Comment Articles

Child's play: the 'kiddies' behind Goner

Robert Vamosi AnchorDesk

Published: 13 Dec 2001 17:25 GMT

It appears that a childish rivalry between gangs of script kiddies (youths who cut-and-paste existing code to create malicious programs) led to the creation of last week's Goner worm, which has caused an estimated $5m in damage worldwide. Over the weekend, four Israeli youths age 15 to 16 were charged with authoring Goner. Under Israeli law, the alleged virus writers could each face sentences of between three to five years in prison.

The Israeli newspaper Ha'aretz Daily reports that the teenage authors of Goner, also known as Pentagone, were embroiled in a turf battle over Internet communications. One of Goner's payloads was to launch a denial-of-service attack against a rival gang of script kiddies over Internet Relay Chat (IRC). According to London-based site The Register, security experts at the DALnet IRC Network were able to trace the origin of the IRC channel #pentagonex back to the alleged teen creators.

On infected systems, Goner displays the typical script-kiddie greetz. One of the messages takes credit for the worm. It reads: "Pentagone coded by: suid, tested by: ThE_SkuLL and Isatanl." The other is a more traditional message: "Greetings to TraceWar, k9unit, stef16, ^Reno. Greetings also to nonick2 out there where ever you are." Displaying these messages, the worm spread across the world via email and the ICQ instant-messaging service, and deleted antivirus and firewall products from the infected systems. Goner's creators first gave themselves away by signing the worm with "greetz," simple messages from one group to another that are akin to spray-painting graffiti on city walls. For years, script kiddies have passively defaced commercial, government, and educational Web sites by substituting real Web pages with their own creations, or just their greetz. But Web sites are static, and defacements can be removed. Mobile code such as viruses and worms, however, tends to leave a more lasting impression.

Where virus writing was once seen as beneath the typical script kiddie, it's now apparently the cool thing to do. It made Goner's authors famous overnight. According to email screening service MessageLabs, Goner, at its peak, spread at the rate of 1 in every 30 emails. By comparison, the ILOVEYOU virus spread at the rate of 1 in every 28 emails.