Lousy E-mail Filters Complicating Outlook Worms

Mar writes "FRISK Software founder Fridrik Skulason has issued an open letter in which he blames other anti-virus companies for much of the Sobig.F network load problems: 'If mail filters send out one message for every copy of Sobig.F received, they are in effect doubling the amount of traffic. This makes them a part of the problem, not a part of the solution.'"

Comments

But still less...

[mindriot]

...traffic than you'd have if the worm got to its target and continued spreading.

Re:But still less...

[LiquidCoooled]

Shouldn't it be handled one step further upstream - ie when the mail is being transmitted initially.
In the same way that the server indicates error messages regarding destination addresses or transmission errors etc, couldnt the virus checker scan the data at that point, and only allow the data in if its clean?

Re:But still less...

[LiquidCoooled]

I would not want to ban based upon email address, there would be no way to identify the fake from the real.
No, the AV companies need to start working on an effecient mailserver (or simply hook into the existing ones), and prevent sucessful transmission of viral contents.

Because it would be on an upstream server away from the users, Virus definition files will be updated quicker, and protection will be automatic.

The problem then becomes one of localised ISP traffic only, and this can be cured by the ISP themselves. Another benfit of this, the ISP can send a single "You are infected" mail to the Account holder of the source IP.
For Unknown IP addresses - simply block relay access :)

Re:But still less...

[John Miles]

Did you ever stop to think that many of the Internet's protocols were designed when there were no fuckwits running operating systems that are a virtual "petri dish" for viruses and worms?

(Shrug) Bad engineering is bad engineering. Postel's accomplishments were legion, but in the email department, he and his colleagues dropped the ball big-time. There's just no room to defend the decisions that were made.

The minute the Internet showed signs of growing out of the obscure DARPA-funded labs where it was born, the engineers should have started paying attention to security and authentication issues. It would not exactly have been hard to fix SMTP by disallowing open relays and including a trivial sender-authentication mechanism to prevent forged headers, but now it's probably too late. A couple dozen lines of C code written between coffee breaks at USC would have made all the difference.

That being said, the bouncing-attachment idiocy most likely has more to do with the default configurations of popular server-side virus filter packages than with anything Postel was involved with. The common denominator is that people with a great deal of responsibility in the Internet engineering field seemed to have taken leave of their senses at a few critical junctures with no one around to say "Hey, wait, maybe that's not a smart thing to do."

Re:But still less...

[SSpade]

So thanks, antivirus programmers. Thanks for wasting my time instead of doing your job correctly. How long would have taken to add an extra if(){} to your code, and another boolean field to your virus database?

They are doing their job correctly. They're using spam (email? check. bulk? check. unsolicited? check. heck, commercial? check) to advertise their virus filtering products.

They're violating various state anti-spam laws, so there's one obvious way to encourage them to stop spamming.

How come we even get them?

[TerryAtWork]

This is completely stoppable at the ISP level. I received over 1,000 SoBig.F messages, not one of which had to go through!

Re:How come we even get them?

[ConceptJunkie]

My ISP offers Postini, which is a pretty decent spam filter, for free. Therefore the 20,000 or so SoBig virus and related crap got stopped before it reached the mail server.

Of course, the folks at Postini have failed to take Microsoft's abysmal software into account: You can view/delete quarantied spam up to 200 at a time, but viruses must be deleted 10 at a time. Thpthpthpthpthpptt!

Microsoft: Creating the most effective virus development tools for over 10 years!

Re:How come we even get them?

[lseltzer]

My latest column deals with this too. I got a lot of e-mail in response from ISPs talking about how it would be difficult/expensive to implement and that it would violate customer privacy. One said it would be a HIPAA violation. My own ISP (Speakeasy.net) virus-scans all e-mail that goes through their servers; is that a HIPAA violation? A lot of them are also scared of losing customers after offending them by blocking their outbound port 25 access, but does an ISP really want business from someone infected with Sobig?

It is true that since Sobig uses its own SMTP server the ISP would have to do the monitoring via a port 25 monitor. I'm not completely sure how difficult/expensive this would be to implement on a large scale, but there's an opportunity for someone who comes up with a cheap solution. I suppose it could be part of a general IDS, but it needs to be something price-accessible to an ISP.

Larry Seltzer
Security Editor, eWEEK.com
http://security.eweek.com/

Re:How come we even get them?

[nacturation]

It is true that since Sobig uses its own SMTP server the ISP would have to do the monitoring via a port 25 monitor. I'm not completely sure how difficult/expensive this would be to implement on a large scale, but there's an opportunity for someone who comes up with a cheap solution. I suppose it could be part of a general IDS, but it needs to be something price-accessible to an ISP.

This is trivial. Allow for normal port 25 access to the ISP's email server (with the usual restrictions on volume and content) and, for external port 25 access, there's a number of possibilities:

1. Allow the client to setup a pre-determined list of specific hosts they want to connect to. This might be done using a web-based interface.
2. Only allow the first 10 hosts (per dialup connection, per DHCP lease, per hour, etc.) to be accessible via port 25. This should satisfy even power users as few need to check mail on over 10 different servers. Adjust number as appropriate.
3. Setup a proxy service which allows unlimited port 25 access. Any viruses which include their own SMTP delivery engines won't know about the proxy and will simply fail. There's no additional security risk to using your ISP's proxy than using the ISP's connection itself, as both can be logged with equal ease.

Re:How come we even get them?

[Tony-A]

Something I don't think I've seen addressed in coping with these things. Short-term versus long term. The tactics and priorities are quite different.
Getting rid of all of them is a long-term process.
In the short term, you want to stay operational with minimal colateral damage. While emergency training will certainly help, it's almost a certainty that what needs to be done is not covered in the book. Sophisticated tools could certainly help, but it seems to me that with TCPDUMP and a pair of eyes and almost no knowledge it would be obvious that something was going on plus a few clues as to what and from where. I suspect that the best bet for long-term survivability is to leave decisions at the point of crisis to the whim of whoever is manning the stuff at the time.
One PC goes wild. Probably ignored since there's plenty of capacity to handle it.
One PC goes wild and a large bunch of it neighbors do too. You do something to stop the flood. Probably catches a bit of legitimate stuff too. Then you look and see what's making the flood and refine your stuff a bit. After such as Slammer, I would rather see a mixed-up mess that gets the internet back operational in an hour than something carefully thought-out that gets it back in 24 hours.

No doubt!

[tbase]

If the e-mail filter is smart enough to know it's Sobig.F, why isn't it smart enough to know the "from" is spoofed?!?!?

I set our filters to just delete anything with an executable attachment, but that didn't to crap for the stupid "Virus Detected" warnings.

One guy was sending us about 150 copies a day, and the others his PC sent out with our address as the "from" resulted in about 50-75 Virus warnings a day - from the first day it popped up until it expired. I had his IP address, and called and e-mailed his ISP (Birch.net) a dozen or more times, and they did squat. 150 x ~100k x # of people in his address book - not to mention the undeliverables and virus warnings - and they did nothing.

Fuzzy Math

[Akai]

The SoBig.(X) (all of 'em, been getting them for months, good thing Evolution doesn't care) are all around 100K a piece.

A "your message was filtered" is maybe 2-3K including all headers (more likely under 1k), so responding to messages with Virus' in them adds 1-3% not 100% to the traffic.

That being said, since most of the current generation of SoBig happily fake the "From" email address, a reply to the from address doesn't really help anyone either.

So in the worst case scenario, a 3K reply to a fake email address results in a bounce message, so at the most you've got 5% overhead, and theoretically for that 6K of email, you've saved a user from getting infected, which would generate 100K*1000's of data.

I'd say it's not too high a price to pay.

Re:Fuzzy Math

[Zak3056]

A "your message was filtered" is maybe 2-3K including all headers (more likely under 1k), so responding to messages with Virus' in them adds 1-3% not 100% to the traffic.

First off, disclaimer: My mail servers have been (until SoBig) configured to send "Hey, you sent us a virus" messages. We stopped this practice because SoBig is so damn prolific that it proved to us this was absolutely worthless and harmful.

That said, there are some REALLY stupid people out there that not only bounce to the "sender," but are also kind enough to INCLUDE A COPY OF THE DAMN ATTACHMENT.

These, ahem, "virus scanners" really DO increase the load by 100%, and worse yet, are actually SPREADING the virus!

Re:Fuzzy Math

[Snowdog668]

You'd be right and I wouldn't care if I only got the headers. Unfortunately about 95% of the bounce messages I've gotten contain the original attachment as well. Thank goodness I check that account on webmail so I didn't have to wait to download the messages over dial-up(stuck in the great broadband wasteland). It was easy to get rid of from my point of view because all I had to do was was go down the list and mark all the e-mails that were 100k for deletion and get rid of them. If I had to actually download each message over my dial-up account because some sysadmin decided to bounce the entire message I'd be seriously pissed.

As a mailing list manager...

[winkydink]

I have many more complaints about misconfigured UNIX mail systems & poorly written vacation programs than I do about Outlook filters.

This FRISK dude needs to go back and look at his assumptions:
Worse yet, if mail filters send out one message for every copy of Sobig.F received, they are in effect doubling the amount of traffic.

huh? If person A's infected machine sends out 100 emails, and the one received by person Q generates a reply to sender, how does this double the amount of traffic. Sheesh! Calm down.

We've started to filter bounce messages.

[Future Man 3000]

All the bounces from viruses and faked spam 'From:' headers amount to about 5% of our worthless inbox content, so we've just decided to filter the stuff for a while until either the viruses die down or we determine that we really need the bounce messages for some reason.

It's pretty rare that an e-mail that we send out does not eventually get to its recipient, and in most cases the e-mail is in response to something so the recipient will let us know if they aren't getting a message from us, so this system has been working out well so far.

Good for this guy...

[fuqqer]

I work in Tech support for a telecommunications company and I get at least three calls per day regarding a message from Norton Antivirus. The message falsely states that they were a sender of the sobig.f virus. Of course, our users are completely up to date with their virus software and our e-mail servers catch the sobig virus. A big shame on you to Norton for having an e-mail enabled warning like that. It preys on the stupidity of end users.

Granted, if nobody talked about AIDS, the infection rate would probably skyrocket too. So is it better that there be a symptom of the virus such as increased network traffic. Or is it better to not inform external users and try to repair in house?

Maybe it offers a little job security too though.

It's viewed as promotion

[mcrbids]

One of my clients is an ISP - and they *want* the bounces to go out for the simple reason that it broadcasts to the world that "your mail is safe with us".

So the bounce messages go something like "Our mail server detected a virus in an email you appear to have sent, and we protected our customer ... For more information about our services come to --URL--"

I don't know if it's effective at all, but it sure doesn't cost much - the virus notification is essentially a mild form of SPAM which few people really get up in arms about.

Just to understand, there are market conditions behind those virus notices...

Just got my hand slapped by Data Security

[RobertB-DC]

I just got a call from the Data Security guy in my office. I've had run-ins with him before, because their scans of my PC would occasionally find that I run Eudora for my personal email rather than routing it through the corporate virus portal known as Outlook Express. My bosses have been supportive -- as long as I get my work done, who the heck cares what I've got installed?

Now, I get 50-100 messages from "helpful" virus checkers telling me that I sent them a virus. Duh, of course I didn't. But what's worse is when they try to help my by sending the damned virus back to me! So my Eudora inbox fills up with viruses. No problem, I just delete them, right?

But we've got real-time virus scanning installed, and the admins take a dim view of tweaking it to skip certain directories. It finds that In.mbx contains a virus and kills the file. Poof, there goes my Eudora inbox. Frustrating, but it was full of junk anyway.

This morning, though, I get a call from the head Data Security honcho. Norton called mommy when it found the virus, and did it often enough for me to show up on the admin guy's radar again. Now, I'm going to have to quit using Eudora at work, just because brain-dead virus protection is sending me viruses! I'd fight it again, but I have to agree -- if I keep downloading viruses, I'm part of the problem.

Thanks for nothing, AV companies. All you're doing is keeping yourselves in business with false virus alerts. Or maybe that was the "2. ???" in between "1. Spread Viruses" and "3. Profit!"

Not the problem

[Spazmania]

The mail filters that send out a message for each virus message received are not the problem. Indeed, they're just following the basic requirements for bounced messages listed in RFC 2822.

THE problem is the mail filters which also send a second message to postmaster@whatever domain. Whatever brainiac thought that one up should be shot.

Of course not.

[SuiteSisterMary]

At no point should a response be generated for a virus. Maybe five years ago, when viruses tagged along with legitimate data, but nowadays, a virus generates it's own delivery system, and there's no point to a bounce.

Challenge/response sucks

[letxa2000]

Yup, I agree that the whole idea of "bounce" has been killed by spam and by viruses.

The statement "If mail filters send out one message for every copy of Sobig.F received, they are in effect doubling the amount of traffic. This makes them a part of the problem, not a part of the solution" is also what I've been saying for months. This is a condemnation of challenge/response. Challenge/response is flawed conceptually in that it assumes the return address is correct. In an age of spam (which it supposedly addresses) and viruses it is absurd to believe the return address exists and sending email to the return address just multiplies the problem.

Challenge/response was never well thought out. It shifts the burden of spam filtering to the person that sends email to that user, and tends to mailbomb innocent users that happen to have their addresses forged by spam or viruses. All so someone can supposedly enjoy a spam-free existance with no thought to the hassle they are creating for others and the spam that they are creating by mailbombibf C/R challenges to forged addresses.

Hopefully with much better filters already available Challenge/response will just disappear. It's bad technology.

The response I got - it IS part of the problem

[ctwxman]

I received hundreds of bouncebacks from one organization. So, I did a whois and wrote to the contact listed:
My name is Geoff Fox and I am writing because I have received hundreds upon hundreds of message bounces from your **** mail server.
These messages are not originating with me. These are SoBig virus generated and are spoofing my address as the return.
I am asking nicely, but I need you to take action immediately. I am attaching a bounce message so you can see what I've received. From the headers it looks like they're actually coming from ***.com
Sincerely, Geoff Fox

I did get a response... but not what I had expected.

Geoff, Thanks for raising the issue of the SoBig virus infection.
From the information that you have provided, it does look like the infected machine is located at **** Architecs, Inc. of Harford, CT. Their contact information is provided below.
Have your IT technical staff contact the admistrative contact or the technical contact below. They may not realize that they have a SoBig infected machine and that it needs to be cleaned.
(whois stuff deleted)
It was signed by their Director of IT Security.

So, even at that level, he didn't realize he was doing something wrong... or that these bouncebacks came from him, not from the site that was infected. And, he felt it was my obligation to do something about it, not his!

Troublesome? Yes, but necessary ...

[ElektroHolunder]

I am currently looking into antivirus solutions for our company mailserver, and originally thought about disabling the bounce messages.

But unfortunately it seems that it could be illegal in Germany to intercept a message without notifying the sender. As far as I understand it, eMail seems to be subject to the same regulations as snail mail here, so dropping the message silently could constitute a legal hazard ..

Re:Troublesome? Yes, but necessary ...

[Juggler]

In many countries it is illegal to for a communications carrier to drop messages (e.g. e-mail) without notifying someone. However, you can generally choose between notifing the sender and notifying the recipient.

Notifying the recipient is the only technically "safe" course of action, since everything else may be forged and sending mail to it could be increasing the magnitude of the problem.

If the recipient then requests that you discard all such warning messages for him, then that's probably also legal - so it boils down to how you word the contract with the recipient.

I don't think law is really a practical obstacle in such cases. Additionally, in some countries in Europe (not sure about Germany) ISPs are granted specific permission to take steps to protect the network infrastructure from attacks, and virus outbreaks definately a form of attack.

Disclaimer: I work for FRISK on e-mail filtering, but I'm not a lawyer. :-)

Re:Here's what can be done.

[stevel]

I don't see how validating the received chain helps. That will detect forged headers, but not a forged From address, which is what the viruses do. There is no way to reliably detect a forged From address by looking at the headers.

Consider - I, and a lot of you too, I'm sure - routinely send out e-mail with a From address that has a domain unrelated to that of the outgoing SMTP server we are using. How can you tell the difference between such messages and those forged by viruses?

an Idea

[linuxislandsucks]

why not have the filter do a whois on the ip of sender and send the warning to the admin of that net block?

seems like abetter solution as it gets the virus warning in hands of the person that can do soemthing about it rather than sent to people who have no virus on their systems..

comeon how hard is it to parse the record gotten back from a whois query?

Re:Virus autobounces are stupid

[pboulang]

It really isn't all that big of a deal. As said earlier, at MOST 1 email is generated. This effectively doubles the impact of something like SoBig. When looking at a virus that is spreading not linearly, but geometrically, this double-sized payload begins to have little total impact. We aren't talking MB of data, we're talking a couple KB per message.

I suggest that at the very least, users get the message that there is something going on (even it it isn't there particular machine that is affected) and, knowing general users, they make admins aware: "What's this? Is this bad?!?" and anything to draw attention at the early stages of an outbreak (hmmm, maybe I should install patches) is a Good Thing(tm).

Most Email antivirus solutions are just plain dumb

[codeguy007]

I remember the day that SoBig.F reared it's ugly head. I can into work and must have had 40-50 emails claiming I sent a virus to some person I have never heard of. It was so many I actually figured I better check and make sure I didn't have the virus.

Even worse 1 in 4 of the messages sent the virus to me in the message bounce.

But in reality antivirus software is playing a losing game, it tries to get out virus definitions to protect systems after the virus has been released. Not only that the viruses have much faster distribution rate than the definitions so it's a loosing battle. We need a new solution.

I propose that we should call for a ban of Microsoft Lookout. In its short existence, it has become the most insecure piece of software every written -- surpassing Bind, Sendmail and even Wuftpd, programs much older than it.

While we are at it lets call for banning direct access to the internet for all windows based systems. Let's face it. If you put a windows box bare on the net, eventually it is going to be compromised. Windows wasn't originally designed to work on the internet and Microsoft has shoehorned in the internet support without proper security measures taken.

You can't rely on end users who are too afraid to install there own OS to properly secure and update the machine. Someone needs to do that for them and frankly Microsoft doesn't.

No-IP.com did it right

[splitretina]

I use No-IP.com. Within a few hours of the worm spreading they had turned off bounce notifications of virus messages. I received a total of 10 SoBig worm notifications messages, and none of the actual worm.

I think it's up to the ISP administrators to stay up to date with what is going on and to stop these sort of things in their tracks. That is why I get my email through a third party: so I don't have to deal with the bull. They have a responsiblity to their customers. I think No-IP did a great job living up to that responsibility.

Frisk has been around for a long time, I used f-prot in DOS. But I think the letter he wrote is definitely a marketing ploy. They have recently updated their site to a more modern interface and it seems they are attempting to make some kind of mainstream market pull. I have the f-prot trial on my work windows xp box and honestly, it's pretty good. Fast and stable and less intrusive than Norton AV. So it might be good for it to work out for them.

Re:Virus autobounces are stupid

[pboulang]

When looking at a virus that is spreading not linearly, but geometrically, this double-sized payload begins to have little total impact.

Nope. Because the bounce rate is simply a linear factor of (market share of idiot AV vendor) * (virus propogation rage). So if the virus goes geometric, so does the bounce rate.

Gonna have to disagree with your conclusion. When you have x^y where x is the size/impact of a single letter and y is the branching factor (average number of recipients per message) than (x+1)^y isn't a great difference. You see what I am saying?

I suggest that at the very least, users get the message that there is something going on (even it it isn't there particular machine that is affected)

That's *NOT* a good thing. If users get appropriate info, fine. But telling someone to upgrade when they could be just fine isn't good. People will start taking computers in for repair when they don't need them. Confusing people with constant virus warnings will make them blase about it and leave them with less information than they had before.

What does one do if they think they have a virus? If they are in a corporate environment, they ping the help desk (and that would be ONCE per person, regardless of the number of emails they get). If they are a home user, they make sure they have updated virus software. If they are clueless, then they will take it somewhere and get anti-virus software installed. which is what we really want. There is crappy software that is vulnerable, and if you run windows, you MUST run some kind of AV and update patches, etc. If they are confused or blase about having a virus, screw em. That is like keeping an open SPAM relay.

Re:Nice try, but ....

[90XDoubleSide]

The real answer is that virus definition files should have a flag that is set for viruses that always use forged addresses that tells the antivirus never to send an email in reply to that virus.

Re:Virus autobounces are stupid

[pboulang]

Gonna have to disagree with your conclusion. When you have x^y where x is the size/impact of a single letter and y is the branching factor (average number of recipients per message) than (x+1)^y isn't a great difference. You see what I am saying?

No, the math's still off. If x is the so big rate,

Ok, your hypothetical is wrong, not what I was saying. X is the impact or cost of a single sobig email. This is how much? 600k? if for EACH sobig email X there is a "random" message saying "You sent spam" which cost about 2k, the total impact is X + epsilon which I indicated as 1, a small constant. Instead of 600K it is 602K. Please note that I am not even going to bother figuring in the cost of building/tearing down TCP/IP etc as you aren't concerned when one big image is split into multiple images on a web page are you?

I think we need to look only at the normal case where for every sobig message sent that is "caught" an email is sent out. What I really wanted to point out wasn't when a bounce message is infectios (cause I agree wholeheartedly that sending that "back" infectable is dumb) but the case where a legitimate attempt to say "hey, there's and issue" is a couple KB is attempted.

What does one do if they think they have a virus? If they are in a corporate environment, they ping the help desk (and that would be ONCE per person, regardless of the number of emails they get).

Yeah, and in a large environment of thousands of people, that's *exactly* what the help desk needs. Trust me, I know some of these people, and it's driving them nuts.

It is the JOB of people manning a help desk to correctly educate the users. It takes me as an outside consultant about 1 minute to explain it for even the dumbest users and nobody would run more than 50:1 user:hd ratio. A major virus breaks out, the phone is tied up for an hour. That is COMPLETELY acceptable.

If they are a home user, they make sure they have updated virus software. If they are clueless, then they will take it somewhere and get anti-virus software installed.

And if they were already up-to-date, then they just paid money for nothing. And once they get up-to-date and know they're OK, and they keep getting messages, they learn to ignore them. So when another message comes out that they're not prepared for, they think they are.

Updating your virus software costs nothing. And if you need to pay because you don't have it, then are you saying that people should NOT have the latest AV SW?

Yes, they don't understand when 50 emails come in saying they have a virus when they really don't... but they need to be responsible for finding out what this SoBig thing is, and every search engine and geek cousin or hired help knows.

I get about 1000+ virus bounces a day

[Schwern]

I don't think I've gotten a single SoBig virus. Either they're not getting sent or something upstream is blocking them.

OTOH, I get about 1000+ pieces of virus related junk. Its exceeded spam. About half is anti-virus software telling me they blocked a virus. The other half is various bounce messages and autoresponders from viruses going out to addresses that no longer exist or to list admin addresses, lists that require verification, etc... with my email address.

How many legit pieces of email do I get a day? 100-200 maybe.

The situation is absurd. If your email address is widely available (in my case, in the Perl documentation) you'll get clobbered. I had to franticly write a set of SpamAssassin rules to block the antivirus reponses to make my mail usable again.

I've been archiving all my unfiltered, incoming mail since Feburary. 80,000 messages. If anyone seriously wants to run some statistics for how hard a popular email address gets hammered, I'll consider making it available.