New worm's got sass, but not much else
The security researchers at eEye Digital Security are not impressed with the Sasser worm.
The company, which found the flaws that were exploited by both the MSBlast worm and the Witty worm, on Saturday started analyzing the latest piece of attack code that takes advantage of a Microsoft Windows vulnerability discovered by its researchers. So far, eEye's analysts are surprised that the worm has spread so far.
"It's so poorly written," said Marc Maiffret, chief hacking officer for the Aliso Viejo, Calif., company. "This could still have a lot of impact, but it's written by someone that could barely get the code working."
The Sasser worm started spreading late Friday, and so far has not racked up the crowd of compromised computers that its predecessors have been able to claim. Such a limited spread could indicate that computer users are becoming more diligent about heeding warnings and patching their systems, but security researchers believe that the worm's poor programming has given network administrators a break.
"If this virus was better written, you would have seen more impact," said Alfred Huger, senior director of security firm Symantec's response center.
