The author of the original Sassor worm apparently claims to have released it to help his mother's PC repair business.

http://zdnet.com.com/2100-1105-5209099.html?tag=header.newsfeed


My question is:

Do computer technology curricula in your area  require computer ethics training, and do you think it would have kept this kid on the straight and narrow?

Want the best answers? Ask the best questions!

TANSTAAFL!!

No training can force a person to do the right thing. Ethics training in this case would have only mattered if the virus writer were confused over the definition of right and wrong and he had a proclivity for right in the first place.

"Well, once again my friend, we find that science is a two headed beast.  One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick

TomThumbKP:
I agree that no training can force someone to do the right thing.  I will happily congratulate any person who admits in my person to having released a virus into the wild by shaking him warmly by the throat.

But in the words of the infamous Dorothy Parker, "You can lead a horticulture but you can't make her think."  We're talking about one of those "quiet kids" who lives in a small town and who may never have had his deontic heirarchy juggled by being forced to look at the larger picture.

Want the best answers? Ask the best questions!

TANSTAAFL!!

When I was studying CompSci in New Zealand during the late 80s, we had no specific course content that covered Ethics training.

We had a bullet-point list of activites that could get us "disciplined" (including expulsion) and these included all the usual suspects like unauthorised access (and attempts to access) as well as malicious computer use.

Those in our course were aware of the rules (they were part of the student guidebook/calendar as I recall)... and they formed the basis of what was understood to be "right" or "wrong" within that environment.

Given that the Sasser suspect is pre-university, he may very well never have considered the ethical position he was taking. The reported desire to "help out his mother's business" may have been a genuine attempt to "do the right thing" (in his mind).

If he had a responsible computer teacher who was empowered to share the ethics of computer use to such a young audience, then I believe there is a chance that it may have prevented/altered the end result.

What is the typical makeup of a computer coder? We are all different... but at what age do we move from "attention seeking youth" to "aware adult"? At that age I was more interested in "peer approval" than in "right or wrong".

I'd be interested to hear how things have changed... and whether anyone has experienced this kind of "ethics discourse" at pre-university level.

Cheers,
Jeff

There's a reason they're called "script kiddies".

They download a tool that sounds way-cool, run it, and don't realize the full implications of what they've done (they *are* just a kid).

Is he still guilty?  Oh yes.  But his youth should be factored in when a punishment is determined.

Chip H.

If you want to get the best response to a question, please check out FAQ222-2244 first

I'm not so sure about the "innocence of youth" angle though.  The article also mentions this guy might be responsible for NetSky as well as Sasser.

Plus I would say that since computer repair is his mother's business and he intended to create more business for her, then he was fully cognizant that his actions would harm others.

"Well, once again my friend, we find that science is a two headed beast.  One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick

I work for a U.S. public school system.  I got curious about the answer to BabyJeffy's question about ethics training at the pre-college level.

The answer to my question from my boss (formerly a high school science teacher) was, "There is no specific curriculum on ethics, although it is included in the computer science courses.  Not that it would do any good."

When I asked why it wouldn't do any good, the answer was, "Because students in high school are stupid.  They all think they're invincible and indestructible and are seemingly incapable of seeing past their own instant gratification.  If you try to point out any larger consequences of their actions, their eyes glaze over.  They know it's not right to shoot and kill other people, but Columbine still happened."

Want the best answers? Ask the best questions!

TANSTAAFL!!

Out of the entire article, I was most concered with the last paragraph:

Despite the damage to millions of computers, one leading German newspaper said in a page one commentary on Monday there was a strange sense of national pride that a German student had outwitted the world's best computer experts.

"Many of the (German) journalists who traveled to the province could not help but harbor clandestine admiration for the effectiveness if the worm," Die Welt daily wrote.

O.K.,  the German paper just unleashed a challange to other country's kids to out perform their own.

Blue

If I wasn't Blue, I would just be a Dragon...

The author of that column suffers from the same short-sightedness as the student.

Quote (sleipnir214):

... incapable of seeing past their own instant gratification.

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein

On a related note: Sasser Variant.  Pay particular attention to the last two paragraphs.

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein

Yep - I read something similar not too long ago.  Analysts were seeing insults being traded in the virus code between the Bagle and NetSky groups.

Here I go again... tossing a couple of pennies into the mix.

I was reading the report of the arrest on MSNBC this morning, and how they stated it *could be* up to a 5 year prison term.

We need to send a message to virus writers, as well as "script kiddies".  I mean, if the same kid/person pulled a business scam and netted several million dollars, they'd get all kinds of trouble.  But for letting loose a virus that causes that kind of damage, they get a slap on the wrist.  I think there's probably a contest going on between virus writers to see who can make it to Trend Micro's "worst threat" category.  I say **ENOUGH!**.  The laws need to be stricter, and the punishments COMPLETE, to send a message that this will NO LONGER BE TOLERATED.  (Of course, I also think that it would be poetic justice if something happened to Bill Gates, and he ended up on a life support machine that ran on Windows 95... give whole new meaning to the "blue screen of death"... but I digress.)

I have spent more hours battling stupid viruses, trying to keep up with the latest patches from Micro$oft because of buggy software and security holes... it's making me nuts.  And when they finally CATCH one of the punks making ALL OF OUR LIVES miserable, the maximum punishment is 5 years??? He's cost all of us more than 5 years in man-hours REMOVING the viruses he wrote!  ARRRRGH!

I think we need to develop a ZERO TOLERANCE law for virus writers.  And as far as backdoors and such are concerned, if they can figure out what IP address keycatchers are sending your credit card information to, why don't they go bust them as well???

See, the problem is that computer laws for doing stuff like this aren't strict enough.  Now, if they hit them with 150,000 accounts of electronic breaking and entering, THEN we'd see a little justice done.

Anyway... done ranting... just tired of fighting viruses.

--Greg

That sounds good in theory, gbaughma, but easier said than done.

Quote (gbaughma):

I think we need to develop a ZERO TOLERANCE law for virus writers

Under whose legal jurisdiction?

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein

I don't believe any courses in ethics, computer or otherwise, are being offered this year. Next year isn't looking good either.

I believe it would be a tremendous help if classes in ethics, morality and empathy were mandatory for public school systems, but given Sleipnir214's quote from her boss, I don't know who you'd get to teach it.

High School students aren't stupid. They're outspoken, rebellious and will behave badly from time to time, but stupid? No. Any ethics training they might have comes incidently. Correct that and there will be less crime.

Saw some recent research that indicated that there is a development problem with the teen-aged brain.  That the portion leading to risk-taking behaviour is growing faster than the risk-avoidance portion.  Leads to all sorts of stupid behaviour.
Seems to me that the only solution is to lock 'em up from roughly 16 to 25, at which point the parts of the brain should have equalized.
26 hours a week of public service for a year might be of some deterrent effect if it were known and enforced.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

gbaughma

Part of the problem with taking legal action is that when you put the case in front of a jury, the chances are that most of them can barely turn on a PC.  It's like major fraud cases, the evidence is often going to be too technical for the jury to understand - "reasonable doubt" can be equated with "confusing the jury".

Also, what's he done?  He's temporarily "broken" a few computers.  Not a major crime in many people's eyes, just a "prank".

(Of course, if a couple of planes fell out of the sky as a result, it might be different.  Not that I'm hoping for such, but a couple of near-misses might help focus minds on the potential.)

Rosie
"Never express yourself more clearly than you think"  (Niels Bohr)

With regard to ethics training, why should be place that burden on the Public School System.  That should be a parental responsibility, and one easy way to help fulfull that role is through whatever Church you feel comfortable with.

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein

But, saying it is the role of parents who themselves have no formal ethics training is akin to saying the parents should teach calculus. I wouldn't have wanted my Dad teaching me calculus regardless of how well he can use it. IMO there is a difference between using a concept and conveying it to another. If Society determines that formal ethics training is of value, then Society should bear the burden. I'm not saying let the parents off the hook. Just that they are not always the best first choice.

"Well, once again my friend, we find that science is a two headed beast.  One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick

An excerpt that goes hand in hand with TomThumbKP's post:

A 40-year-old man and his 16-year-old son (carrying a shotgun) were walking home in Winnipeg, Manitoba, in March when they decided to rob passing pedestrians of the beer they were carrying; in the ensuing fight, police later said, the beer did not change hands, and the son accidentally shot the father.  [Winnipeg Sun, 4-2-04]

Blue

If I wasn't Blue, I would just be a Dragon...

edfair:
SHDTM (Stupid Hormone-Driven Teenage Machismo) probably serves the same purpose as the tail-feathers on the Bird of Paradise.  It is a way of saying, "See all the risks I take any yet I survive!  This proves I am strong and quick!  My genes will make your offspring strong and quick!  Mate with me!  Mate with me!"


CajunCenturion:
We go back to the problem with jurors' being non-technical.  Parents aren't technically savve enough, in general, to be able to address the ethical issues of IT, and training all parents would be expensive.  Train a few handsful of teachers, and you can train tens of thousands to children at once.

And not all organized religions place the same emphasis on applying reason to faith, morality or ethics.

Want the best answers? Ask the best questions!

TANSTAAFL!!

That's all true.  I just don't think that the Public school system should be responsible for teaching the basics of what is right and wrong.

What if the hacker went to Private School?  Just kidding.

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein

An issue with teaching ethics in the public school beyond the right/wrong of the law hinges on moral judgments.

Which begs the question of whose moral judgment?

Which begins to drag philosophy and religion into the picture as foundations of certain moral judgments.

There ain't a public school district in the US going within 10 miles of that one.

The sad thing is that in a lot of schools, the kids are being taought ethics (the wrong way).  Like the student athlete who gets passed along because of his talents on the field...

Blue

If I wasn't Blue, I would just be a Dragon...

Ethics can be taught without going into the rougher larger waters of general morality, particularly IT Ethics.

Start with the question of who has the right to make use of the computing resources provided by a computer and why.  Then go through the thinking of whether it is ethical to make use of computing resources without permission.  After that, lead discussion of what does and does not consitute unauthorized use of computer resources.  End up at the consequences society places on those who use computer resources without permission, particularly if that use damages the resources.

You don't have to get any closer to morality than Lockean property theory.

Want the best answers? Ask the best questions!

TANSTAAFL!!

sleipnir214
>SHDTM
You can't separate adolescents from their hormones, somehow you have to make playing with viruses unsexy or unadmirable by their peers. Preferably they should be made to seem boring and mainstream.  (And I have no idea how.)

The comments by the press don't exactly help that -  and I'm not sure that punitive sentances would either, kids that age just don't expect to be caught.

I don't think that ethics really apply to that age group, no matter how well taught, peer pressure is paramount.

An interesting question; At what age does the ethics "gene" really kick in?  I'd guess closer to 20.

Rosie
"Never express yourself more clearly than you think"  (Niels Bohr)

rosieb:

Quote (rosieb):

An interesting question; At what age does the ethics "gene" really kick in?  I'd guess closer to 20.

For me, about 23 or 24.  It's the age where considered thought about the greater world ben regularly supercede the hormones.  Or as an old First Sergeant of mine once said, "Sooner or later you have to give little head the controls."


You're right -- you can't separate the adolescent from the hormones.  Probably by definition.  But you might be able to train the mental muscles of adolescents so that they would recognize the stupidity of some of their own actions.

Want the best answers? Ask the best questions!

TANSTAAFL!!

Correction.  My First Sergeant's quote should have read.  "Sooner or later you have to give big head the controls"

Want the best answers? Ask the best questions!

TANSTAAFL!!

I think it tends to come, not at a specific age, but when they are forced to take full responsibility for themselves.  

Flat/appartment, job, responsibilities - no parental cushion to rely on, no feeling that if it all goes pear-shaped you can just go home, and Mummy will kiss it all better.

In the developed world, ecomomics tends to mean that "kids" take on that kind of responsibility much later, 25 year-olds still living at home (and still essentially infantalised).  Compare that with 9 year-olds selling postcards in Istanbul - I know which I'd see as the most "adult".

So maybe the gene kicks in with responsibility.

Rosie
"Never express yourself more clearly than you think"  (Niels Bohr)

Some things to ponder...

- Apparently, the "kid" may also have created the netsky virus.  The latest scoop on the guy...
http://www.globetechnology.com/servlet/story/RTGAM.20040510.gtibsasserb10/BNStory/Technology/

- He is 18 - old enough to drive a car, old enough to get drunk (in Germany), old enough to be a soldier, old enough to carry a gun, and in some countries, old enough to vote.  He is old enough to have killed somebody.  And he is old enough to realize that what he did was wrong.

- Numerous papers have reported the cost of the recent plague of viruses.  They cost business money.
http://www.globetechnology.com/servlet/story/RTGAM.20040402.gtjackvirusapr2/BNStory/Technology/
And they can cost lives - hospitol, traffic lights, power plants, nuclear plants.  (The North American black out in August 2003 apparently caused by a company that had previously been infected in Jan 2003 by the Slammer virus.  Hmmm..., their power grid system takes a dump about the time the blaster virus goes ballistic -- just speculating, just being paranoid)
http://www.theregister.co.uk/2003/08/20/slammer_worm_crashed_ohio_nuke/
http://www.cbsnews.com/stories/2003/08/14/national/main568363.shtml
http://www.cnn.com/2004/US/04/05/blackout.report/

- Next, we live in a global community.  This is what the Internet has done to us.  However, the laws and ethics are light years behind.  Somebody writes a virus in a third world country -- it is unlikely "we" can not touch them.  It may be unlikely there are the necessary laws in place to address the situation in all countries.  What makes up the culture and ehtics in North America or Europe does not neccessary apply in other countries.

From my perspective, it will be a long, long time before we have the legal and cultural infrastructure in a global perspective to keep up with the cyber space crime which has been global for years.

I also believe that virus are a very serious threat, and should be treated as such where ever possible.  A joke virus can be modified to a more sinister entity.  You may lean to the left or to the right, but when it comes to something that can hurt many people, and cost million / billions, then it has to be treated seriously.

What to do...
I have always thought it was the developers of the applications to take on this responsibility.  I have never been a big fan of bells an whistles software "you have mail ".  And I am hopefully that Microsoft and others will heed their PR and promises, and favour security and "meat" over the pizzaz and flash.

And hopefully, we as consumers, will have choices in buying secure vs flashy software.

What will happen to the Sasser Kid?
Probably get a light sentence.... and then will be hired by a software company to develope secure software.

As to the Great North American Blackout, that was FirstEnergy Corp. I worked for them as a contractor for several years, and the blackout was caused by human error.

It isn't the punishment, it's the surety of being caught that drops the crime rate. In this case the government may hang the little honor student out to dry, but I'm betting it won't slow the others down.

I maintain that a good virus deterrent is to switch to Linux and avoid the Micro$oft fiasco altogether.

OhioBill

Thanks for the skinny on the power outage.  I was just being paranoid -- it was quite a coincidence for the power outage to follow so closely to the balster virus with a company that got hit pretty bad by the Slammer virus.  As an FYI, I really don't like to use company names outside of the large IT companys - especially one that caused millions in damage.  

Nonetheless, I feel it is important to realize that it could happen.

Bang on with being caught as the best deteramt.  Example: Nobody like photo radar.

I agree Linux is an alternative, but as it grows in popularity, crafty people will pay attention to the new OS.

I don't believe that most kids that could design and write these worms can't understand the damage they can do.

I don't believe kids that spray paint walls don't understand they are doing something wrong.

I don't believe the 2 kids one town over from me that killed a retarded boy with baseball bats after luring him to the woods and tried to hide the body didn't know what they where doing was wrong.

Because people under 30 don't tend to have fully developed frontal lobs doesn't mean they should not be held accountable.  People most often know they are doing something wrong they just don't exercise the self control not to do it and instead reach for the instant gratification.

Anyone that has sympathy for kids like this and believe that they could write the worm and know its local implication but not know the global implication need to pull their head out.  These people that create these viruses just get their hands slapped.  With billions of dollars lost because of these viruses I hope MS, IBM, HP, Oracle, etc support the capture of these people and start getting heavy sentences pushed out.  5 years jail for causing hundreds of millions or billions dollars of damage....is that reasonable?  I'm not for lesser sentences for first offenses of serious crimes.  If the sentances where more drastic then some of these people would think first.

Hope I've been helpful,
Wayne Francis

If you want to get the best response to a question, please check out FAQ222-2244 first

I don't think this is a matter of knowing right from wrong.  It's a matter of having a screwed up deontic hierarchy.

If a person places too much emphasis on the wrong levels of his ethical responsibilities, then even if he knows the act is wrong (releasing a virus into the wild), another ethical responsibility (furthering the family's interests) will be too heavily outweighed, leading to the wrong action.

Nor am I advocating that this wackadoo be allowed off scot-free, with his screwed up view of ethical responsibilities as the excuse.  Often, a trauma is just the thing to get someone's head screwed on straight, and some jail time sounds like just the trauma this kid could use.

Could some kind of formal education in IT ethics have made a difference?

Want the best answers? Ask the best questions!

TANSTAAFL!!

Not knowing the guy's background, I'll add a few more hypotheticals - supposing IT ethics education is available:

• If ethics is mandatory, and he's predisposed to sociopathy, do we push him further into that realm by, according to his view, attempting to make him conform?
• If ethics is mandatory, and he's naive; we've probably accomplished something.
• If ethics is optional, and he's antisocial, will he seek out ethical training?
• If ethics is optional, and he's naive, how do we convince him to participate.

Just furthering the discussion, no point I'm trying to argue here.

Quote:

Could some kind of formal education in IT ethics have made a difference?

Dunno.

But maybe indentured servitude cleaning up several  large networks that've been hosed by his handiwork might have a lingering effect.

Tired of waiting for an answer?  Try asking better questions. See: FAQ222-2244

Probably not. Kids at that age are always wanting to test the limits. Throw a limit at them, they want to verify for themselves that it really is a limit they should accept.

I did it.  My kids did it. My grandkids are doing it.

One problem is the lack of understanding on the part of the parents. Great that the kids have developed a passion for understanding computers, that can lead to a great career. But parents also need to dig to the heart of the issue and see if it is healthy.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

Quote:

Could some kind of formal education in IT ethics have made a difference?

Since it didn't occure, we will never know, however since the education didn't happen we do know that there was no possibility of affecting this individual's decisions.

"Well, once again my friend, we find that science is a two headed beast.  One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick

TomThumbKP:
I don't know if your last post was an ineffective attempt at humor or that you did not understand my question.  In either regard, I will rephrase.....


Can formal education in IT ethics have a positive effect on whether future virus and worm writers will release their creations into the wild, or should we just accept the damage these products do as a given part of doing business on the internet and rely on prosecution and punishment after-the-fact to be a deterrent?

Want the best answers? Ask the best questions!

TANSTAAFL!!

It was not an attempt at humor, although I realized after I posted it that what I was trying to say made more sense in my head than it did when I wrote it. I think it was Bohr that essentially said "Never express yourself better than you understand a concept" or something to that effect. I rarely have that problem. Sorry for the confusion.

What I was trying to get acrros is that we will never know if education would have made a difference in this case so it really isn't a debatable topic IMO. As for directly addressing the effect of education on future virus writers, I would take the second part of your last question first:

Quote:

or should we just accept the damage these products do as a given part of doing business on the internet and rely on prosecution and punishment after-the-fact to be a deterrent?

I would liken this to driver's education. Teenagers are the worst drivers in the world. No amount of education will overcome their inherrant invicibility complexes. However, we have shown over many years that a teenager that is exposed to safe driving instructions from a trained instructor is safer than one taught by Mom or Dad. The punative penalties for porr driving are the same for both categories, so this can't be seen as the reason for the differences in safety.

"Well, once again my friend, we find that science is a two headed beast.  One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick

But there is a major difference.  Teenagers want to drive, and are willing to go to school to study and do it.  They are willing participants.

How many teenagers do you know that want to study ethics?

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein

That is an issue of motivation. Granted motivation will effect efficacy, but just participating in the training must have more effect than no training at all. Shouldn't it?

"Well, once again my friend, we find that science is a two headed beast.  One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick

I didn't want to take driver's ed in high school, as I had been driving for a year before I took the course.  But I was willing to tolerate it in exchange for reduced rates on insurance.


The ones who will benefit the most from IT ethics instruction will the the ones with the greatest chances for doing harm -- those with existing programming skills.  And they're the ones taking the class to round out college entrance paperwork.

Make IT ethics a prerequisite for taking the programming class, and students will at least tolerate the course.  And may learn something beside.  If even by osmosis.

Formal ethical thinking is something that can be learned -- critical thinking skills to assess values on which to base ethical judgements, application of the rules of logic, etc.  

<aside type="self-sardonic">
Of course, now I'm arguing for formal instruction in critical thinking and logic as a prerequisite for ethics.
</aside>

These young whelps may never really grok ethical-logical thought until they're adults anyway.  But they at least have been exposed to the necessary tools.

Want the best answers? Ask the best questions!

TANSTAAFL!!

When you state that it's an issue of motivation, you're simply restating what sleipnir214 has already said.

The kid was more motivated to try to help his mother's business than he was motivated to that which is ethically correct.  And no, I don't think any formal training would've changed his motivational priorities.

Please read carefully:  Nor do I think that incarceration or civil penalities would change the motivational heirarchy between helping Mom and doing what is right.  But the repercussions, both criminal and civil which I am in complete favor of, may very likely put a new entry at the top of the motivational heirarchy, where next time he might ask, "Is it worth the risk?"

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein

I've come in this rather late, so sorry if this has already been said lots before, but do you feel this is really a matter of this character lacking ethics? I'm sure no doctor's son or daughter would go round assaulting people to keep Mum/Dad's surgery nice and full. Which makes me wonder if people sometimes underestimate the damage their virus will cause? I'd personally, gladly sentence a typical virus-writer to community service until they've done enough to repay the damage (how many thousand years might that take?) But maybe I'm vindictive.

So far as ethics, it really comes down to one of them:
Does that belong to you?

If it does, do what you want to with it.  If it doesn't (as in the Internet and all the computers connected to it), then don't touch it.

Because this young adult didn't understand that principle, he felt there was nothing wrong with infecting other people's property with a virus.

Chip H.

If you want to get the best response to a question, please check out FAQ222-2244 first

Or he knew it was wrong and didn't care. I'd say that is more likely.

"Well, once again my friend, we find that science is a two headed beast.  One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick

A question,

How many believe he really did this to help mom and dad, or was that just a quick thinking plea for leniency.

If this and the netsky is his doing, and the competition with other virus writers, I think this is just another script kiddie trying to make a name for himself with his peers.

The worst punishment you could probably give someone like this is taking away technology from them.  I also agree with the community service and such.

As far as teaching ethics at that level...  I think a little bit of ethics should be taught in every class especially relating to IT.  You will more then likely get a bigger dose of it in college where it is more likely to sink in.  But, in the before college years, some sort of ethics should be taught in everyday classes.

Blue

If I wasn't Blue, I would just be a Dragon...

bluedragon2,

It's just speculation that he did this to help his mom's PC help business.  A magazine in Norway (I believe) printed this as opinion, not as fact, but the media has picked up on it and it spread just as fast as Sasser did.

I agree with teaching ethics in schools, but the basis of ethics is common sense, and teaching that starts at home.

Just my $0.02.  

Dollie

<facetious>
If common sense were truly common, we'd have a one-word nomenclature for the phenomenon.
</facetious>


In terms of everyday person-to-person interactions, you're right -- ethics is common sense.  But when you start dealing with ethics as it applies to IT, a little theory would come in very handy.

Want the best answers? Ask the best questions!

TANSTAAFL!!

Over two decades ago, I worked at an outfit called The Source.  The job was purely experimental and lots of fun: we and Compuserve had the first truly public computer networks.

I also experienced hackers and their viruses for the first time at The Source.   In fact we had to educate the FBI investigators in what hacking really meant.

The phenomenon of hacking or spreading viruses was always directly related to the way people and the media reacted to kids and 'nerds' who could do "prodigious feats" with a computer.   Never mind that professional, gainly employed programmers very easily and usually inadvertently (such is the business of programming) create various strains of viruses at their work - usually in the form of 'bugs'.

The public at large is still unduly fascinated by these misguided kids - despite many of the outraged outcries at spreading viruses.   The kids see this kind of activity as a way of showing off their computing skills to the world - a kind of Robin Hood sick game.    But listen to what people are really saying: "Wow, and he is only 14!  What a genious!" - that's exactly what these kids want to hear.

What I am saying is that the public at large provides an irresistible captive audience to these people.   It's like a drug - they can't just say no.   It's also a vicious cycle: we need to educate people about computers and deprive virus makers of the salivating audience.

Dimandja

Quote:

Because this young adult didn't understand that principle, he felt there was nothing wrong with infecting other people's property with a virus.

I personally don't believe in most cases that even the script kiddies think like this.  I remember when I was young, I knew that stealing candy from the shop was wrong.  My son has a large bowl in his room where I put loose change and I tell him at different times to take out money from the bowl for doing different things.  He's never been told that he isn't allowed to take money from it but he doesn't.  He always comes and asks me if he can have a chuppa-chup (like a lolly pop) from the center piece on the coffee table.  

Quote:

How many believe he really did this to help mom and dad, or was that just a quick thinking plea for leniency.

Exactly.  Kids aren't stupid.  Especially individuals that write these viruses/worms.  They are used to problem solving.  Working out what needs to be done.  They think ahead.  These authors don't just stumble into writing a virus code.  I wouldn't say they couldn't come up with an excuse why they did it if they got caught.

Hope I've been helpful,
Wayne Francis

If you want to get the best response to a question, please check out FAQ222-2244 first

How did he think he could help his mother's business by releasing a virus? Maybe now his mother will put up a poster saying "Sasser was created here".

Dunno. I think it was only an excuse which has been sensationalised by the media and the case sanitised by non-specific laws.

The whole question of when a person is responsible for how he uses computers should be re-examined.

At that age if you aren't selling flowers in Istandbul, you have the liberty to choose the sites you visit and how you use them.

We should be concentrating on profiling the sites and groups where these tools are made able to the script kiddies.

End

I'm not real up to speed on virus/worm writing, so here's a question...

If this author is a "script kiddie" (and I don't think he is), how does he get a script/module so quickly after the exploited flaw goes public? I mean, can he get the script that fast or would he have had to write the whole thing himself from scratch?

Monkeylizard
 -Isaiah 35-

Quote:

can he get the script that fast or would he have had to write the whole thing himself from scratch?

Actually there is a whole cottage industry of sorts that disseminates information, code and strategies on virus/worm writing.    The techniques involved are pretty basic and sometimes painfully simple - especially when you have access to a skeleton module.

So, basically, the kid only needed access to a PC and a modem, the rest is widely available on Internet.

Dimandja

May be, these websites should be target and held accountable for the damages these kids do. I don't know if it will be viewed as holding the gun manufacturers accountable for illegal use of guns. I haven't been to those web sites but I feel what they do it pretty much illegal. Besides, it would be easier to target a few websites than individual user.

Anand

Who will target them? The US Government? If they are in the US, discussing virus writing techniques would be protected under the First Ammendment.

"Well, once again my friend, we find that science is a two headed beast.  One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick

I agree with Dimandja answering monkeylizards question, the flaw gets noticed by either the manufacturers who issue a patch and then it is probably backwards engineered or someone spots it and its flaw is circulated within minutes accross various forums.

The script kiddies and hackers e.t.c. are exploiting the fact that the vast majority of home users and a frightening number of corporates as well are woefully bad at patching their OS or updating thier virus checker when a patch/update is realeased.

The scripting/modules required are scarily simple as well, a quick bit of searching the thousands of Freeware Scripting sites and a smidgen of common sense (regarding script modification) being able to combine them e.t.c. and you have a functioning 'Virus'

Gurner

What is Divine Paradox?

www.divineparadox.co.uk

... if people want to play Robin Hood and gun for the big corporations while proving how good they are at programming, why can't they go and try to write a chess program that gives Deep Blue a run for its money, or something like that? Yes, it's horrendously difficult (yup, being the best in the world just aint easy). But it's a lot less destructive and a lot more fun. And if you succeed, it's just as media-worthy.

Naah...

Much easier to copy and paste a virus program, insert your own name or some nonsense stuff in it, and email it to someone.

The media coverage is guaranteed, and is usually much bigger than writing a mundane chess program.   The media will go with the story on the front page of every major newspaper in the world.

This is why I wrote before that the problem is just as much - if not more - the audience, the media...   If there is no mass histeria promoted through the media, the allure of making viruses will wane.

Dimandja

Few opinions.

1) This guy is not a script kiddie in my book.  Script kiddies to often have no clue how their tools work.  This worm was the fastest released major worm.  10 days from the vunerability to the propergation of the worm.  While it is not rocket science to write some of the worms/viruses with the info out there those situations are normally just rebadging exsisting work.  The hard part about this vunerablity was done very quickly.

2) You can't hold the tool makers responsible.  A large portions of the tools script kiddies use are actually security tools.  It would be like holding a bulletproof jacket manufacturer responsible because some lunatic got ahold of one of their jackets then went on a shooting spree and the cops shooting him didn't stop him because of the vest.  Also in the security areana they men and women that defend us openly discuss the issues so that everyone is better prepared.  

This virus was written in 10 days.  Some of the security patches and virus cleaners have been written within hours of a virus being released because of the open nature of the security industry sharing and discussing potential issues.

It has further implications then just electronics.  I can go down to the local library and get plans for creating a nuclear bomb.  The knowledge isn't the problem.  In some cases the tools are I admit but I don't see this carrying over to the computer side.  

Much discussion has been going around about should the government protect more and more information making it illegal to know.  While I'm one of the last people to scream about my "big brother" type of government this would be just that.  Government deciding who can learn what.

The biggest place this will effect us is not in electronic virus writing but biological virus creating.  We won't be able to stop the ones that will try to do dmg with the knowledge and tools by trying to keep the info from them.  I'd would rather have as many people have access to the same tools and knowledge that creates these viruses so that when the rogue ones get out they can be stopped as quickly as possible.

Hope I've been helpful,
Wayne Francis

If you want to get the best response to a question, please check out FAQ222-2244 first

Quote:

Do computer technology curricula in your area  require computer ethics training, and do you think it would have kept this kid on the straight and narrow?

Unfortunately I do not think this would have much impact.  We are all a product of our experiences (albeit very complicated products) and I believe that the major experiences occur in early life; I believe ethic/moral training should be (and usually is) part of parenting.

The schools could attempt to educate students on right and wrong but it's all so very late for that at 16+.

The only analogy I can think of is number averaging.  If you are brought up with a lot of negative numbers (lessons/exeriences) then the addition of a small positive (ethics training) will make very little difference on it's own.

Personally I believe we need to start thinking a generation ahead and try to produce better parents rather than better children.  That said I understand that it is quite possible for the most caring and ethically upstanding parents to produce a twisted child.

Quote:

This guy is not a script kiddie in my book.  Script kiddies to often have no clue how their tools work.  This worm was the fastest released major worm.  10 days from the vunerability to the propergation of the worm.

Actually stating that a virus was written in only 10 days, and that this was very fast, is misleading.

Since many viruses use existing code and strategies, often all it takes to create a "new" virus is changing a couple of lines of code.   This is hardly speedy coding.

Also, many of the "vulnerabilities" are known in many circles for months, years even, before the information is literally "leaked" to the public at large:  this is because manufacturers prefer to keep this kind of info secret (hopefully until they have a cure) in order to protect their product.

It is also true that many of these kids that release viruses have no idea how exactly their code does the job.   It's really irrelevant to them: they simply know it is a virus - the same way we know it's a 'word processor' without any unnecessary details.   Information on how to customize the virus is what these kids are after, not how the virus actually works - too heady.   

Too many times these kids are taken by surprise when they see the extent of damage they created.   They usually have no idea that their code will even work that efficiently if at all.

Let's stop giving these people too much credit - this is what fuels them.   The science behind the viruses is mostly laughable.

Dimandja

Quote:

We are all a product of our experiences (albeit very complicated products) and I believe that the major experiences occur in early life

While I agree that most learning occurs early in life I think many experienses throughout your life can segnificantly on your personality.  The frontal cortex, which is basically our moral center of our brain, doesn't fully develop until we are about 30.  So unlike much of our other learning moral issues effect us for a long time.  Robert Sapolsky has some good papers on the issue.

I do agree that parents need to shape the development of moral judgement but we still have huge amounts of learning after we leave the home.  I look back and think my moral values have developed more in the last 16 years of my life compaired to the first.  This is just my experience.  I practise discussing moral judgement with my 8 year old son all the time and I'll do so well beyond his 18th birthday to develop his moral stance on subjects.

Dimandja - I appreciate what you are saying but I don't agree with it, which is fine, we don't have to agree.  Sven Jaschan supposedly was writing basically a virus cleaner when he "succumbed to peer pressure after his schoolmates badgered him into writing a more malicious program"

I'm not glorifing what he did.  I'm just saying many of the virus writers out there know a fair bit about computers.  Script kiddies are more likely to rebadge exsisting viruses.  

Sorry for my inaccurate information.  Scalper had a time from patch to worm being released of 10 days.  The LSASS, sasser, worm was 17 days while I admit that Microsoft knew about the problem for months.

Another thing is that just because he's 18 doesn't mean much.  I know plenty of programmers around 18 years old that are WELL above the bell curve of programmers.

His teaches talked about how good he was.  Don't mix up vocational school in germany with vo-tech schools in the US where the guys are there doing mostly auto shop or other production type work.

 

Hope I've been helpful,
Wayne Francis

If you want to get the best response to a question, please check out FAQ222-2244 first

Ok, SemperFiDownUnda,

I am not going to argue this point any further, because I prefer not to release information about the techniques behind viruses.    I have studied ways to defeat viruses for over 20 years now, and I think I should know something about them.    If you think viruses are a great deal, then I will not dispute your point of view: the hysteria they create is certainly big.

I'll say one thing though.   Computers and their networks were never safe from the get go - a fact that is not really well publicized.  And the problem lies in the digital nature of computers, not in the existence of some super geniuses.   Breaking digital locks is far easier than physical ones.

Dimandja

anyone remember Microsofts first attempt at Networking, talk about open house!

the're still trying to catch up (bad sign when they're the market leader in OSs)

XP SP2 is looking promising (so far)

Gurner

What is Divine Paradox?

www.divineparadox.co.uk

Dimandja, I don't think every virus writer out their are geniuses or even that most of them are.  I don't think talking about how to exploit buffer overflow vunerablities and the like is going to aid any potential virus writers as there are a ton of places that are just a google away.
By your statement I'll assume you are not getting what I'm saying.

While I agree that there are a large number of kids out there that can compile a small bit of code that they wrote and insert it into a virus shell I'll not assume that these kids (not saying all are under 18) don't understand what they are doing.  They don't have to be any smarter then joe bloggs that spends his time in wood shop because as you point out there are basically step by step guides.

But I do recognise that the first round of a particular virus often takes more skill then just a script kiddie following a directions.

In any case these kids in my view should understand what they are doing....its like kids saying they don't understand that it is wrong to burn a school, or spraypaint someones fense or to egg someones car or to beat up the neighbors kid.  As far as these worms and viruses spreading around the world ... these kids definately know the no boundry rules of the internet.  They work daily with the fact that they can break into someones computer half way around the world.

To me its just like a kid caught spray painting a fence that the owner just finished painting from the last bit of graffiti saying "I didn't know or think about the owner having to paint over my tags" trying to get out of getting punished.  So even if the kids are joe average or even stupid I fail to believe the don't understand what they are building is dangerous.  

So in a nut shell even "script kiddies" saying "I didn't know it would be this bad..." is IMHO total BS.

The kids do it to make themselves look cool in their own circles.  Start punishing the kids with appropriate sentences.  Because they are kids doesn't wash with me.

Babies aren't as stupid as people believe they are.  Many people think babies don't understand the world around them but even babies understand concepts like gravity before they begin to talk.  I believe script kiddies understand the world they play in too.

Hope I've been helpful,
Wayne Francis

If you want to get the best response to a question, please check out FAQ222-2244 first

Quote:

But I do recognise that the first round of a particular virus often takes more skill then just a script kiddie following a directions

Wayne, I think we agree on most things here.  Without nitpicking, this quote above is probably the type of comments we disagree about.  Simply because a virus has been given a new name does not exactly make it a "first round" virus.  

Commercially (for virus fighters) and media-wise, a new name does wonders; technically, it may simply be a recycled 10 years old shell of a virus targeting an equally old vulnerability hole.

Let me reiterate that our current Internet and OSes are rife with holes.   If you want a safer environment, try a private network; Internet is wide open and public.

Dimandja

You put an orange suit on the kid and let him sweep streets for every free moment he has for a year, and publicise it, you'll cut down on some of it.  Sweeping streets in orange jumpsuits isn't cool.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

Sweeping streets in orange jumpsuits isn't cool, until DJ Cool or whoever dons one in their next video.

Oh Dear!

http://news.bbc.co.uk/1/hi/technology/3725531.stm

Gurner

What is Divine Paradox?

www.divineparadox.co.uk

In a statistical universe as large as the internet, you will have no problems finding people who are two or three standard deviations from the mean:

http://www.infonet.co.jp/Aso/win/int-news/1996/in960701.htm

Want the best answers? Ask the best questions!

TANSTAAFL!!

How about 2 or 3 away from where we are, cause we're offset somewhat to start with.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

edfair:

Quote (edfair):

How about 2 or 3 away from where we are, cause we're offset somewhat to start with.

And man, is that ever saying something....

Want the best answers? Ask the best questions!

TANSTAAFL!!

Nabbed: http://www.msnbc.msn.com/id/4946173/

You know I hate when people put the blame on MS or any other companies.  You know we would be safer if we lived in a police state where everything was recorded blah blah blah

But we live in a world with laws and an expectation that these laws will be followed by most of the world.  Candy stores don't put bubble gum under lock and key to stop shop lifters.  Saying this worm is MS fault is annoying.  It is that little twerps fault and he's the one that cost organisations around the world and estimated 1 billion dollars.  Of which WE end up paying for it via higher prices on good etc.

It just MS haters.  No one jumps up in arms about *NIX systems that have holes.  FFS its alot easier for grandma to use MS update to patch her machine then it would be for her to get a patch and recompile her TCP stack on her RH box.

I guess car companies should be at fault for people breaking into cars and house owners that have a brick thrown through their windows should sue the builder for no using bullet proof 3" windows.

Hope I've been helpful,
Wayne Francis

If you want to get the best response to a question, please check out FAQ222-2244 first

Ok, SemperFiDownUnda, it is not MS fault.   It's just that MS became so big that it is fashionable to take jabs at them. Being clobbered in the media is a sure sign you have been annointed a celebrity: I am sure MS secretly relishes it.  Fame comes with its own price.  Unix systems are too obscure to most people for them to care.  

Dimandja

Perhaps it is the failure to expend adequate resources to attempt to break things so they can be fixed.
I'm not neccessarily a basher, but it seems that I'm a beta tester on every new product MS has released since w3.1.
NASA may be considered a bureaucratic mess but when they were getting ready for the moon they did it right. They had their failures but had most of the possible screwups either trapped or recoverable.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

To me, this is a microcosm of one of the biggest civil problems that needs addressing.
People don't accept responsibility for their own actions.
It doesn't matter if your wrong, just blame it on some shortcoming of the victim.  Just because I shot the gun is not what counts, the victim wasn't wearing a bullet-proof vest.  That's why he died.  Clearly, contributory negligence on the part of the victim.

What is so distressing is that the media and many people, even some participating in this discussion, encourage this behavior.  Very similar to some of the comments and bias shown in the thread "Microsoft Screws Up Again."  I'm no fan of Microsoft, and they certainly have their faults, but let's be realistic, if perfection is required to be a victim, then we're all in deep trouble.

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein

You may have misstated the case,CC.  If perfection is required to not be a contributory cause, we are in trouble.

True, I guess I was just too imperfect to see the difference.

Good Luck
--------------
As a circle of light increases so does the circumference of darkness around it. - Albert Einstein