Feeds

Sasser copycats get busy

Saga continues with Sasser-F and Cycle-A

  • alert
  • submit to reddit

Intelligent flash storage arrays

Copycat virus authors have released a pair of worms targeted at the same vulnerability in Microsoft's operating system exploited by the infamous Sasser worm.

Undeterred by the arrest of Swen Jaschan in Germany last Friday, coders have released a new Sasser variant (Sasser-F) and the first worm in a new strain, Cycle-A. Both worms exploit a hole in Window's Local Security Authority Subsystem Service (LSASS) component. Neither is spreading particularly widely and most AV vendors place them low on the peril index.

Cycle-A kills processes belonging Blaster and Sasser (A-D) worms on infected machines. In addition, it is programmed to launch a denial of service attacks against the websites of the Islamic Republic News Agency (www.irna.com) after 18 May. If it can't reach IRNA it will try to packet the BBC home page, its secondary target.

Sasser-F is a repackaged version of the Sasser-A worm (which never spread widely due to faults in its coding - Sasser-B caused the most problems). Sasser-F shares all of its code and functionality of its predecessor and differs from Sasser-A only in the filename and registry keys it uses. The new variant has a malicious process name of "billgate", probably as a reaction to the aid given to German police by Microsoft in the arrest of Jaschan.

"It is definitely a patched version of Sasser-A. Whoever released this had no access to the source code." said Sorin Victor Dudea, Head of Virus Research at Romanian AV outfit BitDefender Labs.

The release of two versions of Sasser after Jaschan's arrest on Friday has led to speculation its author may either have distributed the source code or not been alone in creating the malware. Police reckon Jaschan released Sasser-E before his arrest, as a damage limitation exercise. AP reports that source code for Sasser was found on Jaschan's PC. Sasser-F was a copycat version so the police line that Jaschan acted alone in releasing Sasser is holding up.

Jaschan is also suspected of writing all 28 versions of NetSky but circumstantial evidence (coding styles, targets of attack, messages in the worm) suggest otherwise. We probably won't get a definitive answer on whether Jaschan acted alone until his trial.

Meanwhile for end-users the most pressing issue remains defending systems against the vulnerability exploited by Sasser. Sasser-style worms remain a serious risk despite Jaschan's arrest. ®

Related stories

New version of Sasser undermines lone coder theory
German police arrest Sasser worm suspect
Sasser ups cost of Windows - Gartner
Sasser creates European pandemonium
We've seen worse than Sasser - MS

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.