BBC NEWS Americas Africa Europe Middle East South Asia Asia Pacific
BBCi NEWS   SPORT   WEATHER   WORLD SERVICE   A-Z INDEX     

BBC News World Edition
 You are in: Technology  
News Front Page
Africa
Americas
Asia-Pacific
Europe
Middle East
South Asia
UK
Business
Entertainment
Science/Nature
Technology
Health
-------------
Talking Point
-------------
Country Profiles
In Depth
-------------
Programmes
-------------
BBC Sport
BBC Weather
SERVICES
-------------
EDITIONS
Friday, 7 February, 2003, 11:18 GMT
Web worm suspects bailed
IRC screenshot, BBC
The hackers' worm targeted net chat users

Two people suspected of creating a malicious web program have been released on police bail.

The pair had been arrested in a combined operation by the FBI and the UK's National Hi-Tech Crime Unit.

The raids in Darlington and Durham in the UK resulted in the seizure of two men accused of being members of a hacker group that calls itself THr34t-Krew.

The two have to return to Darlington police station on 3 April.

The THr34t-Krew group is thought to be behind the creation of the TK web worm that used internet chat channels to attack other computers.

The National Hi-Tech Crime Unit says the worm infected more than 18,000 computers.

Damage claim

The men arrested in the raids were a 19-year-old electrician in Darlington and a 21-year-old man in Durham.

The homes of the pair were searched and computers taken away for examination.

Hacking and virus writing are serious crimes. They are costing UK firms millions of pounds in lost business and downtime

Mick Deats, NHTCU
The worm created by the THr34t-Krew infected machines by exploiting a vulnerability in Microsoft's IIS server software.

The strangled spelling of the group's name is typical of so-called 'l33t' (elite) speak which swaps capital letters and numbers for other characters.

It was designed to provide a backdoor into any computer that had it installed.

Once a machine was infected it reported in regularly to the #tkworld chat channels on IRC.

IRC is used by many people as a way to chat and swap files online. IRC servers host chat channels typically dedicated to a particular group or topic. Conversations are carried on by typing text.

IRC is also used by many malicious computer vandals as an easy way to manage the army of computers that their creations infect.

The computers that THr34t-Krew controlled via IRC could be used to scan for other vulnerable machines or to launch any one of several types of attack by proxy.

In the net

The National Hi-Tech Crime Unit says that the TK worm caused up to 5.5m of disruption.

However, Graham Cluley, spokesman for anti-virus firm Sophos, said the worm was not well-known among computer security firms.

One of the few people to encounter the TK worm and the THr34t-Krew is consultant Seth Fogie who wrote of his encounter with the worm and the group on the Inform IT website.

Detective Superintendent, Mick Deats, deputy head of the NHTCU, said: "Hacking and virus writing are serious crimes. They are costing UK firms millions of pounds in lost business and downtime."

At the same time as the UK raids were being mounted, US law enforcement officers were raiding premises in Illinois that were also expected to net more malicious hackers.

 WATCH/LISTEN
 ON THIS STORY
The BBC's Judith Moritz
"It allows the hackers to see what is on your machine"

Click here to go to BBC Tees


See also:

21 Jan 03 | Wales
10 Dec 01 | Science/Nature
20 Sep 02 | Technology
13 Nov 02 | Americas
02 May 02 | Americas
Internet links:


The BBC is not responsible for the content of external internet sites

Links to more Technology stories are at the foot of the page.


 E-mail this story to a friend

Links to more Technology stories

© BBC ^^ Back to top

News Front Page | Africa | Americas | Asia-Pacific | Europe | Middle East |
South Asia | UK | Business | Entertainment | Science/Nature |
Technology | Health | Talking Point | Country Profiles | In Depth |
Programmes