Subject: RE: [hackers-il] Idea: Worm with EULA

From: Chen Shapira <[email-masked]>
Date: Mon, 24 Sep 2001 15:30:53 +0200

>   I have an intersting project suggestion: Write a M$-Email 
> worm that before

Writing an outlook worm is so easy it isn't even a challange.
Outlook has a wonderful API, I use it regularly for scripting and automation
of my mail, and it is no trick at all to politly ask for an addressbook and
send mail to everyone.

> doing any damage displays an EULA asking the user to agree to a quite
> standard disclaimer and also agree to pay us money and 
> anything we want.
> Only if the user agrees, the worm spreads itself (as mail worms do).
> Spreading this worm should be legal, as any infected user 
> explictly agreed
> to be infected (without knowing it's a worm).

I like the idea, but for diffrent reasons.

Users don't read. They hardly read any popup message that appears on the
screen. But they click. And because they don't read, their clicking patterns
will seem quite random.
However, I have a feeling that given enough study, some interesting patterns
can emerge.
Most users, given a dialog they don't understand will prefer to click
"cancle" rather than "ok".
So given a random dialog, your worm may fail.
But I think an EULA can be designed to look familiar and trust inspiring
enough to promot clicking "OK".
In this sense I find your worm interesting.

>   This example will illustrate the problem with closed-source 
> and EULAs. If
> you can't look at the source, you're a fool to agree to 
> no-warranty and
> other draconic EULA terms.

Careful here. 
The first and strongest thing that you will illustrate is the law of random
clicking. You can make a user click on anything.
I think this virus has almost nothing to do with the closed/open source
issue.
And certainly it will demonstrate that you shouldn't agree to contracts you
didn't read, but hell, we all know that, we are also supposed to eat health
food and excercise, but being human beings, we try to skip those things,
sometimes not to our best benefit.

>   IANAL, but I think spreading this worm will not be consider 
> as a criminal
> offence. If this does not suffice, we could actually tell the 
> user what the
> worm does in the EULA he supposedly agrees to. Nobody reads that stuff
> anyway.

IANAL either, but it sounds interesting.

Chen.

---

From: Alon Altman <[email-masked]>
Date: Mon, 24 Sep 2001 15:46:55 +0200 (IST)

> of my mail, and it is no trick at all to politly ask for an addressbook and

Ofcourse not, but that's not what this worm is about..

> In this sense I find your worm interesting.

  That's exactly what I meant. The worm should e-mail itself as a useful
program (but with no expressed function), or something that can even be true
on our vision of things ("End all your Windows problems!" = wipes user's HD).

  Most users automatically click OK when they see an EULA without reading a
word. Interesting enough, many of these people will never sign something
they didn't read. However, with legislation that makes EULAs binding, both
have the same legal weight. In that sense, this could be an interesting
test.

  Rethinking it, we should actually write in the EULA what the program does
("This program will send itself to all people from which you have stored mail
and then wipe your entire hard drive. By clicking 'I Accept', you hereby waive
all claims against the manufacturers of this program.")

> I think this virus has almost nothing to do with the closed/open source

  When did you see an open source product forcing you to agree to an EULA? :)
Also, with open source you can check the program before agreeing to a
disclaimer of all warranty or liablity.

> sometimes not to our best benefit.

  See my comment above. Most people don't think of EULAs as binding contracts.

> IANAL either, but it sounds interesting.

So let's go... we should just remember to cover our backs...

  Alon

-- 
This message was sent by Alon Altman ([email-masked]) ICQ:1366540
The RIGHT way to contact me is by e-mail. I am otherwise nonexistent :)
--------------------------------------------------------------------------
In Boston, it is illegal to hold frog-jumping contests in nightclubs.

---

From: Tzafrir Cohen <[email-masked]>
Date: Mon, 24 Sep 2001 16:19:52 +0200 (IST)

> When did you see an open source product forcing you to agree to an EULA? :)

When was the last time you installed Mandrake?

-- 
Tzafrir Cohen
mailto:[email-masked]
http://www.technion.ac.il/~tzafrir

---

From: "Nadav Har'El" <[email-masked]>
Date: Mon, 24 Sep 2001 16:25:16 +0200

> "cancle" rather than "ok".

Reminds me of a practical joke I played several years ago on a friend at
work, to "revenge" against the fact that he reniced other people's processes
to make his run faster. I wrote a small program (in Tcl/Tk, if anyone cares)
that popped up on his screen a dialog looking like (I don't remember the
exact text):

             +------------------------------------------------------+
             | The system has detected an illegal attempt to lower  |
             | the priority of other users. All your processes will |
             | now be killed. Press OK to continue.                 |
             |                                                      |
             |                     +-----+                          |
             |                     | OK  |                          |
             |                     +-----+                          |
             +------------------------------------------------------+

I guessed that the guy would be afraid to press OK (because the dialog
says this will kill all his processes), and will run from his office asking
people for help and advice on what to do. That's exactly what happened ;)

-- 
Nadav Har'El                        |       Monday, Sep 24 2001, 7 Tishri 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |Isn't Disney World a people trap operated
http://nadav.harel.org.il           |by a mouse?

---

From: Alon Altman <[email-masked]>
Date: Mon, 24 Sep 2001 16:51:01 +0200 (IST)

On Mon, 24 Sep 2001, Chen Shapira wrote:
> There is a slight diffrence between EULA and a contract.
> When you read your rent contract, you look for things you want to change,
> and ask your future landlord to change them.
> With EULA, one of the reasons we don't bother to read it, is that its the
> only game in town.
> If I need a certain program, I know that I'll have to agree to the EULA in
> the end. So I just agree in the beginning.
> BTW, some contracts I barely read, I never read the contract I signed when
> openning a bank account, or when getting a credit card.

Intersting.

> You are getting more extreme. Last post you claimed that this worm won't
> cause demage.

  OK, Let's forget about the damage part and just mention that the worm is
an experiment and is developed for educational purposed only. Also, we shall
not spread the worm, just post a link to it on /. and let someone else do
the dirty work.

> BTW, perhaps you should familiarize yourself with the concept of illegal
> contracts.
> Not every contract you sign is binding.
> A person can't sell himself to slavery, and in many places the "no warranty"
> clause is also non binding.

  OK, but I think in this case it's legal. Maybe add another precaution like
a modal dialog box asking "Did you actually read the terms of the EULA?".
Many people will even answer 'Yes' to that. We can then gather all data
(click rates for those who pressed 'I Agree') at a central site.

> They usually ask me to agree to a GPL or other license.
> GPL is no warranty too.

  But in the case of OSS, you can actually read the code you're agreeing
about. You can't do that with closed-source.

> Sure... Right...
> The same person who can't be bothered to read 50 lines of EULA will now read
> 1000 lines of code?
> Also, an open source program could be in a programming language you don't
> know too well (emacs modules in lisp come to mind)

  But theoretically, it's possible. Just like a person who is not a lawer can
hire one to understand a contract. He could hire a programmer to understand
code. Also, OSS projects are community-checked to do the Right Thing.

> I agree, thats why they feel free to copy propietory programs around.
> they just can't force themselves to take computers as a real serious thing.
> But I doubt if the worm will make them change their mind, especially since
> it may well be non-binding.

  Copying propietory programs is illegal by copyright law, and you need not
agree to an EULA to be liable.

> I'm a bit hesitant here.
> I like the idea of seeing users agree to horrible things without even
> knowing.
> I dislike the idea of email worm, both in burden to the infrastructure and
> in the breach of privacy involved when you read someones address book.
>
> Sorry, but I doubt if I'll carry it out.
> I still want to do some sort of study on the subject of "what makes users
> click", but I'll guess I'll do it the usual way with a usability lab.

Oh, ok, nevermind.

-- 
This message was sent by Alon Altman ([email-masked]) ICQ:1366540
The RIGHT way to contact me is by e-mail. I am otherwise nonexistent :)
--------------------------------------------------------------------------
The most dangerous organization in America today is:
	(a) The KKK
	(b) The American Nazi Partylove
	(c) The Delta Frequent Flyer Club

---

From: Tzafrir Cohen <[email-masked]>
Date: Mon, 24 Sep 2001 17:54:21 +0200 (IST)

On Mon, 24 Sep 2001, Alon Altman wrote:

> OK, Let's forget about the damage part

Why?

Maybe create a program that shows some anymation, but after a couple of
seconds suddenly pops up a dialog of "deleting all the file files on drive
C:" and have the program start do some disk work (maybe creating and
deleting files in the TEMP directory).

---

From: "Nadav Har'El" <[email-masked]>
Date: Mon, 24 Sep 2001 18:17:53 +0200

> deleting files in the TEMP directory).

I have another practical joke story :)
This time this is something I pulled off in high-school...

While playing around with memory addresses and interrupts on the IBM PS/2
(or IBM compatible, or PC, or whatever we used to call them in these days)
I discovered a way to light the hard-disk's LED without actually doing
anything on it.

So I wrote a joke "virus". Actually it wasn't a virus - it was a TSR
("Terminate Stay Resident", if anyone still remembers what those were) program
which I had to run on the "victim"'s computer (e.g., insert it into
AUTOEXEC.BAT) without him noticing.
What this program did was to trap both the keyboard and timer interrupts.
In one out of 100 keyboard interrupts, the program would randomly change the
key the user pressed (this is quite annoying ;)). And after several hours of
running, or after the user types in a chosen string (e.g., his name as part
of a login process), the program would clear the screen, display a message like
(again, I don't remember the exact text)

    You have a virus. Your hard disk is being formatted. If your reboot
    your computer now your hard-disk may be physically damaged!

and the disk light would turn on. Obviously, nothing would really happen
to the hard disk - that was never my style.

Anybody else has good ideas for hacker-related practical jokes?

-- 
Nadav Har'El                        |       Monday, Sep 24 2001, 7 Tishri 5762
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |Unix is simple, but it takes a genius to
http://nadav.harel.org.il           |understand its simplicity.