Feeds

Estonian DDoS revenge worm crafter jailed

Infection still spreading

Next gen security for virtualised datacentres

An Estonian virus writer has been jailed for two and a half years for creating a Windows worm family that launched denial of service attacks on the websites of a local insurance firm and ISP.

Artur Boiko, 44, was convicted by a jury of creating the Allaple worm and sentenced to two years and seven months following a trial. Boiko pleaded not guilty but prosecutors persuaded the jury that he became a malware author in late 2006 to seek revenge against insurance firm IF following a dispute over a rejected car accident insurance claim.

The Allaple worm family spread fairly widely across the net and launched a denial of service attack from infected machines against three pre-programmed targets: if.ee,
 www.online.if.ee (the insurance firm's customer portal) and 
www.starman.ee (an Estonian ISP).

The fairly basic SYN Flood attacks launched by Allaple nonetheless had a debilitating effect on the targeted websites during the early part of 2007, as explained in a March 2007 blog entry by the SANS Institute's Internet Storm Centre here. This run of attacks predated much larger attacks on Estonian government and bank websites that accompanied the relocation of Soviet-era war memorials and graves in April 2007.

Boiko, who has already served 19 months on remand awaiting trial, was blamed for creating multiple variants of the worm, an aggravating factor in the offence that goes a long way towards explaining the tough punishment he received for his crimes.

He was also ordered to pay large fines for the damage and inconvenience he caused. A judge ordered him to pay IF Insurance 5.1 million Estonian Kroons ($450,000) and Starman ISP 1.4 million Estonian Kroons ($130,000) in compensation.

Mikko Hypponen, chief research officer at net security firm F-Secure, who provided a run-down of the case in a blog entry here, explains that remnants of the attack are still clogging the internet.

"We detected several variants of Allaple during 2006-2007," he writes. "The problem is that this is not a botnet — these worms have no command and control channel. The infected machines will attack their targets until they are cleaned. There are still thousands of active, infected computers today around the world, and they are still attacking. And the worm is still spreading further." ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?