Fergie's Tech Blog

Worm mocks convicted Sasser author

John Leyden writes in The Register:

A new virus mocking the creator of the Sasser worm is spreading across the net. The Lebreat-D worm drops an image of recently convicted virus writer Sven Jaschan onto user's hard drives with the phrase "Bitch" superimposed on an image of the German teenager's face.

Concealed inside the Lebreat-D worm's code is a lengthy diatribe from its author criticising anti-virus vendors. The message (extract below) goes on to scoff at the risk that its author might be investigated by the police.

Netsky(SkyShit),Beagle or Bagle,Mydoom and Sasser bye bye bitchs. It will be my game cuz the fbi or police are not searching for me to arrest me like ya sasser loooooooooooooooooooooooooooooool (next variants will use a better engine to send thousands of copies to users.) :P

Lebreat-D can spread either via infected email attachments or Windows security vulnerabilities (including LSASS (MS04-011) the same security bug exploited by Sasser). The worm opens a backdoor on infected Windows PCs through which hackers can exploit compromised computers. Once activated the worm is programmed to activate denial of service attacks on websites run by anti-virus heavyweights Symantec and McAfee. It is also designed to block users from accessing a list of anti-virus websites, a common tactic by virus writers designed to frustrate clean-up efforts.

posted by Fergie @ 8/01/2005 06:28:00 AM