Blaster Virus Writer Arrested

From the world's stupidest criminals to the hottest court cases, you will find something interesting to ponder here.

Blaster Virus Writer Arrested

Postby Nyufrost » Tue Sep 02, 2003 9:45 am

It's kind of old news by now that the teenager who wrote a variant of the Blaster virus was arrested on Friday but since my original thread went bye bye then I am posting an updated version.

I'm glad they caught this guy and wish they were able to track down more of these malicious punks.

Here is how the FBI tracked him down and IDed him .....

U.S. law enforcement agents said the arrest of the alleged author of the "Blaster" variant sends a message to virus writers that the federal government will seek out and prosecute similar crimes.

The U.S. Attorney's office confirmed Friday afternoon that federal agents had arrested 18-year-old Jeffrey Lee Parson of Hopkins, Minn. for intentionally damaging a computer, a violation of U.S. criminal code. If prosecuted, Parson will face a maximum penalty of 10 years in federal prison and/or $250,000 in fines.

"With this arrest we want to deliver a message, here and to around the world: the DOJ takes these crimes very seriously," said U.S. Attorney John McKay, who said his office in Seattle is dedicated to fighting cybercrime.

"Let there be no mistake about it, cyber hacking is a crime," McKay added. "It harms persons, it harms individuals, it harms businesses. We will investigate, track down and prosecute cyberhackers."

Parson is being charged with modifying the original "Blaster" or "LovSan" virus and releasing it on the Internet, infecting at least 7,000 PCs and using them as "drones" to mount a distributed denial of service (DDoS) attack, according to the complaint filed by the U.S. Attorney's office. Antivirus vendor Symantec Corp. said the worm infected over 500,000 machines, which were programmed to attack Microsoft's WindowsUpdate.com web site, which Microsoft redirected in a successful bid to avoid the worm.

"We will not be deterred by national boundaries, we are never deterred by state boundaries and we will pursue people as far as we can to prosecute crimes," McKay said.

How agents tracked Parson down

Although McKay said that Parson was identified through standard police work, the complaint filed by the U.S. Attorney's office describes a common methodology of seeking out and determining an online user's identity. McKay described the investigation as "ongoing".

In July 2003, the Last Stage of Delirium group discovered and notified Microsoft of a potential hole in the Windows operating system. Microsoft issued a patch to fix the vulnerability, but a Chinese hacker group named XFocus reverse-engineered the patch, rediscovered the vulnerability, and developed scanning software that exploited the hole, according to the complaint. XFocus published the code to the Internet.

At or about the same time, Microsoft discovered several variants of the virus, among them the so-called Blaster.B ("W32/Lovesan.worm.b"), which renamed the executable to "teekids.exe", according to the complaint. When executed, the worm contacted the http://www.t33kid.com hacker site, where the machine was added to a list of infected machines. The t33kid.com site has since been taken down.

Federal agents then tracked down the domain http://www.t33kid.com to an ISP in Southern California, and found out the customer who leased the IP address. That customer had communicated with Parson over IRC, and subsequently discovered a related site, dl.t33kid.com. According to the complaint, Parson hosted the second site on his own PC, which agents discovered mirrored the http://www.t33kid.com site, including the Blaster code and list of infected computers.

Agents then resolved the dl.t33kid.com IP address, and discovered the physical location of Parson's house, which was confirmed by Parson's cable provider, Time Warner Cable. Parson later confessed to modifying the code and holding a list of infected computers, according to the complaint.

Parson was arrested in his hometown at 8 AM this morning and transported to the courthouse, where he was formally charged, McKay said. Although the government asked a Minnesota court to hold Parson in prison before he was trial, the court ruled that house arrest was sufficient. The government seized all of the computers in Parson's house, McKay said, and Parson is being prevented from accessing the Internet. McKay said he did not know whether Parson was a student.

Although the government's formal complaint against Parson only puts the total damage at $5,000 the minimum necessary to charge an individual with malicious damage of a computer, the total damage will run into the "millions", according to Brad Smith, general counsel of Microsoft. The total cost includes technical support for customers and rebuilding its communications infrastructure.

Meanwhile, Smith said, Microsoft is working to develop stronger, more secure software that's resistant to the types of attacks Parson launched, while providing greater technical assistance to consumers, and providing more cooperation to law enforcement. "We need to keep moving forward on all three fronts," Smith said.

McKay said that, for now, Parson was being charged only with modifying and releasing the original Blaster code, and that the government had no evidence he was involved with any other derivatives of the worm or other hacking tools. However, he did say that agents were actively investigating other leads in the case.

"It's not unusual that a young individual at a young age has substantial knowledge and ability," McKay said. "But unfortunately, this has been turned to crime."
<BR><center> "Snowflakes are one of nature's most fragile things, but just look <br> what they can do when they stick together.." ... Vesta M. Kelly</center>
User avatar
Nyufrost
Frost Advisor
Frost Advisor
 
Posts: 5534
Joined: Wed Dec 04, 2002 7:03 am
Location: Out There

Postby Dev » Sun Sep 07, 2003 8:43 pm

holy **** thats once genius 18 yr old computer wiz guy
Fosty wrote:"My fake plants died because I forgot to pretend to water them."
- Mitch Hedberg

CrustyPunk wrote:Talk to Orion. He plays gee-tar."


Funny men
User avatar
Dev
Elite Guard
 
Posts: 1678
Joined: Fri Jul 11, 2003 3:56 pm
Location: low-temperature penis - cold cock. It actually means the stock of a weapon.

Postby Dev » Sun Sep 07, 2003 8:44 pm

i wonder if the infected comps had norton antivirus
Fosty wrote:"My fake plants died because I forgot to pretend to water them."
- Mitch Hedberg

CrustyPunk wrote:Talk to Orion. He plays gee-tar."


Funny men
User avatar
Dev
Elite Guard
 
Posts: 1678
Joined: Fri Jul 11, 2003 3:56 pm
Location: low-temperature penis - cold cock. It actually means the stock of a weapon.

Postby Nyufrost » Mon Sep 08, 2003 7:31 am

I don't know ... it's possible they did but that people did not have it configured to automatically check incoming mail.

Also, a second Blaster variant writer was arrested within the same week ....

LONDON (Reuters) - Police Wednesday said they arrested a 24-year-old Romanian man suspected of releasing a new version of the Blaster Internet worm, the second arrest of a copycat virus writer in the past week.

Meanwhile, the main culprit behind the original super-potent Blaster remains at large. The original worm, which also goes by the name "LovSan," surfaced last month, infecting hundreds of thousands of computers running Microsoft Windows.

Authorities identified the author of the latest worm strain as Dan Dumitru Ciobanu from the northern Romanian city of Iasi.

Police were unavailable for comment, but issued a statement late Wednesday through BitDefender -- the Romanian firm that helped police track down the suspect -- confirming the suspect's identity.

He is a 24-year-old student at the Technical University of Iasi, the statement said.

Mihai Radu, a spokesman for BitDefender, said Ciobanu has not yet been charged. Under recently passed cybercrime legislation, he faces a prison term of three to 15 years if convicted, Radu added.

Police confiscated two of Ciobanu's computers. The machines will be analyzed in the presence of the defendant, his attorney and the local district attorney, officials said, as early as Thursday.

He was in police custody as of Wednesday night, Radu said.
<BR><center> "Snowflakes are one of nature's most fragile things, but just look <br> what they can do when they stick together.." ... Vesta M. Kelly</center>
User avatar
Nyufrost
Frost Advisor
Frost Advisor
 
Posts: 5534
Joined: Wed Dec 04, 2002 7:03 am
Location: Out There

Postby TerraFrost » Mon Sep 08, 2003 7:43 am

it's also possible they didn't download the latest virus updates, if they had it ;)
TerraFrost
Legendary Guard
 
Posts: 12357
Joined: Wed Dec 04, 2002 6:37 am


Return to The Nifelheim Justice League

Who is online

Users browsing this forum: No registered users and 1 guest

cron