full-disclosure - 2nd Blaster copy-catter arrest in Romania (Blaster.F)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <01bd01c37258$19afb560$550ffea9@rms>
From: rms at computerbytesman.com (Richard M. Smith)
Subject: 2nd Blaster copy-catter arrest in Romania (Blaster.F)

http://biz.yahoo.com/rc/030903/tech_internet_virus_1.html

Romanian student arrested for new Blaster worm
Wednesday September 3, 3:42 pm ET 
By Bernhard Warner, European Internet Correspondent 

LONDON, Sept 3 (Reuters) - Police on Wednesday said they arrested a
24-year-old Romanian man suspected of releasing a new version of the
Blaster Internet worm, the second arrest of a copycat virus writer in
the past week. 
Meanwhile, the main culprit behind the original super-potent Blaster
remains at large. The original worm, which also goes by the name
"LovSan," surfaced last month, infecting hundreds of thousands of
computers running Microsoft (NasdaqNM:MSFT - News) Windows. 

Authorities identified the author of the latest worm strain as Dan
Dumitru Ciobanu from the northern Romanian city of Iasi. 

Police were unavailable for comment, but issued a statement late on
Wednesday through BitDefender -- the Romanian firm that helped police
track down the suspect -- confirming the suspect's identity. 

He is a 24-year-old student at the Technical University of Iasi, the
statement said.

....

Like Parson, Ciobanu left behind big clues. The virus code contained a
reference to Ciobanu's nickname "Enbiei," a message written in Romanian
that named one of his teachers, and a link to the university Web site,
which he intended to be the target of a denial of service attack, Radu
said.

"Don't go to the Hydrotechnics faculty!!! You are wasting your
time...Barsan, the retirement wants you!!!," read a translated version
of the message supplied by Finnish anti-virus firm F-Secure.