as time goes on," Hypponen added.

The MyDoom.B variant, which is also programmed to attack SCO, has not spread nearly as rapidly as MyDoom.A. MyDoom.A is believed to have infected more than one million personal computers.

Security officials have warned computer users to delete suspicious e-mail messages that appear to come from "Mail Administrator" and other official-looking addresses that contains a file attachment.


Cyx

[Cyxeris]

No. 1 software firm offers $250,000 for information on creator of worm seen costing firms $250M.

January 30, 2004: 8:05 AM EST
By Andrew Stein, CNN/Money staff writer



NEW YORK (CNN/Money) - Microsoft became the latest company to offer a reward for information leading to the arrest and conviction of the creator of the MyDoom virus -- an e-mail worm that is expected to cost companies up to $250 million in lost productivity and technical support expenses.

"This worm is a criminal attack,' said Microsoft's general counsel Brad Smith in a statement. "Its intent is to disrupt computer users...Microsoft wants to help the authorities catch this criminal." The company is offering $250,000 for information leading to the arrest of the worm writer.

The MyDoom worm that is spreading across the Internet is more costly than the recent So Big or MS Blast viruses that were launched last summer because it leaves behind a "Trojan horse," said John Pescatore, vice president of Internet security for Gartner Inc.

A Trojan horse is a program sent to a computer through an e-mail and can remain behind after the e-mail is deleted to copy or damage files.

"The spreading of the worm has slowed down slightly, but the real cost is going back and cleaning computers," said Pescatore, who estimated that the SoBig virus cost companies about $50 million for lost productivity and technical support expenses.

"MyDoom will be about four or five times that because of the extra time and resources it takes to go back and secure the computers," Pescatore added.

The largest cost will come from medium-to-small sized companies with 400 employees or less, said Andy Cummins, CEO of technology services firm U.S. Networks.

"We think MyDoom will cost these companies $48,000 to $58,000 (each) to secure themselves from MyDoom," he said, adding that his systems will see an estimated 1,000 occurrences of the worm in the next 14 days.

While the virus has been clogging up in-boxes, it's also on course to attack the Web site of software firm SCO Group with a deluge of e-mails Feb. 1. It seems the virus is targeted toward SCO for its royalty fight with IBM over Linux code.

But MyDoom's main threat remains the Trojan horse.

"The denial of service attack on SCO could be seen as a diversion, but it's more like an ID tag from the creator," said Pescatore. "After the attack on SCO, the Trojan horses will remain behind and can still inflict damage."

Bounty hunters
Joining the ranks of software bounty hunters, SCO Group announced Tuesday that it is offering a $250,000 reward for info leading to the arrest and conviction of the virus writer.

In November, Microsoft (MSFT: Research, Estimates), the world's largest software firm, said it created an anti-virus reward program, backed by $5 million of its cash, to help law enforcement agencies catch the authors of computer worms.

As part of the program, the company announced two $250,000 rewards for information leading to the arrest of the writers of two previous computer worms -- the Blaster worm and SoBig.F e-mail virus -- that crippled many PCs running on the Microsoft Windows operating system in the summer.

The latest $250,000 reward is for the creator of the MyDoom.B variant, which also blocks access to anti-virus and Microsoft's Web sites.

A Microsoft spokesman said the company has not paid out any money from the previous rewards for the SoBig or MSBlast viruses, but FBI spokesman Paul Bresson said the agency has received some good information on the cases as a result of the rewards.

Despite the continuing proliferation of e-mail viruses, Microsoft co-founder and chief technology officer Bill Gates predicted last week the eventual demise of unsolicited commercial e-mail at the World Economic Forum in Davos, Switzerland.

"We as a company believe that by a couple of years from now spam will be down to a very manageable trickle ... it will be almost an afterthought," Microsoft spokesman Sean Sundwall said.

[elektro80]

Send in the marines! Send those silly destructive little a@@holes to Mars.

[mosc]

Bill Gates should be facing jail time for selling software that facilitates this. The cultprits are his own developers. Now send me my $250,000 please.

[elektro80]

Hey... you are rich!


yes.... indeed.. the security holes in the various strains of MS Windows are completely silly. Just the idea that receiving an email will fuck your puter is insane. A class action suit against Microsoft? Criminal stupidity??