NWA-PCUG Newsletter Article, October 2003
Attack of the Worms
Did We Learn Anything?
by Ira Wilsker
ira-wilsker@apcug.org
(click to email author)


Recent weeks have seen the most prolific spread of computer viruses and worms in history. While computer viruses and worms have been around for years, the recent attacks of Blaster and Sobig-F, broke all records for the speed of dissemination and the numbers of computers infected. Fortunately, the payloads carried by these programs was quickly identified and neutralized before they could wreak more havoc on our cyber infrastructure. While annoying and troublesome, they apparently did not carry a very dangerous payload.

My first indication of the Blaster attack was a cryptic call I received asking about some bizarre error statement that appeared in a window that popped up; she had opened no suspicious emails, and had updated antivirus software installed. A quick search turned up a warning from Microsoft dated mid-July that there was an identified vulnerability in Windows NT, 2000, and XP, and that Microsoft had released a “Critical Update” patch. Users were advised to download and install this patch immediately. Other references, also from mid-July, were news stories on computer security that there was this vulnerability in some version of Windows, and that Microsoft had released a patch to eliminate the threat. Some pundits also speculated that it was only a matter of time until someone took illicit advantage of the vulnerability. I told her to download and install the patch, to see if that resolved the problem. Minutes later my daughter called from Miami and said that she just had this weird window open on her computer, and a cryptic statement appeared, identical to the other caller’s. Likewise, she had opened no email attachments, and had updated antivirus software installed.

Two strange but identical symptoms within a matter of minutes, on two XP computers, hundreds of miles apart, seemed to be more than a coincidence, but was likely some type of new virus. I posted a request on the restricted “High Tech Cybercrime Consortium” mail list to see if anyone else had encountered such a strange occurrence. Within minutes I received several replies indicating that others had similar inquiries, but other than a suspicion that it was some type of new virus, no one had any other information. A search of the major antivirus sites turned up no new alerts. Within the next hour, I had received several more phone calls and emails appealing for help. By that time the first security alerts traversed the net that a new computer worm, named “Blaster” or “LoveSan” had been identified. Blaster was transmitted directly from computer to computer over the internet or networks without the traditional vector of email, by using a sophisticated utility that searched for other vulnerable computers to infect, and then infected them. The victim had no warning other than to find that his computer was compromised. Carrying a denial-of-service payload, Blaster would have all infected computers attack the Microsoft

Windows Update server at predetermined times, in a coordinated attack. Most of the antivirus software publishers promptly updated their detection files, and provided a free downloadable utility to detect and remove Blaster from infected computers. Microsoft launched a media blitz encouraging users to download and install the security patch which had been released a month earlier, and published instructions on removing the worm. Microsoft took down the server that was the target of the attack. While there are many computers still infected with Blaster, it can no longer shut down Microsoft.

Before we had a chance to catch our breath following the Blaster attack, inboxes were flooded with a variety of emails with the topics “Details”, “Thank You”, “Your Application”, “Approved”, “That Movie”, “Wicked Screensaver”, or some variation, possibly using “Re:” as a prefix. That first morning of the Sobig-F assault, I turned on my computer, updated my antivirus software, and was greeted with an over-filled email box containing over 700 emails with suspicious topics. I use a free program, Mailwasher (www.mailwasher.net), to screen my email, and allow me to delete spam and viruses before they can get on my computer. Even though I was then not aware of Sobig-F, I knew better than to open suspicious emails, and to delete them. As with the Blaster attack, a similar sequence of notifications, antivirus updates, patches, and other fixes were made available in the hours following the onslaught. By that evening, I had received over 1200 copies of Sobig-F; the following day, I turned on my computer and found over 2000 infected emails, with additional emails arriving at the rate of several per minute; by the time I shutdown that evening, I deleted several thousand more emails. Sobig-F hijacks the address books of infected computers and repeatedly sends out emails with randomly selected “From:” lines concealing the source. Many servers automatically bounced infected emails, contributing to the avalanche.

Containing a payload that could launch a denial of service attack on multiple servers, as well as connect to a porn site, Sobig-F is scheduled to self-destruct on September 10. So, what have we learned from this double-barreled attack? First, no matter how good it is, antivirus software may not protect us from rapidly spreading viruses and worms that become endemic before the publishers can respond; still, there is no excuse for not having frequently updated antivirus software installed. While Blaster spread through stealth, Sobig-F was a suspicious email attachment that often came from an acquaintance.

Practicing “safe hex” would prevent Sobig-F infections. Also, we had better pay attention when Microsoft announces critical security updates, and install them. We must frequently check for these patches at windowsupdate.microsoft.com, and install them.

It was bad enough to become a victim of the insidious attacks. It will be even worse if we do not learn from them, and act appropriately. More such attacks will inevitably follow.

Ira Wilsker is the Advisor for Region 8, APCUG Representative & Bylaws Chair for the Golden Triangle PC Club, a columnist for The Examiner in Beaumont, Texas, and has two radio shows. He also graciously shares his articles with the APCUG editors.

There is no restriction against any non-profit group using this review as long as it is kept in context with proper credit given the author. This review is brought to you by the Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member.



==================================================================