Home>News Center>World

Teen confesses to creating 'Sasser' worm
Updated: 2004-05-09 09:11

A German high-school student has confessed to creating the "Sasser" worm that generated chaos across the globe by infecting hundreds of thousands of computers, authorities said Saturday.

A cameraman films the home of an 18-year-old male computer programmer in Rotenburg. The German faces up to five years in prison after he confessed to creating the Internet Sasser worm, police said. [AFP]
The teenager, whose name was not released, was arrested Friday in the northern village of Waffensen, where he lives with his family. In a search of the suspect's home, German investigators confiscated his customized computer, which contained the worm's source code.

"As a result of the student's detailed testimony about the viruses he spread, he has been identified clearly as the author," the state criminal office in Hanover said in a statement. Spokesman Detlef Ehrike said he is being investigated on suspicion of computer sabotage, which carries a maximum sentence of five years in prison.

After being questioned, the teenager was released pending charges.

A window of the home of the suspected 18-year-old creator of the 'Sasser' computer worm. [AFP]
The worm raced around the world over the past week, exploiting a flaw in Microsoft's Windows operating system.

Microsoft said informants contacted it on Wednesday, offering information about the worm's creator. The company's investigators worked with German authorities, the FBI and Secret Service agents, tracing the virus by analyzing its source code, said Brad Smith, Microsoft's top lawyer.

The company would not say how many people came forward or identify them. But in Germany, Microsoft data protection official Sascha Hanke said the informants had backed up their tip by providing part of the worm's source code.

"We can say with great certainty that these people got the source code from the author," he told reporters in Hanover. Hanke said he met in northern Germany on Thursday night with the informants, who told him who the author was.

Unlike many infections, Sasser does not require users to activate it by clicking on an e-mail attachment. Once inside, the worm scans the Internet for others to attack, causing some computers to continually crash and reboot.

The teenager told officials that his original intention was to create a virus called "Netsky A" that would combat the "Mydoom" and "Bagle" viruses, removing them from infected computers. In the course of that effort, he developed Sasser.

"The student did not give any thought to the resulting consequences or damage," investigators' statement said.

On Monday, the worm hit public hospitals in Hong Kong and one-third of Taiwan's post office branches. Twenty British Airways flights were each delayed about 10 minutes Tuesday due to Sasser troubles at check-in desks. British coast guard stations were forced to use pen and paper for charts normally generated by computer.

Sasser is known as a network worm because it can automatically scan the Internet for computers with the security flaw and send a copy of itself there.

The German government's information technology security agency said there were four versions of Sasser.

"The first version was amateurish," spokesman Michael Dickopf said. However, the others "were clearly different in the damage they caused."

Police said the German teenager was responsible for all the versions, in addition to variants of the Netsky virus.

Microsoft investigators told the informants, who had asked whether they would be eligible for a reward, that they would consider paying $250,000 if the information led to the arrest and conviction of those responsible. Smith said the arrest was a sign that such rewards work.

"We believe this is an important step forward in the industry's ability to fight malicious code on the Internet," he said.

Meanwhile, prosecutors in Stuttgart said an unemployed 21-year-old man was arrested Friday in Loerrach, on Germany's border with Switzerland, and admitted to creating a worm that goes by the names "Agobot" and "Phatbot" along with other hackers.

Prosecutors, who said they acted after receiving information from U.S. authorities, said there were no indications of any link between the man and the Sasser programmer.

  Today's Top News     Top World News

Statistics show China's steel sector still red hot



Beijing: HK LegCo motions against NPC illegal



China, EU hold talks over trade compensation



Cause of recent SARS epidemic still unclear



PM Wen sees Sino-Italian ties bear fruit



Chinese might build Mercedes in Beijing


  Chechen leader killed in Grozny blast
  Iraqis die in Basra clashes
  US general blames abuse on poor leadership
  Bush says Palestinian state by 2005 not 'realistic'
  More bad news may be on the way for Bush
  Australia to put marshals on some flights
  Go to Another Section  
  Story Tools  
  Related Stories  
Sasser worm to hit China after holiday
Internet technology vulnerable to hackers
Hackers hint of plan to unleash havoc
  News Talk  
  Scandal over humiliation of Iraqi prisoners