Go Back to the B3 Home Page
Complaints, compliments, arguments? Email me.
[<< "Meet Jim O'Chaos..."] [Archive Index] [>>"I missed Conason on MSNBC last night..."]
08/22/2003 Archived Entry: "Sosick of Sobig... but it ain't over yet."
Sosick of Sobig... but it ain't over yet.
Welp, just when the flood of emails starts to slow down (if I see another email with the header 'That Movie,' I swear I'll gouge my own eyes out), it turns out that Sobig is about to show its big trick:
Windows e-mail worm Sobig.F, which is currently the most widespread worm in the world, has created massive e-mail outages globally since it was found on Tuesday the 18th of August – four days ago. The worm spreads itself via infected e-mail attachments in e-mails with a spoofed sender address. Total amount of infected e-mails seen in the Internet since this attack started is close to 100 million.However, the Sobig.F worm has a surprise attack in its sleeve. All the infected computers are entering a second phase today, on Friday the 22nd of August, 2003. These computers are using atom clocks to synchronize the activation to start exactly at the same time around the world: at 19:00:00 UTC (12:00 in San Francisco, 20:00 in London, 05:00 on Saturday in Sydney).
On this moment, the worm starts to connect to machines found from an encrypted list hidden in the virus body. The list contains the address of 20 computers located in USA, Canada and South Korea.
“These 20 machines seem to be typical home PCs, connected to the Internet with always-on DSL connections”, says Mikko Hypponen, Director of Anti-Virus Research at F-Secure. “Most likely the party behind Sobig.F has broken into these computers and they are now being misused to be part of this attack”.
The worm connects to one of these 20 servers and authenticates itself with a secret 8-byte code. The servers respond with a web address. Infected machines download a program from this address – and run it. At this moment it is completely unknown what this mystery program will do.
F-Secure has been able to break into this system and crack the encryption, but currently the web address sent by the servers doesn’t go anywhere. “The developers of the virus know that we could download the program beforehand, analyse it and come up with countermeasures”, says Hypponen. “So apparently their plan is to change the web address to point to the correct address or addresses just seconds before the deadline. By the time we get a copy of the file, the infected computers have already downloaded and run it”.
Right now, nobody knows what this program does. It could do damage, like deleting files or unleash network attacks. Earlier versions of Sobig have executed similar but simpler routines. With Sobig.E, the worm downloaded a program which removed the virus itself (to hide its tracks), and then started to steal users network and web passwords. After this the worm installed a hidden email proxy, which has been used by various spammers to send their bulk commercial emails through these machines without the owners of the computers knowing anything about it. Sobig.F might do something similar – but we won’t know until 19:00 UTC today.
People, do yourselves a favor - update your anti-virus programs, scan your machines, try to kill this thing if it shows up on your machine. Who knows what this little fucker will do when that .exe is triggered. Protect yourselves.
Update: Looks as though they tracked down the IP addresses for the machines to be used to trigger SoBig II, and they may have averted today's attack. Let's hope.
Replies: 11 people speak up
Here's the address for fixSobig.F. It gives instructions on how to check your system and isolate an infection.
f@mm.removal.tool.html">http://www.symantec.com/avcenter/venc/data/w32.sobig.f@mm.removal.tool.html
Posted by Thumb @ 08/22/2003 01:25 PM NY
Hmmm, I don't know why it displayed it that way. Let's try it as a link:
f@mm.removal.tool.html">Repair link
Posted by Thumb @ 08/22/2003 01:27 PM NY
RATS! But it's closer.
Posted by Thumb @ 08/22/2003 01:28 PM NY
The excerpted article mentions "always-on DSL connections." Presumably the worm attacks any broadband connection, including cable modem.
Does that mean my cheapo, dial-up is safe?
Posted by Metropolitan99 @ 08/22/2003 03:45 PM NY
why do viruses always have to do bad thigs to good people. its a shame they cant target them at the right people, or make them do nice things. like transfer more money into my bank account.
its really wierd, i think my computer is ok, i scanned it with nortons, which i update daily, but my wife had a bunch of emails bounced back to one of her accounts that she never sent, to people she doesnt know. if our computer is clean, how can that happen? could her email company be infected? or is this one of the viruses that fakes who it is from, and it just happened to pick her name? im confused, because my computer is clean
Posted by justin @ 08/22/2003 03:48 PM NY
Justin -
The email bounce backs that your wife had received are not from you, her or her work computer having a virus, in the case of sobig. Sobig forges the "From:" address of the sender. Some email admins leave the "notify sender" portion of their AV software running, and it sends a notification to the forged address. It's very easy for someone to *SUPERFICIALLY* pretend to be someone else with email -I do it all the time when I am testing things.
Hope this helps!!
-K
Posted by K @ 08/22/2003 03:54 PM NY
thanks, thats nice to know. i still want to know why no one makes viruses that do good things, im sure there are some white hat types who enjoy a little bit of light hearted mischeif. maybe a virus that causes conservative internet groups to send letters to the senate opposing bush. im getting tired of signing mike savages email addresses up for gay porn sites, why cant they make a virus that will do that for me?
Posted by justin @ 08/22/2003 05:01 PM NY
thanks, thats nice to know. i still want to know why no one makes viruses that do good things, im sure there are some white hat types who enjoy a little bit of light hearted mischeif. maybe a virus that causes conservative internet groups to send letters to the senate opposing bush. im getting tired of signing mike savages email addresses up for gay porn sites, why cant they make a virus that will do that for me?
Posted by justin @ 08/22/2003 05:01 PM NY
sorry, i could have sworn i only hit the button once, oh well
Posted by justin @ 08/22/2003 05:02 PM NY
Actually, there was a bit of a "white hat" virus, came out Monday. Some places called it Nachi, others Wachia or something to that effect. It was supposed to go and patch up that MS Blaster (RPC) vunerability. Unfortunately, it also went out to ping, sequentially, a whole biiiiiiiiig mess of IP addresses, which in turn flooded internet connections. Made a mess of NAT tables, too, and when you had a few infected machines hitting the same router as a gateway, you had memory allocation failures and chunk errors on the router. Fu-un.
-K
Posted by K @ 08/22/2003 09:53 PM NY
Sobig? So what!
Please pardon the partisan product propaganda. LL
Temporary Windows anti-virus patches at: http://www.symantec.com/avcenter/index.html
Permanent Windows anti-virus fix at: http://www.apple.com/
Microsoft Windows: Insecure by Design
By Rob Pegoraro
Sunday, August 24, 2003; Page F07
http://www.washingtonpost.com/wp-dyn/articles/A34978-2003Aug23.html
Between the Blaster worm and the Sobig virus, it's been a long two weeks for Windows users. But nobody with a Mac or a Linux PC has had to lose a moment of sleep over these outbreaks -- just like in earlier "malware" epidemics.
This is not a coincidence.
The usual theory has been that Windows gets all the attacks because almost everybody uses it. But millions of people do use Mac OS X and Linux, a sufficiently big market for plenty of legitimate software developers -- so why do the authors of viruses and worms rarely take aim at either system?
Even if that changed, Windows would still be an easier target. In its default setup, Windows XP on the Internet amounts to a car parked in a bad part of town, with the doors unlocked, the key in the ignition and a Post-It note on the dashboard saying, "Please don't steal this."
See link above for full article
Posted by Larry LeSueur @ 08/24/2003 11:20 AM NY
