The Register have`s a interesting article on how the writers of the Goner worm/virus getted caught.
Messages coded into the Goner worm and monitoring of the IRC channel used to control its activities led to the arrest of four suspected Israeli virus writers over the weekend. |
One of the actions of Goner, which normally spreads as an infected attached-to-email message, is to install denial of service scripts for the mIRC Internet Relay Chat client. By monitoring the #pentagonex channel used to control the worm's activities, security experts working for DALnet IRC were able to track down its suspected creators.
Emma Monks, a volunteer with DALnet's exploits prevention team, said that after disabling the worm's denial of service abilities, which were believed to be targeted at a rival gang's ISP, DALnet's team set to track down the virus authors.
When activated the Goner worm displays a message, apparently from the author to his friends: "Pentagone - coded by: suid. tested by ThE_SKuLL and [satan]. greetings to: TraceWar, k9-unit, stef16, ^Reno. Greetings also to nonick2 out there where ever you are."
Read the full Story Here
Source: TheRegister
