Israeli Teenagers Charged Over Goner Virus

According to reports in an Israeli newspaper, five teenagers have been charged in connection with the W32/Goner-A virus, which spread worldwide late last year.

The Ha’aretz newspaper reports that the five were charged at Haifa District Court with wilfully causing damage to computers belonging to companies and private individuals around the world, including the American space agency NASA, by deliberately writing and spreading a computer virus across the Internet.

One of the minors has been charged with writing the Goner virus (which was nicknamed ‘Pentagone’), whilst the others have been charged with disseminating it. The virus infected thousands around the world. The indictment also claims that one of the group had previously written a virus targeting users of internet chat rooms – but this failed to cause the intended damage.

W32/Goner-A spread via email, arriving with the subject line ‘Hi’ and carrying an infected attachment called GONE.SCR, posing as a screensaver. Once activated, the worm spread to all contacts in the user’s Outlook address book, and via internet chat. The screensaver displayed a message, apparently from the author to his friends:

“pentagone coded by: suid tested by ThE_SKuLL and |satan| greetings to: TraceWar, k9-unit, stef16, ^Reno. greetings also to nonick2 out there where ever you are.”

“It could be that displaying this message was the key to their capture,” said Graham Cluley, senior technology consultant for Sophos Anti-Virus. “Virus authors often use ‘handles’ or nicknames to hide their true identity. However, these can be valuable clues for computer crime investigators, acting like virtual fingerprints.”

“It’s good to see criminal justice authorities finally clamping down on virus writers,” continued Cluley. “Hopefully handing out tougher sentences will make writers think twice about creating the next virus.”

The suspects could face between three and five years in jail if convicted, said Meir Zohar, head of the police computer crime squad.

A detailed analysis of W32/Goner-A (including graphics) is available at http://www.sophos.com/virusinfo/analyses/w32gonera.html

Don't miss