« John Lennon's Imagine… | Home | Sony's Rootkit Infrin… »

Sober Worm Update system cracked

One of the nastiest/coolest (note: I am both a fan of the coding techniques used by some virus writers, and a loathe virus writers results at the same time) things about the Sober worm is the way it updates itself.

On the face of it, updates can be stopped by looking at the program and seeing where it grabs the updtes from - be it IRC or HTTP or anything else.  The problem with Sober is that the sites updates are downloaded from varied using crypto technology.

It seems F-Secure cracked this system in May, and have now informed the world of this only now.  Presumably so that evidence could be gathered against the author, or something similar.

frak

---

No comments:

---

No trackbacks:

Trackback link:

---

Name:			Remember personal info? Yes No
Email:
URL:
Comment:		/ Textile
this is to stop spam bots causing me pain. the first four letters of frakkle     (Register your username / Log in)
Notify: Yes, send me email when someone replies. Hide email: Yes, hide my email address.
Small print: All html tags except <b> and <i> will be removed from your comment. You can make links by just typing the url or mail-address.