Nice. I would have ended it differently though. Something like:

"Rot in hell you scum sucking pig.

Love, Dana."

:)

amen!

Great letter! Now you just need to convince the miscreants that wrote the worm to read your note.

Cheers,

Ken

Do you think it is a good idea portraying yourself as being so much full of hatred that you loose the grip on logic? Go for a walk, sleep over it.

Obviously the Author of MyDoom fits not the generally accepted (and elitist) definition of a script kiddie which is "using only tools written by others without understanding them".

The way of dealing with criminals is prosecuting them, not insulting them. If you live with the idea of the pimpled, sexually inexperienced, credit carding virus writer you mainly show your ignorance on all research on cyber criminals in the last 15 years - which really surprises me considering the general cluefullness shown in your writing.

Hey Max,

You are right that virus writers should be prosecuted to the fullest extent of the law. But my assessment of this attacker is still the same.

When I look at this attack, and profile how the attacker has approached this, I have to look at it from the point of view of being a nuisance.

What keeps me up at night is not attacks like this. It was too easy to detect, and strong infosec policies have prevented this attack from propagating in areas I am responsible for. There were signature updates for this threat from vendors shortly after launch and most infosec professionals are already on top of it.

Don't get me wrong... the writer is criminal in intent and action, and this attack is bad. I am just frustrated in seeing such blatent disregard for other people's online resources, in an effort to make a big spectacle about it.

Want to impress/scare me? Build a new attack vector based on an unknown vulnerability that can covertly collect information from a targeted source and get past all layers of defense without me knowing. You can name it "Magic Lantern v2" if you like. Its these kind of blended threats that I worry about. And they exist, thanks to professional cybercrimals who are learning from these more public attacks and applying lessons learned into their own code.

I don't live with a fascade believing its always a PFY that is causing this sort of havok. But I also don't believe its always a sophisticated attacker who really benefits from this sort of attack and gets away with it.

I'm sorry that you feel that my tounge in cheek letter was insulting. I am not on the employee payroll for CSIS or the FBI and don't have the resources to build evidence to criminally prosecute the attacker(s).

The intent was to raise awareness of the attack, and by you even reading about it... I met that intent. Thank you for taking the time to read it, and respond. I appreciate the comments.

Another good one, Dana.

Well, Microsoft may not have placed a bounty on the head of the MyDoom author yet, but SCO has! They have offered $250,000 for turning in the author.

SCO Offers Reward for Arrest and Conviction of Mydoom Virus Author

And so too has Microsoft:

http://www.microsoft.com/presspass/press/2004/jan04/01-29MyDoomBRewardPR.asp