Slashdot Mirror

← Back to Stories (view on slashdot.org)

Russian Denies Writing SoBig Worm

Posted by timothy on from the nyet-nyet-nyet dept.

IphtashuPhitz writes "The Russian spamware programmer anonymously accused eariler this week of writing the Sobig worm has responded to the accusations. Ruslan Ibragimov of Send-Safe doesn't deny that his program uses proxies to hide spammer's identities. But he totally refutes the report's technical analysis in an online interview over at OReilly Network."

15 of 67 comments (clear)

  1. I don't buy it by Commander+Trollco · · Score: 3, Interesting

    The bit about headers is believable. But the opcode similarities are harder to defend- anyone know more about this and care to comment? He clearly has a motive, and should be lynched regardless of whether he actually wrote sobig.

    --
    http://persianews.on.nimp.org/?u=Tar_Baby
    1. Re:I don't buy it by Anonymous Coward · · Score: 3, Funny

      "He clearly has a motive, and should be lynched regardless of whether he actually wrote sobig."

      Man, the Bush ideology spreads so fast?

  2. After all this.. by jjeffrey · · Score: 5, Funny

    ..I bet he dosen't feel SoBig now.

    1. Re:After all this.. by iamlucky13 · · Score: 4, Funny

      That's alright. He can sell himself some viagara.

      As long as we're on the topic of spam and such, I think slashdot has slashdotted itself. The "bush wins" thread is average at least a post every 3 seconds, who knows how many hits, and the server is crawling

  3. Remember the rules by Underholdning · · Score: 4, Insightful

    Rule #1:
    Spammers lie!

    --
    Underholdning.info
    1. Re:Remember the rules by Anonymous Coward · · Score: 3, Funny

      Rule #2: If a spammer seems to be telling the truth, see rule #1.

  4. What a stand-up guy... by sczimme · · Score: 5, Funny


    The report noted, for example, a strong similarity in the email headers created by Send-Safe and SoBig. But Ibragimov said Send-Safe chose the particular order of headers merely to mimic Outlook Express and to better evade spam filters.

    Somehow I think Ibragimov's righteous indignation over the accusation is a teensy bit misplaced...

    --
    I want to drag this out as long as possible. Bring me my protractor.
  5. WTF? by Otter · · Score: 4, Insightful

    Not that I'm shedding any tears for this guy but does "Anonymous person accuses other person by name on the basis of sketchy circumstantial evidence!" really merit this degree of publicity?

    --
    What I'm listening to now on Pandora...
  6. Proxie Shortage by Rob+Carr · · Score: 4, Interesting
    From the article:
    "Trojans killed my business," he said, noting that many of his customers have recently migrated to "cracked" (pirated) versions of spamware programs such as Dark Mailer, for which they purchase lists of Trojaned proxies from hackers. .... Comments on Send-Safe's discussion forum appear to confirm that the company has had trouble providing users with sufficient proxies for sending spam.
    There's irony in this guy's complaint, and (assuming he didn't write SoBig) at least a little justice. "My heart bleeds for the Snicker-Snack Company" - Linus (the character from "Peanuts," not the software guy)
    --
    This sig seemed like a good idea at the time....
  7. For sure he denies. by a_hofmann · · Score: 4, Informative

    If you read the original report you can see hard facts against Ruslan Ibragimov.

    The binary comparison in the report shows evidence for a correlation between Send-Safe and Sobig-F which could be proved if Ibragimov would be forced to open the Send-Safe source.

  8. Hmm... by northcat · · Score: 5, Funny

    Maybe he wrote the "Who wrote the SoBig?" report himself to popularize his "Send-Safe" software... You never know...

  9. Surprise! by Se7enLC · · Score: 5, Funny

    Wow, this is surprising! I was expecting "Russian accused of writing SoBig worm admits to it, despite the flagrant lack of evidence to actually convict him of anything."

  10. "Totally refutes"??? by Zocalo · · Score: 3, Interesting
    Well let's see. Ibragimov makes a few claims such as "it's bullshit!", "it's a coincidence!" and gives a very brief outline of how SendSafe works, revealling nothing not in the report. He also claims he's not been spoken by any law enforcement agency regarding the matter, which is possibly true. Hardly a point by point rebuttal is it, and never mind the maxim "spammers lie" which means everything he says will be taken with a huge pinch of salt.

    The only interesting comment I found is that his company is currently having difficulties due to trojans, something that the SendSafe forums seem to confirm. That seems quite probable, but it hardly helps his case - why, exactly, would trojans be causing his SendSafe business any problems? Unless, of course, it might be something to do with other trojans that he didn't write such as NetSky/Sasser preventing SoBig getting as many hosts as it used to? Given that there was a spat between the various trojan authors, complete with a possible Russian connection, just before Sven Jaschen was arrested that at least seems entirely plausible to me.

    --
    UNIX? They're not even circumcised! Savages!
  11. Denied by Anonymous Coward · · Score: 3, Funny

    "Only the true Messiah denies his divinity!"

  12. The evidence... by JohnGrahamCumming · · Score: 4, Insightful
    If you read the long boring document that fingers this Russian guy you'll see the following "evidence":

    1. Send-Safe and SoBig had same release dates. Where the margin on same is up to 10 days, and there are strange inaccuracies, for example the document states that on 5/23/2003 there was a SoBig release compiled on June 24, 2003. Other evidence hinges on the actions of SSSG without considering the possibilities that they were using a hacked version of Send-Safe.

    2. Document contains unfounded statements like "As SSSG appears to be a sizable organization, it would seem unlikely that any individual within the group would actually know the Sobig author(s)."

    3. The skills section is particularly funny since it lists skills like "Newsgroups" and states the the Russian has been posting on Newsgroups since 1998. Woo hoo!

    4. The use of %s section made me want to LOL. The authors see significance in the fact that neither piece of software uses %s to concatenate strings,
    sprintf( together, "%s%s", s1, s2 );
    would be unusual for any C programmer, yet
    sprintf( command, "RCPT TO:<%s>", rcpt );
    looks like something any C programmer would do.

    5. The note on string ordering with an example of SoBig vs Send Safe appears to me to show the opposite of what the authors intended. The two blocks look very different.

    6. A large part of the document is dedicated to showing how the two exectuables are "similar" at the opcode level. There is no actual evidence here, e.g. how about a disassembly of two identical blocks of code? The comparison is interesting, but doesn't tell us much without being able to see the actual code.

    Overall I though the PDF file was poorly written, lacking in rigor and provided no real evidence for the naming of this individual.

    Yes, he helps people spam, and that's very, very annoying, but "innocent until proven guilty" people? Or at least "innocent until you actually show some convincing evidence".

    John.