Infosec stupidity

[holzman_tweed]

Sven Jaschan, the little shit who wrote the Sasser virus has been convicted and sentenecd to one year and nine months's jail.

Suspended. Oh yes, and 30 hours community service.

I'm sure would-be virus writers the world over are cringing in horror at the prospect of meeting a similar fate.

For those with short memories, this little shit is personally responsible for causing millions of dollars of damage to businesses. This little shit is personally responsible for paralyzing Taiwan's postal service. This little shit is personally responsible for stranding planeloads of Delta's passengers because flights had to be grounded. This little shit is personally responsible for stranding thousands of Australian rail passengers whose trains couldn't run because the computers controlling the rail network were fucked up.

This is a very partial list. This little shit's virus infected over a million computers, and we'd be here a long time discussing what each one of them did.

Guess what this little shit does for a living now?

He writes anti-virus software for a company called Securepoint. Someone at Securepoint isn't thinking this through very clearly -- this isn't some highly talented whiz-kid, this is a script-kiddie who figured out how to modify the script a little. I know that if I'm the guy running an IT shop and Securepoint shows up on my door, the question that I'd have to put on the table front and center is, "You willingly and knowingly employ convicted virus-writers. Why on earth should I trust your software not to compromise my network?"

I can't imagine how they'd convince me of their either their company or their software's integrity.

Comments

[cosinejeremiah.livejournal.com]

"Hi, we're Securepoint. Buy our stuff because we'll be the first vendor to have the signatures for the next version of Sasser--two days before the virus is released to the wild!"