Comments on: Microsoft: Worm Operator Worked at Antivirus Firm http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/ In-depth security news and investigation Mon, 21 May 2012 22:21:48 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Samuel http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48916 Samuel Mon, 30 Jan 2012 20:59:45 +0000 http://krebsonsecurity.com/?p=13229#comment-48916 Whatz botnet and whch programng languge dd he use? Whatz botnet and whch programng languge dd he use?

Like or Dislike: Thumb up 0 Thumb down 1
]]> By: dante http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48458 dante Fri, 27 Jan 2012 06:38:32 +0000 http://krebsonsecurity.com/?p=13229#comment-48458 He left of his own volition to pursue other opportunities due in large measure to the project he was working on being terminated, He left of his own volition to pursue other opportunities due in large measure to the project he was working on being terminated,

Like or Dislike: Thumb up 1 Thumb down 2
]]> By: abhishek http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48397 abhishek Thu, 26 Jan 2012 18:13:48 +0000 http://krebsonsecurity.com/?p=13229#comment-48397 hi i m student . i m doing a project on signature based antivirus can u suggest some feature that i can add in my project . Hidden due to low comment rating. Click here to see.

Poorly-rated. Like or Dislike: Thumb up 0 Thumb down 12
]]> By: passingby http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48310 passingby Thu, 26 Jan 2012 01:00:36 +0000 http://krebsonsecurity.com/?p=13229#comment-48310 but i'm sure that lack of details is because there's evidence that just can not be disclosed yet due to investigation going on and mentioned code was just a starting point, looking forward for further materials but i’m sure that lack of details is because there’s evidence that just can not be disclosed yet due to investigation going on and mentioned code was just a starting point, looking forward for further materials

Like or Dislike: Thumb up 1 Thumb down 2
]]> By: Matt http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48304 Matt Wed, 25 Jan 2012 23:52:40 +0000 http://krebsonsecurity.com/?p=13229#comment-48304 There's a little more meat in the amended complaint link provided in the article. It doesn't have a lot of details, but the combination of domain registration and the debug code is pretty strong evidence. "Microsoft...alleges that Defendant wrote and/or participated in creating the harmful computer software that constitutes the Kelihos botnet and that Defendant has used the software to control..." "Microsoft... alleges that Defendant owns, operates, controls and maintains the Kelihos Botnet and does business under the names of the Harmful Botnet Domains." There’s a little more meat in the amended complaint link provided in the article. It doesn’t have a lot of details, but the combination of domain registration and the debug code is pretty strong evidence.

“Microsoft…alleges that Defendant wrote
and/or participated in creating the harmful computer software that constitutes the Kelihos botnet
and that Defendant has used the software to control…”

“Microsoft… alleges that Defendant owns,
operates, controls and maintains the Kelihos Botnet and does business under the names of the
Harmful Botnet Domains.”

Like or Dislike: Thumb up 1 Thumb down 1
]]> By: passingby http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48301 passingby Wed, 25 Jan 2012 23:42:59 +0000 http://krebsonsecurity.com/?p=13229#comment-48301 well, i suggest to consider 3 facts 1) anyone can register any domain name and redirect to someone's page, especially if main desire is to frame someone who makes your life harder, additional research regarding specified domain is required, since anything can be put in whois info, some proof required that there's actual link between person and domain aside from it's name; 2) originating place of source code should be verified, because as was previously stated the source code could be leaked intentionally with framing pieces of code just without any proof that actualy bots acted in this way; 3) source code of malware is treasure for anti malware specialists, especially if it includes polymoprh parts for improving heuristics algorythms and definitions and source could as someone stated it could be used by that person for legimate reasons (generating signatures, finding master servers, researching ways to disrupt botnet etc.); well, i suggest to consider 3 facts
1) anyone can register any domain name and redirect to someone’s page, especially if main desire is to frame someone who makes your life harder, additional research regarding specified domain is required, since anything can be put in whois info, some proof required that there’s actual link between person and domain aside from it’s name;
2) originating place of source code should be verified, because as was previously stated the source code could be leaked intentionally with framing pieces of code just without any proof that actualy bots acted in this way;
3) source code of malware is treasure for anti malware specialists, especially if it includes polymoprh parts for improving heuristics algorythms and definitions and source could as someone stated it could be used by that person for legimate reasons (generating signatures, finding master servers, researching ways to disrupt botnet etc.);

Like or Dislike: Thumb up 3 Thumb down 2
]]> By: dehaul http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48296 dehaul Wed, 25 Jan 2012 22:52:36 +0000 http://krebsonsecurity.com/?p=13229#comment-48296 So if there is a piece of code out there that download malware from a domain that you own, you obviously wrote the code. Am I missing something here? So if there is a piece of code out there that download malware from a domain that you own, you obviously wrote the code.

Am I missing something here?

Like or Dislike: Thumb up 5 Thumb down 2
]]> By: KJ http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48293 KJ Wed, 25 Jan 2012 22:32:16 +0000 http://krebsonsecurity.com/?p=13229#comment-48293 By your own admittance your original comment was off topic, obscure and incorrect. Hidden due to low comment rating. Click here to see.

Poorly-rated. Like or Dislike: Thumb up 1 Thumb down 10
]]> By: Mr. White http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48285 Mr. White Wed, 25 Jan 2012 21:17:46 +0000 http://krebsonsecurity.com/?p=13229#comment-48285 This is a 'duh' statement. He looks like Jesse Pinkman and not everyone knows who that might be without a reference. Hidden due to low comment rating. Click here to see.

Poorly-rated. Like or Dislike: Thumb up 0 Thumb down 12
]]> By: KJ http://krebsonsecurity.com/2012/01/microsoft-worm-author-worked-at-antivirus-firm/comment-page-1/#comment-48277 KJ Wed, 25 Jan 2012 19:43:50 +0000 http://krebsonsecurity.com/?p=13229#comment-48277 It was Walt that was "breaking bad". Jesse was always a punk. Hidden due to low comment rating. Click here to see.

Poorly-rated. Like or Dislike: Thumb up 1 Thumb down 12
]]>