Original URL: http://www.theregister.co.uk/2004/05/13/sasser_worm_dragnet_widens/

German police raid five homes in Sasser case

Dragnet widens

By John Leyden

Posted in Security, 13th May 2004 11:46 GMT

German police have widened the hunt for the vandals responsible for the distribution of the infamous Sasser and NetSky worms by raiding the homes of five new suspects. All are close to the home of Sven Jaschan, the prime suspect.

Last Friday, 18-year-old Jaschan was arrested in the village of Waffensen near Rotenburg, in northern Germany, in connection with writing and distributing the Sasser worm. He later confessed to police that he was both the author of Sasser and the original author of the NetSky worm. Police are expected to lay computer sabotage charges against Jaschan, who has been released on bail pending further proceedings. Jaschan was arrested after a tip-off to Microsoft from individuals hoping to cash in through Microsoft's Anti-Virus Reward Program.

Initially, police implied that Jaschan had worked alone in distributing the first five versions of Sasser and all 28 versions of the NetSky worm. But they are now ready to discount the 'lone coder' theory. "The assessments that have followed have now supported the suspicion that others were involved in distributing the virus," police said.

Police secured a "large quantity of material" during a raid on five homes near the northern German town of Rotenburg on Tuesday. Two of the suspects questioned on Tuesday admitted receiving the source code of NetSky from Jaschan and one has admitted distributing NetSky, Reuters reports. Suspects were questioned but no more arrests were made.

Police released no further details. ®

Related stories

German police arrest Sasser worm suspect
New version of Sasser undermines lone coder theory
Sasser copycats get busy
Phatbot arrest throws open trade in zombie PCs