Another worm may be coming your way
By MIKE BERMAN
Scripps Howard News Service
August 27, 2003

In the past month we've had to battle the dreaded Blaster Worm, Sobig.E and Sobig.F and, if the computer nerds that track such things are correct, we'll be faced with another Sobig worm in mid-September.

These attacks have become annoying at best, causing our computers to suffer through continuous reboots or clogging our mailboxes with messages from folks we never knew or forgot we knew.

And what sets them off? The hard headedness of computer users who, even though they've been warned not to open e-mail or attachments from people they don't know, do so anyway, releasing the scourge so it can infect thousands of inadequately protected computer systems.

According to the folks at Symantec Security Response, the Sobig.F worm uses a technique known as e-mail spoofing "by which the worm randomly selects an address it finds on an infected computer." The worm is activated if the unwary recipient of the e-mail opens the attachment, which then opens a "back door" giving hackers access to computer systems without detection.

This allows spammers to use the infected PCs to send messages anonymously, which includes offers for everything from herbal Viagra to access to porn sites.

Of course, to the delight of Linux and Macintosh devotees everywhere, this latest attack was aimed only at PCs running Microsoft Windows operating systems. In fact, according to published reports, America Online said that, of 31 million e-mails containing attachments, 13 million contained some sort of virus and 11.5 million carried the Sobig worm.

All of this hubbub would have been so easy to avoid if all of the infected systems had adequate virus protection software installed, whether it be from Symantec, Network Associates or Aladdin Systems, to name a few.

In fact, just by keeping my copy of Norton Anti-Virus current, I was able to escape the threat, as virus-laden messages were either quarantined or zapped from my system. Poof!

Apparently the threat from Sobig.F is set to "expire" on Sept. 10, but another worm could be released the next day. Symantec's experts say that the "deactivation date applies only to the mass-mailing, network propagation, and e-mail collection routines. This means that a Sobig.F-infected computer will still attempt to download updates from the respective list of master servers ... even after the infection deactivation date."

The so-called "target IP addresses" - which were apparently 20 servers that would have been used to download additional software that could be either spyware or spam - were either off-line or not responding when the virus-infested computers tried to contact them. In fact, some security experts believe that one of these servers was deliberately taken down by the creator of Sobig, to make it look like the plan had failed.

So, expect at least another tumultuous month, as fears over another strain of this fast-spreading scourge take hold in September.

Meanwhile, I'm adapting a new credo: Sobig? So what!

Feedback Form