Sasser worm

From Wikipedia, the free encyclopedia

The Sasser worm is a computer worm that affects computers running vulnerable versions of the Microsoft operating systems Windows XP and Windows 2000. Like other recent worms, Sasser spreads by exploiting the system through a vulnerable network port. Thus it is particularly potent in that it can spread without the help of the user, but it is also easily stopped by a properly configured firewall, or by downloading patches from Windows Update [1]. The specific hole Sasser exploits is documented by Microsoft in its MS04-011 bulletin, for which a patch had been released seventeen days earlier.

Sasser was first noticed and started spreading in the wild on April 30, 2004. This worm was named Sasser because it spreads by exploiting a buffer overflow in the component known as LSASS (Local Security Authority Subsystem Service) on the affected operating systems. The worm scans different ranges of IP addresses and connects to victims' computers primarily through TCP port 445. Microsoft's analysis of the worm indicates that it may also spread through port 139. Several variants called Sasser.B, Sasser.C, and Sasser.D appeared within days (with the original named Sasser.A). The LSASS vulnerability was patched by Microsoft in the April 2004 installment of its monthly security packages, prior to the release of the worm. Some technology specialists have speculated that the worm writers reverse-engineered the patch to discover the vulnerability, which would open millions of computers whose operating system have not been upgraded with the security update.

The effects of Sasser include the news agency Agence France-Presse (AFP) having all its satellite communications blocked for hours and the U.S. flight company Delta Air Lines having to cancel several trans-atlantic flights because its computer systems had been swamped by the worm. The Nordic insurance company If and their Finnish owners Sampo Bank came to a complete halt and had to close their 130 offices in Finland. The British Coastguard had its electronic mapping service disabled for a few hours, and Goldman Sachs, Deutsche Post, and the European Commission also all had issues with the virus. The X-ray department at Lund University Hospital had all their four layer X-ray machines disabled for several hours and had to redirect emergency X-rays to a nearby hospital.

1 Author
2 Side effects
3 Mitigation
4 See also
5 External links

[edit] Author

Sasser was at first believed to have been authored in Russia by the same person(s) who created another worm usually referred to as Lovsan, MSBlast or Blaster (due to the media), a connection indicated by code similarities between the two, but on May 7, 2004, 18-year old computer science student Sven Jaschan from Rotenburg, Lower Saxony was arrested for writing the worm. He immediately confessed to having written it when he was 17-years old and not only Sasser, but also Netsky.AC, a variant of the Netsky worm. Another variation of Sasser, Sasser.E, was found to be circulating shortly after the arrest. It was the only variation that attempted to remove other worms from the infected computer, much in the way Netsky did.

He was tried as a minor because the German courts determined that he created the virus before he was 18. The virus was released on his 18th birthday (April 29, 2004). Sven Jaschan was found guilty of computer sabotage and illegally altering data. On Friday, July 8, 2005, he received a 21 month suspended sentence. This was because he was tried as a minor.

[edit] Side effects

An indication of the worm's infection of a given PC is the existence of the file C:\WIN.LOG or C:\WIN2.LOG on the PCs hard disk, as well as seemingly random crashes of LSASS.EXE caused by faulty code used in the worm. The most common characteristic of the virus is that it randomly begins shutting down the system while the user has multiple programs running.

[edit] Mitigation

The shutdown sequence can be aborted by pressing start and using the (Run) command to enter: shutdown -a (This aborts the system shutdown and you may continue what you were doing). The shutdown.exe file is not available within Windows 2000 unless you extract it from the windows 2000 resource kit (it is available in XP). Another way to stop the virus from shutting down your computer is to change the time on your clock to a few days earlier. The virus will then show the shutdown time as however far back you put your clock.