3 ms·

This reminds me of a time at Red Hat when a worm was going around and infecting Red Hat systems, one of the engineers reverse engineered the worm and wanted to

This reminds me of a time at Red Hat when a worm was going around and infecting Red Hat systems, one of the engineers reverse engineered the worm and wanted to release it in the wild to fix the bug, legal wouldn’t let them. I think legal was right (for a public company) but this kind of shows the actual right response, in my opinion. Keep in mind in like 1999, you didn’t expect upgrades via package managers online for most large customers so this was an appealing release vector.

angled 5y ago
Was that a BIND / named bug?
- codezero 5y ago
  Was too long ago to remember, but bind was one of my areas of focus back then so maybe?
Cthulhu_ 5y ago
Similarly nowadays there's efforts to take over C&C servers and mechanisms with the intent to disable a virus / worm going around.
nuisance-bear 5y ago
It also sounds like the time Max Butler exploited a buffer overflow in BIND to patch a bunch of DOD systems. As we later found out, he added some extra "functionality" to that patch. Who's to say FBI hasn't done that in some small fraction of cases? https://en.wikipedia.org/wiki/Kingpin_(book) https://en.wikipedia.org/wiki/Kingpin_(book)
- mschuster91 5y ago
  Interesting, looks like he's actually supposed to be released from prison today: > Butler is currently incarcerated at FCI Victorville Medium 2 in California, he expected to be released April 14, 2021.
- rho4 5y ago
  That wikipedia article mentions he is expected to be released today, April 14, 2021.
throw4738 5y ago
There was similar antiworm for Code Red on 2001. MS IIS had vulnerability that got exploited, someone released worm to patch it.
duxup 5y ago
Yeah I can understand legal's approach and maybe not wanting test the waters by going to a judge and all that work. Microsoft and the DOJ have established a track record of getting judicial approval and so on. I'm sure now it is a much more known quantity / outcome legally for them than Red Hat back in 1999. I can imagine there is a good chance of a judge in 1999 think "You're who? and you want to wut wut the wut wut?"

angled 5y ago

Was that a BIND / named bug?

codezero 5y ago
Was too long ago to remember, but bind was one of my areas of focus back then so maybe?

Cthulhu_ 5y ago

Similarly nowadays there's efforts to take over C&C servers and mechanisms with the intent to disable a virus / worm going around.

nuisance-bear 5y ago

It also sounds like the time Max Butler exploited a buffer overflow in BIND to patch a bunch of DOD systems. As we later found out, he added some extra "functionality" to that patch. Who's to say FBI hasn't done that in some small fraction of cases? https://en.wikipedia.org/wiki/Kingpin_(book) https://en.wikipedia.org/wiki/Kingpin_(book)

mschuster91 5y ago
Interesting, looks like he's actually supposed to be released from prison today: > Butler is currently incarcerated at FCI Victorville Medium 2 in California, he expected to be released April 14, 2021.
rho4 5y ago
That wikipedia article mentions he is expected to be released today, April 14, 2021.

throw4738 5y ago

There was similar antiworm for Code Red on 2001. MS IIS had vulnerability that got exploited, someone released worm to patch it.

duxup 5y ago

Yeah I can understand legal's approach and maybe not wanting test the waters by going to a judge and all that work. Microsoft and the DOJ have established a track record of getting judicial approval and so on. I'm sure now it is a much more known quantity / outcome legally for them than Red Hat back in 1999. I can imagine there is a good chance of a judge in 1999 think "You're who? and you want to wut wut the wut wut?"