Sober code cracked
The latest variant of the Sober worm caused havoc in November by duping users into executing it by masking as an e-mails from the FBI and CIA. Anti-virus companies were aware that the worm somehow 'knew' how to update itself via the Web. The worm's author programmed this functionality in order to control infected machines and, if required, change their behaviour.
On Thursday, Finnish anti-virus firm F-Secure revealed that it had cracked the algorithm used by the worm and could now calculate the exact URLs the worm would check on a particular day.
Mikko Hyppönen, chief research officer at F-Secure, explained that the virus author has not used a constant URL because authorities would easily be able to block it.
"Sober has been using an algorithm to create pseudorandom URLs which will change based on dates. Ninety nine percent of the URLs simply don't exist ... however, the virus author can precalculate the URL for any date, and when he wants to run something on all the infected machines, he just registers the right URL, uploads his program and BANG! It's run globally on hundreds of thousands of machines," Hyppönen wrote in his blog.
According to F-Secure's calculations, on 5 January 2006, all computers infected with the latest variant of Sober will look for an updated file located in a list of domains, including:
- http://people.freenet.de/gixcihnm/
- http://scifi.pages.at/agzytvfbybn/
- http://home.pages.at/bdalczxpctcb/
- http://free.pages.at/ftvuefbumebug/
- http://home.arcor.de/ijdsqkkxuwp/
Hyppönen advised administrators to ensure any infected PCs can't upgrade automatically by blocking access to the domains.
Adam Biviano, premium services manager at Trend Micro, told ZDNet Australia that blocking the URLs could be beneficial but the safest bet would be to ensure that PCs are safe.
"Blocking those URLs is not a bad idea but administrators need to make sure their machines are not infected in the first place," said Biviano.