4 ms·

Would it be feasible to write a virus that only exploits vulnerabilities more than, say, 18 months old, to either encourage or force sysadmins to upgrade? If y

Would it be feasible to write a virus that only exploits vulnerabilities more than, say, 18 months old, to either encourage or force sysadmins to upgrade? If you get access, then you can look for ssh keys and whatnot to figure out who to send form letters to. "Your server is vulnerable to x, y, and z: please upgrade a, b, and c." It would be more fun if the virus tried to upgrade a, b, and c itself, though. Even if it fails, a broken server that used to process credit cards is better than a vulnerable one, right?

kjs3 13y ago
You don't fix bad behavior with bad behavior.
greenyoda 13y ago
As we know from recent history, many companies have pursued criminal charges against people who have broken into their systems, even if they had no intention to do harm. And DAs are very happy to prosecute these cases. So this would be a great virus to write if you wanted to add a prison sentence to your resume. (And you could be held responsible for the cost of restoring the servers after your failed upgrades, which could run into the millions of dollars if you damaged enough servers.)
bediger4000 13y ago
Back in 1996, I heard two different people complain that since Microsoft convinced anti-virus companies to support Windows 95, and drop support for Windows 3.11, new viruses for Windows 3.11 were forcing them to upgrade to Windows 95. At least one of these folks was perfectly happy with Windows 3.11, had a huge stash of Windows 3.11 games on CDs and just plain didn't want to upgrade. He saw the whole thing as a charade to force people to shell out for upgrades.
- mikeash 13y ago
  This is playing out again pretty much word-for-word with the termination of support for Windows XP.
  - justin66 13y ago
    It would have been a more valid complaint for someone compelled to upgrade from Win3.1 to Windows 95. At this stage, Windows XP users are like Japanese soldiers stranded on an island, growing old not knowing they lost the war. Except without the excuse of being on an island.
    - rprospero 13y ago
      As someone stuck supporting a Windows XP server, I know we lost the war. We raised a big white flag and rolled out a welcome mat for our new overlords. Still waiting for someone to show up, though. (To break the metaphor, our server is hooked up to a PCI-X card which runs a radiation sensor. The drivers for the card will not run under anything after XP. The vendor has discussed possibly considering looking into designing a new card that would might run under Vista, but that's probably five years down the road.)
      - derekp7 13y ago
        Sounds like you need a new vendor? As an alternative, could you run XP in a minimum VM, which has that particular PCI card's address passed directly to the VM? Then make sure that there is no other way into the XP VM (i.e., don't run any other apps on it, and keep it only on the host-only network).
      - keithpeter 13y ago
        XP Embedded? Still has support.
        HeyLaughingBoy 13y ago
        Not for long. XPe is already at EOL. Support ends in 2016 and license availability ends in 2017. Our products using XP Embedded are expected to still be in the field well past 2020. We are already making plans to transition to Windows 8 simply because it will soon be impossible to buy XPe licenses.
    - anigbrowl 13y ago
backdraw_ 13y ago
> Even if it fails, a broken server that used to process credit cards is better than a vulnerable one, right? "I saw that you dropped your wallet on the floor, so I threw it into the river so nobody could steal your credit cards."
- andrewflnr 13y ago
  If returning the wallet (securing the server) is out of the question, throwing my wallet in the river could easily be preferable to leaving it loose. Of course if someone told me that in meatspace I wouldn't believe them... hm.
  - backdraw_ 13y ago
    You should only intentionally kill their server if you're willing to compensate them for the revenue they lost while they try to figure out what the hell happened. An alternate analogy would be something like: "I saw you forgot to install a lock on door, so I superglued it shut."

kjs3 13y ago

You don't fix bad behavior with bad behavior.

greenyoda 13y ago

As we know from recent history, many companies have pursued criminal charges against people who have broken into their systems, even if they had no intention to do harm. And DAs are very happy to prosecute these cases. So this would be a great virus to write if you wanted to add a prison sentence to your resume. (And you could be held responsible for the cost of restoring the servers after your failed upgrades, which could run into the millions of dollars if you damaged enough servers.)

bediger4000 13y ago

Back in 1996, I heard two different people complain that since Microsoft convinced anti-virus companies to support Windows 95, and drop support for Windows 3.11, new viruses for Windows 3.11 were forcing them to upgrade to Windows 95. At least one of these folks was perfectly happy with Windows 3.11, had a huge stash of Windows 3.11 games on CDs and just plain didn't want to upgrade. He saw the whole thing as a charade to force people to shell out for upgrades.

mikeash 13y ago
This is playing out again pretty much word-for-word with the termination of support for Windows XP.
- justin66 13y ago
  It would have been a more valid complaint for someone compelled to upgrade from Win3.1 to Windows 95. At this stage, Windows XP users are like Japanese soldiers stranded on an island, growing old not knowing they lost the war. Except without the excuse of being on an island.
  - rprospero 13y ago
    As someone stuck supporting a Windows XP server, I know we lost the war. We raised a big white flag and rolled out a welcome mat for our new overlords. Still waiting for someone to show up, though. (To break the metaphor, our server is hooked up to a PCI-X card which runs a radiation sensor. The drivers for the card will not run under anything after XP. The vendor has discussed possibly considering looking into designing a new card that would might run under Vista, but that's probably five years down the road.)
    - derekp7 13y ago
      Sounds like you need a new vendor? As an alternative, could you run XP in a minimum VM, which has that particular PCI card's address passed directly to the VM? Then make sure that there is no other way into the XP VM (i.e., don't run any other apps on it, and keep it only on the host-only network).
    - keithpeter 13y ago
      XP Embedded? Still has support.
      - HeyLaughingBoy 13y ago
        Not for long. XPe is already at EOL. Support ends in 2016 and license availability ends in 2017. Our products using XP Embedded are expected to still be in the field well past 2020. We are already making plans to transition to Windows 8 simply because it will soon be impossible to buy XPe licenses.
  - anigbrowl 13y ago

backdraw_ 13y ago

> Even if it fails, a broken server that used to process credit cards is better than a vulnerable one, right? "I saw that you dropped your wallet on the floor, so I threw it into the river so nobody could steal your credit cards."

andrewflnr 13y ago
If returning the wallet (securing the server) is out of the question, throwing my wallet in the river could easily be preferable to leaving it loose. Of course if someone told me that in meatspace I wouldn't believe them... hm.
- backdraw_ 13y ago
  You should only intentionally kill their server if you're willing to compensate them for the revenue they lost while they try to figure out what the hell happened. An alternate analogy would be something like: "I saw you forgot to install a lock on door, so I superglued it shut."