www.economist.com/science/displayStory.cfm?story_id=2020978
F sent out millions of e-mails with that and other vague but enticing subject lines. Those unfortunates who opened the attachment to these e-mails will have had their machines infected by the virus, which will then have used their machines as platforms to spread the epidemic further. F was responsible for one out of every 16 e-mails that crossed the net. A few days beforehand, a worm called Blaster had taken control of hundreds of thousands of computers. A DDOS attack works by overwhelming the computer controlling a particular network by bombarding it with messages. Microsoft was able to deal with the threat by changing the address of the website before the scheduled attack time. Nicholas Weaver explains his 59 concept of the "Warhol worm". F's ultimate objective remains unknown--infected computers were meant to download a program from one of 20 pre-selected computers on the internet. However, pre-emptive action by America's Federal Bureau of Investigation prevented the author of the virus from loading his instructions on to those computers in the first place. Though both of these programs fell short of the apparent objectives of their authors, they still caused damage. For instance, they forced the shutdown of a number of computer networks, including the one used by the New York Times newsroom, and the one organising trains operated by CSX, a freight company on America's east coast. Computer scientists expect that it is only a matter of time before a truly devastating virus is unleashed. F was the more visible of the two recent waves of infection because it propagated itself by e-mail, meaning that victims noticed what was going on. F was so effective that it caused substantial disruption even to those protected by anti-virus software. That was because so many copies of the virus spread (some 500,000 computers were infected) that many machines were overwhelmed by messages from their own anti-virus software. On top of that, one common counter-measure backfired, increasing traffic still further. Anti-virus software often bounces a warning back to the sender of an infected e-mail, saying that the e-mail in question cannot be delivered because it contains a virus. F was able to spoof this system by "harvesting" e-mail addresses from the hard disks of infected computers. Some of these addresses were then sent infected e-mails that had been doctored to look as though they had come from other harvested addresses. The latter were thus sent warnings, even though their machines may not have been infected. F was so much more effective than other viruses that work this way is because it was better at searching hard-drives for addresses. F was capable of "multi-threading": it could send multiple e-mails simultaneously, allowing it to dispatch thousands in minutes. Worming into the system Blaster worked by creating a "buffer overrun in the remote procedure call". In English, that means it attacked a piece of software used by Microsoft's Windows operating system to allow one computer to control another. It did so by causing that software to use too much memory. Most worms work by exploiting weaknesses in an operating system, but whoever wrote Blaster had a particularly refined sense of humour, since the website under attack was the one from which users could obtain a program to fix the very weakness in Windows that the worm itself was exploiting. One way to deal with a wicked worm like Blaster is to design a fairy godmother worm that goes around repairing vulnerable machines automatically. In the case of Blaster someone seems to have tried exactly that with a program called Welchi. However, according to Mr Haley, Welchi has caused almost as many problems as Blaster itself, by overwhelming networks with "pings"--signals that checked for the presence of other computers. Fortunately, as Nicholas Weaver of the University of California, Berkeley has pointed out, the algorithms that worms use to spread themselves are not particularly efficient. Blaster, after infecting a computer, searched at random for others to infect. A clever worm, says Mr Weaver, would start with a list of 10,000 or so vulnerable computers. This could be assembled surreptitiously by several months of discreet probing over the internet. Such a worm, which Mr Weaver dubs a "Warhol worm" after Andy Warhol's famous aphorism about fame, could infect all those vulnerable computers in about 15 minutes, giving it a huge head start. If a Warhol worm were to be released, by the time anti-virus engineers came up with a patch to protect the vulnerability it exploited, it would be too late. And if the worm had a truly malicious payload that, say, deleted files pell-mell, the damage would dwarf that caused by recent viruses. Legal affairs Who, though, bears responsibility for such outbreaks? The author of a virus certainly does, and is subject to harsh criminal penalties in most countries. However, what about intermediaries who unknowingly transmit the virus? In the early days of the internet, the "packets" that encapsulate data in transit were handled without concern for what was within. However, recent efforts to enforce copyright law have been imposing new sorts of responsibilities on organisations that are connected to the internet. Internet service providers enjoy a "safe harbour" under American and European law that gives them exemptions from liabilities they might otherwise incur, so they are probably safe. And Jonathan Zittrain of the Harvard Law School's Berkman Centre for Internet and Society reckons that software companies are safe, too, for the moment. Their products are, he says, so full of bugs that any regime to make them pay for the consequences of failed software would bankrupt them--an outcome that few seek. However, his colleague John Palfrey says that it would not surprise him if a lawsuit were brought against an organisation which unknowingly but negligently transmitted a virus. And if you think virus writers are scary, you have clearly never met a tort lawyer.
|
http://csua.com/feed/