Teenager wreaks global havoc from laptop

Published on Sunday 9 May 2004 01:00

IT LOOKS like any other suburban house in a quite district of an ordinary town in Germany, but it was last night at the epicentre of a massive investigation into an act of computer sabotage which has caused unprecedented global chaos.

This is the home of 18-year-old computer-mad schoolboy Sven Juergens, who has confessed to masterminding the devastating Sasser virus which, over the last week, has crippled millions of computers worldwide and caused mass panic among major institutions.

Juergens’ bedroom in his parents’ home in the northern German town of Waffensen, near Bremen, was described as looking as normal as the house itself with posters of Britney Spears and Beyonc on the wall.

But beneath these was Juergens’ laptop and a nondescript three-year-old computer terminal, where it is alleged he infected millions of computers around the globe with his unique, "fiendishly clever" virus.

It wasn’t until informants in Juergens’ local area contacted an anti-virus reward line run by Microsoft that the trail began to hot up. He then left what police described as "tell-tale electronic footsteps" which led to his door. The tip-off was made to Microsoft officials who then contacted the FBI in Washington, who immediately passed on what they knew to the German police.

Numerous computer discs, software and machines were seized from Juergens’ home.

Police said Juergens - known to have a special aptitude for maths and computer science - confessed to being the brains behind the virus, which he devised on a laptop given to him as a present two years ago by his mother, who, ironically, runs a computer advice firm.

Yesterday police said the teenager could face up to five years in jail on charges of computer sabotage, and confirmed that he has potentially laid both himself and his family open to massive damage claims from companies affected around the world.

His high-profile victims included British Airways, where flights were delayed on Tuesday after the virus hit check-in desks, investment bank Goldman Sachs, the German army and Germany’s Deutsche Post. Britain’s coastguard stations were also reduced to creating charts using pen and paper.

In Hong Kong, the virus hit IT systems at hospitals, while in Taiwan one-third of post office branches were affected.

Frank Federau, a spokesman for the Lower Saxony criminal office in Hanover, confirmed that the schoolboy, who has been released on bail, was "the programmer of the first version of the worm."

A police spokesman in Hanover added: "It looks as if the boy did it all on his own from his bedroom. He is extremely clever but there were tell-tale electronic footsteps which led intelligence agencies in America to alert us."

Since it emerged a week ago, Sasser has caused chaos for countless people using the Microsoft Windows 2000, NT and XP systems home computers, big businesses and government agencies throughout Europe, North America and Asia.

And, although anti-virus systems are expected to slow the spread of Sasser, it is still expected to infect millions more machines before it runs its course.

The Sasser virus had baffled experts because it was programmed simply to spread and knock out computer networks, not to take over machines and possibly steal the information stored on them.

Unlike most outbreaks, Sasser does not require users to activate it by clicking on an e-mail attachment. Once inside, the worm scans the internet for others to attack, causing some computers to continually crash and reboot.

Sasser is known as a network worm because it can automatically scan the internet for computers with the security flaw and send a copy of itself there.

Some believed that the culprit behind Sasser was merely "showing off". However the prevailing theory among experts was that Sasser was written by the same gang which was responsible for another devastating internet virus, the prevalent two-month-old Netsky virus. German police have said that the schoolboy does not have any links with organised crime. But spokesman Federau said police could not rule out the possibility that the suspect had ties to other worm programmers.

Security officials have pointed out that previous versions of Netsky were programmed to attack the website for an education server in the German state of Lower Saxony, where Juergens lived.

And pieces of code found in a recent version of Netsky made references to Sasser - forming the kind of clue which typically generates the biggest leads for authorities in hunting down culprits.

If Juergens is found to be part of the Netsky group officials believe his arrest could be the single biggest yet in bringing down a virus-writing gang.

Graham Cluley, senior technology consultant at Sophos Plc, a British-based security outfit, said: "The police may just have cracked the Netsky gang with this arrest. The whole ring may be broken wide open."

The teenager, who has been released on bail pending charges, is being investigated on suspicion of computer sabotage, which carries a maximum sentence of five years in prison.

Meanwhile legal action relating to Sasser could see the schoolboy and his family hit with a host of lawsuits which could bankrupt him and his family many times over.

German company law expert Otto-Enno Meiner was quoted saying: "Companies which lost time and money would be entitled to claim against the boy. He would need to have one hundred lifetimes to pay back the potential damages."

Meanwhile fears remain that with Sasser still at large, it could mutate by combining with the Netsky worm, to create a virus capable of wreaking destruction attacks that would put it on par with Blaster, the destructive worm that appeared last year and used infected computers to attack Microsoft Corp.’s MSFT.O website.

COMPUTERS' NEMESIS

COMPUTER worms such as Sasser have caused widespread problems for businesses and individuals in recent years.

Most viruses which have brought global chaos to computers do so via infected e-mail attachments, which are activated when users click on them.

In 1986, two brothers in Pakistan wrote what is thought to be the first PC virus to infect floppy disks and advertise their software company, Brain Computer Services in Lahore.

The first worm - a type of virus that can replicate itself - was released in 1988, by Cornell graduate student Robert Morris Jr. It spread within days to about 6,000 mainframes.

The Blaster worm and the Sobig e-mail virus disabled computers and snarled internet traffic across the globe in August and September 2003.