Finnish security firm F-Secure has cracked a code used by the Sober
worm, potentially allowing the company to block the worm from receiving
updates.
Sober has mutated constantly since October 2003, when the first variant was picked up, with more than 20 other variants making the rounds. Last month the latest version, called Sober.Y by F-Secure (or CME-681 using US-CERT's CME naming system), was responsible for the biggest outbreak of the year, and still accounts for about 40 percent of all infections detected by F-Secure.
One of the features that has made Sober so dangerous is its ability to download new variants, instantly infecting large numbers of machines, say security experts. The current variant is expected to re-activate itself on 5 January, according to iDefense.
View: Read more at TechWorld
News source: TechWorld
Sober has mutated constantly since October 2003, when the first variant was picked up, with more than 20 other variants making the rounds. Last month the latest version, called Sober.Y by F-Secure (or CME-681 using US-CERT's CME naming system), was responsible for the biggest outbreak of the year, and still accounts for about 40 percent of all infections detected by F-Secure.
One of the features that has made Sober so dangerous is its ability to download new variants, instantly infecting large numbers of machines, say security experts. The current variant is expected to re-activate itself on 5 January, according to iDefense.
The downloading pattern stumped anti-virus researchers for a time because the URL used was created by a secret algorithm. "Sober has been using an algorithm to create pseudorandom URLs which will change based on date. These URLs point to free hosting servers typically operating in Germany or in Austria," said Mikko Hypponen, F-Secure's manager of anti-virus research.
View: Read more at TechWorld News source: TechWorld
Yeah, one for the good guys!!
Edit: This news was posted on Slashdot Friday December 09, @03:43AM. I've been noticing recently that reading Neowin is like reading yesterday's news on Slashdot, but this is ridiculous. Neowin can, should, and needs to do better than this.
Last edited by mswarts on 13 Dec 2005 - 13:55
Unacceptable Forum or News comments.
While some members feel that post count is important, there are some posts we that feel do not contribute to the community in any way what-so-ever. Observe, because these are examples of unacceptable posts. If you wish to direct a fellow member to something that has already been posted, please do so in a courteous manner.
# 'old news' or anything similar.
# 'first post' or anything similar.
# '(insert product or brand) sucks' or anything similar
# 'I posted this in BPN x days ago!!!' or anything similar
Don't you think that's a bit too broad of a definition?
Don't you think that's a bit too broad of a definition?< br />
Well, that covers comments like "OOOOOOLD News...!", doesn't it? Plus derivatives like, "AAAAANCIENT News...!", and "This news is SOOOOO old!".
I think you can get the point.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.