Romanian Student Arrested for New Blaster Worm

net1

Police Wednesday said they arrested a 24-year-old Romanian man suspected of releasing a new version of the Blaster Internet worm, the second arrest of a copycat virus writer in the past week.

Meanwhile, the main culprit behind the original super-potent Blaster remains at large. The original worm, which also goes by the name "LovSan," surfaced last month, infecting hundreds of thousands of computers running Microsoft Windows.

Authorities identified the author of the latest worm strain as Dan Dumitru Ciobanu from the northern Romanian city of Iasi.

Police were unavailable for comment, but issued a statement late Wednesday through BitDefender -- the Romanian firm that helped police track down the suspect -- confirming the suspect's identity.

He is a 24-year-old student at the Technical University of Iasi, the statement said.

Mihai Radu, a spokesman for BitDefender, said Ciobanu has not yet been charged. Under recently passed cybercrime legislation, he faces a prison term of three to 15 years if convicted, Radu added.

Police confiscated two of Ciobanu's computers. The machines will be analyzed in the presence of the defendant, his attorney and the local district attorney, officials said, as early as Thursday.

He was in police custody as of Wednesday night, Radu said.

TAME VARIANT

Ciobanu is suspected of releasing a relatively tame variant of Blaster known as "Blaster.F." It first appeared Monday, but has not inflicted the widespread damage of the original Blaster worm.

Last week, U.S. authorities arrested 18-year-old Jeffrey Lee Parson for creating and distributing the Blaster "B" variant. "Ciobanu probably had the (Blaster) source code and modified it just like Parson," said Radu.

Like Parson, Ciobanu left behind big clues. The virus code contained a reference to Ciobanu's nickname "Enbiei," a message written in Romanian that named one of his teachers, and a link to the university Web site, which he intended to be the target of a denial of service attack, Radu said.

"Don't go to the Hydrotechnics faculty!!! You are wasting your time...Barsan, the retirement wants you!!!," read a translated version of the message supplied by Finnish anti-virus firm F-Secure.

"We knew all along he was from Romania," said Mikko Hypponen, manager of anti-virus research at F-Secure. He added Blaster.F was considered a mild threat. He was unaware of how many computers it infected.

"I don't know what upset this young man that caused him to write a virus that attacked his teacher," said Radu, adding that in identifying his teacher it made him easy to track down.

A major break in the Parson investigation came when security experts found a clue in the code of his virus referring to his online alias, "teekid."

Parson faces a maximum of 10 years in prison and a $250,000 fine. His next court hearing is set for Sept. 17 in Seattle.