So, Who Wrote Sobig?

An anonymous reader writes "F-Secure's Virus Blog posted links to a 48-page technical study on who wrote the infamous Sobig worm which went around the world last year. The study is done by anonymous authors. The study concludes that author of this worm is a Russian programmer and goes out all the way to name him. This file has now been posted publicly but on Geocities and and Tripod. So you can have a look by yourself and make your own conclusions."

Mirror!

I'm a whore! Mirror: HERE! [decarbonated.org]

Re:Mirror!

i'm a whore with a website: NSFW [wikipedia.org] mirror here [wetsexygirl.com]...

yes, this is real. NSFW keeps bandwidth down.

"Who Wrote Sobig" by Anonymous

Not me.

Re:"Who Wrote Sobig" by Anonymous

Anyone who has kids knows that the first person that says "Not me" is guilty :)

Great Geocities Link

What do they have 10MB of transfer a day?

Geocities? Tripod?

...now been posted publicly but on Geocities and and Tripod. So you can have a look...

Ummm, you realize that you're telling the entire /. community that they should look at Geocities and Tripod accounts, right? This should last, oh, about 5 seconds.

That's not the half of it...

We have what's described as an anonymous article, based apparently on pure speculation, on a free webhost, that purports to identify a virus author that, SFAIK, has not yet been arrested?

Impressive. I can't believe Slashdot got such a big scoop on this one ;-]

Kasperski

A French magazine [acbm.com] named Kasperski, a former KGB agent and now an antivirus publisher.
They said he happened to develop such things and then ask the major AV editors to bid in order to get the virus specs first...
Not sure if it's that accurate but it will sure raise some tin-foil-heads interest...

Re:Kasperski

The old myth that says that the antivirus makers are the ones that are developing virus? I use AVP/KAV [kaspersky.com] since a decade ago, first in DOS and now in Linux, and is one of the best (if not THE best) available antivirus on the market.

Even know someone that programmed a test virus long time ago, and sent to antivirus publishers to see how well it could be detected, and the response from the community of that time, specially the people from Kaspersky, was very against that kind of "tests", so is very improbable what you are telling there (and that includes too most of the other biggest players 10 years ago if the same is said about i.e. F-Prot or McAfee people)

At least without hard proof (not just speculation or just urban myths) i would give that notice the same weight as that Bill Gates is sending big bucks to any that continues a chain letter.

incase you cant get the article....

Ruslan Ibragimov of Russia

Re:incase you cant get the article....

Thanks! We didn't need to review any of the "evidence" and discuss their merits and authenticity. We just needed the bastard's name so we can hunt him down and stone him. Let's go folks! It's time to rid the world of this heathen!

Heh...

Kinda funny how the BSD devil up on the /. bar is looking at the worm...maybe he fears retribution?

Good American Programmers?

There never seems to be any good American programmers who write malicious code and viruses like this. Ah well, where's Kevin Mitnick? :-P

Re:Good American Programmers?

I don't know if you read much code, but most virus code is horrible. Quite a bit of it is straight from a point-and-click virus builder, and the stuff that is hand written tends not to work as intended. Of course, I am talking about a virus, so maybe it works just like the author wanted it to for all I know....

Viruses for profit

Malware written for fun isn't any less damaging, I guess, but when apparently written specifically for a commercial purpose (sending spam in this case) it's certainly more annoying IMHO. At least if this case is anything to go by, there's likely to be more of a forensic trail left by the perpetrators due to the associated commercial activities. I hope this Ibragimov guy gets what's coming to him.

Re:Viruses for profit

Malware for profit is worse.

The problem isn't that professionals are necessarily better than amateurs at a task -- we know this isn't true. But being a professional allows you to work full-time on something. Many people are motivated by financial rewards (and egoboo doesn't put bread on the table, either).

When a lot of money gets involved, organized crime gets involved, and they bring with them the infrastructure for serious misdeeds.

I want my script kiddiez back.

The text of sections 1 & 2 of the pdf

One site was down before the story went active. The other shouldn't last long. The document is 48 pages. 26 are a hex dump. Here are two pages, sections 1 & 2, the Introduction and Overview. Pardon the messy text; I imported from PDF an fixed it up as best I could quickly.

1 About This Document

August 18, 2003 was a day of infamy in the world of computer software malware. The Sobig virus, as it was affectionately named by its the anti-virus industry, infected hundreds of thousands of computers within just a few short hours. W32.Sobig.F@mm was a mass-mailing, network-aware worm that sent itself to all the email addresses it could find, worldwide.

Within two days after Sobig was released, an estimated $50 million in damages were reported in the US alone. China had reported over 30% of email traffic had been infected by Sobig, equivalent to over 20 million users! After interrupting freight operations and grounding Air Canada, Sobig went on to cripple computing operations within even the most advanced technology companies, such as Lockheed Martin. Sobig was so virulent that on November 5, 2003 Microsoft, in coordination with the FBI, Secret Service, and Interpol, setup the Anti-Virus Reward Program.
Backed by $5 million from Microsoft, the program offered a $250,000 bounty for information leading to the arrest and conviction of the Sobig author. As the one year anniversary of the Anti-Virus Reward Program bounty for Sobig approaches, we felt this was an appropriate time to publicly release the current state of our Sobig forensic investigation. Appropriately, the authors of this document have chosen to release it anonymously for many reasons, some of which are:

By releasing the information publicly, we hope to increase tips to law enforcement concerning the Sobig authorship and spur efforts toward apprehension of the malware author(s);

This document shows how computer forensics can identify virus authors. The computer forensic methods demonstrated throughout this document have been utilized to successfully identify authors of other viruses as well;

Our focus is the objective analysis of Sobig. It is our contention, position, and belief that associating this paper with any specific company, organization, group, or individual will only serve to detract from the investigation.

The following public PGP key is provided for document validation, with the private key component safely locked away as to eliminate any future chance of a lost key pair. Any individual or entity that claims authorship should be able to validate their 'authorship' by signing a message with the corresponding PGP private key.

The included PGP public key prevents unscrupulous people from claiming ownership of this document or attempting to collect the Microsoft bounty;

As this document is present on multiple mirrored sites and has been turned over to law enforcement, anyone modifying the PGP public key will be unable to pass a fake key for potential bounty award;

This PGP public key will only be included is this document. Other documents, where malcontents attempt to place our ownership on other findings, should be considered forgeries unless they include a message
signed with the PGP private key.

In the event that any individual or entity may be able to identify the authors of this document, we urge you to respect our request for anonymity.

2 Overview

Sobig was a virus specifically designed to aid the anonymity of spammers. Sobig opened up services that enabled spammers to relay their emails anonymously. Although publicly the motivation and author of the Sobig virus is unknown, through the use of forensics and profiling, we have identified a very likely suspect and motive. Our research indicates that Ruslan Ibragimov of Moscow, Russia, and/or Ibragimov's development team, authored the Sobig virus. Ibragimov himself is the author of Send-Safe, a bulk mailing tool product that was explicitly designed for sending unsolicited em

In Related Links ...

Best deals: Worms

Coralized mirror

Why aren't all link submissions required to include a mirror? Ah well, here's the Coralized link [nyud.net]

Another mirror

Another mirror here [lafayette.edu]

Circumstantial evidence.

I glanced through most of the points the authors make in this document and most of the evidence (if not all) is circumstantial. Although there are a lot of similarities that could lead you to think that he did it, I don't think comparing the skill sets needed write the program to his newsgroup/forum posts and similarities in headers warrants an inquisition.

Granted he should probably burn at the stake just for writing SPAM software...

Re:Circumstantial evidence.

If you actually read the PDF you would see that they compared the opcode sequences between sobig and various programs.

The important bit is that when sobig was compared to Atomic Mail Sender (AMS) they didn't find much in the way of opcode sequence matches. What was there was standard glue code that just has to be there.

When they compared sobig to Send-Safe they found big chunks of common code, strings, etc.

And they don't say that Ruslan Ibragimov is the author. They say he and/or his development team.
Assuming he has 4-5 developers working for him it could be one developer who swiped the Send-Safe code and used it to develop sobig. Although I would bet on Ruslan giving the nod on the development of sobig.

This type of analysis is how people find GPL violations. Unless you take alot of effort to completely rearrange the code it keeps the same signatures, embedded strings, etc.

The analysis appears to be sounds. LEA should use Ruslan as a starting point to track down the person(s) responsible for sobig.

But since we are talking about spam tool/virus/worm writers I think the Aliens quote is best..

I say we dust off and nuke the site from orbit. It's the only way to be sure.

-Jerry

Re:Circumstantial evidence.

Well, you obviously didn't glance through all of the points, as you neglect to mention the opcode simmilarities, timeline of significant releases of both pieces of software and the activites of groups known to use Send Safe, and SoBig.

Not to mention the exhaustive opcode comparison diagram at the end of the document.

Circumstantial evidence, it may be, but that doesn't mean it's not valid. And what is forensics aside from a circumstantial investigation? Getting as many facts as you are able to directly observe in order to come to a logical conclusion about a question you can't directly observe the solution to.

Avast, slashbots!

Let's all go visit [send-safe.com] the guy. Even if he didn't write Sobig, he's still developing software for spammers.

"author of this worm is a Russian programmer"

In Soviet Russia... oh, nevermind.

With all apologizes the Barry Manilow

I wrote the virus which made the whole world cringe.
I wrote the virus which screwed up things
I wrote the virus that made system administrators cry
I wrote the virus, I wrote the virus

Just...

...tell me what address to mail this...um...strangly ticking package to.

Interesting approaches

The anonymous authors have done really interesting technical forensics.

The executable comparison charts between Send-Safe and Sobig-F in the appendix show a large correlation in both binaries. A different code base seems to be a pretty unrealistic thing there.

If the given facts hold true, I bet that Ruslan Ibragimov will not sleep very well in the next time.

Do we ever really hear about good viruses?

Script kiddies using virus writing kits and punks putting graffiti on stop signs is at about the same level.

What do you think of the notion that there are at least several really successful viruses that we never hear about, because they are more useful to the writer if they are not obviously annoying?

Are all these zombie machines we hear about for rent to spammers infected with viruses that would be caught be common virus scanners, or are they truely different?

I'm waiting

I'm waiting for the study on who wrote the technical study on who wrote the infamous Sobig worm.

Reasons for going public now...

Leaving aside the validity of their arguments for the time being (though I found them persuasive), I was wondering why exactly they felt the need to release this now. I think there are a few clues in the document:

"Sobig was so virulent that on November 5, 2003 Microsoft, in coordination with the FBI, Secret Service, and Interpol, setup the Anti-Virus Reward Program. Backed by $5 million from Microsoft, the program offered a $250,000 bounty for information leading to the arrest and conviction of the Sobig author."

And they add in a footnote to that sentence:

"Ironically, our investigation into the identification of the likely Sobig author(s) and corresponding findings had already been concluded and passed on to law enforcement over two months prior to the Microsoft bounty offer. The bounty was not our incentive."

So they say they had submitted their research prior to Nov. 5, '03. Why go public now? Though they don't say it, I can't help but think that it was frustration. Their own explanations for why they are going public seem thin to me.

fairly convincing

The argument concering that he "had the skills necessary" to create the virus aren't really that convincing to me.

The comparible code-base (unusual string concatanations that appear in both the virus and his commercial software) I suppose I *could* also overlook that because I know that a lot of developers copy code snippets from support pages and such. Especially for such generic functions as sending email.

But, then throw in the fact that send-safe and the sobog virus have very consistent release schedules. That is a little suspicious.

Not only that, but, if you remember when SoBig first came out - it was quite a long time after before people started to realize that it was creating spam proxies. send-safe was using those proxies even before the massive outbreak. Now that is kinda weird.

So, when you add up all of those things, It seems convincing to me. Is it enough to raid his office computers?

String him up ...

Is stringing this guy up by his testicles and leaving him to dangle too good a punishment?

Coral mirror

Of http://authortravis.tripod.com [tripod.com] available here [nyud.net], for those that don't know Coral [nyu.edu] yet.

Charge spammers

So it was written to send spam. A nice thing that could be done is to charge all the money lost by that virus to all the companies that sent spam directly or indirectly thru that program.

Also could be count as a "hard fact" for companies/governments/etc that people that send spam are in part responsible for the virus they receive and the damages they make, and start to take actions.

Well, doubt that spammers could be liable for SoBig damages, but is a nice dream.

One question

I have only one question for virus writers:

Has anyone ever gotten laid for writing a virus?

Two points

1. According to the authors this study was completed prior to Nov. 5 2003. If the overriding concern is to "...increase tips to law enforcement..." then why did it take so long to publish this?

2. Spelling and grammar in the document leave a lot to be desired. Computer forensics aside, I submit that English isn't the primary language of the authors or they just don't care that their paper is riddled with mistakes that make them sound ignorant.

Assumptions on Virus Creators

I've always assumed that those who create viruses do so just for the coolness of taking down systems. Mostly kids or young ones under the age of 25. In realizing that I have this assumption, it made me step back and now ask?

So does anyone really know why viruses are created? What is the personal motivation of the virus creator?

Because now viruses hurt real people. I think Microsoft should not be allowed to put out such junky software, regardless of the quality of the software real people are hurt.

No, thanks, I'm more interested in...

...the watchmen of the 'net that responded immediately to the infestation. The article from Wired describing the events surrounding that disaster made for an excellent techno-thriller type read. Does anybody have a link to it, as I only read the printed version...

Re:motivation

Why is it always acceptable--preferable--to refer to anyone with a different belief than ourselves as a ``zealot''? This word is being way overused lately. ``Cease!'' sayeth the style police.

Re:motivation

This is bs. The word linux did not appear once in the paper. Furthermore, all the other software written by him mentioned in the paper was windows software, mostly used for spamming.

Re:motivation

5.4 Motive to Write Sobig Senders of spam typically relay their email messages through open proxy servers in a continuing effort to obscure the true sending host. With the proliferation of blacklists and other anti-spam systems, spam senders are finding it more and more difficult to locate available open proxy servers. By opening multiple proxy services on millions of compromised systems, a spam sender could very quickly and anonymously relay messages without the fear of being identified. Sobig provides the following two benefits for spam senders: 1. Sobig opens multiple proxy servers on systems that are not blacklisted; 2. Sobig spreads very quickly, infecting and re-infecting millions of systems in under a week. These benefits provide spam senders with a very large base of open proxy servers. Even though most of the infected systems will be cleaned within a week, there will be some systems that will remain infected to continually provide open proxies for weeks or even months. We believe that Sobig was most likely written to support spam software. Any user or developer of spam mailing software, including Ruslan Ibragimov and Send-Safe, would be financially eager to leverage malware such as Sobig.

Doesn't say anything about linux as far as I can see....

Re:motivation

if they are that dedicated to the open source initiative, shouldn't they spend that time improving linux rather than writing viruses?

Or, at the very least, release the source code under the GPL?

Re:motivation

MOD PARENT DOWN!!!!!!! MISINFORMATION.

MODS: please, fucking read the article before you go on your modding spree.

linux was not mentioned ONCE in the article. the motivation guessed(and reasoned) was creation of open proxies so the guy could sell more of his spam sending software. so purely financial.

Re:motivation

Where did you get that idea? I admit didn't have time to read the entire paper thoroughly -- I just skimmed it -- but I don't see any anti-Windows sentiment discussed. They're pretty clear that they think the motive for SoBig was spam:

5.4 Motive to Writing SoBig
......
We believe that Sobig was most likely written to support spam software. Any user or developer of spam mailing software, including Ruslan Ibragimov and Send-Safe, would be financially eager to leverage malware such as Sobig.

Writing viruses for spam propagation is big business. [oreillynet.com]\

Re:The reports seems biased

You have IT skills and have posted to newsgroups since 1996?

We'd like to arrange a meeting with you to discuss some "things"...

- Sincerly, The Dept. of Homeland Security.

Of course its biased. They are making a case

Of course it is biased. They are making their case that Ruslan is the author. They present evidence to that affect.

Seems to me that your problem is you read the Slashdot topic and description and then fault the original article for not living up to your expectation. The article IS biased because it makes a case against Ruslan. The lame ass slashdot topic & description don't quite relay that fact.

As for evidence in the article which you neglected to cite, they show that

1) his other software Send Safe share common opcodes in the executable and is highly indicative of common source code.

2) he demonstraded foreknowledge of the virus existance because Send Safe was exploiting infected machines before Sobig virus was ever announced.

3) he has a motive -> PROFIT!!

Re:The reports seems biased

with wirus writers/writings

Try repeating that as fast as possible. Lt. Chekov anyone? :-P

Virus writers

It used to be try that many viruses were simply released as nuisances. However, it has also been true for a long time that they are also released for financial/personal benefit of the writer. Sniffers used to gather information can steal passwords etc, and others can turn your machine into one-of-hundreds in a group of zombies. The zombies can be sold to those whom attack major websites (extortion, disabling, etc) or spammers etc. The passwords could be for online banking or simply to root a machine and make it a zombie.

I think that viruses nowadays are more written for profit than peskiness - perhaps not the majority but the big ones definately show signs of it.

Re:Stop trolling

you didn't... fuck off. This is the real link that one of those things tries to take you to...

http://lm.aderkach.org/?u=penisbird

and this is what the browser tab changed to:

GNAA Last Measure version 3.4

and it surprised me that Konqueror almost went there. The only thing that stopped it was my

"Warning: Your data is about to be transmitted across the network unencrypted.
Are you sure you wish to continue?"

prompt... and the fact that I spotted the URL change...

Not saints, but not devils

While many of the linux community aren't saints, the attitude-in-general towards viruses and their makers is negetive. You're not going to get a pat-on-the-back from the community for creating an anti-windows virus, you're going to get a kick-in-the-ass for dampening the reputation of the community. Furthermore if a bounty comes up for the virus it's likely somebody will turn you over if possible.

MS would love to be able to state that linux programmers are behind virus attacks on windows, and most are smart enough to realize that.

We don't love windows, but we're smart enough not to dirty our hands with viruses, partly because we hate viruses more than we'll ever hate windows (viruses/etc being in-fact one of the reasons for disliking windows)

Re:burn the witch, burn the witch!

If you read it, the first page indicates that they passed this information on to law enforcement over a year ago. Seems like law enforcement has really done a whole lot since then.