Feeds

Sasser copycats get busy

Saga continues with Sasser-F and Cycle-A

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Copycat virus authors have released a pair of worms targeted at the same vulnerability in Microsoft's operating system exploited by the infamous Sasser worm.

Undeterred by the arrest of Swen Jaschan in Germany last Friday, coders have released a new Sasser variant (Sasser-F) and the first worm in a new strain, Cycle-A. Both worms exploit a hole in Window's Local Security Authority Subsystem Service (LSASS) component. Neither is spreading particularly widely and most AV vendors place them low on the peril index.

Cycle-A kills processes belonging Blaster and Sasser (A-D) worms on infected machines. In addition, it is programmed to launch a denial of service attacks against the websites of the Islamic Republic News Agency (www.irna.com) after 18 May. If it can't reach IRNA it will try to packet the BBC home page, its secondary target.

Sasser-F is a repackaged version of the Sasser-A worm (which never spread widely due to faults in its coding - Sasser-B caused the most problems). Sasser-F shares all of its code and functionality of its predecessor and differs from Sasser-A only in the filename and registry keys it uses. The new variant has a malicious process name of "billgate", probably as a reaction to the aid given to German police by Microsoft in the arrest of Jaschan.

"It is definitely a patched version of Sasser-A. Whoever released this had no access to the source code." said Sorin Victor Dudea, Head of Virus Research at Romanian AV outfit BitDefender Labs.

The release of two versions of Sasser after Jaschan's arrest on Friday has led to speculation its author may either have distributed the source code or not been alone in creating the malware. Police reckon Jaschan released Sasser-E before his arrest, as a damage limitation exercise. AP reports that source code for Sasser was found on Jaschan's PC. Sasser-F was a copycat version so the police line that Jaschan acted alone in releasing Sasser is holding up.

Jaschan is also suspected of writing all 28 versions of NetSky but circumstantial evidence (coding styles, targets of attack, messages in the worm) suggest otherwise. We probably won't get a definitive answer on whether Jaschan acted alone until his trial.

Meanwhile for end-users the most pressing issue remains defending systems against the vulnerability exploited by Sasser. Sasser-style worms remain a serious risk despite Jaschan's arrest. ®

Related stories

New version of Sasser undermines lone coder theory
German police arrest Sasser worm suspect
Sasser ups cost of Windows - Gartner
Sasser creates European pandemonium
We've seen worse than Sasser - MS

Intelligent flash storage arrays

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.