Slashdot Mirror

← Back to Stories (view on slashdot.org)

Lousy E-mail Filters Complicating Outlook Worms

Posted by CmdrTaco on from the cluttering-up-my-inbox dept.

Mar writes "FRISK Software founder Fridrik Skulason has issued an open letter in which he blames other anti-virus companies for much of the Sobig.F network load problems: 'If mail filters send out one message for every copy of Sobig.F received, they are in effect doubling the amount of traffic. This makes them a part of the problem, not a part of the solution.'"

34 of 461 comments (clear)

  1. But still less... by mindriot · · Score: 4, Interesting

    ...traffic than you'd have if the worm got to its target and continued spreading.

    1. Re:But still less... by nacturation · · Score: 5, Insightful

      ...traffic than you'd have if the worm got to its target and continued spreading.

      That's a lousy argument for obvious poor behavior on the part of anti-virus software. It's like saying every time the police catch a violent criminal, they should kick the ass of some random citizen. Hey, it may be annoying, but it's still less violence than you'd have if the criminal got to their target and acted violently.

      --
      Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
    2. Re:But still less... by American+AC+in+Paris · · Score: 5, Insightful
      ...traffic than you'd have if the worm got to its target and continued spreading.

      I'm still getting about 200-300 "You sent a message with SoBig.F! Patch your computer immediately!" every day.

      Trouble is, I'm on a Mac. I couldn't be infected with SoBig.F if I wanted to.*

      Further trouble is, SoBig.F spoofs the FROM: field, so these messages invariably go to everybody except the schmuck with the infected box.

      So no, these messages hurt far more than they help.

      [* Pedant filter: I suppose I could buy Virtual PC or somesuch and install a vulnerable version of Windows. That'd probably do the trick.]

      --

      Obliteracy: Words with explosions

    3. Re:But still less... by mindriot · · Score: 4, Insightful

      Of course you're right. The bounces are becoming a problem because most new worm variants fake the From: header anyway. The question would be, what percentage of total SoBig.F-related traffic comes from bounces? It might, of course, be as high as 50% if every message sent is bounced; but Frisk didn't really point out how much the Bounce problem contributed to the general worm traffic.

      I'd be happy if bounces in SoBig-like cases were reduced, but I find it a weak argument to blame the worm problem on anti-virus software without giving numbers of how much bounces actually added to the problem. (Well, it's another anti-virus software producer writing this statement, so this open letter could be considered a PR statement to some extent.)

      Somehow this also reminds me of those stupid Windows firewall products that by default alert you of every single stupid network packet...

    4. Re:But still less... by arivanov · · Score: 4, Insightful

      It is well known that the Sobig.F and many other viruses forge the sender address. These viruses are identified by the relevant filter product.

      Then, why on earth do you send a notification to an address that is known to be forged?

      The answer is simple - free advertising payed with your and my money. It is not stupidity. It is malice. An outright form of advertising a product by SPAM. I think that any Washington (or other state with antispam laws) resident should sue them for this.

      --
      Baker's Law: Misery no longer loves company. Nowadays it insists on it
      http://www.sigsegv.cx/
    5. Re:But still less... by mph · · Score: 4, Insightful
      Further trouble is, SoBig.F spoofs the FROM: field, so these messages invariably go to everybody except the schmuck with the infected box.
      Yeah, I got tons of those Virus Warnings. I haven't run Windows, or any MS software, since 1995.

      The worst part of it is that the antivirus software sending these messages knows that it's SoBig.F. Thus, it should also know that the virus forges the From: header, and that it's pointless to send out the warning message to that address.

      So thanks, antivirus programmers. Thanks for wasting my time instead of doing your job correctly. How long would have taken to add an extra if(){} to your code, and another boolean field to your virus database?

    6. Re:But still less... by John+Miles · · Score: 4, Insightful

      And on top of that, some of them return the virus with the message. Therefore, it you don't have virus protection (which is stupid) and your address is forged on one, you might get a copy and also get infected.

      <rant>

      That's what utterly astonished me during the recent SoBig.F infestation. When an undelivered mail message with an attachment bounces, the mail servers return not just the subject line, or the message text, but the attachment to the putative sender.

      Were the architects of the common Internet mail utilities just plain stupid? What other conclusion can possibly be drawn? Who taught these epsilon-minus lackwits to use a computer, and why? What else am I supposed to think when a mail gateway or server is designed to bounce hundreds of kilobytes worth of attached junk to someone who, by definition, already has the data (since, after all, it's not as if he or she is the one who fucking sent it the first place)? And when it's designed to do so via an untrustworthy return address courtesy of the nullwits who designed the SMTP protocol, no less?

      It is WAY past time to scrap the Internet's existing email infrastructure in favor of something designed by actual engineers. What we have now is a giant, virtual Petri dish better suited for the cultivation of worms, viruses and spam than for communication between legitimate users.

      </rant>

      --
      Dahlmann tightly grips the knife, which he may have no idea how to use, and steps out into the plain.
    7. Re:But still less... by isomeme · · Score: 4, Insightful

      It can actually exceed 50% in some scenarios. For example:

      1. Trojan fakes from address of 'joe@foo.com', sends email to 'sue@bar.com' with infected attachment.

      2. Filter at 'bar.com' detects infected attachment, sends rejection email from 'sue@bar.com' to 'joe@foo.com'.

      3. It turns out that 'joe@foo.com' is no longer a valid address. 'foo.com' mail agent sends a delivery failure email to 'sue@bar.com'.

      Thus we get two pointless administrative emails generated by a single infected email.

      I am seeing this happening quite commonly, by the way.

      --
      When all you have is a hammer, everything looks like a skull.
    8. Re:But still less... by AKnightCowboy · · Score: 4, Funny
      Were the architects of the common Internet mail utilities just plain stupid? What other conclusion can possibly be drawn? Who taught these epsilon-minus lackwits to use a computer, and why?

      Why don't you go ask him:

      SIMPLE MAIL TRANSFER PROTOCOL
      Jonathan B. Postel
      August 1982
      Information Sciences Institute
      University of Southern California
      4676 Admiralty Way
      Marina del Rey, California 90291
      (213) 822-1511

      I'm sure many of us would love it if you met up with him and had a spirited debate about the issue very soon.

      Did you ever stop to think that many of the Internet's protocols were designed when there were no fuckwits running operating systems that are a virtual "petri dish" for viruses and worms?

  2. How come we even get them? by TerryAtWork · · Score: 4, Interesting

    This is completely stoppable at the ISP level. I received over 1,000 SoBig.F messages, not one of which had to go through!

    --
    It's Christmas everyday with BitTorrent.
    1. Re:How come we even get them? by lseltzer · · Score: 5, Interesting

      My latest column deals with this too. I got a lot of e-mail in response from ISPs talking about how it would be difficult/expensive to implement and that it would violate customer privacy. One said it would be a HIPAA violation. My own ISP (Speakeasy.net) virus-scans all e-mail that goes through their servers; is that a HIPAA violation? A lot of them are also scared of losing customers after offending them by blocking their outbound port 25 access, but does an ISP really want business from someone infected with Sobig?

      It is true that since Sobig uses its own SMTP server the ISP would have to do the monitoring via a port 25 monitor. I'm not completely sure how difficult/expensive this would be to implement on a large scale, but there's an opportunity for someone who comes up with a cheap solution. I suppose it could be part of a general IDS, but it needs to be something price-accessible to an ISP.

      Larry Seltzer
      Security Editor, eWEEK.com
      http://security.eweek.com/

  3. This is so true by blunte · · Score: 5, Funny

    Our Norton Exchange AV kicks out "we-saved-your-butt" emails to the admin, the original recip, and back at the "sender", who of course knows nothing about it since it was forged.

    I've just been creating more and more filters that send to trash with no notification to anyone.

    Of course, you have to pay attention when you first turn some of the capabilities on, as Norton kindly preset you to block AOL mail :) Serves AOL right...

    --
    .sigs are for post^Hers.
    1. Re:This is so true by toddestan · · Score: 4, Funny

      Maybe I should configure an autoresponder that responds to the message from Norton AV that tells the person how to turn off the autoresponse?

      *ducks*

  4. How about a real email client or real rules? by TWX · · Score: 4, Insightful

    Do most users exchange executable files? How about just blocking them if they're executable... How about getting an email client that isn't known for it's ability to spread received infected email without the user having to even open the email?

    /been using pine since 1996...

    --
    Do not look into laser with remaining eye.
  5. Hallelujah! by PopeAlien · · Score: 4, Insightful

    Not only are they doubling traffic, they can help spread the virus.. I've recieved bounced email containing the virus, since the the return address is randomized this in effect helps to spread the virus. Why include the attachment in a bounce message?

    --
    air and light and time and space
  6. No doubt! by tbase · · Score: 4, Interesting

    If the e-mail filter is smart enough to know it's Sobig.F, why isn't it smart enough to know the "from" is spoofed?!?!?

    I set our filters to just delete anything with an executable attachment, but that didn't to crap for the stupid "Virus Detected" warnings.

    One guy was sending us about 150 copies a day, and the others his PC sent out with our address as the "from" resulted in about 50-75 Virus warnings a day - from the first day it popped up until it expired. I had his IP address, and called and e-mailed his ISP (Birch.net) a dozen or more times, and they did squat. 150 x ~100k x # of people in his address book - not to mention the undeliverables and virus warnings - and they did nothing.

    --

    666-607: 6th floor apartment of the beast
  7. Fuzzy Math by Akai · · Score: 4, Interesting

    The SoBig.(X) (all of 'em, been getting them for months, good thing Evolution doesn't care) are all around 100K a piece.

    A "your message was filtered" is maybe 2-3K including all headers (more likely under 1k), so responding to messages with Virus' in them adds 1-3% not 100% to the traffic.

    That being said, since most of the current generation of SoBig happily fake the "From" email address, a reply to the from address doesn't really help anyone either.

    So in the worst case scenario, a 3K reply to a fake email address results in a bounce message, so at the most you've got 5% overhead, and theoretically for that 6K of email, you've saved a user from getting infected, which would generate 100K*1000's of data.

    I'd say it's not too high a price to pay.

    --
    Please send all UCE to scally@devolution.com so I can f
    1. Re:Fuzzy Math by realdpk · · Score: 5, Insightful

      There's some flaws in the logic.

      First, there's a cost per message that you're not including. Every message I get I have to consider and read, or delete. I'm getting tons of virus bounces, even though I've never sent a virus - the virus uses forged headers. So, for me, someone who has no way to contract a virus, my "work"load has gone up noticably, and the price I pay went from $0 to $X where X is a positive number.

      Second, the autoresponder is not a necessary part of the virus removal. The savings is already there by blocking the virus from infecting the user's computer. The bounce is just an extra thing the anti-virus people put in to try to advertise their product.

      It's *pretty damn close* to being spam.

    2. Re:Fuzzy Math by Snowdog668 · · Score: 4, Interesting

      You'd be right and I wouldn't care if I only got the headers. Unfortunately about 95% of the bounce messages I've gotten contain the original attachment as well. Thank goodness I check that account on webmail so I didn't have to wait to download the messages over dial-up(stuck in the great broadband wasteland). It was easy to get rid of from my point of view because all I had to do was was go down the list and mark all the e-mails that were 100k for deletion and get rid of them. If I had to actually download each message over my dial-up account because some sysadmin decided to bounce the entire message I'd be seriously pissed.

      --
      I wouldn't say I'm a bad gambler but the last time I went to Vegas I even lost a buck on the soda machine.
  8. I completely agree by PktLoss · · Score: 4, Insightful

    One member of our software development team ended up receiving over 10,000messages/hour during our peak load, about equally split between virus messages, and bounce backs/mailer daemon messages. The latter weren't blocked by the standard anti-spam solution.

    The messages generally contain no usefull information, and are deleted without reading.

    Spam catchers should be combined with anti virus solutions, to ensure that authentic messages do generate some sort of response, either to the sender or receiving, informing them of the infection. The technologies would mesh well in this case.

    --
    paul reinheimer
  9. Good for this guy... by fuqqer · · Score: 5, Interesting

    I work in Tech support for a telecommunications company and I get at least three calls per day regarding a message from Norton Antivirus. The message falsely states that they were a sender of the sobig.f virus. Of course, our users are completely up to date with their virus software and our e-mail servers catch the sobig virus. A big shame on you to Norton for having an e-mail enabled warning like that. It preys on the stupidity of end users.

    Granted, if nobody talked about AIDS, the infection rate would probably skyrocket too. So is it better that there be a symptom of the virus such as increased network traffic. Or is it better to not inform external users and try to repair in house?

    Maybe it offers a little job security too though.

  10. It's viewed as promotion by mcrbids · · Score: 5, Interesting

    One of my clients is an ISP - and they *want* the bounces to go out for the simple reason that it broadcasts to the world that "your mail is safe with us".

    So the bounce messages go something like "Our mail server detected a virus in an email you appear to have sent, and we protected our customer ... For more information about our services come to --URL--"

    I don't know if it's effective at all, but it sure doesn't cost much - the virus notification is essentially a mild form of SPAM which few people really get up in arms about.

    Just to understand, there are market conditions behind those virus notices...

    --
    I have no problem with your religion until you decide it's reason to deprive others of the truth.
  11. Just got my hand slapped by Data Security by RobertB-DC · · Score: 4, Interesting

    I just got a call from the Data Security guy in my office. I've had run-ins with him before, because their scans of my PC would occasionally find that I run Eudora for my personal email rather than routing it through the corporate virus portal known as Outlook Express. My bosses have been supportive -- as long as I get my work done, who the heck cares what I've got installed?

    Now, I get 50-100 messages from "helpful" virus checkers telling me that I sent them a virus. Duh, of course I didn't. But what's worse is when they try to help my by sending the damned virus back to me! So my Eudora inbox fills up with viruses. No problem, I just delete them, right?

    But we've got real-time virus scanning installed, and the admins take a dim view of tweaking it to skip certain directories. It finds that In.mbx contains a virus and kills the file. Poof, there goes my Eudora inbox. Frustrating, but it was full of junk anyway.

    This morning, though, I get a call from the head Data Security honcho. Norton called mommy when it found the virus, and did it often enough for me to show up on the admin guy's radar again. Now, I'm going to have to quit using Eudora at work, just because brain-dead virus protection is sending me viruses! I'd fight it again, but I have to agree -- if I keep downloading viruses, I'm part of the problem.

    Thanks for nothing, AV companies. All you're doing is keeping yourselves in business with false virus alerts. Or maybe that was the "2. ???" in between "1. Spread Viruses" and "3. Profit!"

    --
    Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
  12. Re:Yes, virus bounces suck by realdpk · · Score: 4, Insightful

    The bounces from the anti-virus software programs is pretty damned close to spam. Close enough that it gets their name out there, but not close enough that they'd actually be pinned about it except by the most self-righteous of the anti-spammers.

  13. Microsoft EULA Security Update enclosed: by Anonymous Coward · · Score: 4, Funny

    Critical Update:

    A security issue has been identified that could allow an attacker to compromise a computer running Microsoft Windows and install Linux on it. You can help protect your computer by installing this EULA from Microsoft. After you install this EULA, a NULL update will be downloaded for your benefit.

  14. Re:Yes, virus bounces suck by Xzzy · · Score: 4, Funny

    I must have really smart friends, because I didn't get a single bounce! /preen

    Or maybe I just have no friends. /sigh

  15. Speaking of bad email filters... by Anonymous Coward · · Score: 4, Funny

    We have Mail Marshall here at work. I got the following mail from the system yesterday...

    MailMarshal (an automated content monitoring gateway) has stopped the following email for the following reason:

    It believes it may contain unacceptable language, or inappropriate material.

    Message: B000038072.00000001.mml
    From: xxx@xxx.com
    To: xxx@xxx.com
    Subject: Re: So Whuz Up?

    Please remove any inappropriate language and send it again.

    The blocked email will be automatically deleted after 5 days.

    MailMarshal Rule: Inbound Messages : Block Unacceptable Language Script Offensive Language (Basic) Triggered
    Expression: asshole Triggered 1 times weighting 5


    Email security by MailMarshal from Marshal Software.

    So the message tells both the ortiginal sender and I that it won't deliver the email because it contains the term "asshole". So it lets me know that by sending me an email telling me the exact same word that was supposed to be filtered? It seems like we've got a hypocrytical mail filter here :(

  16. Re:His two minutes by Juggler · · Score: 5, Informative
    Not true, most worms and viruses have spoofed the From address for quite a long time now.

    Autoreplies have always been problematic at best, which anyone who's experienced the annoyance caused by vacation programs on public mailing lists can attest to. Autoreplies to automatically generated traffic have always been a no-no.

    Viruses and worms are clearly autogenerated traffic.

    Also, although 95% of computer users have never heard of FRISK, Fridrik has been a respected member of the A/V community since it very began and wrote one of the very first virus scanners.

    Disclaimer: I work for FRISK, writing said e-mail filter code. But I can tell you with authority that the decision was taken a long time ago.

    --
    Host your own websites, anywhere!
  17. The response I got - it IS part of the problem by ctwxman · · Score: 5, Interesting

    I received hundreds of bouncebacks from one organization. So, I did a whois and wrote to the contact listed:
    My name is Geoff Fox and I am writing because I have received hundreds upon hundreds of message bounces from your **** mail server.
    These messages are not originating with me. These are SoBig virus generated and are spoofing my address as the return.
    I am asking nicely, but I need you to take action immediately. I am attaching a bounce message so you can see what I've received. From the headers it looks like they're actually coming from ***.com
    Sincerely, Geoff Fox

    I did get a response... but not what I had expected.

    Geoff, Thanks for raising the issue of the SoBig virus infection.
    From the information that you have provided, it does look like the infected machine is located at **** Architecs, Inc. of Harford, CT. Their contact information is provided below.
    Have your IT technical staff contact the admistrative contact or the technical contact below. They may not realize that they have a SoBig infected machine and that it needs to be cleaned.
    (whois stuff deleted)
    It was signed by their Director of IT Security.

    So, even at that level, he didn't realize he was doing something wrong... or that these bouncebacks came from him, not from the site that was infected. And, he felt it was my obligation to do something about it, not his!

  18. FYI Taco and Mar by Abm0raz · · Score: 5, Informative

    Lousy E-mail Filters Complicating Outlook Worms

    SoBig.F is not an Outlook worm. It is a Windows worm. It does not require Outlook to run. It has it's own built in MTA and grabs email addresses from cached webpages and local text files as well as the Outlook/Express address book.

    -Ab

    --
    Nothing fails quite like prayer.
  19. Troublesome? Yes, but necessary ... by ElektroHolunder · · Score: 4, Interesting

    I am currently looking into antivirus solutions for our company mailserver, and originally thought about disabling the bounce messages.

    But unfortunately it seems that it could be illegal in Germany to intercept a message without notifying the sender. As far as I understand it, eMail seems to be subject to the same regulations as snail mail here, so dropping the message silently could constitute a legal hazard ..

  20. Message Headers should be Compulsory by gvc · · Score: 5, Insightful

    Last year, my wife received a spate of "you sent this virus" messages. Worse, a number of her associates received "this person tried to send you a virus" message, referring to her.

    I followed up with several of the administrators running the virus filters. In all cases, the administrators had quarantined the messages without headers so it was impossible to tell what machine really sent the message. I would have liked to know this information so as to have some hope of tracing the owner of the infected machine.

    I understand why users are unaware of headers. Microsoft's products go out of their way to hide them. In Outlook Express, to get headers you have to find the relevant show headers pull-down and even then the headers appear in a too-small non-resizable window. You have to clip the contents and paste into a real window before the headers can be read/forwarded.

    The "From:" field of email means no more than the snail-mail return address that you scribble on an envelope. The header, like the snail-mail postmark, tells the origin.

    What is the excuse for vendors of email software (filtering or end-user) perpetrating unawareness of this basic property of email?

  21. Re: Forged From: viruses by frankie · · Score: 4, Informative
    Until recently, no e-mail worms spoofed the email address

    What is your definition of "recently"? Apparently it's about two years.

  22. Cry me a river by maggard · · Score: 4, Insightful
    I just got a call from the Data Security guy in my office. I've had run-ins with him before, because their scans of my PC would occasionally find that I run Eudora for my personal email rather than routing it through the corporate virus portal known as Outlook Express.
    You on the clock? In the company office? Using company hardware? On an account with access to material the company would probably rather not get corrupted, infected, or randomly sent out to strangers?

    Uh huh.

    So you wanna read your personal email at the office. Fine if your company supports that.

    But then you just absolutely positively gotta use only your favorite email client, not the one already installed, not a web portal. The email client now installed by you, presumably licensed to you, that is not owned or supported by IS. The one that makes IS's day that much tougher by throwing one more ingredient into the stew that is the company's desktop computer.

    Now on top if it your personal email client reading your personal email is bringing in viruses to the company. Onto that corporate PC logged into the corporate network. And dammit those nasty folks in IS aren't willing to spend their time making exceptions to the virus scanning so your unique-in-the-company personal email client reading your personal, virus-infected email is exempted.

    Cry me a river.

    --
    I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.