Sober Code Cracked
Anti-virus firms have cracked an algorithm that was being used by the Sober worm to 'communicate' with its author.
The latest variant of the Sober worm caused havoc in November by duping users into executing it by masking as an e-mails from the FBI and CIA. Anti-virus companies were aware that the worm somehow 'knew' how to update itself via the Web. The worm's author programmed this functionality in order to control infected machines and, if required, change their behaviour.
On Thursday, Finnish anti-virus firm F-Secure revealed that it had cracked the algorithm used by the worm and could now calculate the exact URLs the worm would check on a particular day.
Mikko Hyppönen, chief research officer at F-Secure, explained that the virus author has not used a constant URL because authorities would easily be able to block it.
