Subject: [NEXTEL-1] "Blaster" Internet virus writer arrested

From: [email-masked]
Date: Sat, 30 Aug 2003 13:50:47 -0400

Authorities arrest 
Minnesota teen in Internet attack

By Ted Bridis
 The Associated Press 

Aug 29 2003

U.S. cyber investigators arrested a Minnesota teenager Friday who the FBI said has
admitted unleashing one version of a damaging virus-like infection weeks ago on
the Internet. 

A court official identified the teenager as Jeffrey Lee Parson, 18, of Hopkins,
Minn., known online as "teekid." A U.S. official in Washington also confirmed an
arrest was made early Friday. 

Court papers said FBI and Secret Service agents searched Parson's home on Aug. 19
and seized seven computers, which are still being analyzed. In an interview with
FBI Special Agent Eric Smithmier, Parson admitted modifying the original "Blaster"
infection and creating a version known by a variety of different names, including
"Blaster.B.," court papers said. 

FBI Director Robert Mueller hinted earlier this week that an arrest was imminent,
when he cited the damage from the recent Blaster and "SoBig" infections. 

"We employ the latest technology and code analysis to direct us to potential
sources, and I am confident that we will find the culprits," Mueller said Tuesday. 

Parson -- a physically imposing presence at 6-foot-4 and 320 pounds -- told the
FBI he built into his version a method for reconnecting to victim computers later,
according to court papers. Infected computers automatically registered themselves
with Parson's Web site so he could keep track of them. 

Parson operated the t33kid.com Web site, according to Internet registration
records. 

The Web site, which was operated from computers physically in San Diego, appeared
Friday not to have any content on it but previously contained software code for at
least one virus and a listing of the most-damaging viruses circulating on the
Internet. 

The FBI said in court documents that at least 7,000 computers were infected by
Parson's software. 

Further details were expected to be disclosed Friday by the FBI and U.S.
attorney's office in Seattle, which has been leading the investigation. The case
was being handled from Seattle because the infection affected software sold by
Microsoft Corp., based in nearby Redmond. 

Prosecutors said Microsoft suffered financial losses that "significantly" exceeded
$5,000, the statutory threshold in most hacker cases. 

Collectively, different versions of the virus-like worm, alternately called
"LovSan" or "Blaster," snarled corporate networks worldwide, forcing Maryland's
motor vehicle agency to close for one day. The infection inundated networks and
frustrated home users. 

Symantec Corp., a leading antivirus vendor, said the worm and its variants
infected more than 500,000 computers worldwide. Experts consider it one of the
worst outbreaks this year. 

The "Blaster.B" version of the infection, which began spreading Aug. 13, was
remarkably similar to the original Blaster worm that first struck two days
earlier; experts said the author made few changes, renaming the infecting file
from "msblast" to an anatomical reference. 

All the Blaster virus variants took advantage of a flaw in Microsoft Corp.'s
flagship Windows software. Government and industry experts had anticipated such an
outbreak since July 16, when Microsoft acknowledged the software problem, which
affects Windows technology used to share data files across computer networks. 

The infection was quickly dubbed "LovSan" because of a love note left behind on
vulnerable computers: "I just want to say LOVE YOU SAN!" Researchers also
discovered another message hidden inside the infection that appeared to taunt
Microsoft Chairman Bill Gates: "billy gates why do you make this possible? Stop
making money and fix your software!" 

Infected computers were programmed to automatically launch an attack on a Web site
operated by Microsoft, which the software maker easily blunted. The site,
windowsupdate.com, is used to deliver repairing software patches to Microsoft
customers to prevent these types of infections. 

http://www.globetechnology.com/servlet/story/RTGAM.20030829.gtvirusnabaug29/BNStory/Technology/

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Buy Ink Cartridges or Refill Kits for Your HP, Epson, Canon or Lexmark
Printer at Myinks.com. Free s/h on orders $50 or more to the US & Canada. http://www.c1tracking.com/l.asp?cid=5511
http://us.click.yahoo.com/l.m7sD/LIdGAA/qnsNAA/61FxlB/TM
---------------------------------------------------------------------~->

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/