Week in review: Virus king

All eyes were on security as a fast-moving e-mail virus claimed the crown as the worst ever, and along the way it managed to make enemies of two software heavyweights.

MyDoom raced onto the Internet on Monday, quickly clogging e-mail servers, as it propagated itself with millions of messages laden with malicious software code. The virus arrived with one of several different random subject lines, such as "Mail Delivery System," "Test" or "Mail Transaction Failed."

Once the virus infects a Windows-running PC, it installs a program that allows the computer to be controlled remotely. The program primes the PC to send data to the SCO Group's Web server, starting Sunday. SCO quickly offered $250,000 for information leading to the arrest and conviction of the person or group responsible for creating MyDoom virus.

The virus also copies itself to the Kazaa download directory on PCs, on which the file-sharing program is loaded. The virus camouflages with one of seven file names: Winamp5, icq2004-final, Activation_Crack, Strip-gril-2.0bdcom_patches, RootkitXP, Officecrack and Nuke2004.

An offshoot of MyDoom soon emerged, aiming data attacks at Microsoft's Web site and interfering with an infected PC's ability to access downloadable security-software updates. Microsoft followed SCO's lead and announced a $250,000 reward of its own

The reward is the third time Microsoft has posted a $250,000 "Wanted" sign on the Internet. It offered the same amount for information leading to the capture and conviction of the persons or groups responsible for releasing the MSBlast worm and the Sobig.F virus.

Two days after the attacks began, the U.S. Department of Homeland Security announced an e-mail alert system aimed at informing two groups of citizens--technical experts and the average home user--of potential online threats. The system, known as the National Cyber Alert System, will be maintained and administered by the U.S. national computer emergency response team, or US-CERT, but it relies on the expertise of many security companies.

The alert system is the United States' first nationally coordinated warning system for Internet threats and vulnerabilities. The system will take information from a variety of public and private sources and issue warnings, bulletins and how-to notifications.

Browser beef
Microsoft is making some changes to Explorer to better protect Web surfers, but holding off previously announced changes because of a patent dispute.

Microsoft will release a software update to Internet Explorer and Windows Explorer designed to protect Web surfers from being lured to Web sites that might contain malicious code. In December, a Danish security firm alerted the security community to an IE bug that would let hackers display false Web addresses. This week, the company posted details of an alleged flaw that could let Web surfers be tricked into downloading malicious files from counterfeit sites reached via such fake addresses.

However, Microsoft will delay making any modifications to Windows and Internet Explorer Web browser, based on the Eolas patent case. Microsoft said it will hold off on implementing previously announced changes until its efforts to appeal the suit or invalidate the patent are settled.

Microsoft originally said it would make minor tweaks to IE and Windows XP to bypass some of the disputed technology, but it backed off those plans. Microsoft said the proposed tweaks could inconvenience Web developers and other software companies and may not be necessary, if the U.S. Patent and Trademark Office invalidates Eolas' patent.

Cooking spam
The battle to rid the world's in-boxes of spam has got itself a heavyweight champion--Bill Gates--making an even more heavyweight promise: an end to the e-mail plague within two years. Gates said he could crack spam by 2006, adding that with the help of some canny tech measures, spammers would be hit where it hurts--in their fat wads of Viagra-inspired cash.

One of the suggestions on Gates' antispam checklist is setting those sending e-mails a simple brainteaser, or asking their PCs to do an easy computation. If you're sending an odd e-mail or two, the time and difficulty wouldn't pose much of a problem. For machines belching out huge amounts of spam day in and day out, however, the cost and computing power needed to send the e-mails off through the ether would be huge.

The Federal Trade Commission has some ideas of its own on how to get rid of unsolicited e-mail. The commission proposed a mandatory tag for commercial e-mail that contains pornographic material--a stipulation of the new federal antispam law enacted this month.

The FTC proposed a rule that would require senders of adult-related e-mail to include the phrase, "Sexually-Explicit-Content:" in the messages. That way, recipients would be able to recognize and easily filter such e-mail before viewing it, according to the FTC and backers of the law.

The FTC also has some advice for network administrators: Secure your servers. The FTC and its counterparts in 26 other nations began sending e-mail to tens of thousands of people believed to be responsible for open relays and open proxies that spammers use as broadcast points for massive amounts of junk mail.

This represents an escalation of the FTC's efforts to close open relays, which began last May with notices to operators of more than 1,000 servers. An open relay is a mail server configured so that anyone can use it as a relay point for mail to any recipient.

Looking at Longhorn
As Microsoft readies Longhorn--the next version of Windows--the company wants to wean developers and independent software vendors off older Windows programming models. Microsoft software architect Don Box said the company will not invest much more in Component Object Model and Distributed Compound Object Model--Microsoft's mechanisms for sharing objects between programs.

Instead, Box said, programs will use managed services based on the Extensible Markup Language to communicate with each other. Box is leading the work on the "plumbing" part of Longhorn, called "Indigo," which is effectively the successor to Microsoft .Net and as such will dictate how programs are written in future Windows platforms.

Box's boss--Microsoft chief software architect Bill Gates--took a swipe at rival operating systems as he reiterated the importance of security for Windows and in particular for the upcoming Longhorn. Gates stressed the importance of security for his company's products but said companies such as SCO were courting danger by sitting back.

"To say a system is secure because no one is attacking it is very dangerous," said Gates, referring to operating systems that have a smaller share of the desktop market, such as Apple Computer's Macintosh OS and the open-source software Linux.

Besides Longhorn, Microsoft plans to start testing a new version of its Windows XP Media Center edition, a customized OS designed for entertainment-oriented PCs. The software, code-named Symphony, is likely to make its way later this year onto new entertainment-oriented PCs.

Media Center includes all the features of Windows XP, but adds a second interface that can be navigated by remote control, for doing tasks like playing music, viewing digital pictures and pausing or recording TV shows.

Also of note
Responding to sharp criticism from legislators, a group of file-swapping companies told Congress that they have no ability to block copyrighted files or child pornography from their networks...This year's cap of 65,000 H-1B guest-worker visas is already close to being reached, as employers snap up the controversial visas...Intel plans to demonstrate a 64-bit revamp of its Xeon and Pentium processors in mid-February--an endorsement of a major rival's strategy and a troubling development for Intel's Itanium chip...Following in the footsteps of rivals, Oracle is launching a Web services-based effort to make its business management applications more compatible with other business systems...The server market surged in 2003, with shipments growing 25 percent in the last quarter.