Japanese break virus writing arrest duck

newsguy 0 Tallied Votes 262 Views Share

It has been a long time coming, but a virus writer has finally been arrested by the Japanese authorities. According to security specialists Sophos law enforcement agencies in Kyoto, Japan, have arrested three men who stand accused of plotting to infect users of a popular P2P file-sharing network with a Trojan. The Trojan itself displays images of popular anime characters on-screen, all very lovely and Japanese, while at the same time deleting MP3 and movie files from the system: not so nice, obviously.

The malware which was targeted at Winny P2P users has been identified as ‘Harada’ in various and Sophos say this is related to the similar Pirlames Trojan horse which it first reported intercepting in Japan last year. According to Japanese media reports, the three men have admitted their involvement in the crime. One of the men is said to have written the malware, while the other two are believed to have distributed the malicious code via Winny.

"It isn't illegal to write viruses in Japan, so the author of the Trojan horse has been arrested for breaching copyright because he used cartoon graphics without permission in his malware. Because this is the first arrest in Japan of a virus writer, it's likely to generate a lot of attention and there may be calls for cybercrime laws to be made tighter," said Graham Cluley, senior technology consultant for Sophos. "Malware is truly a global menace, impacting on every user of the internet, and it is good to see police around the world doing their bit to tackle the problem."

Isamu Kaneko, the author of the Winny file-sharing program, was fined by a Japanese court in December 2006 for assisting in copyright violation. The rights and wrongs of the case have been widely debated on the internet. A survey conducted in 2006 by Sophos reflected the serious concern that uncontrolled applications are causing system administrators:

  • 86.5 percent of respondents want to block P2P applications
  • 79 percent say that blocking is essential

"Businesses are increasingly looking to control users' access to P2P file-sharing software not just because they can eat up bandwidth or infringe copyright laws, but also because they can present a security risk to corporate data," continued Cluley. "This music and movie-munching Trojan horse is a timely reminder of the danger malware can pose to a company's network."

Dani AI

Generated

This thread captured an early public reaction to the arrests that raised hard questions about P2P, privacy and the limits of “punishment through code.” The legal landscape moved after those events: Japan later strengthened its statutes to make creation and distribution of destructive malware a specific offense, and subsequent prosecutions resulted in custodial sentences — illustrating that courts and legislatures eventually closed the gap the original reporting exposed. (gmanetwork.com)

Comments here that treat malware as “poetic justice” (see and ) miss the practical and legal risks. Vigilante code can damage innocent users, destroy irreplaceable data and expose the author and third parties to prosecution in many jurisdictions; private “hack‑backs” are widely discouraged and legally dangerous. ’s point about enforcement priorities is relevant — law enforcement choices are complex — but that doesn’t make ad‑hoc technical retaliation a safe option. (lawfaremedia.org)

Practical steps for network owners and admins (actionable, low‑risk): block or tightly control P2P at the perimeter using application control / DPI and egress whitelisting; enforce application whitelisting on endpoints; deploy EDR/antivirus and file‑integrity monitoring; and adopt an immutable, air‑gapped backup strategy (3‑2‑1 with an immutable/air‑gapped copy) so user data can be restored after destructive malware. Prepare and practise an incident‑response playbook (detect → isolate → preserve → analyze → remediate) following NIST guidance. For background on P2P risks and enterprise controls see SANS and NIST. (sans.org)

A minimal example of an egress‑whitelist approach (test in a lab first — whitelist-only policies can break services):

# allow essential outbound (example)
iptables -P OUTPUT DROP
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
# allow SSH for admins as needed, then log and deny the rest
iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

If an infection is suspected, isolate the host, preserve volatile data and logs, image disks (do not “play” with the machine), then follow a CSIRT playbook and forensic best practices. (csrc.nist.gov)

jwenting 1,905 duckman Team Colleague

Their first arrest, and it has to be someone who's trying to go after pirates...

peter_budo 2,532 Code tags enforcer Team Colleague Featured Poster

One one side as p2p mostly used for piraty media sharing so deleting these files from illegal downloaders is fair punishment, on other hand get it on your pc and ereasing your holiday clips, or your child first birthday would make you angry

jwenting 1,905 duckman Team Colleague

Never think I'm in favour of virusses, but when they hit the pirate 2 pirate networks there's some sort of poetic judgement in what happens next :)

Chaky 191 Posting Virtuoso

Too bad the police don't do jack regarding organized crime in Japan.
Instead, they focus on Sony-offenders.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.