Sober.P Worm Accounts for 5% of all Email Traffic

destuxor writes "The grave insecurity of the day is the Sober.P worm which is currently pushing nearly 5% of all email traffic at the moment. Unlike previous worms, Sober can disable the Windows Firewall and Symantec Antivirus. Interestingly, patched machines are not vulnerable to the exploits used by this worm. What are we going to have to do to convince "ordinary users" to visit WindowsUpdate once in a while?" update percentage corrected.

Comments

Re:Nothing really

[Short Circuit]

It doesn't have to be in the same high-level languge the OS was written in; it could be a compiler-specific intermediate language, like GCC's SSA.

Such an arrangement offloads some of the compiling process to Microsoft's servers, and obfuscates the patch.

The compiler included with the OS doesn't even have to support any other language. And it can require a signed certificate from Microsoft to accept the code.

The only way to wake people up

[NtroP]

Remember the good old days when viruses did real damage? Remember when they actually did format your hard drive or screw up you boot sector? That made people sit up and take notice.

If virus writers ever changed their tactics from one of "sneak in and just borrow their CPU cycles and bandwidth for my bot-net" to one of "let's infect, spread, then kick them in the nuts" people would take notice once again.

Several years ago there was a virus that went around replacing jpegs with copies of itself (or something). My friend had a struggling web-hosting business where he hosted websites for about 100 different small mom-and-pop shops. Even though I warned him about the risks of viruses and that he should run his site with Linux/Apache he didn't listen. That virus wiped him out.

No, he didn't have up-to-date backups. But guess what? He keeps meticulous backups now and keeps his computers patched with up-to-date virus software and only connects to his web server via ftp (no mounted shares any more).

Alas, he still hasn't embraced Linux or OS X, but at least he's not part of the problem any more.

Just think what would happen if a virus spread around and just looked for .xls files and quietly changed all the 3's to 7's? How far back would companies have to go into their backups to be sure they had a known-good copy? D'ya think they might take viruses and security more seriously then?

The last major hassle we had with a worm was primarily due to the enormous amount of traffic it generated, bringing our networks to their knees. That was an annoyance to management, but they saw it as a network problem - not a virus/worm/security problem.

One of these days some one or some group is going to unleash a virus that really IS going to do real damage. Maybe then people will realize that they aren't sitting in front of an internet toaster, but sophisticated computing device that has a tremendous impact on many aspects of all of our lives.