So, Who Wrote Sobig?

An anonymous reader writes "F-Secure's Virus Blog posted links to a 48-page technical study on who wrote the infamous Sobig worm which went around the world last year. The study is done by anonymous authors. The study concludes that author of this worm is a Russian programmer and goes out all the way to name him. This file has now been posted publicly but on Geocities and and Tripod. So you can have a look by yourself and make your own conclusions."

Comments

Re:motivation

[benhocking]

Why is it always acceptable--preferable--to refer to anyone with a different belief than ourselves as a ``zealot''? This word is being way overused lately. ``Cease!'' sayeth the style police.

I think that releasing a virus to achieve your ends qualifies one as a zealot. In fact, I would guess that the poster of the parent (this post's grandparent) thread is most likely not a Windows fan, so the underlying belief probably is not different, just what is perceived as acceptable means.

Coralized mirror

[Randar the Lava Liza]

Why aren't all link submissions required to include a mirror? Ah well, here's the Coralized link

Re:Kasperski

[gmuslera]

The old myth that says that the antivirus makers are the ones that are developing virus? I use AVP/KAV since a decade ago, first in DOS and now in Linux, and is one of the best (if not THE best) available antivirus on the market.

Even know someone that programmed a test virus long time ago, and sent to antivirus publishers to see how well it could be detected, and the response from the community of that time, specially the people from Kaspersky, was very against that kind of "tests", so is very improbable what you are telling there (and that includes too most of the other biggest players 10 years ago if the same is said about i.e. F-Prot or McAfee people)

At least without hard proof (not just speculation or just urban myths) i would give that notice the same weight as that Bill Gates is sending big bucks to any that continues a chain letter.

Do we ever really hear about good viruses?

[NotQuiteReal]

Script kiddies using virus writing kits and punks putting graffiti on stop signs is at about the same level.

What do you think of the notion that there are at least several really successful viruses that we never hear about, because they are more useful to the writer if they are not obviously annoying?

Are all these zombie machines we hear about for rent to spammers infected with viruses that would be caught be common virus scanners, or are they truely different?

Re:Circumstantial evidence.

[analog_line]

Well, you obviously didn't glance through all of the points, as you neglect to mention the opcode simmilarities, timeline of significant releases of both pieces of software and the activites of groups known to use Send Safe, and SoBig.

Not to mention the exhaustive opcode comparison diagram at the end of the document.

Circumstantial evidence, it may be, but that doesn't mean it's not valid. And what is forensics aside from a circumstantial investigation? Getting as many facts as you are able to directly observe in order to come to a logical conclusion about a question you can't directly observe the solution to.

Reasons for going public now...

[Shambhu]

Leaving aside the validity of their arguments for the time being (though I found them persuasive), I was wondering why exactly they felt the need to release this now. I think there are a few clues in the document:

"Sobig was so virulent that on November 5, 2003 Microsoft, in coordination with the FBI, Secret Service, and Interpol, setup the Anti-Virus Reward Program. Backed by $5 million from Microsoft, the program offered a $250,000 bounty for information leading to the arrest and conviction of the Sobig author."

And they add in a footnote to that sentence:

"Ironically, our investigation into the identification of the likely Sobig author(s) and corresponding findings had already been concluded and passed on to law enforcement over two months prior to the Microsoft bounty offer. The bounty was not our incentive."

So they say they had submitted their research prior to Nov. 5, '03. Why go public now? Though they don't say it, I can't help but think that it was frustration. Their own explanations for why they are going public seem thin to me.

Not saints, but not devils

[phorm]

While many of the linux community aren't saints, the attitude-in-general towards viruses and their makers is negetive. You're not going to get a pat-on-the-back from the community for creating an anti-windows virus, you're going to get a kick-in-the-ass for dampening the reputation of the community. Furthermore if a bounty comes up for the virus it's likely somebody will turn you over if possible.

MS would love to be able to state that linux programmers are behind virus attacks on windows, and most are smart enough to realize that.

We don't love windows, but we're smart enough not to dirty our hands with viruses, partly because we hate viruses more than we'll ever hate windows (viruses/etc being in-fact one of the reasons for disliking windows)

Re:Kasperski

[gmuslera]

Never was infected by a virus myself. But had a BBS whose files were checked against virus, worked in LANs where workers had not a lot of common sense sometimes, and avp is pretty good for checking for virus in mail servers (i.e. teamed up with anomy sanitizer).

To be "unprotected" from virus is ok if you have common sense, firewalls and safe software (i.e. windows is not in that category, and if well linux is pretty safe against virus, maybe is not 100% safe against worms), but when you talk about a lot of people, common sense looks not so common.