Feeds

Sasser copycats get busy

Saga continues with Sasser-F and Cycle-A

  • alert
  • submit to reddit

Build a business case: developing custom apps

Copycat virus authors have released a pair of worms targeted at the same vulnerability in Microsoft's operating system exploited by the infamous Sasser worm.

Undeterred by the arrest of Swen Jaschan in Germany last Friday, coders have released a new Sasser variant (Sasser-F) and the first worm in a new strain, Cycle-A. Both worms exploit a hole in Window's Local Security Authority Subsystem Service (LSASS) component. Neither is spreading particularly widely and most AV vendors place them low on the peril index.

Cycle-A kills processes belonging Blaster and Sasser (A-D) worms on infected machines. In addition, it is programmed to launch a denial of service attacks against the websites of the Islamic Republic News Agency (www.irna.com) after 18 May. If it can't reach IRNA it will try to packet the BBC home page, its secondary target.

Sasser-F is a repackaged version of the Sasser-A worm (which never spread widely due to faults in its coding - Sasser-B caused the most problems). Sasser-F shares all of its code and functionality of its predecessor and differs from Sasser-A only in the filename and registry keys it uses. The new variant has a malicious process name of "billgate", probably as a reaction to the aid given to German police by Microsoft in the arrest of Jaschan.

"It is definitely a patched version of Sasser-A. Whoever released this had no access to the source code." said Sorin Victor Dudea, Head of Virus Research at Romanian AV outfit BitDefender Labs.

The release of two versions of Sasser after Jaschan's arrest on Friday has led to speculation its author may either have distributed the source code or not been alone in creating the malware. Police reckon Jaschan released Sasser-E before his arrest, as a damage limitation exercise. AP reports that source code for Sasser was found on Jaschan's PC. Sasser-F was a copycat version so the police line that Jaschan acted alone in releasing Sasser is holding up.

Jaschan is also suspected of writing all 28 versions of NetSky but circumstantial evidence (coding styles, targets of attack, messages in the worm) suggest otherwise. We probably won't get a definitive answer on whether Jaschan acted alone until his trial.

Meanwhile for end-users the most pressing issue remains defending systems against the vulnerability exploited by Sasser. Sasser-style worms remain a serious risk despite Jaschan's arrest. ®

Related stories

New version of Sasser undermines lone coder theory
German police arrest Sasser worm suspect
Sasser ups cost of Windows - Gartner
Sasser creates European pandemonium
We've seen worse than Sasser - MS

Next gen security for virtualised datacentres

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?