Microsoft Mail Worms Gang War?

cuzality writes "The media is now beginning to suggest that this recent onslaught of new viruses (with new versions of major-impact viruses being found daily) the result of a virus gang turf war, kinda like the India/Pakistan virus conflict, in which official Pakistani sites were savaged by such infamous groups as Indian Snakes and Indian Hackers Club. The gangs are shooting fast and loose: variations of the big ones are being discovered daily (as of March 4, we are up to MyDoom.H, Netsky.F, and Beagle.K), and in the space of three hours on Wednesday morning, five variants of these three were first discovered. Typically these viruses (or more correctly, worms) do little damage to the infected computer, intent mostly on spreading far and wide, and sometimes inflicting DoS on some poor evil empire."

Comments

Ah, the power of /. spelling!

[Daniel Dvorkin]

From the article:

Most of the comments tucked inside the latest bugs are brief, unprintable and poorly spelled. "Bagle -- you are a looser!!!" opined the author of the sixth version of Netsky.

Hmmm, where have I seen that misspelling before? Let me think ...

Virus Activity

[Eberlin]

Wouldn't this much virus activity raise the chances of being caught? Pride has been the downfall of a great many "1337 d00dz" who can't seem to avoid bragging about their 5|i77z. Then again, if you did stage such acts, it does nothing for your ego unless people know you did so.

These are not your stealth haxorz, these are the works of script kiddies. But of course everyone here already knew that.

Server-side filters?

[Dominic_Mazzoni]

Can anyone recommend a good server-side tool to block viruses and worms? I'm using procmail now with a bunch of handwritten rules, and they work well on a bunch of older viruses, but there are so many new variations now that I can't keep up! On the client side, Bayesian filters (in Mozilla Mail and Apple Mail.app, for example) work reasonably well with spam, but they have a harder time with viruses and worms. It's also more annoying because viruses and worms are so large (30k or 100k, typically) and my local mail client has to download the entire message before filtering it out.

Note that I don't want to just block all messages containing attachments with certain extensions. There are many legitimate reasons for someone to send me a zip file as an attachment.

Re:Yeah, it's a gang war alright...

[TCaptain]

you're not kidding.

At my office, we are using a non-standard email client that doesn't allow execution of code in any way and we still got nailed.

why?

The moron in the next cubicle (a PROGRAMMER no less) did this:

1) viewed the email (after receiving 5 memos specifically saying to just delete it)
2) clicked on the attachment
3) selected save as
4) opened up explorer, went LOOKING for the attachement
5) executed it by doubleclicking.

I mean seriously! his defense when confronted?
"Well I wasn't sure...so...hum...we'll I wouldn't have done that at home!"

I wanted to beat the crap out of him...

What's more likely...

[Kyouryuu]

What I think is more likely is that some spam mail company is commissioning virus writers to create these worms in order to spread their operations. Sobig's objective, after all, seemed to be based on setting up infected machines as peer-to-peer drones for use by the author. It is a logical extension of the "monolithic" approach I'm certain most spammers follow of having several powerful computers running at all hours of the day, consuming electricity, bought and maintained, stashed away in a basement. Why not take advantage of a peer-to-peer system and infect the computers of careless Internet users and exploit their ignorance to become spam drones?

That's where I think this is all ultimately headed. The spammers are in bed with the virus writers, who have taken the penis enlargement pills as commission. :P

No more attachments.

[Animats]

It's time to just block all E-mail attachments. If you want to send a file, do it some other way, like uploading it to a server for explicit download.

Allow PDF, GIF, and JPEG at the firewall and in the mail client. That's it.

Microsoft needs to turn off the "feature" that clicking on a mail attachment runs it. It should just be "viewed", with a dumb viewer. It should be impossible to launch programs from mail attachments. Users should have to explictly save to a file and run to do that.

Re:I would like to point out...

[b0r0din]

Little damage, my ass. However, I will point out, that on a positive note, I work in a network callcenter, every time one of these babies comes out our call volume spikes by as much as 30%. These virii are at least keeping the calls coming in, which is how we generate cash. So at least for us, it's job security on some scale.

Of course it doesn't help that people we've helped in the past by emailing them fixes, solutions, and patches have us under our address books, so in turn we get all their email telling us 'Hi.'

Re:Of course these viruses are for posturing

[Elwood P Dowd]

You're just plain wrong.

People are beginning to write viruses for money. Witness the latest ICQ worm that monitors and relays all HTTPS and i-banking data back to HQ. It was modular and appeared to be written by a team of programmers.

Klez and Bagle also both seem like for-profit endeavors. Klez seemed to be a team perfecting their methods in such a way that they were sure the world's security wouldn't clamp down in response: They had a sunset written into the program. I guarantee you there are hundreds of thousands of people with Klez on their computer out there that never got cleaned up. For a long while, after every sunset they released a slightly improved product.

Once they got it right, they stopped. Maybe they're working on new methods, another virus, or they're looking for some spammer to pay them for 100,000 free mail relays before they release again.

But it's not just for posturing. It's organized crime. They're going to get paid.