- Feb 7, 2001
- 12,232
- 30
- 101
Fox News reports:
JERUSALEM ? Four Israeli teens confessed Saturday to writing and spreading the "Goner" computer worm that attacked computers worldwide this month, according to police.
The teens, ages 15 and 16, are high school students in the northern city of Nahariya, said Meir Zohar, head of the police computer crime squad.
One of the teens confessed to writing the worm and the other youths confessed to spreading it, Zohar said. All four are in custody and could face between three and five years in jail if convicted.
The Goner worm looks like an e-mail from a friend, with a subject line of "Hi," Symantec security response group manager Kevin Haley said.
"The text will say 'How are you? I saw this screensaver and immediately thought of you.' That's a giveaway," Haley said.
The Goner worm is a hybrid of a traditional computer virus and a hacking attack. It spreads by going through a computer's e-mail address books and sending copies of itself out, and by using instant-messaging services like ICQ to send additional copies. Once inside a user's system, it deletes anti-virus and firewall programs, then installs scripts to allow hackers to access the computer and use it as a platform for denial-of-service attacks.
Israeli police have been investigating the case for about a week, Zohar said.
The worm first appeared early this month, infecting computers in France and Germany.
The Associated Press contributed to this report.
The Goner worm crashed our mail server here at work for a while. I'm glad they caught the kids that wrote it.
*Update*
From The Register
Goner suspects were tracked down
Messages coded into the Goner worm and monitoring of the IRC channel used to control its activities led to the arrest of four suspected Israeli virus writers over the weekend.
One of the actions of Goner, which normally spreads as an infected attached-to-email message, is to install denial of service scripts for the mIRC Internet Relay Chat client. By monitoring the #pentagonex channel used to control the worm's activities, security experts working for DALnet IRC were able to track down its suspected creators.
Emma Monks, a volunteer with DALnet's exploits prevention team, said that after disabling the worm's denial of service abilities, which were believed to be targeted at a rival gang's ISP, DALnet's team set to track down the virus authors.
When activated the Goner worm displays a message, apparently from the author to his friends:
"Pentagone - coded by: suid. tested by ThE_SKuLL and [satan]. greetings to: TraceWar, k9-unit, stef16, ^Reno. Greetings also to nonick2 out there where ever you are."
DALnet records the IP address of anyone setting up an IRC channel which combined with the nicknames featured in the message the virus generates gave investigators vital clues.
Monks explained that by cross references the nicknames of those attempting to control drones from compromised machines on the channel with its database gave the IP addresses of members of the virus writing gang.
This information was turned over to the FBI, which in turn passed it on to the Israeli police. The four teenagers who were arrested on Friday are held in a juvenile detention centre pending a court appearance today and their computers have been seized. If convicted they could face a sentence of between three to five years in jail.
Goner is a fairly simple in its design, but it contains some nasty tricks up its sleeve including an attempt to disable antivirus and personal firewall applications. It spreads by ICQ as well as by Outlook. More details on the worm can be found here.
JERUSALEM ? Four Israeli teens confessed Saturday to writing and spreading the "Goner" computer worm that attacked computers worldwide this month, according to police.
The teens, ages 15 and 16, are high school students in the northern city of Nahariya, said Meir Zohar, head of the police computer crime squad.
One of the teens confessed to writing the worm and the other youths confessed to spreading it, Zohar said. All four are in custody and could face between three and five years in jail if convicted.
The Goner worm looks like an e-mail from a friend, with a subject line of "Hi," Symantec security response group manager Kevin Haley said.
"The text will say 'How are you? I saw this screensaver and immediately thought of you.' That's a giveaway," Haley said.
The Goner worm is a hybrid of a traditional computer virus and a hacking attack. It spreads by going through a computer's e-mail address books and sending copies of itself out, and by using instant-messaging services like ICQ to send additional copies. Once inside a user's system, it deletes anti-virus and firewall programs, then installs scripts to allow hackers to access the computer and use it as a platform for denial-of-service attacks.
Israeli police have been investigating the case for about a week, Zohar said.
The worm first appeared early this month, infecting computers in France and Germany.
The Associated Press contributed to this report.
The Goner worm crashed our mail server here at work for a while. I'm glad they caught the kids that wrote it.
*Update*
From The Register
Goner suspects were tracked down
Messages coded into the Goner worm and monitoring of the IRC channel used to control its activities led to the arrest of four suspected Israeli virus writers over the weekend.
One of the actions of Goner, which normally spreads as an infected attached-to-email message, is to install denial of service scripts for the mIRC Internet Relay Chat client. By monitoring the #pentagonex channel used to control the worm's activities, security experts working for DALnet IRC were able to track down its suspected creators.
Emma Monks, a volunteer with DALnet's exploits prevention team, said that after disabling the worm's denial of service abilities, which were believed to be targeted at a rival gang's ISP, DALnet's team set to track down the virus authors.
When activated the Goner worm displays a message, apparently from the author to his friends:
"Pentagone - coded by: suid. tested by ThE_SKuLL and [satan]. greetings to: TraceWar, k9-unit, stef16, ^Reno. Greetings also to nonick2 out there where ever you are."
DALnet records the IP address of anyone setting up an IRC channel which combined with the nicknames featured in the message the virus generates gave investigators vital clues.
Monks explained that by cross references the nicknames of those attempting to control drones from compromised machines on the channel with its database gave the IP addresses of members of the virus writing gang.
This information was turned over to the FBI, which in turn passed it on to the Israeli police. The four teenagers who were arrested on Friday are held in a juvenile detention centre pending a court appearance today and their computers have been seized. If convicted they could face a sentence of between three to five years in jail.
Goner is a fairly simple in its design, but it contains some nasty tricks up its sleeve including an attempt to disable antivirus and personal firewall applications. It spreads by ICQ as well as by Outlook. More details on the worm can be found here.
Facebook
Twitter