By Munir Kotadia, 3 March 2004 14:40
NEWS The authors of the MyDoom, Bagle and Netsky worms have been insulting each other by inserting lines of text into their malware - while keeping one step ahead of antivirus companies
Security researchers have discovered that the authors of MyDoom and Bagle are exchanging insults with the author of Netsky using text that is hidden inside the virus's code.
Since Friday, more than 10 variants of the Netsky, Bagle and MyDoom worms have been discovered. Mutants spreading in the past 24 hours have contained messages that indicate the authors of MyDoom and Bagle have teamed up against Netsky's author, antivirus experts said.
Finnish security company F-Secure on Tuesday reported that Bagle.J contained a line of text that said: "Hey, NetSky, f*ck off you b*tch, don't ruine our bussiness, wanna start a war?"
Mydoom.G, which was released on the same day, also contained a message to Netsky's author: "To netsky's creator(s): imho, skynet is a decentralised peer-to-peer neural network. we have seen P2P in Slapper in Sinit only. they may be called skynets, but not your shitty app."
In response, the latest Netsky variant (F), which was discovered on Wednesday morning, contained the message: "Skynet AntiVirus - Bagle - you are a looser!!!!".
Graham Cluley, senior technology consultant for antivirus company Sophos, told silicon.com sister site ZDNet UK that he believes the insults are flying because the authors of Bagle and MyDoom are not happy that Netsky has received so much publicity. "The author of Bagle is rather upset that the Netsky guy is taking all the headlines and getting most of the attention," he said. "Like any community, the virus writers often are at war with each other - rather like politicians - but their war of words is taking place on users' desktops and users' email systems."
To get their messages across, the worm writers are constantly changing their code to ensure they keep one step ahead of the antivirus companies.
"They are just tweaking them just enough - and getting a big kick out of seeing the antivirus companies reacting and posting information on their sites," said Cluley. "We are the ones that are all suffering. I would much rather they ranted at each other on message boards instead of in raw code."
This isn't the first time worm authors have included a message in their malware. For example, the MSBlast worm, which caused so much damage last summer, contained a message directed at Microsoft chairman Bill Gates: "I just want to say LOVE YOU SAN!! billy gates why do you make this possible ? Stop making money and fix your software!!"
Comments
There are 3 comments. Join the discussion
1. Angus Doyle
The media is fueling these wars and "one up man ships" that is currently progressing.
The media should concentrate more on publising the bounties on these individuals as there is no honour among these sad gimps, yet I can understand that they treat there computer as there partner, there Viri as there offspring, off course they want the best for there child. Spread there wings and travel the world, meet new people. But now we are seeing genetically modified viri, DNA that can be changed to beat up and flame the other kids, gone are the days of my dad is better than yours, its my genetically modified code is better than yours.
Makes you wonder why no Viri Bounty Hunter companies have risen from all this.
Could this be the next big thing? Watch this Space I guess
2. Andy Watson
The author of Bagle is rather upset that the Netsky guy
Is Graham Cluley sure that is a guy, he's been down this route before.
3. Jim
It seems strange to me that these Virus Writers manage to produce such impressive (if thats the right word) code and yet they can't spell simple things like 'loser'! Says a lot about the actual intelligence behind these people, when they can't take a few sexonds to be sure they've actually spelt insults correctly. Bunch of idoits!! ;)