[aclug-L] Re: FW: Does the end justify the means?

[james l <james@xxxxxxxxxxxxxxxxxx>]

Root/Great Overall Dictator replies:
> With all that has been happening lately, I thought everyone might be 
> interested
> in reading about the lastest Linux Worm - The Cheese Worm.
> 
> --dwh
> 

Hmm... if you don't want it firewall off port 10008, but even so, it is a fix
for a virus. 

I personally think it was someone trying to address the 'linux distros are too
open' problem, by targeting a specific worm's backdoor. I don't worry too
much about it, as A) your machine must have been infected with another worm
already, and B) it is perl, an interpreted language so you have to be able to
read the source right? (and determine what it did) C) If you get it, you
should wipe the machine clean and start over, as it was already infected.

To me it kind of sounds like the second polio vaccine (where it itself was a
modification of polio, and spread that way) If we had some way to be sure,
say a 'worm' like this that says "Your system was infected by a worm
(normally known as a virus) that left a backdoor, which is how this patch
entered, if you wish to run it, type "Iwishtorunit", if you wish to check the
signed file against xxxx's (Redhat, Debian, etc) public key (to verify this
is not a malicious virus) go to http://fhdsafdskjaf/fdshafj.html), the file
will reside in /tmp/patch-for-worm75845, if you wish to run it later"

Something like that would be wonderful, this, I am kind of leary. The problem
with that is that it could be easily mimiced and people are lazy and might
not check.


James L.

hmm... Clint, cheese, clint, cheese..........
-- This is the discussion@xxxxxxxxx list.  To unsubscribe,
visit http://tmp2.complete.org/cgi-bin/listargate-aclug.cgi