Teenage Blaster worm suspect arrested [29th August 2003]

SAN FRANCISCO, Aug 29 (Reuters) - The FBI on Friday arrested a teenager who admitted making a copycat version of the Blaster Internet worm, even as experts combed over data in the hunt for the creator of the virus that devastated computers all over the world.

Jeffrey Lee Parson, 18, of Hopkins, Minnesota, a middle- class suburb west of Minneapolis, was arrested at home on one count of intentionally causing or attempting to cause damage to a computer. The arrest was the result of a joint investigation by the U.S. Secret Service and the Federal Bureau of Investigation.

Parson, described in the complaint as being 6-feet-4-inches (193-cm) tall and weighing 320 pounds (145 kg), sported a bleached blond mop of hair atop a closely-cropped fringe of brown hair. He wore a faded gray T-shirt with "Big Daddy" spelled out on the front, as well as cargo shorts and high-top sneakers.

At an initial hearing in St. Paul, Minnesota, U.S. Magistrate Judge Susan Nelson ordered Parson to be held under house arrest, though he can leave to attend high school and medical appointments.

Assistant U.S. Attorney Paul Luehr had argued for keeping Parson in jail, based on the "grievous and substantial" harm he had caused computer users.

The judge forbade him from using the Internet, surfing the World Wide Web or using instant messaging and instant relay chat. She also told Parson there had been threats made against him and she was concerned for his safety.

The suspect had previously admitted to law enforcement officials that he created a variant of the worm, according to a complaint filed in the Western District of Washington state. Parson's next court hearing will be Sept. 17 in Seattle.

MODIFIED BLASTER

Parson admitted modifying Blaster and creating a variant known by different names, including "W32/Lovesan.worm.b" and admitted he renamed the original code, dubbed "MSBlast.exe," "teekids.exe" after his online alias, the complaint said.

Parson also said he included a hidden Trojan horse program called "Lithium" in the worm, leaving a back door so he could reconnect remotely to the infected computers later.

FBI agents interviewed Parson when they searched his home on Aug. 19 and seized seven computers.

Blaster and its variants are self-replicating Internet worms that bore into machines using Microsoft Corp.'s (MSFT) Windows operating system through a security hole, harnessing them to launch concerted data attacks via the Internet on a Microsoft technical service Web site.

At least 7,000 "drone" computers tried to attack the Microsoft Web site, the complaint said. Microsoft thwarted the attacks by disconnecting the Web address from the Internet.

Blaster is believed to have infected hundreds of thousands of computers worldwide since it was released on Aug. 11.

The Internet addresses of infected computers were sent to the t33kid.com Web site. That site was traced back to Parson through Brian Davis, of Watauga, Texas, who leased Web hosting services to Parson, according to the complaint.

Davis told officials he knew "teekid" had performed Internet attacks and written various Internet worms, the complaint said.

The t33kid.com site is registered to Parson at an address in Hopkins, Minnesota. A phone number at that address is registered to R. Parson. A woman who answered the telephone there declined to comment.

The alias also appears to have been used to deface the Web site of the Minnesota Government Finance Owners Association, and there are messages from "Teekid" on message boards related to trojans -- small programs that hackers plant on computers. (Additional reporting by Eric Auchard in New York, Bernhard Warner in London, Deborah Charles in Washington, D.C., Daniel Sorid in San Francisco, and Andy Stern in Chicago)

© Reuters 2003. All rights reserved. Republication or redistribution of Reuters content, including by caching, framing or similar means, is expressly prohibited without the prior written consent of Reuters. Reuters and the Reuters sphere logo are registered trademarks and trademarks of the Reuters group of companies around the world.