Slashdot Log In
So, Who Wrote Sobig?
Posted by
Hemos
on Mon Nov 01, 2004 11:00 AM
from the i'm-SO-BIG dept.
from the i'm-SO-BIG dept.
An anonymous reader writes "F-Secure's Virus Blog posted links to a 48-page technical study on who wrote the infamous Sobig worm which went around the world last year. The study is done by anonymous authors.
The study concludes that author of this worm is a Russian programmer and goes out all the way to name him. This file has now been posted publicly but on Geocities and and Tripod. So you can have a look by yourself and make your own conclusions."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Mirror! (Score:5, Informative)
Re:Mirror! (Score:5, Funny)
i'm a whore with a website: NSFW [wikipedia.org] mirror here [wetsexygirl.com]...
yes, this is real. NSFW keeps bandwidth down.
Parent
Re:Mirror! (Score:3, Funny)
hmm, dunno about that. I clicked on it because of the NSFW message...
Another one.. distribute the /. effect.. ? (Score:3, Funny)
Re:Copyright (Score:2, Informative)
"Who Wrote Sobig" by Anonymous (Score:5, Funny)
Re:"Who Wrote Sobig" by Anonymous (Score:5, Funny)
Parent
Geocities? Tripod? (Score:5, Funny)
Ummm, you realize that you're telling the entire /. community that they should look at Geocities and Tripod accounts, right? This should last, oh, about 5 seconds.
You forgot... (Score:2, Funny)
to add the word milli after the five....
That's not the half of it... (Score:4, Funny)
Impressive. I can't believe Slashdot got such a big scoop on this one
Parent
Kasperski (Score:5, Informative)
They said he happened to develop such things and then ask the major AV editors to bid in order to get the virus specs first...
Not sure if it's that accurate but it will sure raise some tin-foil-heads interest...
Re:Kasperski (Score:5, Insightful)
Even know someone that programmed a test virus long time ago, and sent to antivirus publishers to see how well it could be detected, and the response from the community of that time, specially the people from Kaspersky, was very against that kind of "tests", so is very improbable what you are telling there (and that includes too most of the other biggest players 10 years ago if the same is said about i.e. F-Prot or McAfee people)
At least without hard proof (not just speculation or just urban myths) i would give that notice the same weight as that Bill Gates is sending big bucks to any that continues a chain letter.
Parent
Re:Kasperski (Score:3, Insightful)
To be "unprotected" from virus is ok if you have common sense, firewalls and safe software (i.e. windows is not in that category, and if well linux is pretty safe against virus, maybe is not 100% safe against worms), but when you talk about a lot o
incase you cant get the article.... (Score:5, Informative)
Re:incase you cant get the article.... (Score:5, Funny)
Parent
Heh... (Score:5, Funny)
Good American Programmers? (Score:2, Interesting)
Re:Good American Programmers? (Score:5, Informative)
Parent
Re:Good American Programmers? (Score:2, Funny)
It all got outsourced to Asia.
Viruses for profit (Score:5, Interesting)
Re:Viruses for profit (Score:5, Interesting)
The problem isn't that professionals are necessarily better than amateurs at a task -- we know this isn't true. But being a professional allows you to work full-time on something. Many people are motivated by financial rewards (and egoboo doesn't put bread on the table, either).
When a lot of money gets involved, organized crime gets involved, and they bring with them the infrastructure for serious misdeeds.
I want my script kiddiez back.
Parent
The text of sections 1 & 2 of the pdf (Score:5, Informative)
1 About This Document
August 18, 2003 was a day of infamy in the world of computer software malware. The Sobig virus, as it was affectionately named by its the anti-virus industry, infected hundreds of thousands of computers within just a few short hours. W32.Sobig.F@mm was a mass-mailing, network-aware worm that sent itself to all the email addresses it could find, worldwide.
Within two days after Sobig was released, an estimated $50 million in damages were reported in the US alone. China had reported over 30% of email traffic had been infected by Sobig, equivalent to over 20 million users! After interrupting freight operations and grounding Air Canada, Sobig went on to cripple computing operations within even the most advanced technology companies, such as Lockheed Martin. Sobig was so virulent that on November 5, 2003 Microsoft, in coordination with the FBI, Secret Service, and Interpol, setup the Anti-Virus Reward Program.
Backed by $5 million from Microsoft, the program offered a $250,000 bounty for information leading to the arrest and conviction of the Sobig author. As the one year anniversary of the Anti-Virus Reward Program bounty for Sobig approaches, we felt this was an appropriate time to publicly release the current state of our Sobig forensic investigation. Appropriately, the authors of this document have chosen to release it anonymously for many reasons, some of which are:
By releasing the information publicly, we hope to increase tips to law enforcement concerning the Sobig authorship and spur efforts toward apprehension of the malware author(s);
This document shows how computer forensics can identify virus authors. The computer forensic methods demonstrated throughout this document have been utilized to successfully identify authors of other viruses as well;
Our focus is the objective analysis of Sobig. It is our contention, position, and belief that associating this paper with any specific company, organization, group, or individual will only serve to detract from the investigation.
The following public PGP key is provided for document validation, with the private key component safely locked away as to eliminate any future chance of a lost key pair. Any individual or entity that claims authorship should be able to validate their 'authorship' by signing a message with the corresponding PGP private key.
The included PGP public key prevents unscrupulous people from claiming ownership of this document or attempting to collect the Microsoft bounty;
As this document is present on multiple mirrored sites and has been turned over to law enforcement, anyone modifying the PGP public key will be unable to pass a fake key for potential bounty award;
This PGP public key will only be included is this document. Other documents, where malcontents attempt to place our ownership on other findings, should be considered forgeries unless they include a message
signed with the PGP private key.
In the event that any individual or entity may be able to identify the authors of this document, we urge you to respect our request for anonymity.
2 Overview
Sobig was a virus specifically designed to aid the anonymity of spammers. Sobig opened up services that enabled spammers to relay their emails anonymously. Although publicly the motivation and author of the Sobig virus is unknown, through the use of forensics and profiling, we have identified a very likely suspect and motive. Our research indicates that Ruslan Ibragimov of Moscow, Russia, and/or Ibragimov's development team, authored the Sobig virus. Ibragimov himself is the author of Send-Safe, a bulk mailing tool product that was explicitly designed for sending unsolicited em
In Related Links ... (Score:2, Funny)
Coralized mirror (Score:3, Insightful)
Re:Coralized mirror (Score:2)
Maybe because some of us can't get to good ol' 8090 anyway?
I can get to exactly 4 external ports:
80/443 - http/s
20/21 - ftp (cmd/dat)
So all the coralized links in the world won't help me. I couldn't even get to an 8080 if there was one, and that's a fairly well-known alternate HTTP port [grc.com].
Another mirror (Score:2, Informative)
Circumstantial evidence. (Score:4, Interesting)
Granted he should probably burn at the stake just for writing SPAM software...
Re:Circumstantial evidence. (Score:5, Informative)
The important bit is that when sobig was compared to Atomic Mail Sender (AMS) they didn't find much in the way of opcode sequence matches. What was there was standard glue code that just has to be there.
When they compared sobig to Send-Safe they found big chunks of common code, strings, etc.
And they don't say that Ruslan Ibragimov is the author. They say he and/or his development team.
Assuming he has 4-5 developers working for him it could be one developer who swiped the Send-Safe code and used it to develop sobig. Although I would bet on Ruslan giving the nod on the development of sobig.
This type of analysis is how people find GPL violations. Unless you take alot of effort to completely rearrange the code it keeps the same signatures, embedded strings, etc.
The analysis appears to be sounds. LEA should use Ruslan as a starting point to track down the person(s) responsible for sobig.
But since we are talking about spam tool/virus/worm writers I think the Aliens quote is best..
I say we dust off and nuke the site from orbit. It's the only way to be sure.
-Jerry
Parent
Re:Circumstantial evidence. (Score:5, Insightful)
Not to mention the exhaustive opcode comparison diagram at the end of the document.
Circumstantial evidence, it may be, but that doesn't mean it's not valid. And what is forensics aside from a circumstantial investigation? Getting as many facts as you are able to directly observe in order to come to a logical conclusion about a question you can't directly observe the solution to.
Parent
Avast, slashbots! (Score:5, Interesting)
With all apologizes the Barry Manilow (Score:2)
I wrote the virus which screwed up things
I wrote the virus that made system administrators cry
I wrote the virus, I wrote the virus
Just... (Score:3, Funny)
Interesting approaches (Score:2)
The executable comparison charts between Send-Safe and Sobig-F in the appendix show a large correlation in both binaries. A different code base seems to be a pretty unrealistic thing there.
If the given facts hold true, I bet that Ruslan Ibragimov will not sleep very well in the next time.
Do we ever really hear about good viruses? (Score:3, Insightful)
What do you think of the notion that there are at least several really successful viruses that we never hear about, because they are more useful to the writer if they are not obviously annoying?
Are all these zombie machines we hear about for rent to spammers infected with viruses that would be caught be common virus scanners, or are they truely different?
Re:Do we ever really hear about good viruses? (Score:3, Interesting)
I think it's not very likely. It isn't the payload that necessarily gets viruses noticed. If a virus (well, technically a worm in this case) tries to exploit buffer overruns in remote services (as was done by worms like Code Red and Blaster), it's going to get caught by the log entries from failed intrusions.
I'm waiting (Score:5, Funny)
Reasons for going public now... (Score:3, Insightful)
And they add in a footnote to that sentence:
So they say they had submitted their research prior to Nov. 5, '03. Why go public now? Though they don't say it, I can't help but think that it was frustration. Their own explanations for why they are going public seem thin to me.
Frustrated yes, but not for money. (Score:3, Interesting)
fairly convincing (Score:3, Interesting)
The comparible code-base (unusual string concatanations that appear in both the virus and his commercial software) I suppose I *could* also overlook that because I know that a lot of developers copy code snippets from support pages and such. Especially for such generic functions as sending email.
But, then throw in the fact that send-safe and the sobog virus have very consistent release schedules. That is a little suspicious.
Not only that, but, if you remember when SoBig first came out - it was quite a long time after before people started to realize that it was creating spam proxies. send-safe was using those proxies even before the massive outbreak. Now that is kinda weird.
So, when you add up all of those things, It seems convincing to me. Is it enough to raid his office computers?
One question (Score:3, Funny)
Has anyone ever gotten laid for writing a virus?
Re:One question (Score:3, Funny)
Re:motivation (Score:4, Informative)
Parent
Re:motivation (Score:4, Informative)
Doesn't say anything about linux as far as I can see....
Parent
Re:motivation (Score:2, Insightful)
MODS: please, fucking read the article before you go on your modding spree.
linux was not mentioned ONCE in the article. the motivation guessed(and reasoned) was creation of open proxies so the guy could sell more of his spam sending software. so purely financial.
Re:motivation (Score:2, Informative)
Writing viruse
Re:motivation (Score:3, Insightful)
I think that releasing a virus to achieve your ends qualifies one as a zealot. In fact, I would guess that the poster of the parent (this post's grandparent) thread is most likely not a Windows fan, so the underlying belief probably is not different, just what is perceived as acceptable means.
Re:motivation (Score:2)
It has nothing to do with the differeing belief and everythign to do with his views of people who hold a differing belief
Re:motivation (Score:2, Funny)
Or, at the very least, release the source code under the GPL?
Not saints, but not devils (Score:5, Insightful)
MS would love to be able to state that linux programmers are behind virus attacks on windows, and most are smart enough to realize that.
We don't love windows, but we're smart enough not to dirty our hands with viruses, partly because we hate viruses more than we'll ever hate windows (viruses/etc being in-fact one of the reasons for disliking windows)
Parent
Re:The reports seems biased (Score:5, Funny)
We'd like to arrange a meeting with you to discuss some "things"...
- Sincerly, The Dept. of Homeland Security.
Parent