Sasser worm accomplices sought in Germany

13 May 2004

HANOVER – Authorities in Germany have expanded their investigation into the Sasser internet worm to include possible accomplices of an 18-year-old German who has confessed to creating it.

“We have reason to believe other persons were involved in the dissemination of the virus,” a police spokesman in Hanover said.

Searches have been conducted at a number of homes of friends and schoolmates of Sven Jaschan, the confessed author of the Sasser internet worm, he added.

Investigators are also trying to find out what prompted Jaschan to create the worm in the first place. He reportedly claims he was seeking to create an anti-virus programme when he inadvertently created the destructive worm instead.

Police also say say that, just prior to his arrest, the teenager had even launched a new version of the worm that was meant to limit the damage that was caused by the original one.

There were also news reports that the teenager may have created the Sasser worm to drum up business for his mother’s computer store. But a prosecutor said those reports could not as yet be verified.

Jaschan was arrested Friday, at his home in the village of Waffensen between Hamburg and Bremen.

A senior public prosecutor said Jaschan may escape formal punishment because he was arrested on Friday, only a day after his 18th birthday. Since the alleged crime of computer sabotage was apparently committed before his 18th birthday, Jaschan must be tried as a juvenile.

Helmut Trentmann said, “Although retribution plays a role, German young persons’ courts are mainly concerned with correction.” That means the punishment does not have to fit the crime, and even short terms of detention can be commuted if the youth shows remorse.

An adult committing computer sabotage in Germany can be sentenced to up to five years in prison.

Microsoft released a patch last month to protect computers, shortly before Sasser was released and began infecting Windows XP and Windows 2000 worldwide. The virus, or countermeasures, hit a German bank, a US airline, a coastguard, and the European Commission.

Jaschan, who was attending trade-training school to become a software technician, was described by neighbours as someone whose only topic of conversation was computers.

Meanwhile, a court in southern Germany remanded a 21-year-old man in jail on charges of circulating a worm, Phatbot, that piggy-backs on Sasser to take control of personal computers, making them send spam mail and disclose confidential files.

Sasser by contrast was mainly a nuisance, overloading the Internet and causing personal computers to automatically shut down when they were hooked up to the internet. Unlike earlier viruses, it does not use e-mails to spread.

Phatbot reported attacked enterprise computers in Britain and the United States last year. Prosecutors said it could silently take copies of files, circulate spam or mount bombardment attacks that can knock out third-party computers by overloading them.

Despite the two arrests, both self-replicating viruses are still on the loose, mainly attacking people who find virus protection too difficult or believe an attack could never happen to them.

The Sasser worm began to spread last week, and can spread by itself to any unprotected computer linked to the internet.

It attacks through a flaw in recent versions of Microsoft’s Windows – Windows 2000, Windows Server 2003 and Windows XP – and causes the computer to shut down, then rebooting it, repeating the process several times. But it appears to do no lasting damage.

DPA

Subject: German news