Slashdot Mirror
Sober Code Cracked
An anonymous reader writes "The algorithm used by the Sober worm to 'communicate' with its author has been cracked. According to F-Secure, it can now calculate the exact URLs the worm would check on a particular day. Mikko Hyppönen, chief research officer at F-Secure, explained that the virus author has not used a constant URL because authorities would easily be able to block it. From the article: "Sober has been using an algorithm to create pseudorandom URLs which will change based on dates. Ninety nine percent of the URLs simply don't exist...however, the virus author can precalculate the URL for any date, and when he wants to run something on all the infected machines, he just registers the right URL, uploads his program and BANG! It's run globally on hundreds of thousands of machines," Hyppönen said. Sober is expected to launch itself again on January 5, 2006."
The only way they can make money is from a rival company wanting the worm to take down their competition, or a rival country in some cases, wanting to take down a lot of a country's infrastructure based on the net. We're all familiar with the hackers the russian government hired to try and rip down the internet, but it is often attempted with worms too
~HTP~ Hug that tux
The URLs are not domain names registered in DNS, but page names on "free homepage" services.
So they would have to get in contact with the providers of those services instead (arcor.de, pages.at)
No, Sober is pro Nazi virus. Jan 05 is "1919 - Free Committee for a German Workers' Peace founded." Check virus descriptions on any antivirus vendor site.
If you think, that is about free software, then you haven't got bunch of text emails about dresden bombings and other propaganda.
The Sober virus author can precalculate the URLs. We wanted to be able to do the same thing. So we cracked the algorithm. This enabled us to calculate the download URLs for any future date. In fact, we did this already in May 2005, and we informed the local police in Germany as well as the affected ISPs. But we didn't want to talk about it publically then - we didn't want to fill in the virus writer on this. But he must know this by now.
I'm curious if you bothered to read F-Secure's blog:
So we cracked the algorithm. This enabled us to calculate the download URLs for any future date. In fact, we did this already in May 2005, and we informed the local police in Germany as well as the affected ISPs. But we didn't want to talk about it publically then - we didn't want to fill in the virus writer on this. But he must know this by now.
Something to think about.
The revolution will be mocked
Read the F-Secure blog.
Or read my previous comment.
F-Secure didn't simply crack the algorithm yesterday.
The revolution will be mocked
Ok, so, it's /., we don't usually RTFA, but those are the domains:
http://people.freenet.de/
http://scifi.pages.at/
http://home.pages.at/
http://free.pages.at/
http://home.arcor.de/
not really "alphabet soup with a TLD suffix", uh?
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048
As it clearly says in F-Secure's blog, they cracked this in May. They're only going public now. They've informed both the ISPs affected and the police. It is very unlikely that anyone will be able to register those accounts - if they do, they'll probably be talking to the police.
Does my bum look big in this?
Yeah you could spoof the response from the timesever, but simply cracking the code is far more elegant.
pi = 2*|arg(God)|