The Zotob worm trail leads to arrests in Turkey and Morocco

The Zotob virus that wormed its way through America’s corporate and government networks, resulted in the FBI chasing an electronic trail that has lead to two youngsters faraway in the Middle East and North Africa. It is believed that 18-year old Moroccan Farid Essebar wrote the Zotob viral program in return for a payment offered by the 21-year old Turk Atilla Ekici, after meeting him over the Internet. Yesterday both were arrested and now await prosecution in their respective countries.

FBI's assistant director, Louis M. Riegel, said that like in any classic cyber crime Essebar and Ekici may have never met "but they certainly knew each other via the Internet". However, Riegel is unable to say how much Essebar was paid for the damaging Zotob worm and variants that targeted computers using the Windows operating systems, especially the Windows 2000 version in mid-August this year. The affected networks included that of big news and media firms such as the Associated Press, ABC, and The New York Times, besides manufacturers like Caterpillar Inc and numerous government agencies across the US.

While neither Microsoft nor the FBI are making public any estimate of the damage unleashed by the worm, experts surmise it could not be substantial as most of the affected firms managed to quickly make software fixes. The Zotob worm and its variants, that uniquely attacked computers without opening any program to give users an inkling of its presence, skulked around shortly after Microsoft’s release of a “critical” patch for a security flaw. The FBI also suspects the duo for unleashing the earlier worms named Rbot and Mytob. While Zotob affected over a 100 U.S. companies, targeting the Windows 2000 operating system’s plug and play feature, it did not cause as much damage as SQL Slammer and MyDoom worms.

In several cases of cyber crime investigated by FBI so far, the speed at which investigations proceeded to nab the culprits in the Zytob worm case was uncanny. Louis Reigel said of the advantage of working closely with Microsoft Corp., besides Moroccan and Turkish authorities, "Had we not had those entities involved in this investigation, I suspect it would still be ongoing today". While Microsoft investigators started analyzing the Mytob worm’s trail in March, the release of Zytob helped speed up and serve as evidence to get to the perpetrators quickly. Had the duo gone without detection there was all likelihood that the backdoor Trojans they had planted in the computers affected by the worms could have been used to provide remote access to the computers at a later date.

Meanwhile the FBI is also trying to ascertain the duo's involvement in cyber frauds and identity thefts. From the looks of it, the relatively less damaging Zytob worm may only be the tip of the ice-berg, as new angles emerge about the cyber-crimes committed by the duo.

More Internet News click here