There is no evidence so far that the MyDoom worm originated with the Linux community, but that has not stopped SCO chairman and CEO Darl McBride from saying that he had suspicions about the attacker’s motives and identity.
On Tuesday, and a company spokesperson said: We suspect it could be someone from the Linux or open source communities.
The worm carries a payload designed to conduct a denial of service attack on www.sco.com on Sunday, and the Lindon, Utah-based company has offered a $250,000 reward to whoever turns over the author. There is no clear evidence that anyone in the Linux community is related to the worm, however.
Email security services provider MessageLabs Inc’s analysis of the worm indicates that the first copy was sent from Russia, although it is not clear at this stage where the worm originated. At this point it’s too early to tell, said Natasha Staley, infrastructure security analyst with MessageLabs.
Staley added that there was no indication, other than SCO’s offer of a reward, to suggest that a member of the Linux community was behind it. Unless they’ve got something we haven’t there isn’t any hard evidence of that, she said, but the fact that SCO’s offering a reward indicates that they are fairly convinced.
SCO has also said that it is working with US law enforcement authorities including the US Secret Service and the FBI to determine the identity of the individual or individuals involved with the worm.
SCO has an ongoing argument with the Linux community following its claims that the open source operating system contains code copied from its Unix System V code base. It has been hit with numerous denial of service attacks that it has blamed on the Linux community, so it was little surprise that the company linked MyDoom with open source advocates.
While Perens did not respond directly to that link, the author of the Open Source Definition has written an open letter to free and open source software supporters urging them to publicly deplore the attacks.
Do not cheer on the attacks on the SCO site, he wrote. By doing so you falsely implicate our community in the attacks, in the eyes of outsiders who read your words. Our community believes in freedom of speech, not silencing our opponents’ speech through net attacks. We will defeat SCO using the truth, not by gagging them.
The MyDoom worm is now the fastest growing worm in history, according to MessageLabs, with the company intercepting more than 1.2 million copies of the worm in the first 24 hours, compared to 1 million for SoBig.F. At its peak MyDoom was running at 1 in 12 emails, compared to an infected peak of 1 in 17 for SoBig.F.
This article is based on material originally published by ComputerWire
