In what the company called a "coordinated multinational law enforcement effort," information provided to Microsoft by informants led local authorities to arrest the 18-year-old unnamed resident of Rotenburg, Germany, only a week after the original Sasser virus had been released.
Bottom line:
What's new:
Microsoft's $5 million fund for rewarding informants for leads on virus attacks may have snagged its first success in the arrest of a suspect in the Sasser worm case.
Security experts said this could be the single biggest arrest yet in the campaign against the computing underground responsible for hatching worms and viruses, which has proved difficult for law enforcement to crack.
The arrest brings a quick end to the latest worm incident. The week-old worm has slowed its spread, as companies clean up existing infections. The worm and its three known variants have compromised hundreds of thousands of computers running Microsoft Windows, though some estimates put the number of infected systems in the low millions.
The arrest is the first success for Microsoft's Antivirus Award Program, a $5 million fund to reward people for coming forward with information about those who release major worms and viruses. While Microsoft has offered three rewards for $250,000 each for those who were responsible for the havoc caused by the MSBlast worm, the Sobig virus and the MyDoom virus, no arrests in those cases have yet been made. The arrest of the author of a minor variant of the MSBlast worm predated the award program.
While Microsoft had not announced any reward for information about the person or group that released, and presumably wrote, the Sasser worm, the informants approached the software giant's German office on Wednesday and inquired about whether such a cash award would be paid.
Smith would not comment on whether there may be additional arrests, but he confirmed the investigation is ongoing.
Graham Cluley, senior technology consultant for antivirus firm Sophos, praised the quick arrest.
 | ||||
|
| | ||
|
Related coverage Sasser keeps slithering  Read all of News.com's stories on this latest Internet worm. Also: Sasser prevention and cure. |
| ||
|
|
||||
|
|
||||
Smith wouldn't say how many people came forward, except to indicate it was fewer than five. Moreover, while he would not comment on whether a relationship existed between the Sasser suspect and the informants, he did say that they both live in the same part of Germany.
"These were individuals who were aware of who the perpetrator was; they did not stumble upon this because of technical analysis," Smith said.
The arrest could be the most significant since David L. Smith was arrested for spreading the Melissa virus in 1999, and Sasser may eventually exceed that case in importance as well, because Sasser may have been written by a group of programmers. The arrest could lead to more suspects.
|
| ||||
|
| | ||
|
Get Up to Speed on... Enterprise security Get the latest headlines and company-specific news in our expanded GUTS section. |
| ||
|
|
||||
|
|
||||
Moreover, security experts and German police believe that the author of Sasser also created several, if not all, variants of Netsky, a mass-mailing computer virus. At least one version of that virus was signed by what seemed to be a group of programmers calling itself the Skynet Antivirus Team.
"All these worms have been highly disruptive and complex, suggesting that the author isn't working alone," he said. "Seizing this man's computers could provide the vital clues that will bring down the infamous Skynet virus-writing gang. We would not be surprised if more arrests follow in due course."
Microsoft also said that several new virus research techniques that the software giant has developed over the past year have played a key role in identifying the author and verifying the data provided by the informants.
The message for virus writers is that they are not safe from the law, Smith said.
"I do think that the fast action in this case does send a message to people who are thinking of launching or creating malicious viruses and worms," he said. "And that is, we together with law enforcement can and will identity (individuals) who launch malicious code on the Internet. And law enforcement can and will bring them to justice regardless of where they are in the world."
