VeriSign iDefense Security Company has recently predicted that the next major attack by the Sober virus will occur on January 5, 2006. This date marks the 87th anniversary of the founding of the German Nazi Party.
Ken Dunham, a senior expert at VeriSign iDefense, stated that January 5, 2006, is the most frequently mentioned date in the recent variants of the Sober virus circulating online.
“We have conducted reverse engineering on several recent variants of the Sober virus and discovered the date January 5, 2006, embedded within them,” said expert Dunham.
“This programming method warns us that this is a predetermined time, and on this exact date, computers still infected with the Sober virus will automatically connect to certain servers to download the latest version of this malicious code.”
This is not a new programming method for viruses. The Sobig virus also employed this technique to create significant impacts in 2003 when a new variant of this virus spread vigorously on a specific date, while the old variant automatically ceased to function and disappeared.
Furthermore, this is not the first time the Sober virus has used this method to orchestrate attacks. On November 14, the Bavarian State Criminal Police (Bayerisches Landeskriminalamt) warned about an attack from the Sober virus set to occur the following day. The reality proved them correct. At that time, the Bavarian police did not disclose how they knew and accurately predicted that attack.
“We later speculated that the police might have infiltrated a Sober virus programming group and learned about it. However, it is possible they also discovered some date embedded within the old variants of the Sober virus.”
To date, there have been more than 30 different variants of the Sober virus. This is also the first virus to utilize two different languages—English and German—with the capability to self-propagate through email addresses on the victim’s computer.
The creator of this virus—suspected to be a German individual—appears to lack any financial motives. One variant of Sober caused no harm at all, merely aimed at spamming in support of the far-right in Germany. This particular variant carried a comprehensive message regarding the author’s political views and sent messages to a website supporting a neo-fascist regime in Germany.
The most recent variant of the Sober virus was released on the same day as a significant political event in Germany, November 22, the day Angela Merkel, Germany’s first female chancellor, took office.
These are all the factors that iDefense relied on to predict that January 5, 2006, will be the date when the Sober virus returns with a large-scale attack.
