Zotob

"The Zotob worm and several variations of it, known as Rbot.cbq, SDBot.bzh and Zotob.d, infected computers at companies such as ABC, CNN, The Associated Press, The New York Times, and Caterpillar Inc." — Business Week, August 16, 2005.

Zotob is a computer worm which exploits security vulnerabilities in Microsoft operating systems like Windows 2000, including the MS05-039 plug-and-play vulnerability. This worm has been known to spread on Microsoft-ds or TCP port 445.

It was declared that the Zotob worms cost an average of $97,000 as well as 80 hours of cleanup per company affected.[1]

Rbot variant

Zotob was derived from the Rbot worm. Rbot can force an infected computer to continuously restart. Its outbreak on August 16, 2005 was covered "live" on CNN television, as the network's own computers got infected. Zotob would self-replicate each time the computer rebooted, resulting in each computer having numerous copies of the file by the time it was purged. This is similar to the Blaster (Lovesan) worm.

Sequence of events

Wikinews has related news: CNN headquarters infected with computer worm, exaggerates global threat

Arrest of the coders

On August 26, 2005, Farid Essebar and Atilla Ekici were arrested in Morocco and Turkey, respectively. They are believed to be the men behind the worm's coding.

A signature in the Zotob worm code suggested it was coded by Diabl0 and the IRC server it connects to is the same used in previous version of Mytob. Diabl0 is believed to have incorporated the code of a Russian nicknamed houseofdabus [11] whose journal has been shut down by authorities,[12] just after the arrest of Diabl0. The coder (Ekici) probably paid Diabl0 (Essebar) to write the code.

"He says it's all about making money, and that he doesn't care if people remove the worm because it's the spyware stuff that he installs that's making him the money, Taylor said in a conversation with me." [13]

On August 30, 2005, controversial reports emerged from different anti-virus firms. Sophos declared that several people had access to the Mytob source code (a variant of the worm). On the other hand, F-Secure declared that it has found multiple variants of Mytob that were coded after the arrest of Essebar. Those declarations suggest that Essebar is only a part of a larger group of Dark-side hackers behind the spread of the malware.[14]

See also

References

  1. ↑ http://www.redherring.com/Article.aspx?a=14206&hed=Zotob+Cost+%2497K+per+Company&sector=Industries&subsector=SecurityAndDefense
  2. ↑ http://news.bbc.co.uk/2/hi/technology/4159002.stm
  3. ↑ http://msnbc.msn.com/id/8975840/
  4. ↑ http://www.nytimes.com/2005/08/17/technology/17virus.html
  5. ↑ http://www.cnn.com/2005/TECH/internet/08/16/computer.worm/index.html
  6. ↑ http://today.reuters.com/news/NewsArticle.aspx?type=internetNews&storyID=2005-08-16T232013Z_01_HO683966_RTRIDST_0_NET-VIRUS-DC.XML
  7. ↑ http://msnbc.msn.com/id/8975840/
  8. ↑ http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/1124243901921_51/?hub=TopStories
  9. ↑ http://www.map.ma/eng/sections/general/young_moroccan_hacke4792/view
  10. ↑ http://news.bbc.co.uk/1/hi/technology/5345404.stm
  11. ↑ http://www.milw0rm.com/author/183
  12. ↑ http://www.livejournal.com/users/houseofdabus/
  13. ↑ http://blog.washingtonpost.com/securityfix/2005/08/conversation_with_a_worm_autho_1.html
  14. ↑ http://www.channelregister.co.uk/2005/08/30/zotob_arrests_follow-up/

External links and sources

Security vulnerability information

Worm information

News coverage

This article is issued from Wikipedia - version of the Thursday, March 24, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.