youareanidiot.org

追加: 2026-06-04

[00:00:00]Hello everybody. My name is Eric and today we're going to be looking at an absolute classic malware. This was kind of the stuff of legends, at least when I was young and this was the kind of thing people talked about at school. They were like, "Oh, you heard of the you are an idiot virus." And there's a lot of mythology about it. People really hyped it up saying that it would completely like physically destroy your computer.

[00:00:21]Now, the website, at least for a long time, remained online, but the more nefarious payload was shut down as browser security improved. But luckily, uh, we're going way back in time to the year 2000 when Windows Millennium Edition was still king. Uh, also sometimes referred to as Mistake Edition. We didn't have to worry about security. We didn't worry about browser permissions. That's we we don't need that. uh you know and as many people have said nobody likes those security people we we don't need them. So let's try this out. So let's open up Internet Explorer the market leading browser and let's go. So weirdly, Windows Millennium Edition is actually harder to set up with non-dialup internet, but uh we we have to uh do that that and then go land manual because technically broadband did exist in the year 2000. Certainly wasn't common. Uh what that wasn't supposed to happen.

[00:01:31]Oh, it worked. Okay. Uh, that's why people sometimes call this uh mistake edition. So, we should have our host set up.

[00:01:41]What? Oh, why did we go to Bing? Wow, it even works. Okay, so we definitely have internet. No, it's http.samples.iawaurisack.com you. So, does the host file not work on this version? Don't don't worry. I got a plan B. I can just uh edit the actual DNS. And uh with that, it worked. I actually didn't know that it was going to work that quickly. Uh what I did was I put the local IP of the sample server on the public internet and somehow SWF files. I thought I was going to have to wait. Does Windows ME come with Flash Player? What? Okay. Well, that saved a bunch of time. So, this is the basic. Uh but what do you think's going to happen if we try and close? If we hit alt f4.

[00:02:32]Uh now uh the payload takes effect. Now I do have the code for this. So we can actually explain how this. So now what do you think is going to happen if we try and close one of the newly spawned?

[00:02:45]Oh, okay. Now we get even more.

[00:02:51]And the reason why we're getting more is because for every hit uh uh seems like something is going wrong.

[00:03:05]But uh yeah, I think we're what? Wait, why are they transforming?

[00:03:12]We have bouncing. You are an idiot.

[00:03:20]And let's see what the resource usage of this mess is. This don't get rid of me.

[00:03:25]Okay, this this seems to have hit a wall. So, we're going to try resetting it. We're going to see. We're going to give this one more shot and see uh if we can get more. You are an idiot, Windows going. Did we?

[00:03:37]Definitely. Uh, doing this on Windows ME makes it more fun because Windows ME is terrible, but at least it has really good login music.

[00:03:47][music] You got to give it that. You You can hate on Windows ME, but you got to admit that login music for this uh and Windows 2000 was the best one Microsoft ever did. Okay, now let's see. Now, does closing them this way spawn it? Yep. Oh.

[00:04:04]Oh, wow.

[00:04:09]This is basically a troll version of a fork bomb.

[00:04:23]>> So it is and and of course it will continue uh and it swans six of these for every instance.

[00:04:40]You are an idiot.

[00:04:41]>> We now uh we now have pages of you are an idiot uh going.

[00:04:49]Be careful cuz if I hit alt f4 too many times, I'm actually going to alt f4 virtual box which will kill this. But nope. Uh and we got more coming.

[00:05:00]Okay. So, so far there we go. And we've now got two filled uh task bars worth of you are an idiot.

[00:05:10]That's really all that happens here.

[00:05:12]Now, as we saw before, and I'll show you again, actually, let's see what happens.

[00:05:17]This could actually be really funny if we try and shut it down properly because wait, does it draw over the shutdown?

[00:05:29][screaming] >> Why would that even be a thing?

[00:05:35]What what happens if we try to log off?

[00:05:44]>> Oh, I think it's working. Yeah. So, what I was thinking is if we if we get wind log in to try and Okay, we could also try actually cuz I think this version supports Okay, we can't send the shuttle.

[00:05:59][cheering] Okay, so if you manage to send the login or resale signal because the system will try and kill all the windows and every time you try and kill the window.

[00:06:13]So I'm just going to try and see and it's going to be really vague how much is being used by looking at virtual box in activity monitor.

[00:06:24]Wow. Okay. So RAM doesn't really matter.

[00:06:28]Uh oh, actually it is going. I wasn't sure if it was just showing. I don't think I gave this virtual machine that much RAM, but CPU, given this is a 64 core CPU only host, that means it's completely maxed. The one core that Windows Millennium can support.

[00:06:46]Let's see how much RAM we give it.

[00:06:49]128 megabytes of RAM.

[00:06:52]So, it is completely maxed [cheering] and uh yeah, we can't even get to the Wait, did it actually log out? Okay, so you can actually log out and we can see everything here so far is still working. So, this is more of a troll browser exploit, but it still could uh at least in the short term cause some distress.

[00:07:22]So given I set this thing up and I have the source code, we might as well briefly look at it now.

[00:07:28]And of course this is for educational purposes only. Don't worry, these URLs will not work. This is a local IP address. I just pushed it to DNS. So unless you are on my local network, uh these URLs will not work. And they will also not work in a modern browser. Not just because you don't have Flash, but also because uh the browser security would not let you do these things. So, let's take a look at how this really works. Now, I got this from a GitHub repository. There's plenty of recreations of you are an idiot, but this is the actual source code of the original. Uh, and uh, so and also pretty OG domain, I think. Uh, so let's see. So, if you hit these keys, uh, the Procreate command, which creates several more windows, is triggered and the JavaScript is loaded from here. Now the actual you are an idiot flashing thing is a simple a swf a flash file. So let's see what we get uh from thing.js which I think is the equivalent of u.js. I don't know if the re-uploader did this or uh yeah these these would appear to be functionally identical.

[00:08:40]So Procreate uh opens several of these windows. Open window this. Okay, these are so that the play ball command which all the new windows will run uh which moves the window around. Now, as far as I know on modern uh browsers, you cannot do this.

[00:09:04]We got this.

[00:09:09]You can see there's nothing earthshattering here.

[00:09:14]What I am curious to see is does it work on slightly more modern browsers as we do have uh Windows XP which Oh yeah, we got to do that cuz I think I may have also detect disabled networking on this VM.

[00:09:35]Not sure. Maybe we did it through Well, that's what we did. Yeah, right. because that was on the that was so that the worm would work.

[00:09:46]And now it Let's see what happens if we hit uh Oh.

[00:09:53]And okay, so the windows still seem to spawn, but what doesn't happen? Okay, the second stage doesn't seem to work. So, we do have flash. Okay, so it but it it doesn't work. And it doesn't spawn more windows, so it kind of works. And this is also another example of why and maybe a more realistic version of when people say you shouldn't use something like Windows XP or Windows 9X on the internet especially 9X which doesn't get wormed but is still clearly insecure. This is the kind of risk that can happen is there are a lot of known vulnerabilities for web browsers that run on these old operating systems that of course will never get patched. So very easy to come across malware uh or just trollware in this case. So, that's what I'm going to call this. Uh, so that's going to be all for me for now.

[00:10:48]Please do let me know what you thought of this video in the comments below. And if you have any other classics you'd like me to take a look at, I've got some ideas. Going to sort of do uh every every week or two, we're going to try and do a classic malware video cuz a lot of people really enjoyed it. So, that's all for me for now. Bye.