UK police release TK worm suspects

Further investigations

By John Leyden, 10th February 2003

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Two Britons suspected of writing a virulent Internet worm have been released on police bail, pending further investigations.

On Thursday morning, police arrested a 19 year-old electrician and a 21 year-old unemployed man suspected of membership of a hacking group called the "THr34t-Krew" as part of a joint US/UK investigation. Investigators believe the pair, from County Durham,, and a US man, are members of a group which released the TK worm earlier this year.

The worm infected 18,000 computers and caused estimated damages of £5.5 million, according to a statement by the UK's National Hi-Tech Crime Unit (NHTCU).

Following question by officers from the NHTCU, the two men were bailed to report back to police in early April. Police are to examine computer equipment, and other evidence, seized when the pair were arrested last week.

US investigators arrested a man in Illinois last week as part of the same investigation.

The TK worm exploits the well-known Unicode directory traversal vulnerability in Microsoft IIS to spread and cause all manner of mischief. Infected machines are completely compromised. Crackers can control the machines through IRC to filch sensitive data or turn the machines in drones in DDoS attacks, according to Symantec (which previously referred to the malicious code as IRC Trojan).

All the more reason then to apply Microsoft's patch for IIS, designed to fix this flaw, which can be found here. ®