Microsoft, Reward-seekers Help Nab Sasser Creator

[Sip]

Microsoft, Reward-Seekers Help Nab Sasser Creator

 

By Stephane Nitschke and Stefan Braun

Sat May 8, 1:36 PM ET  

 

HANOVER, Germany (Reuters) - A tip from reward-seekers and information from Microsoft led to the arrest of an 18-year-old suspected of creating the "Sasser" computer worm, German police and the software giant said on Saturday. Spokesman Frank Federau for Lower Saxony police said police were certain they had the man behind one of the Internet's most costly outbreaks of sabotage.

 

"We are absolutely certain that this really is the creator of the Internet worm because Microsoft experts were involved in the inquiry and confirmed our suspicions and because the suspect admitted to it," he said in an interview with Reuters Television.

 

It was the lure of cash that proved the man's undoing. A group of individuals from Lower Saxony approached Microsoft (Nasdaq:MSFT - news) on Wednesday inquiring about reward money should they turn in the man.  The U.S. software giant in the past has put bounties of up to $250,000 on the heads of other notorious virus writers.  Microsoft general counsel Brad Smith told reporters the company agreed to pay the informants if there is a conviction.

 

"They did not stumble upon him through technical analysis. They were aware of who he was," Smith said, declining to elaborate on their relationship to the suspect and saying only the number of informants was less than five.  The economic toll of Sasser may never be known, but it claimed some big scalps, including Germany's Deutsche Post (DPWGn.DE), Britain's coastguard stations and investment bank Goldman Sachs (NYSE:GS - news).

 

"COMPUTER FREAK"

 

Federau said the man, who he described as a highly intelligent "computer freak" living with his parents, was arrested on Friday near the central German town of Rotenburg but was no longer in custody.  Authorities and Microsoft said they suspect the man created all the versions of Sasser, adding he worked alone.

 

He is also believed to be a main person, if not the mastermind, behind the Netsky viruses that have been plaguing Internet users since February, Smith said.

 

All the man's computers were confiscated by police, Federau said.

 

Since appearing one week ago, Sasser has wreaked havoc on personal computers running on the ubiquitous Microsoft Windows 2000 (news - web sites), NT and XP operating systems, but is expected to slow down as computer users download anti-virus patches.  The computing underground responsible for hatching worms and viruses has proved a difficult ring to crack for law enforcement and security experts were surprised at the rapid arrest. (Additional reporting by Bernhard Warner in London and James Mackenzie in Hanover)

 

Source on yahoo news

 

Good riddence! I hope they throw the book at this bastard as I have been getting about 10 or more Netsky attachments a day for the past few weeks from some infected computer in the LA area.

[Accelerated]

Sip, how easy is it to create such a damaging virus/bug? Would you be able to do it - say in a weeks time? - just wondering

[Sip]

Well .. depends on the virus. The vulnerability that sasser is using to get into a system was discovered several weeks ago. A patch was made available. I even posted a warning here I think telling people to make sure to keep up with win update. Then I think it took about 15 days until sasser showed up so there was plenty of time to protect against it.

 

In terms of how easy it is to write it's really not that complicated but it's not something your average PC user/programmer would be able to figure out. To be honest, I don't know how long it would take me to do it as I have never had any desire to do such a dumb ass thing!

 

The problem is that this vulnerability information is sometimes widely available on the web kinda like those "how to make a bomb in your garage" recepies So any girlfriendless punk with tons of time on his hands and some brains can sit there and really learn how to do it.

 

Basically what Sasser does (there are variations of it) is it uses this particularly nasty win XP security hole to get in that allows it to get shell access on the remote system (i.e. start to run different programs). That is probably the hardest part to figure out how to do. Once it's got shell access, it copies itself and sets up an FTP server on the computer and resets it. Once reset, it scans random IP addresses of other computers connected and tries to infect them. Again, once in, it connects back to the computer it connected from and copies itself to the new infected PC using the FTP server mentioned above ... and thus it spreads like crazy ... now you got 2 computers looking to infect and soon 4 and soon 8 ... and millions in not too long.

 

Pretty much all that stuff above is really easy to do for anyone that knows some network programming so the problem basically becomes finding this hole to get into a system. That either takes some serious brains, inside info (e.g. source code), or a lot of dedication and free time to brute force it (as in systematically try a lot of things in the hopes of finding a hole).

[Sip]

Of course a lot of other viruses rely on stupid users to get in (as in opening unsafe attachments). Those are TRIVIAL to write ... as in it will take a couple of minutes . But those won't spead as much or as fast and are relatively easier to protect against than these nasty ones like Sasser that just spread like crazy.

 

The good thing about sasser is that it didn't do much damage other than just slowing things down by trying to spread really fast. But you can imagine a very malicious virus writer could do all sorts of evil things once in your PC ... delete your files, corrupt things, use your PC to attack critical government or finanical systems, or just silently send info about you back to the author.

[Accelerated]

girlfriends for all!, I say

[Sip]

Yah ... the best antivirus.