Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Software

SoBig: Worst is Yet to Come 683

Posted by CmdrTaco from the get-your-worm-on dept.
bl8n8r writes "Experts say when vacationers get back to work Monday, Inboxes will unleash the worms worst attacks. Sunner said that most of the problems caused by SoBig involve the time and cost of cleaning the worm from computer systems. "
This discussion has been archived. No new comments can be posted.

SoBig: Worst is Yet to Come More

SoBig: Worst is Yet to Come

Comments Filter:

  • Finally. (Score:2, Funny)

    by Anonymous Coward
    They named a virus after my penis.

  • Cost Benefit Analysis (Score:5, Funny)

    by Transient0 ( 175617 ) on Thursday August 21, 2003 @02:40PM (#6757806) Homepage
    If the majority of the cost comes from cleaning the system, I would recommend (in my professional opinion) simply letting the systems remain infected.

    • Re:Cost Benefit Analysis (Score:5, Funny)

      by jmv ( 93421 ) on Thursday August 21, 2003 @02:43PM (#6757841) Homepage
      Great idea! Do you have a degree at the Enron Institute of Business? :)
    • Do you work for the government, by any chance? :)

    • Re:Cost Benefit Analysis (Score:5, Interesting)

      by stinkwinkerton ( 609110 ) on Thursday August 21, 2003 @02:47PM (#6757922)
      I'm not sure if this should be +5 funny. It is a real option for some users.

      I have known many people that actually know they have a virus on their computer and don't make it the first priority in using their systems... if it is usable by them, they don't care.

      Of course, this sort of person doesn't have the slightest understanding (or care) that their system is causing a variety of problems on other systems.

      They only seem to care if it is causing THEM some problem.

      I've long since given up trying to explain what is going on to these folks or the urgency of solving their own virus problem in a timely manner. I make sure that their system is as up-to-date as possible and make sure their virus protection software automatically updates as frequently as possible.

      And, recently, these are the folks that I have broken my long standing rule on, and configured "Windows to update automatically" and not wait for the user to OK it.

      • Re:Cost Benefit Analysis (Score:5, Interesting)

        by shepd ( 155729 ) <slashdot,org&gmail,com> on Thursday August 21, 2003 @03:04PM (#6758176) Homepage Journal
        >I've long since given up trying to explain what is going on to these folks or the urgency of solving their own virus problem in a timely manner.

        Try this one:

        "Some these viruses have been known to attmempt to destroy the computers of various military installations. The penalty in many countries for this is death. The penalty in YOUR country is a federal jail term. You may want to consider purchasing a $60 upgrade to your computer to help you avoid this problem in the future."

        • Re:Cost Benefit Analysis (Score:5, Funny)

          by EverDense ( 575518 ) on Thursday August 21, 2003 @03:37PM (#6758550) Homepage
          Try this one:

          "Some these viruses have been known to attmempt to destroy the computers of various military installations. The penalty in many countries for this is death. The penalty in YOUR country is a federal jail term. You may want to consider purchasing a $60 upgrade to your computer to help you avoid this problem in the future."

          Thank God!

          They've FINALLY started jailing people for being too stupid to own computers! ;-)

        • Re:Cost Benefit Analysis (Score:5, Funny)

          by paranoic ( 126081 ) on Thursday August 21, 2003 @03:54PM (#6758787)
          This is slashdot, shouldn't

          You may want to consider purchasing a $60 upgrade to your computer to help you avoid this problem in the future.


          read

          You may want to consider installing Linux on your computer to help you avoid this problem in the future.


        • Re:Cost Benefit Analysis (Score:5, Funny)

          by GoRK ( 10018 ) on Thursday August 21, 2003 @03:55PM (#6758801) Homepage Journal
          If I get someone who doesnt care, I just tell them the virus e-mails, at random, their web history and any files/photos/etc. it can find on the hard drive to any address it can find in the e-mail application.

          This works suprisingly well. Even though it's a lie, they are spooked about it. If they pester me, I'll tell them the truth but add that viruses in the past have done this and probably will do it again.

        • Re:Cost Benefit Analysis (Score:5, Funny)

          by Natty P ( 636815 ) on Thursday August 21, 2003 @03:55PM (#6758806)
          This should be Microsoft's next big marketing campaign!

          I'm sure it'll be more successful than .NET or that stupid WinXP commercial with the Madonna song and people flying around....

          "Where do you want to go today?!?! Federal prison?!?! If not, upgrade now!"

      • Re:Cost Benefit Analysis (Score:4, Funny)

        by whoever57 ( 658626 ) on Thursday August 21, 2003 @03:24PM (#6758416) Journal
        I have known many people that actually know they have a virus on their computer and don't make it the first priority in using their systems... if it is usable by them, they don't care.

        Could it be that they are planning to use the "virus downloaded the pr0n/mp3/..." defense should they ever be challenged about exactly what is on their computer?
      • I think the users who aren't paying attention to viruses make it that much harder for those users who do. These users make it possible to leverage the idea of giving away remote root access, effectively. What's to stop Microsoft from bundling a program with this feature with, say, behind/within a whole layer of digital rights management? DRM coming to reality makes it hard for non-Microsoft computer users then.

        So basically, MS gets control because users let it be so. Or am I way off on this?

    • Re:Cost Benefit Analysis (Score:5, Funny)

      by BWJones ( 18351 ) on Thursday August 21, 2003 @02:48PM (#6757930) Homepage Journal
      If the majority of the cost comes from cleaning the system, I would recommend (in my professional opinion) simply letting the systems remain infected.

      That's my plan. Just pull the plug on the Wintel stuff, toss em in the trash and replace them with Macs running OS X. :-)

      • Re:Cost Benefit Analysis (Score:5, Insightful)

        by BWJones ( 18351 ) on Thursday August 21, 2003 @02:53PM (#6758019) Homepage Journal
        That's my plan. Just pull the plug on the Wintel stuff, toss em in the trash and replace them with Macs running OS X. :-)

        I was being a little glib there, but it should be pointed out that the labor costs associated with managing all of this crap are pretty serious. Overtime charges, benefits and basic salary for an $74k employee for the last three days are running what? At least $1000k per employee. With eight IT dudes running around fixing all of the Wintel systems that's eight grand worth of new Macs that will have much better uptime and lower costs just from the last three days alone. Now, consider how many of these little virus and worm issues there have been in the past year.

        • Re:Cost Benefit Analysis (Score:5, Interesting)

          by Electrum ( 94638 ) <david@acz.org> on Thursday August 21, 2003 @03:20PM (#6758367) Homepage
          With eight IT dudes running around fixing all of the Wintel systems

          No "IT dudes" worth anything will be "running around fixing" things. If they had done their job properly in the first place, they wouldn't have to fix anything at all.

          • Re:Cost Benefit Analysis (Score:5, Insightful)

            by Frymaster ( 171343 ) on Thursday August 21, 2003 @03:41PM (#6758610) Homepage Journal
            f they had done their job properly in the first place, they wouldn't have to fix anything at all.

            does "doing their job properly" include preventing end-users from touching the keyboards? let's face it, the network that remains unused always stays in a stable, functioning state. put users on it and then things go wrong.

          • Re:Cost Benefit Analysis (Score:5, Insightful)

            by jonbrewer ( 11894 ) * on Thursday August 21, 2003 @04:21PM (#6759066) Homepage
            No "IT dudes" worth anything will be "running around fixing" things. If they had done their job properly in the first place, they wouldn't have to fix anything at all.

            I don't know what world you're living in, but it isn't the one I'm posting from. You can be a brilliant IT guy who does his job incredibly well, but if a corporation's policies (i.e. waiting until a patch has been regression tested with bespoke applications) have you running around fixing things, it's the CIO that's not "worth anything" and not the "IT dudes".

            And, of course, in the case where you're paid $74k/year (as the parent post mentioned), You Do What You're Told, or you quickly lose said salary.

        • Mac Users = Naive (Score:3, Insightful)

          by Anonymous Coward

          was being a little glib there, but it should be pointed out that the labor costs associated with managing all of this crap are pretty serious. Overtime charges, benefits and basic salary for an $74k employee for the last three days are running what? At least $1000k per employee. With eight IT dudes running around fixing all of the Wintel systems that's eight grand worth of new Macs that will have much better uptime and lower costs just from the last three days alone. Now, consider how many of these little

        • Re:Cost Benefit Analysis (Score:5, Funny)

          by mekkab ( 133181 ) on Thursday August 21, 2003 @04:25PM (#6759113) Homepage Journal
          ... that's eight grand worth of new Macs ...

          Yeah, and just think what both of those machines could do!

  • Worms worms and more worms (Score:5, Funny)

    by Lane.exe ( 672783 ) on Thursday August 21, 2003 @02:41PM (#6757822) Homepage
    Is 2003 the year of the Worm on the Chinese calendar? I'm confused!

  • No Kidding.... (Score:2, Redundant)

    by Cyclopedian ( 163375 )
    The past 3 days, I've had over 300 Sobig.F messages in my Junk folder (filtered by Mozilla Mail). Other co-workers with Eudora are less fortunate, since they spend better than an hour clearing out all those emails.

    -Cyc

  • Is not a problem... (Score:2, Funny)

    by Anonymous Coward
    It's an open source business model!

    1: Write free software.
    2: ?
    3: Get inbox filled with worms and viruses.
    4: Profit!

  • Skeptical (Score:3, Insightful)

    by Urthpaw ( 234210 ) on Thursday August 21, 2003 @02:43PM (#6757843) Homepage
    This article claims that time wasted will cost businesses tens on millions of dollars. It seems to me that no matter how much spam/virus flooding/crap you get in your inbox, you only do so much work everyday. If you take five extra minutes to clean out your inbox, that's five minutes less of surfing slashdot or screwing around. Deadlines don't change for viruses-- people still have to work as much real work as ever.

    • Re:Skeptical (Score:5, Interesting)

      by NexusTw1n ( 580394 ) on Thursday August 21, 2003 @03:20PM (#6758379) Journal
      It depends on how clueless your email admins are.

      Rather than blocking .scr/Pif/.exe and deleting any email with such an attachment, they are letting the group virus scanner on our exchange servers deal with the entire load.

      So the virus scanner is scanning and moving to the infected folder literally thousands of these an hour. After it moves the infected message, it generates a nice email letting you know an email that was sent to you is currently in quarantine. Therefore this is generating even more work for the mail servers. Turning off this feature for a couple of days is apparently too much trouble.

      The servers exchange is running on are therefore hanging every few minutes with all the disk and processor activity. Everyone gets a message every few minutes about "please wait, connecting to server" until you get fed up and close outlook down for the day.

      This is the first virus I've ever seen to disrupt my work like this. But this is 100% the fault of our email admins who can't be bothered to write a couple of simple mail rules.

      At the basic internet security zone Outlook can't even open .scr and .exe attachments, so why they don't delete this crap before it hits the servers I don't know.

  • Microsoft has serious problems (Score:4, Insightful)

    by Anonymous Coward on Thursday August 21, 2003 @02:43PM (#6757852)
    2 worms (DCOM and Welchia) and a virus variant in less than two weeks.

    This should tell investors that they are wasting their money.

    This should tell companies that they are wasting their money.

    Someone, somewhere, will hopefully get a clue.

  • school's in! (Score:3, Insightful)

    by theflea ( 585612 ) on Thursday August 21, 2003 @02:45PM (#6757877)
    Wait till infected laptops & workstations start moving back into the dorms!

    • Re:school's in! (Score:5, Funny)

      by Jacer ( 574383 ) on Thursday August 21, 2003 @02:52PM (#6758016) Homepage
      This isn't funny, I work on campus tech support. It's move in week, and the 30 of us on staff are working 60+ hours this week. 8,000 or so computers are coming back, of those, we expect about 5,600 to be unpatched, and we expect that of those 5,600, that only 1,400 or so will be able to follow our documentation. That leaves us with 4,200 machines to patch, and clean before Monday (and here I sit on Slashdot)

    • Re:school's in! (Score:3, Interesting)

      by Skweetis ( 46377 )
      Not funny. They've started coming back already, and our dorm subnets are crawling with msblast. I filtered port 135 and 444 ingress and egress at the building routers, but we still (no joke) have around 95% infection rate. I'm assuming the other 5% are CS students with Linux boxes and a few old Win98 systems.

      I'm just dreading Saturday when the majority of them show up, it's only 200 students now and the technicians can't keep up.

      • Re:school's in! (Score:5, Interesting)

        by Skweetis ( 46377 ) on Thursday August 21, 2003 @03:12PM (#6758274) Homepage
        Sorry to reply to my own post. The quarantine partition (I save out dropped messages for a while, just in case of a false positive or something) on the mailserver just hit 90%, and it's 100GB. It was somewhere around 5-10% this morning. Not a good day.

  • Procmail finally (Score:5, Informative)

    by unfortunateson ( 527551 ) on Thursday August 21, 2003 @02:45PM (#6757878) Journal
    Our computers aren't getting infected: between virus scan, ZoneAlarm, ancient e-mail client and knowing not to open the stupid attachments, we've not gotten infected.

    But >1000 100K e-mails per day to a single address were swamping our ability to do anything but download and delete.

    It took two days of querying tech support at my ISP before they'd admit that procmail would work, and a quickie recipe dumps all the infected files. Yay. I should have just done it without checking tech support, for all they helped.

    This was listed in a previous thread, but it's worth repeating:
    In a .procmailrc file, put :0 B
    * ^ *Content-Disposition: attachment;
    * filename=".*\.(pif|exe|scr)" /dev/null

    This deletes any message with a pif, exe or scr attachment.

    I'll get more sophisticated later once I learn more about procmail, but for now, this does the job, without having to worry about SHELL and PATH settings.

    • Sorry - shoulda previewed (Score:5, Informative)

      by unfortunateson ( 527551 ) on Thursday August 21, 2003 @02:48PM (#6757942) Journal
      The line wrapping on the recipe got mangled:
      :0 B
      * ^ *Content-Disposition: attachment;
      * filename=".*\.(pif|exe|scr)"
      /dev/null

      • Better filters (Score:3, Insightful)

        by unfortunateson ( 527551 )
        The points above are well taken: I intend on spiffing up my procmail recipes, but only as I am able to understand them.

        The enhancements suggested above are simple to implement, but are still crude band aids. While I doubt I would ever *really* want to receive an executable attachment (heck -- most places won't even let me SEND it, let alone receive it), I might want to

        (a) log it
        (b) bounce a 'hey stoopid' message back a legit senders to tell them that if they need to send me something, it shouldn't be an

  • Brain-dead auto-responders... (Score:5, Insightful)

    by ktakki ( 64573 ) on Thursday August 21, 2003 @02:45PM (#6757886) Homepage Journal
    So far this week, I've received only seven actual copies of W32/Sobig. However, the number of messages from mailer-daemons and mail server virus scanners has exceeded this by a factor of ten. Some of these rejection messages actually include a copy of the infected .PIF file.

    You would think that after Klez, the people who write these virus scanners and those who administer mail servers would realize that viruses sometimes spoof the "From:" field. I didn't send it, my Mac is not infected. You're just annoying me. Please go away.

    At best, this is collateral damage. At worst, these rejection messages are actually advertising the IP addresses of infected systems. Should a virus drop a back door payload, this would multiply the damage.

    k.
    • I like it when they include the pif in the return message, that way SpamAssassin files it away in my spam folder ... without the pif it's seen (rightfully) as a legitimate message.

    • Even worse... (Score:5, Insightful)

      by cperciva ( 102828 ) on Thursday August 21, 2003 @02:50PM (#6757973) Homepage
      You would think that after Klez, the people who write these virus scanners and those who administer mail servers would realize that viruses sometimes spoof the "From:" field.

      The situation is even worse than that: Most (all?) of the virus scanners sending me autoreplies correctly identified the virus as being Sobig -- which always uses spoofed source addresses.

      Sending autoreplies is sometimes useful, but these scanners should at very least have a table which tells them, for each virus, whether an autoreply should be sent (ie, a table which specifies if a virus uses spoofed source addresses).

      • Re:Even worse... (Score:3, Insightful)

        by jrumney ( 197329 )
        Sending autoreplies is sometimes useful, but these scanners should at very least have a table which tells them, for each virus, whether an autoreply should be sent (ie, a table which specifies if a virus uses spoofed source addresses).

        They don't even need a table. If the domain in the From address doesn't match any of the Received headers, just silently bin the thing. This would also handle heuristic scans which pick up new viruses that aren't in the scanner's database yet.

        But I don't think the virus c

    • You would think that after Klez, the people who write these virus scanners and those who administer mail servers would realize that viruses sometimes spoof the "From:" field.

      They don't care. The point of those messages is not some public service of informing people that their computers are infected, the point is to advertise the virus software.

      Actually, I take that back. I did get one scanner-autoreply today that included full headers, which let me track down the real culprit. But most of them are blate

    • You would think that after Klez, the people who write these virus scanners and those who administer mail servers would realize that

      viruses sometimes spoof the "From:" field. I didn't send it, my Mac is not infected. You're just annoying me. Please go away.

      Someone on LiveJournal speculated that these messages were actually advertising, for the anti-virus product, and should be treated as spam/unsolicited bulk email.

      I certainly agree that where the virus is known to spoof email addresses, it only makes

    • Re:Brain-dead auto-responders... (Score:5, Interesting)

      by billstewart ( 78916 ) on Thursday August 21, 2003 @07:03PM (#6760472) Journal
      This has been discussed a bit on the NANOG list. The ideal place to do the virus scanning would be during the SMTP transmission phase, rather than after the fact, so you could fail the transmission with a "553 go away you virus!" (and maybe a teergrube) instead of accepting the message and sending it to the forged From: line. (It looks like Sendmail milters give you hooks that could be used for this.) That way, if the virus runs its own SMTP, it gets messages that it ignores, and if the virus abuses it's victims' email programs, then they'll get the warning, but the From: won't.

      Alternatively, if you're going to do the virus check after the mail's been accepted, it sure would be nice if the virus-checker programs kept track of which viruses usually forge the sender and which don't, so it can skip the bouncegrams on the forged ones.

      Dave Farber's been mentioned in the press - his mailing list is very large and gets quoted a lot, so his address is in lots of people's mailboxes and gets forged a lot.

  • SoNice.ToSee.YouBack (Score:5, Funny)

    by blcamp ( 211756 ) on Thursday August 21, 2003 @02:46PM (#6757894) Homepage

    Don't complain.

    With SoMany.IT.Workers unemployed, SoBig.And.ItsVariants have a strangely positive side effect... ...job security.

  • Ouch! (Score:5, Interesting)

    by Shadow2097 ( 561710 ) <shadow2097@NOsPaM.gmail.com> on Thursday August 21, 2003 @02:46PM (#6757896)
    I've been dealing with literally thousands of emails coming into my office just today! The sales people are having a running contest to see who gets the most infected emails every hour. So far the winners are usually at ~150/hour.

    Normally we don't block emails with specific attachments at our post office because it takes too long to scan them. Our company of 100 people averages 14,000 legit email per day in and out, but with this outbreak as bad as it is (and not peaked yet!) the blocking is being instated tonight.

    While musing with a programmer here who just moved her daughter into college, we brought up an interesting thought: Hundreds of thousands of college kids are moving back into dorms with huge fat pipes and Outlook style email clients on computers that haven't been patched since April or May. Yikes!

    -Shadow

  • Vacation? (Score:5, Insightful)

    by *weasel ( 174362 ) on Thursday August 21, 2003 @02:49PM (#6757945)
    did a statistically significant portion of the workforce on vacation this week?

    that seems like a pretty weak overall premise for an expected resurgence.

    now if he said that he expects a steady stream of continued activity into early next month, due to all the people who take vacations throughout august - he might have a point.

    but to suggest that these 'vacationers' will unleash the same spam deluge monday that the rest of the unwashed have given us this past week, is a bit shaky.

    • Re:Vacation? (Score:3, Insightful)

      by RollingThunder ( 88952 )
      It's more that they will all open their mailboxes, and the previously dormant worms, simultaneously.

      The rest of the victims got it in bits and pieces - but the vacationers will unleash it in hourly bursts, as they come into the office.

      It'll only be a 10-20% boost, probably, but it'll be the biggest "all in one" boost.

    • Re:Vacation? (Score:3, Informative)

      by pigscanfly.ca ( 664381 ) *
      Yes they did . In ontario all non essential employees were told not to work (a number still did anyways ; go figure .) but non the less that is a huge number of employees . They are to be going back tommorow or monday to there regular works . And the federal goverment has huge pipes. I can only hope CIS has everyt thing locked down in advanced (not bloddy likely given there past performance . )

  • Slashdot Headline Concat Fun (Score:5, Funny)

    by JonTurner ( 178845 ) on Thursday August 21, 2003 @02:51PM (#6757983) Journal
    String the last two 'default' headlines together and whaddaya get?

    "New Longhorn Screenshots Leaked. Sobig. Worst Is Yet To Come."

    Yep. That just about says it all!

  • Another brick in the wall (Score:4, Insightful)

    by Gothmolly ( 148874 ) on Thursday August 21, 2003 @02:51PM (#6757984)
    This will be used by countless FUDmasters to con Joe Sixpack into things like:
    Accepting DRM/TPCA (otherwise unsigned code can run)
    Outlawing P2P
    Port filtering by ISPs
    Accepting blind AutoUpdates
    [US]Cheering on the Patriot Act[/US]
    'outlawing' Spam

    All in the name of 'security'. Insert obligatory Franklin quote: Those who would trade freedom for security will lose both, and deserve neither.

  • Read between the lines (Score:5, Insightful)

    by Rosco P. Coltrane ( 209368 ) on Thursday August 21, 2003 @02:51PM (#6757985)
    Sunner said that most of the problems caused by SoBig involve the time and cost of cleaning the worm from computer systems rather than the destruction of files or the opening of files to outsiders on the Internet, which can be problems with many computer viruses. Pescatore said that the cost of both technical support personnel and lost productivity by the computers' users can range from $500 to $1,000 per infected machine.

    And who is Marc Sunner? he's the CTO of MessageLabs. And what does MessageLabs do, you ask? see for yourself, from the main page at messagelabs.com:

    Email security today is a global issue which pervades whole organizations. Viruses, spam, pornographic material and other harmful or unwanted content represent a serious risk to your company. To combat these all too real threats, you need a total, proven and effective solution. Only MessageLabs can assure you of complete peace of mind from complete email security

    $500 to $1000 to clean up each infected machine? Right, whatever Marc. And it's obvious you don't have *any* interest in propagating that baloney too. (on second thought, if you hire me to clean your machines, I'll do 5% discount off that price).

    Another fine impartial article reposted by Slashdot. (By the way, the word you're looking for is "advertising") ...

  • The Slashdot story missed the interesting part... (Score:4, Insightful)

    by raehl ( 609729 ) * <raehl311&yahoo,com> on Thursday August 21, 2003 @02:52PM (#6758003) Homepage
    According to the article, since SoBig is much more successful against servers that do not have very good spam filters, the excessive SoBig traffic has prevented a lot of spam from being sent since it's eating up the bandwidth usually used by spammers. I'll have to admit that while I've had a LOT of SoBig spam, I have seen a decrease in other spam over the past few days.

    So is that the solution to spam? Maybe someone should write a worm that always has the same payload so it can be easily filtered. We never have to see the fake spam messages, the real spammers won't be able to send harder-to-filter messages, and the server owners of those loose servers will have an incentive to clean up their act with the worm eating up all of their bandwidth.

    Actually, extending this, maybe the way to fight open machines is to cause the open machines to send themselves excessive traffic, rendering them fairly useless until their operators fix them, but not negatively impacting the rest of the net.

  • $500 - $1000 (Score:3, Interesting)

    by scrotch ( 605605 ) on Thursday August 21, 2003 @02:52PM (#6758007)
    "Pescatore said that the cost of both technical support personnel and lost productivity by the computers' users can range from $500 to $1,000 per infected machine."

    How much does Windows cost?

    I know it's not really Microsoft's fault, since they had a patch and it's not their fault that people try to get email and stuff... But my users are rather annoyed. We all run Macs and either Mac OS X or FreeBSD servers so we're not vulnerable to this virus, but it's getting annoying just deleting the things. I can't imagine having to worry about getting infected on top of having to run Windows :)

    We got almost all of ours (150 to 5 addresses) from one local government office. I emailed them when we narrowed down what machine they were coming from and the flow has stopped. We didn't get a Thank You or anything, but maybe our little government office doesn't want to publicly admit to running insecure systems.

    I wonder if this $500 - $1000 per computer will be in the budget next year.

  • how can people fall for it... again (Score:5, Insightful)

    by kubla2000 ( 218039 ) on Thursday August 21, 2003 @02:53PM (#6758023) Homepage

    What I find discouraging is that the lemmings are falling for it despite this being The Week of Teh Worm.

    All the hopeful articles that have sited users claiming a new awareness of the risk of worms and virii seem to be pipe dreams.

    Dumb users are dumb users and the more infectuous and persistant the virus, the more networks are going to get hammered. Why oh why aren't all pif, scr, exe, com, and vbs attachments just blocked by the MDA. There is no good reason for allowing an end user the huge complexity of choosing whether or not to click on the latest attachment that's come to them from "the internet".

    If the lemmings are getting suckered this week... when every news medium is blathering on about viruses worming their way through nuclear reactors and motor vehicle registration offices, what hope is there for when the attention has settled?

  • Save procmail recipe (Score:4, Interesting)

    by Frodo Looijaard ( 12815 ) <frodo.frodo@looijaard@name> on Thursday August 21, 2003 @02:58PM (#6758095)
    The following should be a safe procmail recipe that only matches the virus, and nothing else:
    :0B:
    * ^TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAA$
    virus
    NB: This may not be rendered correctly; there should be no space in the string of A letters.

    The idea is courtesy from the macosx forum [macosxhints.com]

  • Where I work... (Score:5, Funny)

    by Znonymous Coward ( 615009 ) on Thursday August 21, 2003 @02:59PM (#6758112) Journal
    We haven't seen the virus. But then again, we're admins who know what we're doing...

    That's right, we run $CO UnixWare. And since there are only 2 or 3 other copies of $CO UnixWare being used in the world, we don't have to worry about worms and viruses.

  • coming spike in old-fashioned spam (Score:5, Informative)

    by jdunlevy ( 187745 ) on Thursday August 21, 2003 @03:00PM (#6758124) Homepage

    Looks like in addition to all the garbage we've been getting as a result of this virus propagating (the virus itself, attachment-free e-mailings by the virus, mis-directed automated notifications that "Your mail server sent us a virus", bounces to people whose addresses were spoofed by the virus, probably etc.), we can expect the infected computers to start being used as relays for the sending of "normal" spam [washingtonpost.com] -- with the corresponding spike in spam volume that would bring.

    According to this article [washingtonpost.com]:

    After examining two month's worth of junk e-mail earlier this year, New York City-based e-mail security company MessageLabs found that roughly 65 percent of spam originated from computers running proxy servers. More than 75 percent of those servers appeared to be installed on PCs that showed signs of being infected with Sobig and similar viruses.

    And Symantec [symantec.com]:

    Sobig.F can download arbitrary files to an infected computer and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers.

  • It's been abating in my corner of the internet (Score:5, Interesting)

    by zenyu ( 248067 ) on Thursday August 21, 2003 @03:03PM (#6758157)
    My ping times to www.mit.edu (my personal benchmark, as its on the next POP over and always up) are normally 25ms from home, they grew slowly from about 30 ms Monday morning to as high as 2600 ms yesterday with 2/3 packet drop. But today and especially in the last few hours it's fallen back to about 29 ms with 1/3 packet drop.

    There are still occasional storms, I guess as a new host gets infected nearby. But things are good compared to the last two days when I couldn't even listen to internet radio and plain old web browsing and e-mail were slow...

    BTW I haven't seen any of the e-mails myself do to our spam filter but I have gotten some returned e-mail the virus sent and a non-tech friend who got this one and another friend (who's very non-tech) got last weeks virus. I usually don't personally know the people who get these things, it has been a good week for discussing an OS upgrade to Linux with non-techies ;)

  • SoBig ... So Annoying (Score:4, Interesting)

    by Tsu Dho Nimh ( 663417 ) <abacaxi@NoSpAM.hotmail.com> on Thursday August 21, 2003 @03:04PM (#6758173)
    I dump any emails over 100K from one account right to /dev/null, which is enough to be dumping almost all viruses. Checking the logs, I've a hundred or so already.

    More annoying than the worm are all the "You are infected" warnings coming from clueless virus software. They make it through the spam filters.

  • PIF (Score:4, Interesting)

    by kenp2002 ( 545495 ) on Thursday August 21, 2003 @03:14PM (#6758306) Homepage Journal
    Honestly why would a user run a PIF attachment anyways? Would you use unknown medication? Why would you run unknown attachments? Simple solution: Server.CreateFilter(attachments, PIF)

    • Re:PIF (Score:3, Interesting)

      by Aidtopia ( 667351 )

      In an effort to be "friendly," newer versions of MS Windows default to hiding those oh-so-confusing file extensions from helpless uses, so they'll typically see "foo" rather than "foo.pif". Even nastier are those infection files named things like "photo.jpg.pif". Windows dutifully hides the .pif extension, and the user sees "photo.jpg". Doesn't look so dangerous that way.

  • How did you get SoBig? (Score:5, Funny)

    by og_sh0x ( 520297 ) on Thursday August 21, 2003 @03:24PM (#6758420) Homepage
    I had a user that called me because he actually got a copy of SoBig in his inbox. Usually our mail scanners are really good at filtering out even the newest viruses. What I didn't realize is that our AutoUpdate had failed that day, so it didn't have the SoBig update. So I asked him, "Well how the heck did you get SoBig?" and he answered, "From eating so many sandwiches."

  • hardware nat/firewall? (Score:3, Insightful)

    by whorfin ( 686885 ) on Thursday August 21, 2003 @03:26PM (#6758437)
    Would it be a good idea to have consumer pc boxes equipped with cheap builtin hardware firewall/nat?

    It could, of course, be turned off by corporate IT folk who don't want to have it, or by the intrepid home user who knows what they are doing, but for the unwashed masses, would just 'be there'.

    Anyway, would this provide any actual protection? And could it pass the UI test for the standard user?

  • 671 out of 693 from one IP... (Score:3, Interesting)

    by rthille ( 8526 ) <web-slashdot.rangat@org> on Thursday August 21, 2003 @03:30PM (#6758480) Homepage Journal
    I've got 693 SoBig spams to my obfuscated address: 'web-slashdot@NOSPAM.rangat.org' (I've since updated my DNS to serve an MX for nospam.rangat.org to 127.0.0.1, but it hasn't propagated yet. ) Almost all were from one IP: "Received: from cs24174102-171.houston.rr.com (HELO MARK-TRQBH52QXQ) (24.174.102.171) by bluesky.thille.org with SMTP; 21 Aug 2003 19:59:41 -0000"
    Not sure if he's a spammer that got infected, but the 'from' addresses are coming from a huge number of unique and seemingly 'real' addresses.
    I finally just setup my mail server to drop connections from that IP.

  • A great new slogan (Score:5, Funny)

    by McAddress ( 673660 ) on Thursday August 21, 2003 @03:30PM (#6758485)
    Linux during a virus epidemic, it's like being out of the country during the blackout.

  • Some companies deserve it (Score:5, Interesting)

    by EZmagz ( 538905 ) on Thursday August 21, 2003 @03:33PM (#6758520) Homepage
    My company being one of them. The place I currently work (fuck it, I hate working there anyway...it's 3M, the Scotch Tape(tm) people) is a disaster zone right now. The entire IT staff is contract-only. There is no centralized IT plan for keeping systems up-to-date, beyond updating the software when the PCs come in for repair or an upgrade. That gives some users a 5 year timespan when no service packs are installed.

    This week alone our entire department has been thrown around, manually patching EVERY box on the network. That's around 50,000 computers. Today alone I ran across probably 10 Windows NT boxes that were still running THE FIRST SERVICE PACK!

    My point is, I do NOT feel sorry in the least when companies like 3M lose millions of dollars because they don't hire a competent IT department. Hell, out of the 20 guys I work with, only myself and two others graduated from a 4 year college. Whatever. For the last four days when full-timers have been bitching at me while I upgrade their PC because their order-tracking software won't work, I just smile and tell them "you get what you pay for. Tell your bosses to hire a competent IT department and you'll never have this problem again." Then I walk away and sigh because I know it'll never happen. Guess paying a contracting firm $40/hr so they can turn around and pay me $13/hr while they get to save themselves from paying benefits is worth the millions of dollars in downtime.

  • Hold M$ Accountable!!! (Score:3, Insightful)

    by gsperling ( 625206 ) <slashdot@NOspam.lawlynn.com> on Thursday August 21, 2003 @03:40PM (#6758595)
    With the MSBlast worm running rampant right next to the recent re-release of the SoBig virus, it's hard not to be involved in the removal and sanitization of a computer system, especially for the majority of /. readers and participants.

    Face it, most of us are in a technical position of some sort, and are looked upon for assistance because of the knowledge we possess.

    My question is this: Who pays for our time? Is YOUR company expected to "eat" the costs of paying you for your time to sanitize their network from this malicious traversing code? Should it be the company's fault for utilizing software so prone to public vulnerabilities? Should the creators of the vulnerable software be held liable and accountable for their obvious flaws? Of course, tracking down the creators of the viruses is left up to the law enforcement officials and the persons charged with solving crimes. But, the viruses would not have existed if the vulnerabilities did not exist and were not exploited accordingly.

    I understand that the Glock company cannot be held accountable if some person used their weapon to terminate somebody's life. However, in the act of homicide, there is a definitive exchange of decisions. In the case of the virus, the infected party neither intended to receive the virus, nor wanted the problems associated.

  • Conspicuous absence (Score:3, Interesting)

    by __aajqwr7439 ( 239321 ) on Thursday August 21, 2003 @03:43PM (#6758644)
    Hmm... Nowhere does the article say the only Windows machines are infeccted by and propagate the worm.

    The SoBig worm is the latest in an outbreak that began 10 days ago with the so-called "Blaster" or "LovSan" worm which, by some estimates, infected more than 500,000 computers running the latest version of Microsoft Windows, the world's dominant operating system.

    That's the only place Windows is mentioned, with regards only to Blaster.

    xox,
    Dead Nancy

  • SoBig Clean up (Score:3, Informative)

    by pandrel ( 633485 ) * <pjandrel1@verizon.net> on Thursday August 21, 2003 @04:26PM (#6759114)
    I've already had to help a few people remove SoBig from thier systems and found that SARC has a removal tool that cleans up SoBig quickly and effortlessly by: 1. Terminating the W32.Sobig.F@mm viral processes. 2. Deleting the W32.Sobig.F@mm files. 3. Deleting the dropped files. 4. Deleting the registry values that the worm added. For those who need it it can be found at http://www.sarc.com/avcenter/venc/data/w32.sobig.f @mm.removal.tool.html

  • Anti-virus Programmers Crack IP Encryption (Score:5, Informative)

    by Jugalator ( 259273 ) on Thursday August 21, 2003 @04:29PM (#6759146) Journal
    According to a swedish newspaper (I'm sure others run the story as well by now), anti-virus programmers have now finally cracked the 20 IP addresses SoBig will get its updates from this weekend. It's now a race against time to shut those IP addresses down. The IP addresses are located in USA and Canada.

    The reason it took this long to get the IP addresses were because they were heavily encrypted in the code and they couldn't to the usual "dump memory" trick when the virus was active since the IP addresses were only stored in memory just when they were needed, then the memory was freed.

    The anti-virus guys at F-Secure don't know what will happen if they don't shut down the 20 addresses in time, only that something might happen if they don't take down all addresses.

    Unusually clever actually, since I usually find viruses to be rather poorly coded and much like a hack job, like the Blaster virus that shouldn't have crashed the Windows computers much more efficiently go unnoticed. Anti-virus developers have also noticed this about SoBig and it is not very exhibitionistic either, like viruses usually are. These signs suggest that it's a more professional work than usual.

  • college computers booted from network for worm (Score:3, Interesting)

    by mrgreenfur ( 685860 ) on Thursday August 21, 2003 @04:45PM (#6759303)
    i'm a current student at Carnegie Mellon Univ. and about a week before everyone's slated to return, computing services sent out a letter saying that they were scanning the network for this worm and if found were removing machines from the network. If your machine has been removed, you gotta patch it and request it be re-allowed.

    it seems like a pretty good way to go about preventing it from spreading, and even non-techies at my school will jump on the patch once they read the part about getting kicked off the net (read: AIM/Kazaa/email)

  • The law needs to assign responsibility (Score:4, Insightful)

    by exp(pi*sqrt(163)) ( 613870 ) on Thursday August 21, 2003 @04:55PM (#6759393) Journal
    We can argue until we're blue in the face about responsibility but frankly it doesn't matter. Make anyone vaguely connected (and catchable) responsible and the problem will be solved. Make MS responsible and they'll tighten up their OSes. Make users responsible for sending viruses from their computers and they'll soon put pressure on MS for better OSes and keep their virus checkers up-to-date. Make the PC vendors responsible and I'm sure we'll get imporvements too. But as it is we have a situation where nobody is held accountable and that means it's simply never going to be fixed.

  • Email notification: A cure worse than the disease (Score:5, Interesting)

    by greywalker ( 689874 ) on Thursday August 21, 2003 @06:43PM (#6760315)
    "Sunner said that most of the problems caused by SoBig involve the time and cost of cleaning the worm from computer systems."
    My experience with this virus may be abnormal, but I have to completely disagree with that statement. As a dispatch tech for a large state university, I've been up to my eyes in emails related to the virus, but have only found However, the amount of email traffic on campus has been mind-boggling -- it even took down our mail servers a few times. And less than 10% of the emails were from the virus. Most of them were f*cking auto-notification emails from other servers that someone had sent the damn virus, which thanks to the spoofing feature, was almost never true. Why don't server admins turn off such notifications when dealing with a mass-mailer/spoofer virus? All these assorted servers managed to do was clog up our mail server with these meaningless "you have sent us a virus" emails that do nothing but contribute to any damage the does!!
    IMHO, the REAL cost of dealing with this virus was bearing the burden of 100,000 stupid auto-generated emails that other servers were sending us, in response to emails that didn't even come from us.

  • Save your inbox with procmail (Score:4, Informative)

    by bigberk ( 547360 ) <bigberk@users.pc9.org> on Thursday August 21, 2003 @10:16PM (#6761735)
    This is where procmail comes to the rescue! Add this rule:

    # Ignore W32/Sobig.f@MM
    :0 B
    * ^vZgwXohhqrN4MDHpZfjXC6Aye4uyh5TU7soFb85wpJILzujHN
    /dev/null

    This matches the worm on a base64 encoded line from its body. This is on the current variant I got flooded with; redirect the suckers to /dev/null. And if you get a NEW strain, just take an encoded body sample from it and make a new rule!

Slashdot Top Deals

Lisp Users: Due to the holiday next Monday, there will be no garbage collection.

Close