NWA-PCUG Newsletter Article, May 2004
Under Attack by Cyber Worms
by Ira Wilsker, APCUG Board of Directors
ira-wilsker@apcug.org
(click to email author)


If you use email, as you most likely do, you may have noticed the recent increased onslaught of worms and viruses. Using a variety of techniques, the latest attacks are once again flooding our inboxes with dangerous content, as well as seeking out security holes in our systems and attacking us through our internet and network connections.

One insidious family of new pests is the group referred to as the “Bagel” or “Beagle” virus and worm family. Now spreading endemically, as I type this, are sixteen variants, referred to by the sequential letters “A” through “K”. These nasties were explicitly designed to slip through most spam filters, and many antivirus scans by concealing their malicious payload in a password protected zip (compressed) file, which can only be opened by opening the email, and clicking on the attachment, and entering the password shown. The rapid appearance of the many variants also makes it easier to slip through our antivirus defenses, and more difficult to protect against. While most of us are reluctant to click on attachments from unknown senders, these creatures try to use “human engineering” to trick us into opening the email and activating the attachment. This is accomplished by spoofing the “From:” line and making it falsely appear to be from the management, tech support, email server, billing department, or other department of your ISP (Internet Service provider). They use an internal template to create a variety of subjects and messages incorporating the name of the ISP in order to appear to be authentic. Some of the common subject lines are “E-mail account security warning”, “Warning about your e-mail account”, “Email account utilization warning”, “E-mail account disabling warning”, and similar subjects. The body of the message typically starts with some variation of “Dear user of (the name of your ISP)”, followed by text indicating that your email account is about to be disabled, you have been sending out infected emails, the email server will be shut down, and similar attention getters. The punch line may be of the type "For more information see the attached file" or "Please, read the attachment for further details." To make it look even more legitimate and secure (and to bypass spam and virus filtering) it may contain a closing line to the effect of “For security reasons attached file is password protected” or “The password is (password)."

The infected email is signed with "Sincerely," or "Best wishes," or some nicety, and often has a tagline "The team, http://www.(the name of your ISP)"

Attached to the email is an innocent looking file possibly with the filename (ending in “.zip”) “Information”, “Readme”, “Document”, “Message” or some other innocuous name. If this file is opened, and your antivirus software does not detect the payload, the computer will be instantly infected. Once infected, the worm will search your computer for any email addresses, and use its built-in email utility to replicate itself to the email addresses found on your computer, again spoofing the name of the recipients ISP as the sender. If you think about it, this is both a clever way to entice even a suspicious victim into opening the attachment and infecting his computer, and an insidious thing to do to countless thousands of innocent victims. One of the common payloads in the Bagel/Beagle series is a utility that deactivates many of the popular antivirus programs, and prevents them from being updated, leaving the computer open to later attacks. Some versions also open a port through a firewall (ZoneAlarm is often targeted) allowing external “backdoor” access to the computer, and broadcasting the IP address of the vulnerable computer over the Internet. Fortunately, many of the Bagel/Beagle variants have code in them that will cease their propagation between March 14 and 25.

In another trick, some of the new virus and worm writers are trying to fool us into believing that their content is safe by including a falsehood either in its subject or as a closing tagline that the message has been scanned by a major antivirus program (most often Norton AntiVirus). Just because an email is from someone you know, and contains a line indicating that it is certified as safe, do not believe it. The creator of the worm is lying to you by concealing the real sender by spoofing the “From:” line to appear that it is from an acquaintance, and including the “certified virus free” tag.

The massive recent attacks by the authors of the Netsky, MyDoom, and Bagel/Beagle viruses and worms have created a battle among themselves, indicated by messages encoded in their respective payloads. According to several antivirus companies, the code includes attacks on each other, such as when Netsky attacks a computer already infected with MyDoom or Bagel/Beagle, Netsky tries to deactivate them, while installing its own malicious code, and stating “We kill malware writers. They have no chance”. The author of Bagel responded in a quickly released variant “Hey Netsky... Don't ruin our business. Wanna start a war?''. Later variants of these three malicious products have continued the dispute.

Wouldn’t it be nice if these virus authors spent more time and effort fighting each other, and less time trying to infect our computers?

FREE online virus scans are available at the following websites:

http://www.housecall.antivirus.com
http://www.pandasoftware.com
http://www.bitdefender.com
http://www.us.mcafee.com

There is no restriction against any non-profit group using this article as long as it is kept in context, with proper credit given to the author. This article is brought to you by the Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member.

Click here to return to top



==================================================================