] A mass-mailing virus quickly spread through the Internet
] on Monday, compromising computers so that they attack the
] SCO Group's Web server with a flood of data on Feb. 1,
] according to antivirus companies.

I'm seeing many of these..

I need to think about this some more before I comment. This is interesting. Its all about the bounces.

Update(2): Congrads. Someone has written a virus that has gotten me confused.. I'm not sure if what I think is happening, is happening. And I'm not receiving enough of the spams anymore to tell. This virus was doing a few odd things. Either that, or some additional weird emails that are completely unrelated to this are hitting me.. [shrug]

This is the _wrong_ type of remix culture. This shows the dangerous edge of everything I ranted about in the post below. Taking viruses, modifying them, and passing them around is helping the evolutionary process of problems, that's all. We want to evolve culture, not threats.

New virus infects PCs, whacks SCO | CNET News.com

Did MSBlast cause the Aug. 14 blackout? The official analysis says "no," but Bruce Schneier is not so sure.

Internet worms and critical infrastructure | CNET News.com

] In a rare wireless hacking prosecution, federal officials
] this week accused two Michigan men of repeatedly cracking
] the Lowe's chain of home improvement stores' nationwide
] network from a 1995 Pontiac Grand Prix parked outside a
] suburban Detroit store.

This was covered earlier. However, this article by Kevin Poulsen (who is quite familiar with computer crime) has much more detail about the timeline of events. This is a hacker positive article, but it also fully acknowledges that these guys went way over the line. This wasn't some case of wardriving, or even just network probes, and it went way beyond anything that could be even be considered "harmless machine intrusions". No vague grey ethical line to stand on here.. These guys got caught installing a sniffer to monitor credit card transactions across Lowes' entire company network. There is not that much detail about how Lowes caught them, but it sounds like they broke so much stuff on the network screwing around that Lowes was alerted to their presence.

] Timmins and Botbyl, known online as "noweb4u" and "itszer0"
] respectively, are also part of the Michigan 2600 scene -- an
] informal collection of technology geeks that meet, blog, eat
] pizza and attend hacker conventions together, but generally
] balk at penetrating systems or otherwise committing felonies.

I was actively involved in "the 2600 scene" in the southeast several years ago. This would not have been condoned behavior. I'm sure for the bulk of the people in the mi scene it isn't there either. But this also doesn't really surprise me..

This is of interest.. The following was snagged from a 2600 mailing list in the southeast, which will remain unattributed in order to maintain a certain level of pointlessly transparent hacker mystique:

] hmmmmmm.....michigan....
] Article mentions immaturity....
] doing some rough math here.....
] idiots at phreaknic that were cutting the lan wires a couple
] of yrs ago were from michigan...
] One wonders what's in the water up there !??
]
] On a positive note, the article was fair....

Hmm.. My curious side wonders if there is a connection between the wire cutting that year and the mentality that picks the nym 'noweb4u'.. Anyone familiar with the scene up there care to shed some light on this? :)

So anyway.. We seem to have a good track record with rehabilitating criminal hackers by turning them into journalists and other such things. [smirk] Their bail was only set at $10k, which isn't actually that bad.. They can still use computers for work and school. So in a way, this is a step forward from the draconian handling of these things in the past. At least on face, the handling of this seems reasonable thus far. The initial vibes of mass hysteria and stupidity that I'd normally expect doesn't seem to be present.. Due Process even..

SecurityFocus HOME News: Wireless hacking bust in Michigan

] Two young men sitting in a car in the parking lot of a
] Lowe's home improvement store in Southfield repeatedly
] hacked into the company's national computer network over
] the past two weeks, gaining access to credit card numbers
] and other information, federal prosecutors said Monday.

] Timmins said he is a $38,000-a-year computer network and
] security specialist for a Southfield software company.
] Botbyl said he's a student at ITT Technical Institute in
] Troy. Morgan released both men on $10,000 unsecured
] bonds.

] FBI agent Denise Stemen said in an affidavit that Lowe's
] alerted the FBI recently that intruders had broken into
] its computer at company headquarters in North Carolina,
] altered its computer programs and illegally intercepted
] credit card transactions.

Waterford men hacked store files, FBI alleges

] Gangs based in Eastern Europe have been found to have
] been launching waves of attacks on corporate networks
 . . .
] The attacks involve gangs commandeering as many as hundreds of
] computers through hacking methods to use without their owners'
] knowledge. A command is then issued to each one simultaneously to
] make a series of bogus requests to the servers of the victim. The
] weight of traffic brings the servers to a halt and legitimate
] requests to carry out transactions cannot be completed.

Elonka thinks that this type of thing is a likely use for some of the recent clone-army building worms we have seen. I think I agree with her..

Eastern European Hackers Using DDOS Attacks to Blackmail Companies

] An anonymous reader writes "The BitKeeper to CVS gateway
] was apparently hacked in an attempt to add a root exploit
] back door to the Linux kernel, according to the
] linux-kernel archive. The change was in the file
] kernel/exit.c and changed the user ID of a process to
] root under the guise of checking the validity of some
] flags. The core Linux BitKeeper kernel repository was not
] at risk, and in fact it was the BitKeeper CVS export
] scripts that detected the unauthorized modifications to
] CVS. The changes were falsely attributed in CVS to
] long-time Linux developer davem (David Miller). Users of
] the BKCVS repository should resync their trees to remove
] the offending code if they had replicated it since
] yesterday."

Slashdot | Linux Kernel Back-Door Hack Attempt Discovered

This is a weblog written by a friend of mine who is has much infosec clue. I expect good things out of Randy's blog.

Insights into Information Security by Randy Bias

] Caffrey claimed the evidence against him was planted on
] his machine by attackers who used an unspecified Trojan
] to gain control of his PC and launch the assault.
]
] Neil Barrett, an expert witness for the prosecution, said
] that Caffrey's machine showed no trace of the tell-tale
] signs that would be left by such an attack but today's
] verdict, shows that this did not persuade the jury.

This is actually the right decision, but I'll bet it will send the computer forensics industry for a loop. Computer log file "evidence" cannot be trusted. You need something else. There is always reasonable doubt that the computer records have been tampered with. There are no "telltale" signs.

The Register - Jury says computer records not enough to convict

] Microsoft promised to improve the way in which Windows
] manages computer memory to protect users against commonly
] exploited software flaws known as buffer overruns, which
] can trick Windows into accepting dangerous commands. Some
] of the most damaging attacks in recent months fall under
] this category.

MS deploys non-executable stack patch. (What year is it?)

CNN.com - Microsoft plans Windows overhaul to fight hackers - Oct. 16, 2003

] According to Tubul, his group controls 450,000 "Trojaned"
] systems, most of them home computers running Windows with
] high-speed connections. The hacked systems contain
] special software developed by the Polish group that
] routes traffic between Internet users and customers'
] websites through thousands of the hijacked computers. The
] numerous intermediary systems confound tools such as
] traceroute, effectively laundering the true location of
] the website. To utilize the service, customers simply
] configure their sites to use any of several domain-name
] system servers controlled by the Polish group, Tubul
] said.

According to the article, this may have been one of the original purposes of the Sobig worm.

Wired News: Cloaking Device Made for Spammers