Slashdot Mirror
SoBig: Worst is Yet to Come
bl8n8r writes "Experts say when vacationers get back to work
Monday, Inboxes will unleash the worms worst attacks.
Sunner said that most of the problems caused by SoBig involve the time and cost of cleaning the worm from computer systems.
"
SoBig is the worst email virus I've seen -- BY FAR.
Normally, I get about 30 spams per day and a few viruses. Not much harm to a Linux system running `mutt` as an MUA!. Yesterday, I received about 150 SoBig, plus maybe 30 automated msgs saying _I'd_ sent out such nastiness/bloat.
Normally we don't block emails with specific attachments at our post office because it takes too long to scan them. Our company of 100 people averages 14,000 legit email per day in and out, but with this outbreak as bad as it is (and not peaked yet!) the blocking is being instated tonight.
While musing with a programmer here who just moved her daughter into college, we brought up an interesting thought: Hundreds of thousands of college kids are moving back into dorms with huge fat pipes and Outlook style email clients on computers that haven't been patched since April or May. Yikes!
-Shadow
...for two reasons: IT staff will have had just that many more days to upgrade safety systems, and there are actually fewer people on vacation (at least here in the US) this week of the year than last week. So, the worst is likely behind us...not that the coming weeks will be a picnic.
I'm not sure if this should be +5 funny. It is a real option for some users.
I have known many people that actually know they have a virus on their computer and don't make it the first priority in using their systems... if it is usable by them, they don't care.
Of course, this sort of person doesn't have the slightest understanding (or care) that their system is causing a variety of problems on other systems.
They only seem to care if it is causing THEM some problem.
I've long since given up trying to explain what is going on to these folks or the urgency of solving their own virus problem in a timely manner. I make sure that their system is as up-to-date as possible and make sure their virus protection software automatically updates as frequently as possible.
And, recently, these are the folks that I have broken my long standing rule on, and configured "Windows to update automatically" and not wait for the user to OK it.
"Look! There! Evil, pure and simple from the Eighth Dimension!" --Buckaroo Banzai
I like it when they include the pif in the return message, that way SpamAssassin files it away in my spam folder ... without the pif it's seen (rightfully) as a legitimate message.
(Score:-1, Wrong)
"Pescatore said that the cost of both technical support personnel and lost productivity by the computers' users can range from $500 to $1,000 per infected machine."
:)
How much does Windows cost?
I know it's not really Microsoft's fault, since they had a patch and it's not their fault that people try to get email and stuff... But my users are rather annoyed. We all run Macs and either Mac OS X or FreeBSD servers so we're not vulnerable to this virus, but it's getting annoying just deleting the things. I can't imagine having to worry about getting infected on top of having to run Windows
We got almost all of ours (150 to 5 addresses) from one local government office. I emailed them when we narrowed down what machine they were coming from and the flow has stopped. We didn't get a Thank You or anything, but maybe our little government office doesn't want to publicly admit to running insecure systems.
I wonder if this $500 - $1000 per computer will be in the budget next year.
The idea is courtesy from the macosx forum
I'm just dreading Saturday when the majority of them show up, it's only 200 students now and the technicians can't keep up.
My ping times to www.mit.edu (my personal benchmark, as its on the next POP over and always up) are normally 25ms from home, they grew slowly from about 30 ms Monday morning to as high as 2600 ms yesterday with 2/3 packet drop. But today and especially in the last few hours it's fallen back to about 29 ms with 1/3 packet drop.
;)
There are still occasional storms, I guess as a new host gets infected nearby. But things are good compared to the last two days when I couldn't even listen to internet radio and plain old web browsing and e-mail were slow...
BTW I haven't seen any of the e-mails myself do to our spam filter but I have gotten some returned e-mail the virus sent and a non-tech friend who got this one and another friend (who's very non-tech) got last weeks virus. I usually don't personally know the people who get these things, it has been a good week for discussing an OS upgrade to Linux with non-techies
Just a few hours ago I cleaned sobig.F from one machine that was already patched in our 'MSBlaster Clean-sweep' and discovered this.
More annoying than the worm are all the "You are infected" warnings coming from clueless virus software. They make it through the spam filters.
>I've long since given up trying to explain what is going on to these folks or the urgency of solving their own virus problem in a timely manner.
Try this one:
"Some these viruses have been known to attmempt to destroy the computers of various military installations. The penalty in many countries for this is death. The penalty in YOUR country is a federal jail term. You may want to consider purchasing a $60 upgrade to your computer to help you avoid this problem in the future."
If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
With all the mainstream media attention, I'd be willing to bet Symantec and Network Solutions are hiring. Does anyone have statistics on the relationship between the size of the virus outbreak, and the revenue that these companies take in?
I turned off Sender Notifications for virus stripping ages ago because these things spoof that reply-to. Now I am starting to block domains whose notification messages are clobbering my server. These notification messages are coming in by the thousands and only further confuse the issue. They also annoy my users who aren't at fault in the first place.
To: All Georgia Tech Students
.
The Office of Information Technology (OIT) has detected the following worms and viruses proliferating on the Georgia Tech campus network:
-MS Blaster worm
-DCOM (Nachi) worm
-W32/Sobig-F virus
Successful worm and virus outbreaks impair networks by blocking access or increasing the time it takes to transfer data across a network connection. It is imperative that everyone on campus take appropriate actions to secure their systems from current and future outbreaks.
Overall Risk to Georgia Tech
Infected systems must be cleaned to contain the worm or virus and prevent further proliferation. The time it takes to clean infected systems causes lost productivity throughout the campus community. If an outbreak is not contained, some network services will become unavailable due to "denial of service" events.
Any desktop and server computers with Windows (2000, NT 4.0, XP, and Server 2003) that connect to the Georgia Tech campus network and have not been patched are vulnerable to the MS Blaster and DCOM/Nachi worms. The Sobig-F virus can infect any Windows system (95, 98, NT 4.0, Me, 2000, and XP) via email attachment or Windows file sharing. These worms and the virus do not infect Macintosh computers.
Actions Taken by OIT
OIT has taken these steps to contain the current outbreaks:
-Blocked the ports vulnerable to these worms at the campus network border.
-Notified the technical support community on what to do regarding these worms.
-Temporarily blocked the ports vulnerable to these worms at the ResNet and EastNet routers to prevent un-patched systems of arriving students from damaging the rest of the campus. The effect of this will be that certain services such as file sharing will not be possible from within Resnet/EastNet to the rest of campus. These changes will not prevent access to mail, internet or other campus services.
We are currently working very closely with the ResNet manager to repair ResNet's infected student machines. You can help us by following these actions immediately:
Actions for Students to Take
If your system is currently infected, you must make sure it gets disinfected.
Get assistance from one of the technical support staff members, obtain the fix CD from your RTA, or download the appropriate software tools from the web.
To remove the Blaster worm, obtain the Stinger tool:
http://vil.nai.com/vil/averttools.asp#sting er
Immediately update your computer's security software.
All computers that use the Georgia Tech network should have up-to-date anti-virus and personal firewall software installed. To protect your system from future worms and viruses:
-Download and configure anti-virus (VirusScan) and personal firewall (ZoneAlarm) software from the OIT software distribution web page (http://www.oit.gatech.edu/software/ ).
-Do not open any email attachments from senders you do not recognize.
-Since some viruses and worms send infected messages that appear to come from email addresses that may be known to you, care should be taken before opening attachments that you are not expecting. More information and guidelines can be found at http://www.security.gatech.edu/
If you are running Windows and have not installed the current patches, please go to the Microsoft website and download the Blaster worm security patch.
WinXP:
http://www.microsoft.com/downloads/detai ls.aspx?Fa milyID=2354406c-c5b6-44ac-9532-3de40f69c074&displa ylang=en
Win2000:
http://www.microsoft.com/downloads/det ails.aspx?Fa milyID=c8b8a846-f541-4c15-8c9f-220354449117&displa ylang=en
Win2003:
http://www.microsoft.com/downloads/det ails.aspx?Fa milyID=f8e0ff3a-9f4c-4061-9009-3a212458e92e&displa ylang=en
If you need assistance from the ResNet technical staff:
ResNet site (http://www.res
http://almostsmart.com
Sorry to reply to my own post. The quarantine partition (I save out dropped messages for a while, just in case of a false positive or something) on the mailserver just hit 90%, and it's 100GB. It was somewhere around 5-10% this morning. Not a good day.
Honestly why would a user run a PIF attachment anyways? Would you use unknown medication? Why would you run unknown attachments? Simple solution: Server.CreateFilter(attachments, PIF)
-=[ Who Is John Galt? ]=-
Just look at how well Symantec is doing! Up almost three dollars today.
With eight IT dudes running around fixing all of the Wintel systems
No "IT dudes" worth anything will be "running around fixing" things. If they had done their job properly in the first place, they wouldn't have to fix anything at all.
It depends on how clueless your email admins are.
.scr/Pif/.exe and deleting any email with such an attachment, they are letting the group virus scanner on our exchange servers deal with the entire load.
.scr and .exe attachments, so why they don't delete this crap before it hits the servers I don't know.
Rather than blocking
So the virus scanner is scanning and moving to the infected folder literally thousands of these an hour. After it moves the infected message, it generates a nice email letting you know an email that was sent to you is currently in quarantine. Therefore this is generating even more work for the mail servers. Turning off this feature for a couple of days is apparently too much trouble.
The servers exchange is running on are therefore hanging every few minutes with all the disk and processor activity. Everyone gets a message every few minutes about "please wait, connecting to server" until you get fed up and close outlook down for the day.
This is the first virus I've ever seen to disrupt my work like this. But this is 100% the fault of our email admins who can't be bothered to write a couple of simple mail rules.
At the basic internet security zone Outlook can't even open
It has become appallingly obvious that our technology has exceeded our humanity. --Albert Einstein
The thing I like the most in those "worm reports" it's they say everytime that the worm spread throught mail, but never cite that there is only one email client that allow that kind of stuff and that there are alternatives.
Why can't someone come with something inteligent and say "the worm uses Microsoft's Outlook to spread itself"?
I've got 693 SoBig spams to my obfuscated address: 'web-slashdot@NOSPAM.rangat.org' (I've since updated my DNS to serve an MX for nospam.rangat.org to 127.0.0.1, but it hasn't propagated yet. ) Almost all were from one IP: "Received: from cs24174102-171.houston.rr.com (HELO MARK-TRQBH52QXQ) (24.174.102.171) by bluesky.thille.org with SMTP; 21 Aug 2003 19:59:41 -0000"
Not sure if he's a spammer that got infected, but the 'from' addresses are coming from a huge number of unique and seemingly 'real' addresses.
I finally just setup my mail server to drop connections from that IP.
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
This week alone our entire department has been thrown around, manually patching EVERY box on the network. That's around 50,000 computers. Today alone I ran across probably 10 Windows NT boxes that were still running THE FIRST SERVICE PACK!
My point is, I do NOT feel sorry in the least when companies like 3M lose millions of dollars because they don't hire a competent IT department. Hell, out of the 20 guys I work with, only myself and two others graduated from a 4 year college. Whatever. For the last four days when full-timers have been bitching at me while I upgrade their PC because their order-tracking software won't work, I just smile and tell them "you get what you pay for. Tell your bosses to hire a competent IT department and you'll never have this problem again." Then I walk away and sigh because I know it'll never happen. Guess paying a contracting firm $40/hr so they can turn around and pay me $13/hr while they get to save themselves from paying benefits is worth the millions of dollars in downtime.
"Hell hath no fury like a woman scorned for SEGA. ..."
Hmm... Nowhere does the article say the only Windows machines are infeccted by and propagate the worm.
The SoBig worm is the latest in an outbreak that began 10 days ago with the so-called "Blaster" or "LovSan" worm which, by some estimates, infected more than 500,000 computers running the latest version of Microsoft Windows, the world's dominant operating system.
That's the only place Windows is mentioned, with regards only to Blaster.
xox,
Dead Nancy
I guess just an idea (that seems useful and maybe I'll think about more later) is why not actively hunt virii. There was this big collective effort with SETI a few years back, why couldn't there be some big servers hunting for the cracks on the backbone. Maybe just a group of people, or a coalition to produce a virus in the wild that goes after viruses. Maybe try to infect servers clandestinely with patches if it becomes known that a user is spouting out bad email. Why niot actively hunt spammers too? It seem like that was sort of the code of the hackers.. Or at least the myth back in the old days (94-96) when I was keeping track of things more (or at least listening to people rant on usenet about such things as kookery). What are the big time hackers (or is it crckes or some other new term nowadays) doing? Are they being anonymous, or testing the waters before something "big" is put out. Maybe I'm just blowing steam, but considering the power a virus can harness to replicate itself and search for new ports to infect.. It seems that the government/military or rogue hackers/(paramilitary) could make more of presence on the scene than seems viewable from the public eye. Are virii the only big claim to fame to people who know how to mess with big systems? Couldn't we have avanging angels against spam/virii instead? Well just my 4 cents.
Someone on LiveJournal speculated that these messages were actually advertising, for the anti-virus product, and should be treated as spam/unsolicited bulk email.
I certainly agree that where the virus is known to spoof email addresses, it only makes the problem much much worse for everyone if you send a message saying (in effect) "the message you didn't send had a virus, there's nothing you can do about it, but please share the pain". And the anti-virus writers should be... persuaded... not to send out these virus reports to forged email addresses.
The 1000+ copies per day of the virus are easy enough to filter. The gazillons of different formats of useless "virus notifications" are not.
Ewen
i'm a current student at Carnegie Mellon Univ. and about a week before everyone's slated to return, computing services sent out a letter saying that they were scanning the network for this worm and if found were removing machines from the network. If your machine has been removed, you gotta patch it and request it be re-allowed.
it seems like a pretty good way to go about preventing it from spreading, and even non-techies at my school will jump on the patch once they read the part about getting kicked off the net (read: AIM/Kazaa/email)
Why the hell would I use wine to open e-mail under linux? Linux is not spreading this shit the MS UI is. Get your facts strait. The fault is entirely MS they are counting on this kaos so that they can step forward with the ultra secure win 2003 server and then the Longhorny security solutions. Your are spreading fluff and fud! Yes everyone is going to rush and secure their computers with Longhorny. But as Ben Franklin said "Those who sacrifice freedom for security will gain neither."
OH THE SHAME I fell off the wagon and use sigs again!
"The key problem is that people are opening these attachments. That's just foolish."
True. But think on this - SoBig is a *benign* virus. It does no real appreciable damage. (Don't give me cleanup cost speak, if you hired competent people, you wouldn't *need* to clean the corporate networks.)
What will happen when a *real* virus is finally written for Windows? Back in the day (As in, decade+ ago), I remember what virii were like. Destroy the boot sector, frag the hard disk, randomly rearrange critical OS files..
Under Linux, unless you've some dolt running as root, this isn't a threat. Joe User can only befuk the files in his home directory, and nothing else.
Under Windows? Joe User just caused the whole box to shit itself.
Microsoft would do well to remedy this problem before someone decides to write a 'real' virus.
We had a guy in marketing spamming child porn to the company's customers and some people in the company. When he logged in at 6:00 am my time on the road one day when I was working graveyard shift. Needless to say he did not ever leave Illinois as far as I know.
An Education is the Font of All Liberty
Hmm, here's my numbers... this on a site that pushes about 9,000,000 messages/month. Oh, these numbers are since the 18th, and only include the ones for which any significant numbers have been recieved.
91673 | W32/Sobig-F
1460 | Bad File Pattern
1062 | Very Bad Header Pattern
1039 | W32/Sircam-A
960 | W32/Yaha-P
365 | W32/Bugbear-B
280 | W32/Klez-H
240 | W32/Mimail-A
223 | W32/Yaha-K
124 | W32/Bugbear-Dam
122 | W32/Dumaru-A
14 | W32/Magistr-B
9 | W32/Yaha-A
"Sunner said that most of the problems caused by SoBig involve the time and cost of cleaning the worm from computer systems."
My experience with this virus may be abnormal, but I have to completely disagree with that statement. As a dispatch tech for a large state university, I've been up to my eyes in emails related to the virus, but have only found However, the amount of email traffic on campus has been mind-boggling -- it even took down our mail servers a few times. And less than 10% of the emails were from the virus. Most of them were f*cking auto-notification emails from other servers that someone had sent the damn virus, which thanks to the spoofing feature, was almost never true. Why don't server admins turn off such notifications when dealing with a mass-mailer/spoofer virus? All these assorted servers managed to do was clog up our mail server with these meaningless "you have sent us a virus" emails that do nothing but contribute to any damage the does!!
IMHO, the REAL cost of dealing with this virus was bearing the burden of 100,000 stupid auto-generated emails that other servers were sending us, in response to emails that didn't even come from us.
Alternatively, if you're going to do the virus check after the mail's been accepted, it sure would be nice if the virus-checker programs kept track of which viruses usually forge the sender and which don't, so it can skip the bouncegrams on the forged ones.
Dave Farber's been mentioned in the press - his mailing list is very large and gets quoted a lot, so his address is in lots of people's mailboxes and gets forged a lot.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Well, as long as you're going to go the BSD route, you may as well just spring for a shiny new Mac with OS X and be done with it. Although we Mac owners are certainly not immune to virii and their broader effects, we are certainly less frequently directly infected. This is one instance where small market share proves beneficial.
Incidentally, the first infection I ever had on a Mac was the old Macro Virus which appeared shortly after I first welcomed Microsoft (via Office) onto my machine. Ah Microsoft!
"...all the labours of the ages, all the devotion, all the inspiration, all the noonday brightness..." yada yada
Show him/her the hard numbers and if they are still too stupid to listen, take it to the next level. If the company has any business smarts, someone will listen to your well reasoned arguements. If not, you may want to start looking for a new job, that company probably won't be in business for long.
Well, I "took it to the next level" and suddenly I lost my $85k/year (yeah, that's US Dollars) job because I had improperly stored my bicycle in my office. No other reason mentioned, no bad reviews, no warnings, nothing. And it was perfectly legal because I (as all my former colleagues in this 30bn/year company) was an "at-will" employee.
And I don't think they're going out of business soon.