Yet another Sasser worm appears

A new version of the Sasser Internet worm, Sasser-F, appeared on Monday, despite claims by German authorities to have arrested the sole author of that worm on Friday.

Antivirus software companies issued warnings about the new worm, which one antivirus expert called a crude adaptation that was unlikely to spread widely. The discovery, more than three days after German authorities arrested an 18-year-old German man for creating Sasser, suggests that the worm's code is circulating on the Internet and raises the specter of more Sasser versions, experts said.

Like earlier versions of Sasser, the F-variant exploits a recently disclosed hole in a component of Microsoft's Windows operating system called the Local Security Authority Subsystem Service, or LSASS. Microsoft released a software patch, MS04-011, on April 13, that fixes the LSASS vulnerability. (See: http://www.microsoft.com/technet/security/bulletin/ms04-011.mspx.)

Symantec rated Sasser-F a "Category 2" or low level threat and released a virus definition update for its products. Sophos and Panda Software also issued alerts.

Microsoft will update its Sasser cleaner tool to detect the new variant, a company spokeswoman said.

After receiving tips about the suspected author, identified in news reports as Sven Jaschan, on May 5, Microsoft provided information to German authorities in Lower Saxony that lead to his arrest. Jaschan provided an "extensive" confession when he was taken into custody, admitting to creating both the Sasser and Netsky worms in an effort to fight infections of the Mydoom and Bagle worms, according to a statement provided by German authorities.

Based on that confession, authorities and Microsoft believed that Jaschan wrote all the versions of Sasser, including a new variant, Sasser-E, that appeared at the time of his arrest, according to Brad Smith, senior vice president and general counsel at Microsoft.

However, antivirus experts raised questions about the timing of the E-variant, which was not detected by antivirus companies until hours after the arrest. Experts also said that changes in the Netsky worm family over time and messages in both worms pointed to a group of virus writers, not a lone author.

Asked Monday about the company's reaction should a new variant appear, Brad Smith, senior vice president and general counsel at Microsoft, said a new Sasser worm would not change Microsoft's belief that it led police to the Sasser author.

"A new variant won't change our thinking about variants A through E. What it will mean is that somebody else is up to something else, as well," he said.

Smith cited German police reports of "overwhelming" evidence that Jaschan created the worm and the young man's confession as proof of his link to the first five versions of the worm.

However, the investigation is ongoing and other arrests in the case were possible, he said.

The new Sasser version does not disprove the lone-author idea, but suggests that the Sasser worm source code has been released on the Internet, said Patrick Hinojosa, chief technology officer of Panda Software U.S.

An analysis of the Sasser-F worm's code revealed that it is an offshoot of the original worm, Sasser-A, that does not include any of the changes or improvements to the worm introduced in previous variants, he said.

That would make sense, if the author released the Sasser source code with the initial worm, then made modifications to it himself, Hinojosa said.

"It makes sense that this is a variant of the (Sasser-A) source code. It's been out for more than a week and made the rounds of whatever computing underground (Jaschan) was connected to. Now somebody has had a chance to play with it," he said.

Hinojosa called the changes to Sasser-F "child-like." The changes include a switching the name of a process created by the worm to "Bill Gates," and the addition of new comments containing expletives, Hinojosa said.

The apparent release of the Sasser source code complicates the picture of who's responsible for Sasser. Once source code is available for a worm, it "lowers the bar" of technical knowledge needed to create a variant or a new worm, said Gerhard Eschelbeck, chief technology officer at Qualys Inc.

Only an investigation of Jaschan's computer will confirm what role he had in the creation of the Sasser worm and its variants, and whether he worked with others to create and distribute the worms, Hinojosa said.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Paul Roberts

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?