Suspected 'Blaster' Is Busted
A Minnesota teenager known online as "teekid" was arrested and placed on electronic monitoring Friday for allegedly unleashing a version of the "Blaster" computer worm that infected thousands of computers.
U.S. Magistrate Judge Susan Richard Nelson told Jeffrey Lee Parson not to access the Internet or any other network connection as a condition of his release. He did not enter a plea during his initial court appearance.
Parson, a physically imposing 18-year-old, admitted during an interview with the FBI and Secret Service agents that he had modified the original "Blaster" infection and created a version known by a variety of different names, including "Blaster.B.," court papers said. At least 7,000 computers were affected by Parson's worm, Assistant U.S. Attorney Paul Luehr said Friday.
Collectively, different versions of the virus-like worm, alternately called "LovSan" or "Blaster," snarled corporate networks worldwide, inundating more than 500,000 computers, according to Symantec Corp., a leading antivirus vendor. Experts consider it one of the worst outbreaks this year.
Parson is the first person arrested in connection with the attack.
His next hearing was scheduled for Sept. 17 in Seattle, where the case was being investigated.
He faces one charge of knowingly causing more than $5,000 in damage with an Internet worm. If convicted, he could face up to 10 years in prison and a fine of up to $250,000.
In court, the high school senior wore a T-shirt that read "Big Daddy" on the front and "Big and Bad" with a grizzly bear on the back. He sported a metal stud under his lip and his hair was dyed blond on top and shaved close around the sides and back.
His mother, seated in the back row of the courtroom, sighed heavily and wiped tears from her face before the hearing. Neither she nor Parson's father would comment afterward.
Parson left the courtroom escorted by federal marshals after Nelson said threats had been made against him. He is allowed to leave his home only for doctor visits and school.
Residents of the neighborhood in Hopkins, Minn. where Parsons lives described him as a loner who drives too fast, neighbors said.
Bill McKittrick called 18-year-old Jeffrey Lee Parson "a computer genius," but not a criminal.
"He's smart on the computer, but I cannot believe he was doing any hacking," McKittrick said.
Another neighbor, Curtis Mackey, said the 6-foot-4, 320-pound Parson has few friends and drives too fast in their neighborhood.
"He's just got one kid he hangs with typically," he said. "He speeds up our street and it really ticks me off."
Luehr told the judge the Blaster variants caused $5 million to $10 million worth of damage to Microsoft alone.
FBI and Secret Service agents searched Parson's home in the Minneapolis suburb of Hopkins on Aug. 19 and seized seven computers, which are still being analyzed. One remaining computer will also be removed.
Parson told the FBI he built into his version a method for reconnecting to victim computers later. Investigators said the worm allowed him to access individual computers and people's personal communications and finances. It wasn't immediately clear how he might have used that information.
Parson apparently took few steps to disguise his identity. As a byproduct of each infection, every victim's computer sent signals back to the "t33kid.com" Web site that Parson had registered in his own name, listing his home address. The computer bug also included an infecting file called "teekids.exe" that experts quickly associated with Parson's Web site: Hackers routinely substitute "3" for the letter "e" in their online aliases.
CBS Tech analyst Larry Magid notes the FBI would not speculate about Parson's motives but there is a line inside Parson's code that may give a clue: "billy gates why do you make this possible? Stop making money and fix your software." It's not uncommon for hackers and virus writers to claim that their purpose is to expose security weaknesses in other people's software.
The FBI has given Microsoft some of the credit for helping with the investigation that helped nab Parson but it's important to remember that Microsoft is also somewhat to blame for security holes in its software, says Magid.
Microsoft Chairman, Bill Gates, in a speech at the Detroit Economic Club agreed that it's Microsoft's responsibility to make computing "trustworthy" and he pointed out that the company did post patches, (fixes) to Windows that would have prevented computers from being infected. Trouble is, many people didn't apply that patch. And some do blame Microsoft making it just a bit too easy for those malicious programs to worm their way into our computers, says Magid.
By midday Friday, hours after Parson's arrest, professional virus-hunters across the Internet were slapping their foreheads in frustration that nobody figured out the clues earlier.
"It's kind of embarrassingly simple," said Nick Fitzgerald of New Zealand, a widely recognized expert and contributing editor to the Virus Bulletin newsletter. "I guess we should praise the Lord for stupid people, right?"
Parson's Web site, which was operated from computers physically in San Diego, appeared Friday not to have any content on it but previously contained software code for at least one virus and a listing of the most-damaging viruses circulating on the Internet.
Further details were expected to be disclosed Friday by the FBI and U.S. attorney's office in Seattle. The case was being handled from Seattle because the infection affected software sold by Microsoft Corp., based in nearby Redmond.