Two arrests made in Zotob worm attack
{{date|August 27, 2005}}

[[Turkey|Turkish]] and [[Morocco|Moroccan]] authorities arrested two suspects who are believed to be the creators of the {{w|Zotob}} worm that took down ''{{w|CNN’s}}'' computer network and crippled other computers in the [[United States|U.S.]] and worldwide earlier this month.
  
The [[Federal Bureau of Investigation|FBI]] traced an electronic trail that led to two men from the [[Middle East]] and North Africa. An 18-year old Moroccan, {{w|Farid Essebar}}, is believed to have written the worm in return for a payment from a 21-year old Turk Atilla Ekici. Both were arrested Friday and await prosecution in their respective countries.

It appears that Essebar and Ekici never met personally, and conducted the entire cyber crime through contact with each other over the internet. The online monikers for the two is believed to be "Diabl0" for Essebar and “Coder” for Ekici.

The speedy pace at which investigators made arrests is credited from working closely with the [[Microsoft|Microsoft Corp.]], and Moroccan and Turkish authorities, said the FBI assistant director Louis Reigel. "Had we not had those entities involved in this investigation, I suspect it would still be ongoing today."
 
Microsoft investigators began in March to analyze an e-mail variant called Mytob, which emerged in late February.  The two suspects are believed to have authored the predecessor to Mytob, known then as 'Rbot'. These worms could plant in infected computers a backdoor that could be used to gain remote access to the computer and their networks at a later date.

The release of the Zytob worm yielded more evidence of the perpetrators’ identities. The motive for the attacks appears to be financial gain and not terrorist related. The two men allegedly forwarded stolen financial information to a credit-card fraud ring, according to the Moroccan government.

The 5-year-old {{w|Windows 2000}} operating system is most vulnerable to attack. The worm uses a flaw in the Windows Plug and Play service; a flaw for which Microsoft has issued a patch. But an August 23 Microsoft [http://www.microsoft.com/technet/security/advisory/906574.mspx advisory] notes that some non-default configurations of Windows XP Service Pack 1 systems could also be at risk. XP SP2 users are not at risk.  
 
==Related news==
*{{Wikinews|title=CNN headquarters infected with computer worm, exaggerates global threat
|date=August 16, 2005}}

==Sources==
*{{source|url=http://www.earthtimes.org/articles/show/3898.html 
|title=The Zotob worm trail leads to arrests in Turkey and Morocco
|author=Roland Waite
|pub=EARTHtimes
|date=August 27 , 2005}}
*{{source|url=http://www.washingtonpost.com/wp-dyn/content/article/2005/08/26/AR2005082601201.html 
|title=Suspected Worm Creators Arrested
|author=Brian Krebs
|pub=The Washington Post
|date=August 27, 2005}}
*{{source|url=http://www.eweek.com/article2/0,1895,1851879,00.asp 
|title=Zotob Worm Could Squirm on Windows XP 
|author=Ryan Naraine
|pub=eWeek
|date=August 24, 2005}}

{{Publish}}{{PD-Article}}
{{archive}}
[[Category:Science and technology]]
[[Category:Internet]]
[[Category:Crime and law]]
[[Category:Turkey]]
[[Category:Morocco]]
[[Category:Africa]]
[[Category:United States]]
[[Category:Europe]]
[[Category:Asia]]
[[Category:North America]]
[[Category:Computing]]
[[Category:FBI]]
[[Category:Microsoft]]
Turkish and Moroccan authorities arrested two suspects who are believed to be the creators of the CNN’s computer network and crippled other computers in the U.S. and worldwide earlier this month.
  
The FBI traced an electronic trail that led to two men from the Middle East and North Africa. An 18-year old Moroccan, , is believed to have written the worm in return for a payment from a 21-year old Turk Atilla Ekici. Both were arrested Friday and await prosecution in their respective countries.

It appears that Essebar and Ekici never met personally, and conducted the entire cyber crime through contact with each other over the internet. The online monikers for the two is believed to be "Diabl0" for Essebar and “Coder” for Ekici.

The speedy pace at which investigators made arrests is credited from working closely with the Microsoft Corp., and Moroccan and Turkish authorities, said the FBI assistant director Louis Reigel. "Had we not had those entities involved in this investigation, I suspect it would still be ongoing today."
 
Microsoft investigators began in March to analyze an e-mail variant called Mytob, which emerged in late February.  The two suspects are believed to have authored the predecessor to Mytob, known then as 'Rbot'. These worms could plant in infected computers a backdoor that could be used to gain remote access to the computer and their networks at a later date.

The release of the Zytob worm yielded more evidence of the perpetrators’ identities. The motive for the attacks appears to be financial gain and not terrorist related. The two men allegedly forwarded stolen financial information to a credit-card fraud ring, according to the Moroccan government.

The 5-year-old  operating system is most vulnerable to attack. The worm uses a flaw in the Windows Plug and Play service; a flaw for which Microsoft has issued a patch. But an August 23 Microsoft  advisory notes that some non-default configurations of Windows XP Service Pack 1 systems could also be at risk. XP SP2 users are not at risk.
Science and technology Internet Crime and law Turkey Morocco Africa United States Europe Asia North America Computing FBI Microsoft