As the article notes, this isn't unheard of. Max Vision's 1998 worm fixed a BIND vulnerability. That seemed to be the worm's main purpose and motivation. Fixing a vulnerability or two behind malware is rare. There are WordPress-ecosystem malwares that seem to mostly exist to eliminate previously-installed malware.
The question is: why is that rare? Simulations of worms that patch holes as they go shows they easily out-compete worms that don't. Why don't feral software developers include code to fix the vulnerabilities they use to gain access in the first place?
Bender · 5h ago
Why don't feral software developers include code to fix the vulnerabilities they use to gain access in the first place?
These were hacktivists and were mostly grey-hats. In the early internet there are far less monitoring and logging. The risk of being a grey-hat was lower and there were less legal precedent for what happens when caught.
Logging and monitoring is very common now and there are a myriad of court cases that show hacktivists what happens when they are caught. The older former-hacktivists now have something to lose and the younger ones don't want to spend a portion of their life in jail whereas criminals that spread malware for financial gain are often in locations that first world countries can not easily pursue and they have accepted the risks vs. rewards.
As the article notes, this isn't unheard of. Max Vision's 1998 worm fixed a BIND vulnerability. That seemed to be the worm's main purpose and motivation. Fixing a vulnerability or two behind malware is rare. There are WordPress-ecosystem malwares that seem to mostly exist to eliminate previously-installed malware.
The question is: why is that rare? Simulations of worms that patch holes as they go shows they easily out-compete worms that don't. Why don't feral software developers include code to fix the vulnerabilities they use to gain access in the first place?
These were hacktivists and were mostly grey-hats. In the early internet there are far less monitoring and logging. The risk of being a grey-hat was lower and there were less legal precedent for what happens when caught.
Logging and monitoring is very common now and there are a myriad of court cases that show hacktivists what happens when they are caught. The older former-hacktivists now have something to lose and the younger ones don't want to spend a portion of their life in jail whereas criminals that spread malware for financial gain are often in locations that first world countries can not easily pursue and they have accepted the risks vs. rewards.