Feeds

Sasser copycats get busy

Saga continues with Sasser-F and Cycle-A

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Copycat virus authors have released a pair of worms targeted at the same vulnerability in Microsoft's operating system exploited by the infamous Sasser worm.

Undeterred by the arrest of Swen Jaschan in Germany last Friday, coders have released a new Sasser variant (Sasser-F) and the first worm in a new strain, Cycle-A. Both worms exploit a hole in Window's Local Security Authority Subsystem Service (LSASS) component. Neither is spreading particularly widely and most AV vendors place them low on the peril index.

Cycle-A kills processes belonging Blaster and Sasser (A-D) worms on infected machines. In addition, it is programmed to launch a denial of service attacks against the websites of the Islamic Republic News Agency (www.irna.com) after 18 May. If it can't reach IRNA it will try to packet the BBC home page, its secondary target.

Sasser-F is a repackaged version of the Sasser-A worm (which never spread widely due to faults in its coding - Sasser-B caused the most problems). Sasser-F shares all of its code and functionality of its predecessor and differs from Sasser-A only in the filename and registry keys it uses. The new variant has a malicious process name of "billgate", probably as a reaction to the aid given to German police by Microsoft in the arrest of Jaschan.

"It is definitely a patched version of Sasser-A. Whoever released this had no access to the source code." said Sorin Victor Dudea, Head of Virus Research at Romanian AV outfit BitDefender Labs.

The release of two versions of Sasser after Jaschan's arrest on Friday has led to speculation its author may either have distributed the source code or not been alone in creating the malware. Police reckon Jaschan released Sasser-E before his arrest, as a damage limitation exercise. AP reports that source code for Sasser was found on Jaschan's PC. Sasser-F was a copycat version so the police line that Jaschan acted alone in releasing Sasser is holding up.

Jaschan is also suspected of writing all 28 versions of NetSky but circumstantial evidence (coding styles, targets of attack, messages in the worm) suggest otherwise. We probably won't get a definitive answer on whether Jaschan acted alone until his trial.

Meanwhile for end-users the most pressing issue remains defending systems against the vulnerability exploited by Sasser. Sasser-style worms remain a serious risk despite Jaschan's arrest. ®

Related stories

New version of Sasser undermines lone coder theory
German police arrest Sasser worm suspect
Sasser ups cost of Windows - Gartner
Sasser creates European pandemonium
We've seen worse than Sasser - MS

Beginner's guide to SSL certificates

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.