More details on Sober worm



There’s a bit more detail in this betanews article on the sober worm. They basically say that the next expected “release” is January 8th, that f-secure has cracked the “code” of the worm. You see it appears that the URL’s that new versions of the worm are downloaded from are not hardcoded, but “psuedorandom” and they’ve cracked the algorithm the worm uses.


They say they’ve had it cracked since about May of this year, but had kept things close to the vest, only notifying German authorites located where the url’s were to be hosted. They say 99% of the url’s are currently non-existent, but all the virus writer must do is activate one and then all the currently infected sober systems start updating. After the January 5/6 check, the virus will check every two weeks for updates.

It is a quite clever “distributed” model that they seem to have employed to evade getting it snuffed out up until now. Most of the url’s seem to be pointing to accounts that would be hosted at free sites.

It sounds as though this will require continued monitoring and attention until the machines infected by sober are eliminated.

Related Posts

Blog Traffic Exchange Related Posts
  • Sending Virus or Spam Abuse reports It occured to me that I may not have brought things to a neat conclusion on the post earlier about tracking email header data. I did make reference to sending an abuse report. Here's an attempt to clear up a few things that might still be fuzzy. 1) usually the......
  • A couple interesting online Advertising notes I've run across a couple of interesting things. The first was linked to from the second one I'll mention. I know, some time back, I visited a publicly available Google Adsense tool a few months back and at that time found an interesting tool that gave you keyword suggestions based......
  • HP virus throttler available for Linux HP will be making their virus throttler software avialable for Linux. Their virus throttler software detects compromised machines on a network, mails the administrator and throttles network connections to the machine, attempting to minimize the impact of the viral outbreak. (It seems as though it would be especially useful against......
Blog Traffic Exchange Related Websites
  • The 7 Steps To Internet Marketing Success Have you achieved all you wanted to achieve in the last 12 months? - Chances are you didn't know what you wanted to achieve... So in theory my first question may be difficult or even impossible to truthfully answer. If, like me, you are wanting to build a successful online......
  • Real-estate Hosting - Don't Overpay! Recently, I d been using WordTracker.com to see which "real estate property website" phrases get searched quite often through Google, Yahoo and similar major search engines. It surprised me that the phrase "property web hosting" and also the longer "real-estate internet page hosting" were two of the most commonly searched......
  • Weekly Mashup, April 26th This week you can find me in 3 different carnivals: Mighty Bargain Hunter hosted the Carnival of Personal Finance and included my article on What to do with all of your extra money?. I hosted the Festival of Frugality. I didn't realize I was going to at first, so I......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site