Virus gang wars on the Web

Bernhard Warner

LONDON: A new virus outbreak emerged that packs a baffling message: a photograph of accused German virus author Sven Jaschan that security officials believe to be a geeky taunt from a rival gang of computer programmers.

Last week, German authorities charged 18-year-old Jaschan with sabotage for allegedly creating the destructive Sasser computer worm and Netsky computer viruses, some of the most potent digital outbreaks to ever hit the Internet.

Following his arrest in May, the teenage computer wizard admitted to police he wrote the code for Sasser and more than two dozen Netsky viruses that wreaked havoc across the Internet during the first few months of 2004.

Now, it appears rival programmers are exulting in his downfall and using their favorite calling card -- a tenacious computer virus dubbed MyDoom -- to mock their vanquished foe.

"I think the MyDoom group wants to rub it in that they won, Jaschan lost," said Mikko Hypponen, manager of anti-virus research at Finnish security firm F-Secure.

In the past week, a volley of new MyDoom viruses have hit the Internet, including the most recent MyDoom.Y, which carries a file attachment with a mugshot of Jaschan.

The viruses are relatively benign and have done little more than communicate to the world that their authors are still free to program new outbreaks.

"The really bad guys are still out there," Hypponen said.

BAD BLOOD RUNS DEEP

The rivalry between Jaschan and the MyDoom gang became clear to anti-virus experts earlier in the year when Jaschan's Netsky virus was unleashed on the Net designed to hunt out and destroy MyDoom and another pesky virus, Bagel.

Bagel and MyDoom contagions had been programmed to take control of vulnerable PCs and turn them into spam machines that spit out streams of junk e-mail. Netsky, at least in its earliest forms, was designed to defuse them.

The real damage to computer users began when a programming war of sorts erupted with both sides devising new strains to eliminate the others' handiwork.

Rivalries between programming groups is nothing new. Security officials point to disputes between Indian and Pakistani hacking groups in 2002 and 2003. At one stage, a group calling themselves Indian Snakes unleashed a worm called Yaha that sought to knock out a series of Pakistani government Web sites.

Oddly, the tussle between Jaschan and the MyDoom group may have its roots in a noble cause: the eradication of outbreaks capable of turning PCs into spam engines.

"Jaschan probably thought of himself as a modern-day Robin Hood," Hypponen said.

Other anti-virus experts are less sympathetic, pointing to Jaschan's final creation -- the Sasser worm -- that is blamed for knocking out an estimated 1 million computer systems of home users and companies around the world.

Sasser victims range from the British Coastguard to the European Commission, Goldman Sachs and Australia's Westpac Bank. Some security firms called it the most destructive worm ever.

"Writing a virus to disable another virus is like fighting a war to win the peace. There's always going to be casualties," said Paul Wood, information security analyst with Britain's MessageLabs.