frozencesium's Journal: Fuck this!

What is the price we pay for being geeks (aside from social ostracism)? I'll tell you what...We get blamed for EVERYTHING.

Case in point...right now I'm being investigated for a virus that hit a lot of people in the dorms I live in.

1.) The dorms I live in are military. Oh, and yeah...I live accross the street from the NSA.

2.) I'm not that stupid to commit such a crime where I live (see #1). Even if I was...give me a little credit...I would at least hide my tracks better.

3.) The person accusing me is pissed at me for some petty shit and figures I'm the only one arround that has the ability to hack his system.

4.) The dumbass is running windoze 2k without a firewall, a virus scanner, has never patched his system, and has a NULL Administrator password (as I found out through a friend)...fucking duh...

Basicly what it comes down to is that I happen to know at least a little about computer security, he knows nothing, he got hacked...therfor I *MUST* be the one who did it...

Of course...this means an investigation is underway (which will clear me as I DIDN'T DO IT!), and they may sieze all my boxes to search them...me without my computers and an internet connection for several months would be a bad thing...

I'm pissed.

-frozen

I'm sorry

[jawtheshark]

This must suck majorly. What strikes me is that a random student (I assume it's a student) can accuse another random student for such a "crime". Besides, if you're an IT student, then writing a real virus is "research"! At least that's my opinion. It's not as if bio students don't get to play around with real virusses. Just don't let it go out in the wild.

The problem with insecured networks, like college dorm networks, is that a multitude of unregulated computers may connect to them. I mean you can't stop that idiot user from connecting to the network with that sieve of his. It would be complete irony if this virus would have used his platform to spread like it did. That would bring him in deep shit. No antivirus? How stupid can you be?

Finally, do you know what this virus is exactly? It might be a known one. If it's known by SARC, you cannot have written it: just double check the discovery dates and the dates of epidemic at the dorm network. Who says that this virus was written within the dorm in the first place. Perhaps it was just infiltrated somehow (see "insecured network above").
I don't know if they still exist, but back in the DOS days there were Virus Generation Kits. If that particular virus was generated with such a kit, virtually everyone could have created it. I mean my sister -who just started HTML [willekens.lu]- can create a virus with such a kit. Especially, I guess they are now point-n-click.

Oh, and for your pr0n collection. If you need a headstart for a new one, I'll gladly burn you some CD's. (If you liked the ones Corporate Troll published, you will like my pr0n collection). On the other hand you must have nice broadband at college. It's not as in my days at college where 6Kbyte/s was fast on the X-Terms.

Re:I'm sorry

[frozencesium]

I'm attending college, but right now the dorms i'm in are military.

i messed up in my first (well 4) years at the university. now i'm letting the US Air Force pay my way through college. I'm "Active Duty", but going to school part time while i'm "in."

the virus (from what a friend leaked to me) is a hydra. it looks for mutiple exploits in windows NT based systems and attacks "open" boxes. it even looks for and disables "nortan(sp?) anti virus." it then tries to attack a random block of IP addresses and brute forces the NT password hash. It first fingerprints the box (if it's a *nix system, it leaves it alone), then uses dictionary files to crack the current user name and password. It then tries to spred to the next block, while storeing the user names and passwords of positive results in a file, then distributes them via IRC. it also checks to make sure that the connection is a broadband connection...presumeably to make the box a zombie fserve...but i haven't seen that part. after it's run, it cleans up after itself (deletes log files and itself). In this case, it got caught in the middle of it's run. I haven't checked to see if it matches any currently known viruses, but i imagine it matches half a dozen at least...

as you said...no virus scanner, no firewall, NULL as the Administrator password...that's just asking to be bent over and fucked by someone.

-frozen

ps
thanks for the offer to replace my p0rn collection, but i'm waiting until the investigation is done before i consider it...i don't want anything questionable on my b0xen at the moment ;-)

Re:I'm sorry

[jawtheshark]

Well... as long as you had fun during your fuckups at College it's all right ;-) I should have had more fun... you know, like chasing girls and such stuff instead of coding and graduating on time. One only realises that after you're done being a "good student".

Sounds indeed like a pretty common virus. Having the name (you know W32.Hydra.ABC) would be nice. I have the latest antivirus of Norton (5 seat license, legal of course), so if you -or your friend- emails it to me I can see what Norton says about it. Having such information is priomoridal to prove your innocence. Guess, that the old adge of "innocent until prove guilty" doesn't work in "computer crime".

My pr0n collection is mainly legal, I have some stuff from Gnutella that is very dubious and I really should shred it myself ;-) Sits on the inactive disk in a cardboard box at the apartment: I still have to plug it into the Dual.

Re:I'm sorry

[frozencesium]

lucky for us, the military here will give you a copy of Norton for free, you just have to ask. now we will just have to see what it says...