[ISN] Romanian man arrested for new MSBlast worm

From: InfoSec News (isnat_private)
Date: Wed Sep 03 2003 - 22:35:09 PDT

  • Next message: InfoSec News: "[ISN] Honeynet Scan of The Month #29"

    By Reuters 
    September 3, 2003
    A Romanian antivirus company said Wednesday that it helped police 
    identify a 24-year-old man arrested on suspicion of releasing a new 
    version of the MSBlast Internet worm, the second arrest of a 
    copycat-virus writer in the past week. 
    Meanwhile, the culprit behind the original MSBlast remains at large. 
    The original worm, which also goes by the names Blaster and Lovsan, 
    surfaced last month, infecting hundreds of thousands of computers 
    running Microsoft's Windows operating system. 
    Romanian security company BitDefender said Romanian authorities 
    arrested Dan Dumitru Ciobanu from the northern Romanian city of Iasi 
    on suspicion of creating and distributing MSBlast.F, the latest 
    version of the worm. 
    According to information posted by U.S. antivirus company Symantec, 
    MSBlast.F was released Sept. 1 and has achieved minimal distribution 
    to date. The offshoot's main difference from the original worm is that 
    it renames some files with Romanian words and attempts to launch a 
    denial-of-service attack against an apparently defunct Romanian Web 
    Ciobanu is a student at the Technical University of Iasi, according to 
    the BitDefender statement, which quoted an investigator from the Iasi 
    Center for Combat Against Organized Crime and Drug Enforcement. 
    Mihai Radu, a spokesman for BitDefender, said Ciobanu has not yet been 
    charged. Under recently passed cybercrime legislation, he faces a 
    prison term of three to 15 years if convicted, Radu added. 
    Police confiscated two of Ciobanu's computers. The machines will be 
    analyzed in the presence of the defendant, his attorney and the local 
    district attorney, officials said, as early as Thursday. 
    Ciobanu was in police custody as of Wednesday night, Radu said. 
    Last week, U.S. authorities arrested 18-year-old Jeffrey Lee Parson 
    for allegedly creating and distributing the first variant of MSBlast. 
    Ciobanu allegedly, like Parson, made it easy for investigators to find 
    him. Radu said the virus code contained a reference to Ciobanu's 
    nickname "Enbiei," a message written in Romanian that named one of 
    Ciobanu's teachers, and a link to the university Web site. 
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Thu Sep 04 2003 - 01:21:52 PDT