SoBig: Worst is Yet to Come

bl8n8r writes "Experts say when vacationers get back to work Monday, Inboxes will unleash the worms worst attacks. Sunner said that most of the problems caused by SoBig involve the time and cost of cleaning the worm from computer systems. "

Comments

Cost Benefit Analysis

[Transient0]

If the majority of the cost comes from cleaning the system, I would recommend (in my professional opinion) simply letting the systems remain infected.

Re:Cost Benefit Analysis

[jmv]

Great idea! Do you have a degree at the Enron Institute of Business? :)

Re:Cost Benefit Analysis

[stinkwinkerton]

I'm not sure if this should be +5 funny. It is a real option for some users.

I have known many people that actually know they have a virus on their computer and don't make it the first priority in using their systems... if it is usable by them, they don't care.

Of course, this sort of person doesn't have the slightest understanding (or care) that their system is causing a variety of problems on other systems.

They only seem to care if it is causing THEM some problem.

I've long since given up trying to explain what is going on to these folks or the urgency of solving their own virus problem in a timely manner. I make sure that their system is as up-to-date as possible and make sure their virus protection software automatically updates as frequently as possible.

And, recently, these are the folks that I have broken my long standing rule on, and configured "Windows to update automatically" and not wait for the user to OK it.

Re:Cost Benefit Analysis

[BWJones]

If the majority of the cost comes from cleaning the system, I would recommend (in my professional opinion) simply letting the systems remain infected.

That's my plan. Just pull the plug on the Wintel stuff, toss em in the trash and replace them with Macs running OS X. :-)

Re:Cost Benefit Analysis

[BWJones]

That's my plan. Just pull the plug on the Wintel stuff, toss em in the trash and replace them with Macs running OS X. :-)

I was being a little glib there, but it should be pointed out that the labor costs associated with managing all of this crap are pretty serious. Overtime charges, benefits and basic salary for an $74k employee for the last three days are running what? At least $1000k per employee. With eight IT dudes running around fixing all of the Wintel systems that's eight grand worth of new Macs that will have much better uptime and lower costs just from the last three days alone. Now, consider how many of these little virus and worm issues there have been in the past year.

Re:Cost Benefit Analysis

[shepd]

>I've long since given up trying to explain what is going on to these folks or the urgency of solving their own virus problem in a timely manner.

Try this one:

"Some these viruses have been known to attmempt to destroy the computers of various military installations. The penalty in many countries for this is death. The penalty in YOUR country is a federal jail term. You may want to consider purchasing a $60 upgrade to your computer to help you avoid this problem in the future."

Re:Cost Benefit Analysis

[Electrum]

With eight IT dudes running around fixing all of the Wintel systems

No "IT dudes" worth anything will be "running around fixing" things. If they had done their job properly in the first place, they wouldn't have to fix anything at all.

Re:Cost Benefit Analysis

[EverDense]

Try this one:

"Some these viruses have been known to attmempt to destroy the computers of various military installations. The penalty in many countries for this is death. The penalty in YOUR country is a federal jail term. You may want to consider purchasing a $60 upgrade to your computer to help you avoid this problem in the future."

Thank God!

They've FINALLY started jailing people for being too stupid to own computers! ;-)

Re:Cost Benefit Analysis

[Frymaster]

f they had done their job properly in the first place, they wouldn't have to fix anything at all.

does "doing their job properly" include preventing end-users from touching the keyboards? let's face it, the network that remains unused always stays in a stable, functioning state. put users on it and then things go wrong.

Re:Cost Benefit Analysis

[paranoic]

This is slashdot, shouldn't

You may want to consider purchasing a $60 upgrade to your computer to help you avoid this problem in the future.

read

You may want to consider installing Linux on your computer to help you avoid this problem in the future.

Re:Cost Benefit Analysis

[GoRK]

If I get someone who doesnt care, I just tell them the virus e-mails, at random, their web history and any files/photos/etc. it can find on the hard drive to any address it can find in the e-mail application.

This works suprisingly well. Even though it's a lie, they are spooked about it. If they pester me, I'll tell them the truth but add that viruses in the past have done this and probably will do it again.

Re:Cost Benefit Analysis

[Natty P]

This should be Microsoft's next big marketing campaign!

I'm sure it'll be more successful than .NET or that stupid WinXP commercial with the Madonna song and people flying around....

"Where do you want to go today?!?! Federal prison?!?! If not, upgrade now!"

Re:Cost Benefit Analysis

[jonbrewer]

No "IT dudes" worth anything will be "running around fixing" things. If they had done their job properly in the first place, they wouldn't have to fix anything at all.

I don't know what world you're living in, but it isn't the one I'm posting from. You can be a brilliant IT guy who does his job incredibly well, but if a corporation's policies (i.e. waiting until a patch has been regression tested with bespoke applications) have you running around fixing things, it's the CIO that's not "worth anything" and not the "IT dudes".

And, of course, in the case where you're paid $74k/year (as the parent post mentioned), You Do What You're Told, or you quickly lose said salary.

Re:Cost Benefit Analysis

[mekkab]

... that's eight grand worth of new Macs ...

Yeah, and just think what both of those machines could do!

Worms worms and more worms

[Lane.exe]

Is 2003 the year of the Worm on the Chinese calendar? I'm confused!

Microsoft has serious problems

[Anonymous Coward]

2 worms (DCOM and Welchia) and a virus variant in less than two weeks.

This should tell investors that they are wasting their money.

This should tell companies that they are wasting their money.

Someone, somewhere, will hopefully get a clue.

Re:Microsoft has serious problems

[Kenja]

How much do you want to bet that the people getting the clue are not the ones who keep putting unpatched computers on the internet without a firewall? Come on, regardless of the platform thats just asking for it.

Procmail finally

[unfortunateson]

Our computers aren't getting infected: between virus scan, ZoneAlarm, ancient e-mail client and knowing not to open the stupid attachments, we've not gotten infected.

But >1000 100K e-mails per day to a single address were swamping our ability to do anything but download and delete.

It took two days of querying tech support at my ISP before they'd admit that procmail would work, and a quickie recipe dumps all the infected files. Yay. I should have just done it without checking tech support, for all they helped.

This was listed in a previous thread, but it's worth repeating:
In a .procmailrc file, put :0 B
* ^ *Content-Disposition: attachment;
* filename=".*\.(pif|exe|scr)" /dev/null

This deletes any message with a pif, exe or scr attachment.

I'll get more sophisticated later once I learn more about procmail, but for now, this does the job, without having to worry about SHELL and PATH settings.

Brain-dead auto-responders...

[ktakki]

So far this week, I've received only seven actual copies of W32/Sobig. However, the number of messages from mailer-daemons and mail server virus scanners has exceeded this by a factor of ten. Some of these rejection messages actually include a copy of the infected .PIF file.

You would think that after Klez, the people who write these virus scanners and those who administer mail servers would realize that viruses sometimes spoof the "From:" field. I didn't send it, my Mac is not infected. You're just annoying me. Please go away.

At best, this is collateral damage. At worst, these rejection messages are actually advertising the IP addresses of infected systems. Should a virus drop a back door payload, this would multiply the damage.

k.

Re:Brain-dead auto-responders...

[billstewart]

This has been discussed a bit on the NANOG list. The ideal place to do the virus scanning would be during the SMTP transmission phase, rather than after the fact, so you could fail the transmission with a "553 go away you virus!" (and maybe a teergrube) instead of accepting the message and sending it to the forged From: line. (It looks like Sendmail milters give you hooks that could be used for this.) That way, if the virus runs its own SMTP, it gets messages that it ignores, and if the virus abuses it's victims' email programs, then they'll get the warning, but the From: won't.

Alternatively, if you're going to do the virus check after the mail's been accepted, it sure would be nice if the virus-checker programs kept track of which viruses usually forge the sender and which don't, so it can skip the bouncegrams on the forged ones.

Dave Farber's been mentioned in the press - his mailing list is very large and gets quoted a lot, so his address is in lots of people's mailboxes and gets forged a lot.

SoNice.ToSee.YouBack

[blcamp]

Don't complain.

With SoMany.IT.Workers unemployed, SoBig.And.ItsVariants have a strangely positive side effect... ...job security.

Ouch!

[Shadow2097]

I've been dealing with literally thousands of emails coming into my office just today! The sales people are having a running contest to see who gets the most infected emails every hour. So far the winners are usually at ~150/hour.

Normally we don't block emails with specific attachments at our post office because it takes too long to scan them. Our company of 100 people averages 14,000 legit email per day in and out, but with this outbreak as bad as it is (and not peaked yet!) the blocking is being instated tonight.

While musing with a programmer here who just moved her daughter into college, we brought up an interesting thought: Hundreds of thousands of college kids are moving back into dorms with huge fat pipes and Outlook style email clients on computers that haven't been patched since April or May. Yikes!

-Shadow

Re:lesson

[Farley Mullet]

isn't the lesson here that people shouldn't go on vacation?

nope. it's that people shouldn't come back from vacation.

Re:Worst I've seen by FAR

[aridhol]

plus maybe 30 automated msgs saying _I'd_ sent out such nastiness/bloat.

I was getting that, too. I think it generates the return address the same way it sends the to: address. They both come from the user's address book. Because of this, other people get the warnings, not the person who's actually infected. This allows the virus to go undetected longer.

Re:Finally.

[coffee_admin]

Did your mom help you think of that comment?

Sorry - shoulda previewed

[unfortunateson]

The line wrapping on the recipe got mangled:

:0 B
* ^ *Content-Disposition: attachment;
* filename=".*\.(pif|exe|scr)"
/dev/null

Vacation?

[*weasel]

did a statistically significant portion of the workforce on vacation this week?

that seems like a pretty weak overall premise for an expected resurgence.

now if he said that he expects a steady stream of continued activity into early next month, due to all the people who take vacations throughout august - he might have a point.

but to suggest that these 'vacationers' will unleash the same spam deluge monday that the rest of the unwashed have given us this past week, is a bit shaky.

Even worse...

[cperciva]

You would think that after Klez, the people who write these virus scanners and those who administer mail servers would realize that viruses sometimes spoof the "From:" field.

The situation is even worse than that: Most (all?) of the virus scanners sending me autoreplies correctly identified the virus as being Sobig -- which always uses spoofed source addresses.

Sending autoreplies is sometimes useful, but these scanners should at very least have a table which tells them, for each virus, whether an autoreply should be sent (ie, a table which specifies if a virus uses spoofed source addresses).

Slashdot Headline Concat Fun

[JonTurner]

String the last two 'default' headlines together and whaddaya get?

"New Longhorn Screenshots Leaked. Sobig. Worst Is Yet To Come."

Yep. That just about says it all!

Read between the lines

[Rosco P. Coltrane]

Sunner said that most of the problems caused by SoBig involve the time and cost of cleaning the worm from computer systems rather than the destruction of files or the opening of files to outsiders on the Internet, which can be problems with many computer viruses. Pescatore said that the cost of both technical support personnel and lost productivity by the computers' users can range from $500 to $1,000 per infected machine.

And who is Marc Sunner? he's the CTO of MessageLabs. And what does MessageLabs do, you ask? see for yourself, from the main page at messagelabs.com:

Email security today is a global issue which pervades whole organizations. Viruses, spam, pornographic material and other harmful or unwanted content represent a serious risk to your company. To combat these all too real threats, you need a total, proven and effective solution. Only MessageLabs can assure you of complete peace of mind from complete email security

$500 to $1000 to clean up each infected machine? Right, whatever Marc. And it's obvious you don't have *any* interest in propagating that baloney too. (on second thought, if you hire me to clean your machines, I'll do 5% discount off that price).

Another fine impartial article reposted by Slashdot. (By the way, the word you're looking for is "advertising") ...

Re:school's in!

[Jacer]

This isn't funny, I work on campus tech support. It's move in week, and the 30 of us on staff are working 60+ hours this week. 8,000 or so computers are coming back, of those, we expect about 5,600 to be unpatched, and we expect that of those 5,600, that only 1,400 or so will be able to follow our documentation. That leaves us with 4,200 machines to patch, and clean before Monday (and here I sit on Slashdot)

how can people fall for it... again

[kubla2000]

What I find discouraging is that the lemmings are falling for it despite this being The Week of Teh Worm.

All the hopeful articles that have sited users claiming a new awareness of the risk of worms and virii seem to be pipe dreams.

Dumb users are dumb users and the more infectuous and persistant the virus, the more networks are going to get hammered. Why oh why aren't all pif, scr, exe, com, and vbs attachments just blocked by the MDA. There is no good reason for allowing an end user the huge complexity of choosing whether or not to click on the latest attachment that's come to them from "the internet".

If the lemmings are getting suckered this week... when every news medium is blathering on about viruses worming their way through nuclear reactors and motor vehicle registration offices, what hope is there for when the attention has settled?

Save procmail recipe

[Frodo Looijaard]

The following should be a safe procmail recipe that only matches the virus, and nothing else:

:0B:
* ^TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAA$
virus

NB: This may not be rendered correctly; there should be no space in the string of A letters.

The idea is courtesy from the macosx forum

Where I work...

[Znonymous Coward]

We haven't seen the virus. But then again, we're admins who know what we're doing...

That's right, we run $CO UnixWare. And since there are only 2 or 3 other copies of $CO UnixWare being used in the world, we don't have to worry about worms and viruses.

Re:huh

[Jhon]

Aren't you lucky. Here's what our email server cought since Monday:

237 W32/Yaha-E
235 W32/Klez-H
009 W32/Sircam-A
004 W32/Bugbear-B
003 Dial/PecDial-B
002 W32/Yaha-K
002 Troj/Peido-B
001 W32/Sobig-F
001 W32/Klez-E
001 W32/Bugbear-Dam

Only one Sobig so far... But Klez and Yaha numbers have been high for months. Too many of our users have front-facing email addresses (posted on our corporate website).

coming spike in old-fashioned spam

[jdunlevy]

Looks like in addition to all the garbage we've been getting as a result of this virus propagating (the virus itself, attachment-free e-mailings by the virus, mis-directed automated notifications that "Your mail server sent us a virus", bounces to people whose addresses were spoofed by the virus, probably etc.), we can expect the infected computers to start being used as relays for the sending of "normal" spam -- with the corresponding spike in spam volume that would bring.

According to this article:

After examining two month's worth of junk e-mail earlier this year, New York City-based e-mail security company MessageLabs found that roughly 65 percent of spam originated from computers running proxy servers. More than 75 percent of those servers appeared to be installed on PCs that showed signs of being infected with Sobig and similar viruses.

And Symantec:

Sobig.F can download arbitrary files to an infected computer and execute them. The author of the worm has used this functionality to steal confidential system information and to set up spam relay servers on infected computers.

It's been abating in my corner of the internet

[zenyu]

My ping times to www.mit.edu (my personal benchmark, as its on the next POP over and always up) are normally 25ms from home, they grew slowly from about 30 ms Monday morning to as high as 2600 ms yesterday with 2/3 packet drop. But today and especially in the last few hours it's fallen back to about 29 ms with 1/3 packet drop.

There are still occasional storms, I guess as a new host gets infected nearby. But things are good compared to the last two days when I couldn't even listen to internet radio and plain old web browsing and e-mail were slow...

BTW I haven't seen any of the e-mails myself do to our spam filter but I have gotten some returned e-mail the virus sent and a non-tech friend who got this one and another friend (who's very non-tech) got last weeks virus. I usually don't personally know the people who get these things, it has been a good week for discussing an OS upgrade to Linux with non-techies ;)

Re:RPC Patch

[cK-Gunslinger]

Also keep in mind that refilling the washer fluid in your car will not prevent you from getting a flat tire.

Just this morning I changed a flat tire on a car that had a full tank of washer fluid and discovered this.

Re:Finally.

[Anonymous Coward]

They named a virus after my penis.

No, child, it's a worm. That's why they named it after your penis.

Re:school's in!

[Skweetis]

Sorry to reply to my own post. The quarantine partition (I save out dropped messages for a while, just in case of a false positive or something) on the mailserver just hit 90%, and it's 100GB. It was somewhere around 5-10% this morning. Not a good day.

Re:Skeptical

[NexusTw1n]

It depends on how clueless your email admins are.

Rather than blocking .scr/Pif/.exe and deleting any email with such an attachment, they are letting the group virus scanner on our exchange servers deal with the entire load.

So the virus scanner is scanning and moving to the infected folder literally thousands of these an hour. After it moves the infected message, it generates a nice email letting you know an email that was sent to you is currently in quarantine. Therefore this is generating even more work for the mail servers. Turning off this feature for a couple of days is apparently too much trouble.

The servers exchange is running on are therefore hanging every few minutes with all the disk and processor activity. Everyone gets a message every few minutes about "please wait, connecting to server" until you get fed up and close outlook down for the day.

This is the first virus I've ever seen to disrupt my work like this. But this is 100% the fault of our email admins who can't be bothered to write a couple of simple mail rules.

At the basic internet security zone Outlook can't even open .scr and .exe attachments, so why they don't delete this crap before it hits the servers I don't know.

Re:RPC Patch

[aldousd666]

If you're a company and it's going to cost you the money to clean worms, get a mail scanner. We haven't been infected with a single email worm for as long as I've been here at the company. (2 years) and we have 1400 users. I think a kink in the budget for scanmail once was a kickass investment in that we have been immune to every single worm (we actually patched everyone in time for the d-com worm as well, so we didn't get that one) If you're going to use windows, get a mail scanner, and deploy your patches via Group Policy before you hear about the exploits. And no, we don't have windows automatic updates enabled either, that's definately not the answer to anyone's problems, at least not in the corporate world. It may be good for people at home, unless they have dialup, then they're f'd, and shouldn't be trusting their computers to microsoft software. May I suggest a preventative approach: NTBUGTRAQ.com has a nice mailing list that seems to keep at least a few days ahead of the exploits. Russ Cooper has saved us more than once.

How did you get SoBig?

[og_sh0x]

I had a user that called me because he actually got a copy of SoBig in his inbox. Usually our mail scanners are really good at filtering out even the newest viruses. What I didn't realize is that our AutoUpdate had failed that day, so it didn't have the SoBig update. So I asked him, "Well how the heck did you get SoBig?" and he answered, "From eating so many sandwiches."

A great new slogan

[McAddress]

Linux during a virus epidemic, it's like being out of the country during the blackout.

Some companies deserve it

[EZmagz]

My company being one of them. The place I currently work (fuck it, I hate working there anyway...it's 3M, the Scotch Tape(tm) people) is a disaster zone right now. The entire IT staff is contract-only. There is no centralized IT plan for keeping systems up-to-date, beyond updating the software when the PCs come in for repair or an upgrade. That gives some users a 5 year timespan when no service packs are installed.

This week alone our entire department has been thrown around, manually patching EVERY box on the network. That's around 50,000 computers. Today alone I ran across probably 10 Windows NT boxes that were still running THE FIRST SERVICE PACK!

My point is, I do NOT feel sorry in the least when companies like 3M lose millions of dollars because they don't hire a competent IT department. Hell, out of the 20 guys I work with, only myself and two others graduated from a 4 year college. Whatever. For the last four days when full-timers have been bitching at me while I upgrade their PC because their order-tracking software won't work, I just smile and tell them "you get what you pay for. Tell your bosses to hire a competent IT department and you'll never have this problem again." Then I walk away and sigh because I know it'll never happen. Guess paying a contracting firm $40/hr so they can turn around and pay me $13/hr while they get to save themselves from paying benefits is worth the millions of dollars in downtime.

Anti-virus Programmers Crack IP Encryption

[Jugalator]

According to a swedish newspaper (I'm sure others run the story as well by now), anti-virus programmers have now finally cracked the 20 IP addresses SoBig will get its updates from this weekend. It's now a race against time to shut those IP addresses down. The IP addresses are located in USA and Canada.

The reason it took this long to get the IP addresses were because they were heavily encrypted in the code and they couldn't to the usual "dump memory" trick when the virus was active since the IP addresses were only stored in memory just when they were needed, then the memory was freed.

The anti-virus guys at F-Secure don't know what will happen if they don't shut down the 20 addresses in time, only that something might happen if they don't take down all addresses.

Unusually clever actually, since I usually find viruses to be rather poorly coded and much like a hack job, like the Blaster virus that shouldn't have crashed the Windows computers much more efficiently go unnoticed. Anti-virus developers have also noticed this about SoBig and it is not very exhibitionistic either, like viruses usually are. These signs suggest that it's a more professional work than usual.

Re:Sobig not really M$'s fault

[ratfynk]

Why the hell would I use wine to open e-mail under linux? Linux is not spreading this shit the MS UI is. Get your facts strait. The fault is entirely MS they are counting on this kaos so that they can step forward with the ultra secure win 2003 server and then the Longhorny security solutions. Your are spreading fluff and fud! Yes everyone is going to rush and secure their computers with Longhorny. But as Ben Franklin said "Those who sacrifice freedom for security will gain neither."

Email notification: A cure worse than the disease

[greywalker]

"Sunner said that most of the problems caused by SoBig involve the time and cost of cleaning the worm from computer systems."
My experience with this virus may be abnormal, but I have to completely disagree with that statement. As a dispatch tech for a large state university, I've been up to my eyes in emails related to the virus, but have only found However, the amount of email traffic on campus has been mind-boggling -- it even took down our mail servers a few times. And less than 10% of the emails were from the virus. Most of them were f*cking auto-notification emails from other servers that someone had sent the damn virus, which thanks to the spoofing feature, was almost never true. Why don't server admins turn off such notifications when dealing with a mass-mailer/spoofer virus? All these assorted servers managed to do was clog up our mail server with these meaningless "you have sent us a virus" emails that do nothing but contribute to any damage the does!!
IMHO, the REAL cost of dealing with this virus was bearing the burden of 100,000 stupid auto-generated emails that other servers were sending us, in response to emails that didn't even come from us.