Slashdot Mirror

Go to http://lurhq.com/sobig-f.html, http://lurhq.com/sobig-e.html and http://lurhq.com/sobig.html.

Kristian

Go to http://lurhq.com/sobig-f.html, http://lurhq.com/sobig-e.html and http://lurhq.com/sobig.html.

Kristian

Go to http://lurhq.com/sobig-f.html, http://lurhq.com/sobig-e.html and http://lurhq.com/sobig.html.

Kristian

How will the music worm work?

It will be distributed as an email worm. The user installs it by clicking on an attachment that arrives in an email spam. A large number people will do this knowingly, but many will be innocent "victims". Knowing users will thus have "plausible deniability".

Once installed, it will do the following:

1) Email itself to everybody in the user's address book, just like any other worm.

2) Install a hidden peer-to-peer server.

3) Identify every music file on the users computer.

4) Make all of them available over the web via peer-to-peer sharing.

5) Begin silently and automatically downloading music files to the user's computer and adding them to his music library, favoring additional titles by artists already represented in the user's library.

6) An internal list will be maintained of the downloaded files, and the worm will monitor their usage. Any downloaded file that is not played within a certain period of time will be marked for eventual replacement, in order to prevent the music archive from growing too large (say 20% above the size of the permanent library or 80% of available disk space, whichever is smaller). Any file that is played will be deleted from this list and permanently added to the user's music library.

7) Knowing users will be able to "order" specific music via a web interface by accessing a web site (actually located on the user's computer) via a web browser. The worm will silently edit the browser's history file to erase the record of this access.

How could such a worm be combatted?

1. Legal assaults on users would become difficult; there will be continuous trading of music over the net. Much of it will be entirely innocent; the result of the worm running on the computers of innocent "victims." This will provide a smokescreen for the activities of knowing users. It will be extremely difficult to prove that somebody is a knowing user, since the patterns of download to any individual user will be similar to knowing use. Many unknowing victims will accidentally add some of the downloaded music to their permanent libraries, because a lot of people do not keep careful track of the contents of their music libraries.

2. Virus scanning software could be employed, but many users do not keep their antivirus software up to date. Attempts to eradicate spammer worms such as Sobig have not been particularly effective. And with the music worm case, many of the "victims" will actually be secret users, intentionally abetting the worm's presence on their computers.

3. The music industry could distribute counter-worms, which would infect computers and delete music, or gather evidence of intentional trading. However, this would require the music industry to engage in an ongoing illegal activity. Moreover, it would be relatively unsuccessful in targeting the technically sophisticated knowing user, who would have a strong incentive to block such worms.

Sobig.a and the Spam You Received Today,
Sobig.e - Evolution of the Worm,
and Sobig.f Examined

Sobig.a and the Spam You Received Today,
Sobig.e - Evolution of the Worm,
and Sobig.f Examined

Sobig.a and the Spam You Received Today,
Sobig.e - Evolution of the Worm,
and Sobig.f Examined

Maybe its just that the virus writer is actually starting to follow the kinds of ideas that geeks often toss out. "Oh yeah, if I was making a virus I'd have it..."

I've wondered if he read Slashdot. I know I would if I were him.

There's a good overview of Sobig.a through e here

They suspect that it's spammers (or other shady elements) covering their tracks.

They suspect that it's spammers (or other shady elements) covering their tracks.

Hey, I found the answer! This stuff is spread by spammers. It doesn't deactivate, it switches to an open proxy.

Thanks.

Before I update the paper I'm waiting to see if there are any substantial changes in the second and third stages - these won't be known for a couple of days probably, depending on the worm author's schedule, but it could be as early as tonight. So far though, the functionality is almost the same as described in the Sobig.e paper.

I'm interested to see if is updated to include info on -f. the -e article was a good eye-opener.

In case you hadn't noticed, few virus writers are developing malicious code.

While it's generally true that historically, most viruses have had feeble or non-existent payloads, the evidence is strong that some of the waves of infection this year have been created by spam gangs, using viral infections to install proxy software.

How will the music worm work?

It will be distributed as an email worm. The user installs it by clicking on an attachment that arrives in an email spam. A large number people will do this knowingly, but many will be innocent "victims". Knowing users will thus have "plausible deniability".

Once installed, it will do the following:

1) Email itself to everybody in the user's address book, just like any other worm.

2) Install a hidden peer-to-peer server.

3) Identify every music file on the users computer.

4) Make all of them available over the web via peer-to-peer sharing.

5) Begin silently and automatically downloading music files to the user's computer and adding them to his music library, favoring additional titles by artists already represented in the user's library.

6) An internal list will of the downloaded files, and the worm will monitor their usage. Any downloaded file that is not played within a certain period of time will be marked for eventual replacement, in order to prevent the music archive from growing too large (say 20% above the size of the permanent library or 80% of available disk space, whichever is smaller). Any file that is played will be deleted from this list and permanently added to the user's music library. 7) Knowing users will be able to "order" specific music via a web interface by accessing a web site (actually located on the user's computer) via a web browser. The worm will silently edit the browser's history file to erase the record of this access.

How could such a worm be combatted?

1. Legal assaults on users would become difficult; there will be continuous trading of music over the net. Much of it will be entirely innocent; the result of the worm running on the computers of innocent "victims." This will provide a smokescreen for the activities of knowing users. It will be extremely difficult to prove that somebody is a knowing user, since the patterns of download to any individual user will be similar to knowing use. Many unknowing victims will accidentally add some of the downloaded music to their permanent libraries, because a lot of people do not keep careful track of the contents of their music libraries.

2. Virus scanning and firewall software could be employed, but many users do not keep their protective software up to date. Attempts to eradicate similar worms employed by spammers have not been particularly effective. And with the music worm case, many of the "victims" would actually be secret users, intentionally abetting the worm's presence on their computers.

3. The RIAA could distribute counter-worms, which would infect computers and delete music, or gather evidence of intentional trading. However, this would require the music industry itself to engage in an ongoing illegal activity. Moreover, it would be relatively unsuccessful in targeting the technically sophisticated knowing user, who would have a strong incentive to block such worms.

And as a result, all the worms and viruses keep spreading, slowing down the network, and helping spammers. Now they're going to make people pay to download the patches? Imagine some guy rear-ending you on the highway because GM made his car with faulty brakes, and charged money to fix the problem, and the car owner decided he couldn't/wouldn't pay the money. Remember, most of these viruses/worms affect everyone, not just the people with infected boxes. The last thing we want to give people is another reason to not apply the patches.

the only really reliable approach I've found is IP blacklists for repeat offenders

I also use IP blacklists (locally compiled and various RBLs) but this is becoming less effective as the spam gangs are moving to using their own army of proxies rather than the traditional exploitation of open relays or throw-away accounts. I'm not saying that ISPs shouldn't be responsible for what emanates from their networks, but these trojaned users are a very different kettle of fish than spammers having "pink contracts" with spam-friendly ISPs.

Why don't you go back to your intersts, Interests: Space, music, psychological warfare and put up a firewall or something to protect your fine FrontPage work from evil hackers? I see your host runs Red Hat for you, but do you know what your home computer is doing for you?

http://www.lurhq.com/migmaf.html

Also search Google Groups for "onlycoredomains.com"

There is a technical writeup here:
http://www.lurhq.com/migmaf.html
Mirror: http://www.joestewart.org/migmaf.html

Here are a couple of beginner-level articles I've written on reverse-engineering malicious code:

Reverse Engineering Hostile Code

Alien Autopsy: Reverse Engineering Win32 Trojans on Linux

Here are a couple of beginner-level articles I've written on reverse-engineering malicious code:

Reverse Engineering Hostile Code

Alien Autopsy: Reverse Engineering Win32 Trojans on Linux

There's a really nice technical writeup of the mechanics and evolution of the SoBig worm here. Fairly scary stuff.

It's a big part of the solution, but it will not stop certain viruses. For sobig, there is a high possibility that the initial "seeding" of the virus is done by spamming it out to hundreds of thousands of users. This is very likely because it is suspected that a spammer is behind the spread of sobig.

This would infect a great number of people before AV vendors have a chance to push out signatures. The only way it could be thwarted is by heuristic scanning, which can never be 100% effective. (But can be quite good - messagelabs is catching these before signatures are available)

Just this week there was a phony "apply this critical patch" mass-spammed to countless users, with the URL "windows-update.com" (as opposed to the genuine windowsupdate.com). This fooled a lot of people into clicking through to the site, where they were immediately exploited if they were using IE without the June 4 hotfix. At this point they became part of an IRC trojan botnet. Even heuristic email virus scans would not have caught this.

It's a big part of the solution, but it will not stop certain viruses. For sobig, there is a high possibility that the initial "seeding" of the virus is done by spamming it out to hundreds of thousands of users. This is very likely because it is suspected that a spammer is behind the spread of sobig.

This would infect a great number of people before AV vendors have a chance to push out signatures. The only way it could be thwarted is by heuristic scanning, which can never be 100% effective. (But can be quite good - messagelabs is catching these before signatures are available)

Just this week there was a phony "apply this critical patch" mass-spammed to countless users, with the URL "windows-update.com" (as opposed to the genuine windowsupdate.com). This fooled a lot of people into clicking through to the site, where they were immediately exploited if they were using IE without the June 4 hotfix. At this point they became part of an IRC trojan botnet. Even heuristic email virus scans would not have caught this.

There is a payload, but it is not immediately obvious. Like every sobig variant, its job is to download a second stage trojan. Check out the whole story of what sobig.a (and likely all the rest) are supposed to do after infecting you: http://www.lurhq.com/sobig.html

Here are some articles covering proxy abuse and the Sobig virus/Spam connection which detail some of the current techniques of spammers and how to fight them.

Here are some articles covering proxy abuse and the Sobig virus/Spam connection which detail some of the current techniques of spammers and how to fight them.

An look at ethical issues involved in "hacking-back" was written by a cow-orker of mine. It looks at different ethical systems and how they might be applied here.

It's called "Crossing the Line: Ethics for the Security Professional"

This is the primary method of spam distribution today. If the spammers are smart, they are staying away from the Sobig.a proxies on port 1180/1182 due to the fact they will allow anti-spammers to quickly track down the spammer's real IP address. If it truly is a handful of big time spammers sending the bulk of the email, one could make a pretty big impact on them this way.

If the spammer uses the proxy/trojan installed by Sobig.a which listens on port 1180 (socks) and 1182 (http), it's very traceable. You need only the password to the proxy management station (it's "zaq123") and you can watch the traffic or shut it down altogether.

See this analysis of Sobig and Spam for more details.

Of course, this MBIWYL (may be illegal where you live)

http://www.lurhq.com/sobig.html