Romanian man arrested for new MSBlast worm

[InfoSec News <isn () c4i org>]

http://news.com.com/2100-1002_3-5071030.html

By Reuters 
September 3, 2003

A Romanian antivirus company said Wednesday that it helped police 
identify a 24-year-old man arrested on suspicion of releasing a new 
version of the MSBlast Internet worm, the second arrest of a 
copycat-virus writer in the past week. 

Meanwhile, the culprit behind the original MSBlast remains at large. 
The original worm, which also goes by the names Blaster and Lovsan, 
surfaced last month, infecting hundreds of thousands of computers 
running Microsoft's Windows operating system. 

Romanian security company BitDefender said Romanian authorities 
arrested Dan Dumitru Ciobanu from the northern Romanian city of Iasi 
on suspicion of creating and distributing MSBlast.F, the latest 
version of the worm. 

According to information posted by U.S. antivirus company Symantec, 
MSBlast.F was released Sept. 1 and has achieved minimal distribution 
to date. The offshoot's main difference from the original worm is that 
it renames some files with Romanian words and attempts to launch a 
denial-of-service attack against an apparently defunct Romanian Web 
site. 

Ciobanu is a student at the Technical University of Iasi, according to 
the BitDefender statement, which quoted an investigator from the Iasi 
Center for Combat Against Organized Crime and Drug Enforcement. 

Mihai Radu, a spokesman for BitDefender, said Ciobanu has not yet been 
charged. Under recently passed cybercrime legislation, he faces a 
prison term of three to 15 years if convicted, Radu added. 

Police confiscated two of Ciobanu's computers. The machines will be 
analyzed in the presence of the defendant, his attorney and the local 
district attorney, officials said, as early as Thursday. 

Ciobanu was in police custody as of Wednesday night, Radu said. 

Last week, U.S. authorities arrested 18-year-old Jeffrey Lee Parson 
for allegedly creating and distributing the first variant of MSBlast. 

Ciobanu allegedly, like Parson, made it easy for investigators to find 
him. Radu said the virus code contained a reference to Ciobanu's 
nickname "Enbiei," a message written in Romanian that named one of 
Ciobanu's teachers, and a link to the university Web site. 



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.