|
| |
What's New
Slammer worm Source Code Provides Clues
(for information click Virus-Worms above)
Although still unclear
on who unleashed the worm onto the Internet, security experts say
signatures in the worm's code indicate a Chinese cracking group may be
responsible for writing the code.
As corporate IT departments go about the business of cleaning up their
networks, there are strong indications that the SQL Slammer worm that
brought down portions of the Internet over the weekend is based on the
work of an obscure Chinese cracking group.
Signatures within the worm's source code indicate that a group known as
the Honker Union of China—also known as the Hacker Union of China—may be
responsible for writing the code, according to security experts who have
analyzed the code. However, experts caution that although they are
certain of the code's origins, someone else may have actually loosed the
worm on the Internet.
|
Technical Support Information
Technical support is offered Monday - Friday from 9 a.m. to 5 p.m.
(PST).
|
"We're 100 percent certain this was based on the CNHonker code," said
Chris Rouland, director of the X-Force research team at Internet Security
Systems Inc., in Atlanta. "But that doesn't mean they released it."
Although the Honker Union has not yet claimed
responsibility for the worm, it has posted on its Web site in the past
several versions of an exploit for the vulnerability used by Slammer. The
group has been quite active in pro-Chinese and anti-American hacking
activity in the past and was involved in a U.S.-Chinese cyber-skirmish
that erupted in early 2001.
The worm did most of its damage in Asia, particularly South Korea, which
was effectively taken off the Internet for several hours Saturday. And
some experts have pointed out that the Slammer worm was released on the
anniversary of a major offensive in the Korean War that began pushing back
Communist Chinese forces that had penetrated South Korea.
Despite the possible political motivations behind the worm's release,
White House security officials downplayed the idea that this was an act of
terrorism.
"We'd rather characterize terrorism as something that physically kills
people," said Marcus Sachs, director of communications infrastructure
protection in the Office of Cyberspace Security in Washington. "There was
no lasting damage done to the infrastructure. We'd like to see the term
cyber-terror dropped."
|
| | |
| |
|
