The 鈥淕oner鈥� computer worm contained tell-tale clues that helped lead police to its suspected authors, according to independent experts who helped with an international investigation.
Four Israeli college students were arrested on 7 December on suspicion of creating the worm after being traced through an Internet Relay Chat (IRC) channel. They are reported to have confessed to creating the worm.
The worm鈥檚 malicious activity provided some vital clues. Once an unwitting recipient had activated the worm, the program would attempt to de-activate anti-virus tools and delete files used by this software.
Advertisement
But the worm also attempted to connect a host computer to an IRC channel named 鈥淧entagonex鈥�. This was registered with a volunteer-run service provider called DALnet.
DALnet system administrators were alerted to the worm鈥檚 IRC functionality and helped identify its alleged creators. They found an Internet Protocol (IP) address and email address, logged during registration of the channel, that led to an internet service provider based in Israel, which enabled individuals to be identified.
Naming names
Anti-virus companies first issued alerts about Goner on 4 December. The worm spread via email to many thousands of computers worldwide over the next few days.
When activated, the worm displays a number of online pseudonyms, or handles, including 鈥渟uid鈥� 鈥淭hE_SKuLL鈥� and 鈥渱satan|鈥�. By monitoring the IRC channel, DALnet experts were able to track down further IP addresses.
鈥淔or computer crime authorities these can be vital clues,鈥� says Graham Cluley, a consultant with Sophos Anti-Virus, based in the UK. 鈥淗andles act as virtual fingerprints: if the author uses the nickname elsewhere links can be made and the authorities can investigate.鈥�
Zombie computers
DALnet administrators contacted the FBI as well as the US government鈥檚 Computer Emergency Response Team (CERT), who in turn informed Israeli investigators.
The worm was designed to automatically connect personal computers to the IRC channel so that they could be used to attack other, more prominent, targets.
Using a string of such 鈥渮ombie鈥� computers it is possible to overload other computer systems with false traffic. DALnet experts prevented the IRC channel from providing this functionality.