/ 27 January 2003

Hunt begins for the worm’s lair

Computer experts were investigating on Monday whether Hong Kong was the origin of the Sapphire worm, a computer bug that infected internet traffic worldwide.

The task won’t be easy, said officials at the government-funded Hong Kong Computer Emergency Response Team.

”Checking the origin of the worm is like finding which part of a river a drop of water comes from,” said S Leung, senior consultant with the computer team.

Leung said he does not necessarily think the worm is from Hong Kong despite several claims that it could be.

A US Internet expert said by telephone on Monday that irregularities appeared first in Hong Kong over the weekend, before moving elsewhere in the Pacific Rim and then on to the United States and Europe, but that does not mean the bug originated in Hong Kong.

It could have been timed for release during the Asian day and cropped up in Hong Kong when people began using their computers, said Tom Ohlsson, a vice president at Matrix NetSystems, which monitors Internet performance.

”It appears that performance on the Internet seemed to degenerate in your area before we noticed it,” Ohlsson said from Boulder, Colorado.

In the United States, The Washington Post reported that experts who studied the worm have found references in its coding to Honker, a Chinese hacker group believed to operate in mainland China and possibly in Hong Kong.

In the shadowy world of computer hacking, many claims can be made about bugs that can be difficult to verify, Leung said. Hong Kong police said in a statement on Monday that authorities here had received just five reports of problems from the worm, three from home computer users and two from corporate users. Investigators found that only one of those was actually a case of Sapphire, Leung said.

”The origin of the worm has yet to be confirmed,” the police statement said. – Sapa-AFP