Sobig.F Virus Traced to Korea
FBI Requests Investigation of Computer Worm
By Soh Ji-young
Staff Reporter

The National Police Agency (NPA) yesterday said it is investigating an Internet Protocol (IP) address here that may have had a role in the spread of the Sobig.F virus, a computer worm that has clogged e-mail inboxes worldwide since last week.

The Cyber Terror Response Center within the NPA said it started the investigation at the request of the U.S. Department of Justice and the FBI on Saturday.

Of 20 IP addresses suspected of being behind the circulation of Sobig.F, one was provided by domestic Internet service firm KT, the FBI told the cyber terror squad.

A 36-year-old office worker in Suwon, Kyonggi Province was found to be the user of the IP address but police said it is unclear whether he was directly involved as he seems to have no particular computer skills.

``Right now, it seems the manĄŻs IP address has been used by hackers, but we have to complete our investigation to be sure,ĄŻĄŻ Yang Kum-won, superintendent at the center, said. ``It is hard to determine whether the hackers operated within Korea or from overseas.ĄŻĄŻ

The results of the investigation will come out in two or three days after police finish examining the manĄŻs computer to see how it was involved in the spread of the virus.

Sobig.F is the sixth version of a virus that first appeared in January. More than 100,000 computers worldwide are estimated to have been infected by the virus, which spreads when unsuspecting users open file attachments in e-mails that contain headings such as ``Thank You!,ĄŻĄŻ ``Re: Details,ĄŻĄŻ and ``Your application.ĄŻĄŻ

Yang said the best precaution against the virus is to avoid opening file attachments of suspicious e-mails. ``As most domestic IP addresses are not well protected, they can easily be misused by hackers,ĄŻĄŻ the superintendent said.

Computer users, especially those using Windows XP, NT and 2000, should update their security patches on a regular basis to prepare for computer worm attacks, he said.


KoreaTimes