Slashdot Mirror
Phatbot Author Arrested In Germany
Tacito writes "After arresting the author of Sasser, the German police claims having caught the author of Phatbot. To read the corresponding articles on Yahoo! News or Heise (use babelfish)."
jm.one adds a link to an "awesome Google translation" of the Heise article.
I must say that I find it very interesting that people are able to spread worms this fast nowadays. Back in the day it took weeks or months to see something, and most people had already patched the worms by then, but now it's crazy, a worm can propagate to the entire world in a day! Even faster than DNS :D Maybe something for the BIND developers to consider?
I just heard this news on NPR and thought I'd submit it to /. but I was scooped. NPR said that he was a "student" and lived with his parents. They said he admitted to being the Sasser worm author but failed to mention the Phatbot connection.
Here's an English language report that mentions a Microsoft connection.
Phatbot is insanely well-written. A while ago I read a web page about what Phatbot can do:
- Exploits all kinds of vulnerabilities.
- Sniffs network traffic for usernames and password.
- Steal IRC operator passwords.
- Can kill many other viruses and anti-virus software.
- Can steal CD keys for popular games.
- Can steal AOL passwords.
- Can harvest emails for spam purposes.
- And more.
Whomever made Phatbot sure spent *a lot* of work into it.
More details at: http://www.lurhq.com/phatbot.html
Also contains instructions to manually remove it from an infected system.
It was that combination of scientific method and social engineering that made Stoll's aproach so effective. That and his persistance and ability to use very basic tools to accomplish the near impossible, all the while accumulating enough evidence to allow a successful prosecution.
If you haven't seen this interview with Stoll, be sure to read it. It captures that quirky geekiness of his that makes Cuckoo's Egg such a great read.